Lucky866 ("we", "us", "our") operates the online gaming platform at lucky866.biz, providing live casino games, card games, fishing games, and related services to registered users in Pakistan. This Privacy Policy describes how Lucky866 collects, processes, stores, and protects the personal information of every person who uses the platform — whether as a registered player, a visitor browsing the site, or a person who contacts our support team.
We take privacy seriously. Pakistani players trust Lucky866 with sensitive information — their names, CNIC details, phone numbers, and financial transaction data. That trust is not taken lightly. This document is designed to be as transparent and readable as possible, explaining in plain language exactly what we do with your information, why we do it, and how you can control it.
This policy applies to the Lucky866 website, mobile browser interface, Android APK application, and all customer support communications. It does not cover third-party websites or services that may be linked from the Lucky866 platform — those parties have their own privacy policies.
Lucky866 collects personal data through several channels: registration forms, payment transactions, gameplay activity, device and browser data, and communications with the support team. Below is a full breakdown of what we collect and why.
Registration and Identity Data
- Full name as it appears on your CNIC or government-issued ID.
- Date of birth (used to verify you are 18 or older).
- Email address (used for account notifications and support communications).
- Mobile phone number (used for OTP verification and, if opted in, SMS promotions).
- Username chosen during registration.
- Password (stored as a one-way cryptographic hash — Lucky866 staff cannot read your actual password).
Identity Verification (KYC) Data
- CNIC number and a scanned copy or photo of your CNIC (front and back).
- Passport details where a CNIC is unavailable.
- Proof of payment method ownership (e.g., screenshot of Easypaisa account in your name) when required.
Financial Transaction Data
- Deposit amounts, timestamps, and the payment method used (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or Visa/Mastercard).
- Withdrawal requests, amounts, and destination accounts.
- Transaction reference numbers generated by payment providers.
- Last four digits of any linked bank card (full card numbers are never stored by Lucky866).
Gameplay and Activity Data
- Games played, bet amounts, round outcomes, and session duration.
- Bonus claims, wagering activity, and cashback calculations.
- Responsible gaming tool usage (deposit limits set, cooling-off periods, etc.).
Device and Technical Data
- IP address at the time of login and key account actions.
- Device type, operating system, and browser version.
- Device identifiers used for fraud detection purposes.
- Session timestamps and page interaction data for platform performance analysis.
Communication Data
- Content of live chat conversations with Lucky866 support.
- Emails sent to and from Lucky866 support addresses.
- Feedback or complaint submissions through platform forms.
| Purpose | Data Used | Can You Object? |
|---|---|---|
| Operating your Lucky866 account | Registration data, session data | No – essential |
| Processing deposits and withdrawals | Financial transaction data, KYC data | No – essential |
| Age and identity verification | KYC documents, date of birth | No – essential |
| Fraud detection and security | IP address, device data, bet patterns | No – essential |
| Responsible gaming compliance | Gameplay data, limit settings | No – essential |
| Customer support | Communication data, account history | No – essential |
| Platform performance analytics | Technical data, session data (anonymised) | Yes – opt-out available |
| Marketing communications (if opted in) | Email, mobile number | Yes – unsubscribe anytime |
| Personalised bonus offers (if opted in) | Gameplay data, deposit history | Yes – opt-out available |
Lucky866 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you — with the exception of standard fraud detection algorithms that may flag your account for manual review. Any account flagged by automated detection is reviewed by a human member of the team before any action is taken.
Lucky866 processes your personal data under the following legal bases:
- Contractual necessity: Processing required to deliver the services you've signed up for — account management, payment processing, game delivery, and customer support.
- Legal obligation: Processing required to comply with anti-money laundering regulations, age verification requirements, and financial record-keeping obligations.
- Legitimate interests: Processing for fraud prevention, platform security, and anonymous analytics where these interests are balanced against your privacy rights.
- Consent: Processing for marketing communications and personalised offers, which you can withdraw at any time. Withdrawing consent does not affect the lawfulness of any processing that took place before you withdrew it.
Lucky866 shares personal data only where it is strictly necessary to deliver the platform's services. We do not sell, trade, or rent your personal information to any third party for their own commercial purposes under any circumstances.
Categories of Third Parties We Work With
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and banking infrastructure partners process your financial transactions. These providers receive only the data necessary to complete each transaction and are bound by their own data protection obligations.
- Game technology providers: Live casino and digital game suppliers who power the titles on Lucky866 receive anonymised session data for technical performance purposes. They do not receive your identity data.
- Identity verification services: Third-party KYC providers who assist in verifying CNIC documents receive your submitted documents in encrypted form for the sole purpose of identity verification.
- Fraud prevention and security: Automated fraud detection systems and cybersecurity partners receive device and session data to identify suspicious activity patterns.
- Analytics providers: Anonymised platform usage data may be processed by analytics tools to help Lucky866 improve the user experience. No personally identifiable information is shared.
Legal Disclosure
Lucky866 may disclose your personal data if required to do so by law, court order, or regulatory authority. In such cases, we will disclose only the minimum data required and, where legally permitted, will notify you that a disclosure request has been received.
Lucky866 uses cookies and similar tracking technologies to operate the platform reliably, remember your preferences, and gather anonymised analytics. Below is a breakdown of the cookie types in use.
You can manage browser cookie settings through your mobile browser's privacy menu. Note that disabling essential cookies will prevent Lucky866 from functioning correctly — the session and authentication cookies are required for the platform to operate.
Lucky866 implements multiple layers of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.
Technical Measures
- All web traffic on lucky866.biz is protected by 256-bit SSL/TLS encryption.
- Passwords are stored using bcrypt hashing — irreversible one-way encryption that means even Lucky866's technical staff cannot read your actual password.
- Full payment card numbers are never stored. Card transactions are tokenised through the payment gateway.
- Database servers are isolated from public internet access and accessible only through authenticated internal network connections.
- Withdrawal requests require two-factor authentication via OTP sent to your registered phone number.
- All administrative access to user data is logged and requires multi-factor authentication.
Organisational Measures
- Access to personally identifiable data is restricted to staff who require it to perform their role — support agents, compliance officers, and payment team members.
- All staff with access to user data are bound by confidentiality agreements.
- Data handling procedures are reviewed regularly.
Lucky866 retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal or regulatory obligations.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years | Legal and regulatory compliance |
| KYC / identity documents | Duration of account + 5 years | Anti-money laundering regulations |
| Financial transaction records | 7 years from transaction date | Financial record-keeping requirements |
| Gameplay history | 3 years from session date | Dispute resolution and responsible gaming |
| Support chat logs | 2 years from conversation date | Quality assurance and dispute reference |
| Technical / device logs | 12 months | Security monitoring |
| Marketing opt-in records | Until consent withdrawn + 1 year | Proof of consent |
When data reaches the end of its retention period, it is securely deleted or anonymised so it can no longer be associated with your identity. If you request account deletion before the end of a retention period, the data required by legal obligations will be retained for the minimum required period and then deleted. All other data will be deleted upon your request.
As a user of Lucky866, you have the following rights regarding the personal data we hold about you. To exercise any of these rights, contact the support team via live chat or email at support@lucky866.biz. We aim to respond within 7 working days.
Lucky866 is strictly an 18+ platform. We do not knowingly collect personal data from individuals under the age of 18. Every Lucky866 account requires age confirmation during registration, and accounts are subject to KYC age verification at any point.
If Lucky866 becomes aware that an account belongs to a person under 18, the account will be immediately suspended, all balances will be frozen pending investigation, and all personal data associated with the account will be deleted as promptly as legally permissible.
If you believe a minor has registered on Lucky866, please contact support immediately at support@lucky866.biz with as much detail as possible. We will investigate and act within 24 hours of receiving a verified report.
Lucky866 reviews and updates this Privacy Policy periodically to reflect changes in platform features, legal requirements, or data handling practices. The "Effective" date at the top of this page shows when the current version came into force.
When we make significant changes that affect your rights or how we use your data, we will notify you through one or more of the following channels before the changes take effect:
- A notification banner displayed when you next log into your Lucky866 account.
- An email to your registered address, if the change is material.
- A notice posted in your Lucky866 account inbox.
Minor updates — such as clarifications of existing language or corrections to typos — may be made without a separate notification, though the effective date will be updated. Continuing to use Lucky866 after a policy update constitutes acceptance of the revised Privacy Policy.
If you have questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how Lucky866 has handled your personal information, please reach out through any of the following channels:
For data rights requests (access, deletion, portability), please include your registered email address and a description of your request. We may ask for identity verification before processing data rights requests to ensure we only share or delete data belonging to the person making the request.
For full platform terms, see our Terms and Conditions. For information on responsible gaming tools, visit our Responsible Gaming page.