LuckySpin Privacy Policy – Protection of Malaysian Members' Data

Luckyspin only collects information that is strictly necessary to provide a safe, seamless and responsible service. We do not collect excessive or irrelevant data beyond what our platform operations require.

Information you provide directly:

• Full name as stated in your official identification document.
• Date of birth for age verification purposes (members must be 18 years of age or older).
• An active Malaysia mobile number for two-factor authentication and account communications.
• A valid email address for notifications, verification, and account-related communications.
• Current residential address for KYC (Know Your Customer) verification purposes.
• A copy of your identification document (MyKad or passport) when required for the KYC process.
• Payment method information including bank account numbers, e-wallet numbers or cryptocurrency wallet addresses.

Information collected automatically:

• The IP address of the device used to access the platform.
• Web browser type and version, as well as operating system.
• Device information including unique device identifier (Device ID).
• Activity logs including pages visited, access times and in-platform actions.
• General location data based on IP address (state/country only, not precise GPS location).
• Cookie data and similar tracking technologies (see Section 5).

Personal data collected by luckySpin is used solely for legitimate and clearly stated purposes. We will not use your data for any other purpose without first obtaining your consent.

Primary purpose of data use:

• Account management: Registering, verifying and maintaining your member account on the luckyspin platform.
• Transaction processing: Processing deposits, withdrawals and all financial transactions safely and efficiently.
• Identity verification (KYC): Fulfilling legal requirements to verify member identities in order to prevent money laundering and fraud.
• Account security: Detecting and preventing suspicious activity, fraud attempts or unauthorised access to your account.
• Customer support: We handle inquiries, complaints and support requests more effectively when we have your account context.
• Promotions and bonuses: Processing promotion eligibility and ensuring bonuses are awarded only to qualifying members.
• Responsible gaming: Monitoring gameplay patterns to identify early signs of problem gambling and provide appropriate intervention.
• Platform improvement: Analysing usage data in aggregate (without identifying individuals) to improve user experience, platform performance and the various services we offer.
• Marketing communications: Sending promotions, exclusive offers and the latest platform updates — only to members who have consented to receive such communications.

Luckyspin takes the trust you place in us seriously. We do not sell, rent or disclose your personal data to third parties for their own commercial purposes. However, under limited and specific circumstances, we may share your information with the following parties:

• Trusted service providers: Payment providers, identity verification platforms, cloud services and other technology vendors that help us operate the platform. They are contractually bound to use your data only for specified purposes and to comply with equivalent data protection standards.
• Game providers: Gaming companies such as slot providers, live casino and sports betting platforms that are partners of luckyspin. Data sharing is minimal and limited to information required to verify gaming sessions.
• Regulatory bodies and law enforcement agencies: When required by law, court order, or direction from a competent authority. luckySpin will not disclose information beyond what is legally required.
• Fraud prevention and AML: Bodies responsible for verifying identity, monitoring suspicious transactions, and fulfilling Anti-Money Laundering (AML) requirements.

In all data sharing arrangements, luckySpin ensures that the receiving parties have adequate data protection measures in place and may only use the data for the specifically defined purposes.

Ensuring the security of your personal data is luckyspin's highest priority. We continuously invest in the latest security infrastructure to protect your information from cyber threats, unauthorised access and data breaches.

Our technical security measures:

• Data encryption in transit using TLS 1.3 and 256-bit SSL protocols.
• Data at rest encryption across all servers and databases.
• Multi-layered firewall and Intrusion Detection System.
• 24/7 security monitoring by a dedicated cybersecurity team.
• Regular vulnerability scanning and penetration testing.
• Strict Role-Based Access Control for internal staff.
• Mandatory two-factor authentication (2FA) for all internal admin access.

While we take all reasonable steps to protect your data, no security system can be guaranteed 100% safe. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities within the timeframe required by law.

Luckyspin uses cookies and similar tracking technologies to enhance your experience on our platform, ensure the platform functions correctly and understand how members use our services.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login sessions and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how members use the platform in aggregate form to help us improve website performance and functionality.
• Functionality Cookies: Remembering your preferences and settings such as preferred language, display format and login details for your convenience.
• Analytics Cookies: Helping us understand overall platform usage patterns for the purpose of continuous service improvement.

You may manage your cookie settings through your web browser at any time. However, disabling certain cookies may affect your experience on the luckySpin platform. Please refer to your web browser's help guide for more information on how to manage cookies.

Under the Malaysian Personal Data Protection Act (PDPA 2010) and international data protection standards, you have the following rights regarding the personal data held by luckySpin:

To exercise any of the above rights, please contact our Data Protection Officer via email [email protected] by stating the right you wish to exercise and the relevant information. We will verify your identity before processing any data-related request.

Luckyspin retains your personal data for as long as your account is active and for the required period thereafter to fulfil legal obligations, resolve disputes and enforce our agreements.

Data retention period:

• Active account data: Stored for the duration your account remains active on luckySpin.
• KYC and identity data: Stored for a minimum of 5 years after account closure in accordance with Malaysia's AML legal requirements.
• Financial transaction records: Stored for a minimum of 7 years for audit and tax compliance purposes.
• Support communication logs: Stored for 2 years after case resolution for reference if required.
• Cookie and access log data: Stored for a maximum of 13 months before being automatically deleted or deactivated.

When the retention period expires or when data is no longer needed for its original purpose of collection, luckySpin will securely delete or anonymise the data using appropriate methods. Deleted data cannot be recovered.

If you have any questions, concerns or complaints regarding this Privacy Policy or how luckyspin handles your personal data, please do not hesitate to contact us.

The luckyspin Data Protection Officer (DPO) can be reached via:

• Email: [email protected] (state "Privacy Inquiry" in the email subject line)
• Live chat on the luckyspin platform — available 24/7 for immediate assistance.

We are committed to responding to all privacy-related inquiries within 3 business days. For more complex complaints, we will provide progress updates within 7 business days and resolve the case within 21 business days.

If you are not satisfied with our response, you have the right to lodge a formal complaint with Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.