Privacy Policy

Introduction

This Privacy Policy ("Policy") is published by Lucky8 ("Lucky8", "we", "us", "our"), the operator of the online gaming platform accessible at lucky8.casa and all associated subdomains and mobile applications (collectively, the "Platform"). Lucky8 is committed to protecting the personal data of all individuals who interact with the Platform, including registered players, prospective players, and visitors.

This Policy describes in detail: (a) the categories of personal data Lucky8 collects and processes; (b) the purposes for which that data is used; (c) the circumstances under which personal data may be shared with third parties; (d) the security measures employed to protect your data; and (e) the rights available to you as a data subject.

Lucky8 operates under an international gaming licence and provides services primarily to players in Malaysia, including players located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions across the country. Where Malaysian data protection laws and international data protection standards overlap, Lucky8 applies the higher standard of protection.

Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, modification, and deletion.
• "Data Controller" means Lucky8, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on Lucky8's behalf pursuant to a written data processing agreement.
• "Data Subject" means you — the individual whose Personal Data is being processed.
• "KYC" means Know Your Customer — the identity and age verification process conducted prior to account activation or withdrawal processing.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and preference storage.
• "Platform" means the Lucky8 website at lucky8.casa, associated mobile applications, and all gaming services accessible therethrough.

Data We Collect

Lucky8 collects Personal Data across the following categories, depending on your interaction with the Platform:

How We Collect Data

4.1 Direct Collection

The majority of Personal Data Lucky8 holds about you is provided directly by you during the account registration process, during KYC identity verification, when making deposits or requesting withdrawals via Malaysian payment methods such as DuitNow, FPX, Maybank2u, or Touch 'n Go eWallet, and when contacting our customer support team.

4.2 Automated Collection

When you access the Platform, certain Technical Data is collected automatically by our systems. This includes your IP address, device identifiers, browser configuration, and session activity logs. This data is collected through server logs, session management systems, and, where consented, analytics cookies.

4.3 Third-Party Sources

Lucky8 may receive Personal Data about you from third-party sources in limited circumstances, including: identity verification providers (for KYC document authentication), fraud prevention databases (for sanctions and politically exposed persons screening), payment processors (for transaction verification and chargeback dispute resolution), and responsible gambling databases (to check self-exclusion status where applicable).

Data Processing & Use

Lucky8 processes your Personal Data for the following purposes:

• Account Management — creating, maintaining, and administering your Lucky8 account, including managing your balance in Malaysian Ringgit (MYR), processing transactions, and applying applicable bonuses;
• Identity Verification (KYC) — verifying your identity and age to comply with our licensing obligations and to enforce the 21+ minimum age requirement across all account types;
• Payment Processing — facilitating deposits and withdrawals through your chosen Malaysian payment method, including Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, FPX, and cryptocurrency channels;
• Fraud Prevention & Security — detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, and other prohibited conduct on the Platform;
• Responsible Gambling — monitoring gameplay and transaction patterns to identify potential problem gambling behaviour, enforcing self-exclusion requests, and applying player-set deposit and loss limits;
• Customer Support — responding to your enquiries, resolving disputes, and improving our support service quality through communication records;
• Legal & Regulatory Compliance — fulfilling obligations under our gaming licence, anti-money laundering (AML) requirements, and any applicable data protection regulations;
• Platform Improvement — analysing aggregated and anonymised usage data to improve the Platform's performance, game selection, and user experience;
• Marketing Communications — sending bonus offers, promotional updates, and platform news to players who have opted in to receive such communications.

Legal Basis for Processing

Lucky8 processes your Personal Data on the following legal bases:

• Contractual Necessity — processing required to fulfil the contract between you and Lucky8 under our Terms and Conditions, including account management, payment processing, and game provision;
• Legal Obligation — processing required to comply with our gaming licence conditions, AML regulations, KYC requirements, and any lawful authority requests;
• Legitimate Interests — processing carried out for Lucky8's legitimate business interests, including fraud prevention, security monitoring, and Platform improvement, where those interests are not overridden by your fundamental rights;
• Consent — processing based on your freely given, specific, and informed consent, primarily for marketing communications and the use of non-essential analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

7.1 Service Providers

Lucky8 shares Personal Data with a limited number of trusted third-party service providers who process data on our behalf under written data processing agreements. These providers include: payment processors and financial institutions (for deposit and withdrawal processing), identity verification providers (for KYC document authentication), customer support platform operators, cloud hosting and infrastructure providers, and fraud detection and cybersecurity services. All service providers are contractually restricted from using your data for any purpose beyond the specific service they provide to Lucky8.

7.2 Regulatory and Legal Disclosure

Lucky8 may disclose Personal Data to regulatory authorities, law enforcement agencies, or licensing bodies where required to do so by applicable law, court order, or regulatory direction. This includes disclosures required under AML/CFT (Anti-Money Laundering / Countering the Financing of Terrorism) regulations. Such disclosures may occur without prior notice to the affected Account holder where legally required.

7.3 No Sale of Data

Lucky8 does not sell, rent, or otherwise transfer your Personal Data to third parties for their own marketing purposes. Any data sharing is strictly limited to the purposes described in this Policy.

Data Retention

Lucky8 retains Personal Data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law or our licensing obligations.

• Account Data — retained for the duration of your account's active period and for a minimum of five (5) years following account closure, to comply with AML record-keeping requirements;
• KYC Documents — retained for the period required by our gaming licence (typically five years from the date of submission or account closure, whichever is later);
• Transaction Records — retained for a minimum of five years in accordance with AML/CFT regulations;
• Gameplay Data — retained for a minimum of three years for dispute resolution and responsible gambling monitoring purposes;
• Communication Records — retained for a minimum of two years for quality assurance and dispute resolution purposes;
• Technical Logs — typically retained for up to twelve months for security and fraud prevention purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised in a manner that prevents reconstruction.

Security Measures

Lucky8 implements technical and organisational security measures appropriate to the risk associated with the processing of your Personal Data. These include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage of account credentials — passwords are stored using industry-standard one-way hashing algorithms and are never stored in plain text;
• Two-factor authentication (2FA) available for all registered accounts;
• Role-based access controls limiting internal staff access to Personal Data on a strict need-to-know basis;
• Regular security audits and penetration testing by independent third-party cybersecurity specialists;
• Intrusion detection systems and real-time monitoring of the Platform infrastructure;
• Secure, access-controlled data centres for storage of account and KYC data.

While Lucky8 takes all reasonable steps to protect your Personal Data, no system is completely immune to breach. In the event of a data security incident that poses a significant risk to your rights, Lucky8 will notify affected players promptly in accordance with applicable notification requirements.

Cookies & Tracking Technologies

10.1 Types of Cookies Used

Lucky8 uses the following categories of cookies on the Platform:

• Essential Cookies — strictly necessary for the Platform to function. These include session authentication cookies, load-balancing cookies, and security tokens. These cookies cannot be disabled without impairing core Platform functionality.
• Analytics Cookies — used with your consent to collect anonymised data about how visitors interact with the Platform, allowing us to improve performance and user experience. These cookies do not identify you personally.
• Preference Cookies — used to remember your Platform settings and preferences across sessions, such as language and display preferences.

10.2 No Third-Party Advertising Cookies

Lucky8 does not deploy third-party advertising cookies or cross-site tracking technologies on the Platform. Your browsing behaviour on lucky8.casa is not shared with advertising networks or social media platforms for targeted advertising purposes.

10.3 Managing Cookies

You can manage or disable non-essential cookies at any time through your browser's settings. Note that disabling essential cookies will impair your ability to log in and use the Platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

Your Rights as a Data Subject

Subject to applicable law and certain exceptions that may apply in the context of our legal and regulatory obligations, you have the following rights in relation to your Personal Data held by Lucky8:

To exercise any of the above rights, please contact Lucky8 customer support via live chat or email. We will respond to all data subject requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it.

Minors & Age Policy

The Lucky8 Platform is strictly for individuals aged 21 years or older. Lucky8 does not knowingly collect Personal Data from individuals under the age of 21. If Lucky8 discovers or is notified that an Account holder is under the minimum age, the Account will be immediately closed, all associated data will be deleted or anonymised (subject to any applicable legal retention obligations), and any deposited funds will be returned in accordance with our Terms and Conditions.

If you believe that Lucky8 has inadvertently collected Personal Data from a minor, please contact our customer support team immediately. We will investigate and take appropriate action as quickly as possible.

International Data Transfers

Lucky8 is an internationally licensed operator. Some of the service providers and infrastructure we use may be located in countries outside Malaysia. When Personal Data is transferred to recipients in other jurisdictions, Lucky8 ensures that appropriate safeguards are in place, including contractual data protection obligations that require the recipient to maintain standards of data protection equivalent to or greater than those applied by Lucky8.

Lucky8 does not transfer Personal Data to jurisdictions that do not provide an adequate level of protection without implementing appropriate contractual safeguards.

Third-Party Services

The Platform may contain references to third-party payment services including Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, and FPX. When you initiate a payment through any of these services, your transaction data is processed by the relevant payment provider under that provider's own privacy policy. Lucky8 is not responsible for the privacy practices of third-party payment processors. We encourage you to review the privacy policy of any payment service you use.

The Platform does not contain links to external third-party websites. Lucky8 is not responsible for the content or privacy practices of any website that may link to or from lucky8.casa.

Policy Amendments

Lucky8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform operations. The effective date at the top of this document will be updated to reflect the date of the most recent revision.

Material changes to this Policy — particularly those that affect your rights or the way we use your Personal Data — will be communicated to registered players via Platform notification or email, with reasonable notice prior to the change taking effect. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

Contact Us

For all privacy-related enquiries, data subject access requests, complaints, or questions regarding this Privacy Policy, Lucky8 customer support is available 24 hours a day, 7 days a week via live chat on the Platform, with an average response time of under 90 seconds.

For written privacy enquiries, you may contact our Data Protection team by email. Our contact email address is displayed below as plain text — it is not a clickable link:

If you have concerns about how Lucky8 handles your Personal Data and you do not feel they have been satisfactorily addressed by our support team, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

For questions related to our Terms and Conditions, please refer to the Terms & Conditions page. For responsible gambling tools and self-exclusion requests, please visit our Responsible Gambling page.