Privacy Policy

This Privacy Policy ("Policy") is published by MrLucky ("Company", "we", "us", "our"), the operator of the online gaming platform located at https://mrlucky.cam ("Platform", "Site"). It describes our practices regarding the collection, use, storage, disclosure, and protection of personal data relating to users of the Platform ("Player", "User", "you").

MrLucky operates in compliance with applicable data protection legislation, including obligations relevant to our service of Malaysian players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. We take our obligations as a data controller seriously and have designed our data handling practices accordingly.

By registering an Account on MrLucky or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information that can identify you as an individual, whether directly (e.g., your name or identification number) or indirectly (e.g., your IP address combined with other data points).
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. MrLucky is the Data Controller for all data collected through this Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, in accordance with documented instructions and applicable data protection obligations.
• "Sensitive Data" — a subcategory of Personal Data that warrants heightened protection, including government-issued identification numbers, financial account details, and identity verification documents.
• "Cookie" — a small text file stored on your device by a website, used to retain information about your session or preferences across visits.
• "KYC" — Know Your Customer verification process, including identity document review and proof of address checks, required for Account compliance.

MrLucky collects Personal Data across several categories, depending on how you interact with the Platform. The table below summarises the categories of data we collect and the context in which each is gathered.

MrLucky collects Personal Data through the following channels:

MrLucky processes your Personal Data for the following specific purposes. We do not use your data for any purpose that is incompatible with these stated objectives.

• Account Administration: Creating, managing, and maintaining your player Account, including processing registrations, password resets, and Account settings changes.
• Transaction Processing: Facilitating deposits and withdrawals via Malaysian payment channels including Touch 'n Go eWallet, DuitNow, Maybank, CIMB, Public Bank, FPX, and cryptocurrency channels.
• Identity Verification (KYC): Verifying your identity and age as required under our Terms and Conditions and anti-money laundering obligations prior to releasing withdrawals.
• Customer Support: Responding to enquiries, resolving disputes, processing complaints, and providing technical assistance through our live chat and email channels.
• Security and Fraud Prevention: Monitoring for suspicious activity, preventing account takeovers, detecting bonus abuse, and fulfilling anti-money laundering (AML) and counter-terrorist financing (CTF) reporting obligations.
• Responsible Gambling: Operating and enforcing deposit limits, session controls, self-exclusion settings, and age verification protections that you have activated on your Account.
• Platform Improvement: Analysing usage patterns, session data, and game performance metrics to improve the platform experience for all players.
• Legal Compliance: Retaining records as required by applicable financial, anti-money laundering, and gaming regulations.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to you — only where you have opted in to receive such communications. You may withdraw consent at any time through your Account settings.

For each category of processing activity, MrLucky relies on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms and Conditions you accepted when registering your Account, including operating your Account, processing transactions, and providing customer support.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, AML transaction monitoring, and financial record-keeping obligations.
• Legitimate Interests: Processing for purposes of security monitoring, fraud prevention, platform integrity protection, and improving platform performance — where these interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies — only where you have provided clear, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

MrLucky does not sell, rent, or otherwise commercially transfer your Personal Data to third parties. We share your data only in the following limited and necessary circumstances:

Some of the service providers we engage may be located in, or operate data processing infrastructure in, jurisdictions outside Malaysia. Where your Personal Data is transferred internationally, we take steps to ensure that appropriate safeguards are in place, including contractual data protection clauses equivalent to applicable international standards.

We maintain a record of all international data transfers and assess each transfer to ensure that the receiving jurisdiction provides an adequate level of protection for personal data. Where adequate protection cannot be confirmed through jurisdictional assessment alone, we rely on contractual mechanisms or other recognised safeguards.

MrLucky retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised. Where anonymisation is applied, the resulting data — which can no longer identify you — may be retained and used for statistical or analytical purposes without restriction.

MrLucky uses cookies and similar technologies to operate the Platform effectively, maintain session security, and analyse platform usage. The following categories of cookies are used:

As a data subject, you hold the following rights in respect of your Personal Data held by MrLucky. These rights may be exercised at any time by contacting our support team via live chat or email.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed. We will respond to verified access requests within 30 days.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. Changes to core identity data will require supporting documentation.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our overriding legal obligations to retain certain records (including financial transaction history under AML regulations).
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances — for example, while a dispute regarding accuracy is pending.
• Right to Portability: You may request a machine-readable copy of the Personal Data you provided to us, for transfer to another service provider where technically feasible.
• Right to Object: You may object to processing carried out on the basis of legitimate interests or for direct marketing purposes. Objections to direct marketing will be actioned immediately. Objections to other processing will be assessed case by case.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

MrLucky employs a range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the Platform.
• AES-256 encryption for sensitive data stored on our servers, including identity documents and financial records.
• Two-factor authentication (2FA) available to all Account holders as an optional security layer.
• Real-time intrusion detection and monitoring systems that flag and respond to suspicious access patterns.
• Role-based access controls limiting employee access to Personal Data to those with a documented operational need.
• Regular security audits and penetration testing conducted by independent third-party security specialists.
• Formal data breach response procedures, including notification timelines aligned with applicable regulatory requirements.

While we employ robust security practices, no system is entirely immune from risk. If you suspect that your Account has been compromised, please contact our support team immediately via live chat so we can take protective action without delay.

MrLucky strictly enforces a minimum age requirement of 21 years for all Account registrations. The Platform is not directed at, and does not knowingly collect Personal Data from, any person under the age of 21.

If we become aware that Personal Data has been collected from a person under 21 years of age, we will close the associated Account immediately, return any deposited funds, and securely delete the data in question. If you believe that a minor may have accessed or registered on the Platform, please notify us immediately at [email protected].

Parents and guardians are responsible for ensuring that minor children do not access devices on which MrLucky is accessible. We recommend using parental control software on shared devices to prevent underage access to gambling platforms.

MrLucky reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or operational changes to the Platform. When material changes are made, we will provide advance notice via the Platform and by email to your registered address, where reasonably practicable.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of any revised Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or your Personal Data held by MrLucky, please contact our Data Protection team using the details below. We are committed to responding to all privacy-related enquiries within 5 business days.

For data rights requests (access, rectification, deletion, portability), please contact us via email with the subject line "Data Rights Request" and include your registered Account email address. We will verify your identity before actioning any request. For information about your responsible gambling options, please visit our Responsible Gambling page.