PhilLucky Privacy Policy — How We Protect Your Personal Data

Our Commitments

Six Things PhilLucky Commits to When Handling Your Data

Before diving into the full policy, here is the short version of how PhilLucky approaches your personal information — in plain, straightforward language.

We Collect Only What We Need

PhilLucky does not collect personal data out of curiosity. Every piece of information we ask for has a specific, documented purpose — account registration, payment processing, identity verification, or regulatory compliance.

Your Data Is Kept Secure

We use industry-standard encryption, access controls, and secure server infrastructure to protect your data. Only authorised PhilLucky staff and vetted service providers can access player information — and only for the purposes described in this policy.

We Do Not Sell Your Data

PhilLucky does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes. Full stop. Your data is used to run your account and meet our legal obligations — nothing else.

You Stay in Control

Under the Philippine Data Privacy Act, you have the right to access, correct, or request deletion of your personal data. PhilLucky has a dedicated process for handling these requests — and we treat each one seriously.

We Are Transparent

This Privacy Policy is written in plain English — not legal jargon designed to confuse you. If PhilLucky ever changes how we handle your data in a material way, we will notify you before the change takes effect.

We Follow Philippine Law

PhilLucky operates under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. Our data practices are also aligned with PAGCOR requirements for licensed online gaming operators in the Philippines.

Why This Policy Matters

Your Data, Your Rights — What Every PhilLucky Player Should Know

A lot of people skip Privacy Policies. We get it — they can be long, dense, and written in a way that feels like it is designed to be ignored. But this one is different, and here is why it is worth reading: it explains the specific rights you have as a Filipino player under the Data Privacy Act of 2012, and it tells you how to exercise them.

When you sign up at PhilLucky, create a deposit, or just browse the platform while logged in, data is generated. Some of it you provide directly — like your name and mobile number during registration. Some of it is collected automatically — like your device type and how you navigate the platform. All of it is governed by this policy.

PhilLucky is registered as a personal information controller with the National Privacy Commission (NPC) of the Philippines. That registration is not just a formality — it means we have formally committed to handling your data in accordance with the Data Privacy Act, and we are subject to NPC oversight and enforcement.

Note: This Privacy Policy applies to all PhilLucky platforms — our website at phillucky.best and any mobile applications. By creating and maintaining a PhilLucky account, you confirm that you have read and understood this policy.

1 Who We Are

PhilLucky is an online betting platform operating at phillucky.best, licensed by the Philippine Amusement and Gaming Corporation (PAGCOR). For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), PhilLucky acts as the personal information controller for the data of all registered players and site visitors.

If you have any questions about how PhilLucky handles your personal data, or if you wish to exercise any of your rights under the Data Privacy Act, you can reach our Data Protection Officer at: support@phillucky.best.

2 What Personal Data We Collect

PhilLucky collects the following categories of personal data:

Identity data: Full legal name, date of birth, gender, and government-issued ID details (as required for KYC verification)
Contact data: Email address, Philippine mobile number, and mailing address
Account data: Username, encrypted password, account preferences, and communication settings
Financial data: Deposit and withdrawal history, payment method identifiers (e.g., GCash mobile number, bank account name — not full card numbers), and transaction records
Betting data: Bet history, game preferences, and session activity on the PhilLucky platform
Technical data: IP address, device type and model, operating system, browser type, and session timestamps
Verification data: Copies of government-issued IDs and selfies submitted during the KYC process
Communications data: Records of your interactions with PhilLucky customer support, including chat transcripts and email correspondence

PhilLucky does not collect sensitive personal information — as defined under the Data Privacy Act — such as race, religion, health conditions, or political views. We collect only what is necessary to operate your account and meet our legal obligations.

3 How We Collect Your Data

Your personal data is collected through the following channels:

Direct submission: Information you provide when registering, completing KYC, making deposits or withdrawals, or contacting support
Automated collection: Technical and behavioural data collected automatically when you use the PhilLucky website or app, including via cookies and similar technologies (see Section 9)
Third-party verification providers: Identity verification data returned by KYC service providers who check your submitted documents against Philippine government records
Payment processors: Transaction confirmation data returned by GCash, Maya, GrabPay, Coins.ph, and bank transfer networks after a deposit or withdrawal is processed

4 Why We Use Your Personal Data

PhilLucky uses your personal data for the following purposes:

To create, verify, and manage your PhilLucky account
To process deposits and withdrawals through your registered payment methods
To verify your identity in compliance with PAGCOR licensing requirements and the Anti-Money Laundering Act (AMLA)
To settle bets and calculate winnings accurately
To apply and enforce responsible gaming tools, including deposit limits and self-exclusion
To detect, investigate, and prevent fraud, money laundering, and other prohibited conduct
To provide customer support and respond to your queries and complaints
To send you account-related communications — such as transaction confirmations, security alerts, and policy updates
To send you promotional offers and personalised recommendations, where you have not opted out of marketing communications
To improve the PhilLucky platform through analysis of aggregated, anonymised usage data

Marketing communications: You can opt out of receiving promotional emails and notifications from PhilLucky at any time via the notification settings in your account or by contacting support. Opting out of marketing does not affect your ability to use the platform or receive transactional messages about your account.

5 Legal Basis for Processing

PhilLucky processes your personal data on the following legal grounds under the Data Privacy Act of 2012:

Contractual necessity: Processing required to fulfil the Terms and Conditions you agreed to when registering your account — including account management, bet settlement, and payment processing
Legal obligation: Processing required to comply with PAGCOR licence conditions, the Anti-Money Laundering Act, and the Data Privacy Act itself — including KYC, transaction monitoring, and regulatory reporting
Legitimate interests: Processing necessary for the legitimate interests of PhilLucky, such as fraud prevention, platform security, and improving our services, where those interests do not override your rights
Consent: For marketing communications and non-essential cookies, where you have provided consent and which you can withdraw at any time

PhilLucky does not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary for each purpose:

Payment processors: GCash, Maya, GrabPay, Coins.ph, InstaPay/PESONet network providers, and card networks — to process your deposits and withdrawals
Identity verification providers: Third-party KYC service providers who verify your government-issued ID against Philippine records
IT and platform infrastructure providers: Cloud hosting and security vendors who process data on our behalf under strict data processing agreements
Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies — where required by law or court order
Professional advisors: Legal counsel, auditors, and accountants, subject to professional confidentiality obligations

All third parties who process personal data on behalf of PhilLucky are required to handle that data in accordance with the Data Privacy Act and our data processing agreements. We do not permit our service providers to use your data for their own purposes.

7 How We Protect Your Data

PhilLucky implements a range of technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or alteration:

Encryption: All data transmitted between your device and PhilLucky is encrypted using TLS (Transport Layer Security). Stored sensitive data — including KYC documents and financial records — is encrypted at rest.
Access controls: Access to personal data is restricted to authorised PhilLucky staff and service providers on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
Password security: Passwords are stored using industry-standard hashing algorithms. PhilLucky staff cannot view your password — only you know it.
Regular security reviews: PhilLucky conducts regular vulnerability assessments and penetration testing of our platform infrastructure.
Incident response: PhilLucky has a documented data breach response plan. In the event of a breach that poses a risk to your rights, you will be notified in accordance with Data Privacy Act requirements — within 72 hours of our becoming aware of the incident.

No system is 100% immune to security incidents. PhilLucky's security measures are designed to meet or exceed industry standards for online gaming platforms, but we encourage all players to use strong, unique passwords and to enable two-factor authentication where available.

8 How Long We Keep Your Data

PhilLucky retains personal data for as long as it is needed for the purpose it was collected, subject to the following minimum retention periods:

Account and identity data: Retained for the lifetime of your account and for a minimum of five years after account closure, in line with AMLA requirements
Transaction and betting records: Retained for a minimum of five years from the date of the transaction, as required by PAGCOR and AMLA
KYC documents: Retained for five years after account closure
Customer support records: Retained for three years from the date of the relevant interaction
Marketing consent records: Retained until consent is withdrawn, plus one year for audit purposes

After the applicable retention period, personal data is securely deleted or anonymised. Data that has been anonymised — where it is no longer possible to identify you from the remaining information — may be retained indefinitely for statistical and platform improvement purposes.

9 Cookies and Tracking Technologies

PhilLucky uses cookies and similar tracking technologies on its website and app. Cookies are small text files stored on your device that help the platform function correctly and allow us to understand how players use our services.

PhilLucky uses the following categories of cookies:

Essential cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
Performance cookies: Collect anonymised data about how players navigate the platform — which pages are visited most, where errors occur, and how long sessions last. This data helps us improve the platform experience.
Functional cookies: Remember your preferences — such as your preferred language and notification settings — to personalise your experience.
Marketing cookies: Used to deliver relevant PhilLucky promotions within the platform. These are only activated where you have provided consent.

You can manage your cookie preferences through the cookie settings panel available on the PhilLucky website. Disabling non-essential cookies may affect some platform features but will not prevent you from placing bets or managing your account.

10 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by PhilLucky:

11 Minors

PhilLucky's platform is strictly for adults aged 21 and above, in line with Philippine gambling regulations. PhilLucky does not knowingly collect personal data from individuals under the age of 21. If we become aware that a minor has registered an account or submitted personal data, the account will be immediately closed and all associated data will be deleted.

If you are a parent or guardian and believe that your child has accessed or registered at PhilLucky, please contact us immediately at support@phillucky.best so we can investigate and act promptly.

12 Changes to This Privacy Policy

PhilLucky may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. The date of the most recent update is shown at the top of this page.

Where changes are material — meaning they significantly affect how your data is used or your rights as a data subject — PhilLucky will notify registered players by email and/or in-platform notification at least seven days before the changes take effect. Your continued use of PhilLucky after a policy update constitutes your acknowledgement of the revised terms.

We encourage all PhilLucky players to review this Privacy Policy periodically. If you have any concerns about a proposed change, please reach out to our Data Protection Officer before the effective date.

13 Contact Our Data Protection Officer

For any questions, concerns, or requests related to this Privacy Policy or your personal data, contact PhilLucky's Data Protection Officer:

Email: support@phillucky.best
Subject line: "Data Privacy Request – [Your Full Name]"
Response time: We acknowledge all privacy requests within 3 business days and provide a substantive response within 15 business days, as required by the Data Privacy Act

If you believe PhilLucky has not handled your personal data correctly, you also have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. Details are available at the NPC's official website.

Player Rights

Your Eight Data Rights Under Philippine Law

The Data Privacy Act of 2012 gives every Filipino player specific, enforceable rights over their personal data. Here is what they mean in practice at PhilLucky.

Right to Access

Request a copy of all personal data PhilLucky holds about you, including how it is being used and with whom it has been shared.

Right to Correction

Request that inaccurate or outdated personal data in your PhilLucky account be corrected. Basic corrections — like a misspelled name — can often be made directly in your account settings.

Right to Erasure / Blocking

Request that PhilLucky delete or block processing of your personal data where it is no longer necessary — subject to our legal retention obligations under AMLA and PAGCOR rules.

Right to Object

Object to the processing of your data for specific purposes — in particular, direct marketing. You can opt out of PhilLucky promotional communications at any time with no effect on your account.

Right to Data Portability

Request a structured, machine-readable copy of the personal data you provided to PhilLucky, for transfer to another service provider.

Right to Be Informed

You have the right to know about any data breach that poses a risk to your rights and freedoms. PhilLucky will notify you promptly in the event of such an incident.

Data Overview

A Clear Summary of the Data PhilLucky Collects and Why

Here is a quick reference table covering the main data types, why PhilLucky needs them, and how long we keep them.

Data Type	Why We Need It	Retention Period
Name & Date of Birth	Age verification, account identity	5 years after closure
Mobile & Email	Account access, transaction alerts	5 years after closure
Government ID Copy	KYC compliance (PAGCOR, AMLA)	5 years after closure
Payment Method Details	Deposits & withdrawals processing	5 years from transaction
Bet & Game History	Dispute resolution, regulatory audit	5 years from transaction
IP Address & Device Data	Security, fraud prevention	2 years from last session
Support Chat Logs	Quality assurance, dispute records	3 years from interaction
Marketing Preferences	Consent record for communications	Until withdrawn + 1 year

Questions about your data? Contact our Data Protection Officer at support@phillucky.best with the subject line "Data Privacy Request". We respond within 3 business days.