Mrlucky Privacy Policy – Your Personal Data Protection

1Introduction

Mrlucky ("we", "the platform") cares about the privacy of every user who entrusts us with their personal information. This Privacy Policy is written in clear, straightforward language so you know exactly what happens with your data — no fine print, no confusing terms.

As an online betting platform operating in the Malaysian market, we are bound by Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data management. This means we only collect data that is strictly necessary, use it solely for the stated purposes, and protect it with multi-layered security measures.

We encourage you to read this Privacy Policy carefully. If any section is unclear or you have questions, our support team is available via 24/7 live chat on the platform.

2Personal Data We Collect

We collect your personal data through several means — directly when you register and use the platform, and automatically through standard tracking technologies. The following are the categories of data we collect:

Data You Provide Directly:

• Registration Information: Full name, email address, phone number, date of birth, and the password you set when creating your account.
• Identity Verification (KYC) Information: A copy of your identity card or passport, proof of current address (utility bill or bank statement), and a verification selfie are required to comply with anti-money laundering legal requirements.
• Financial Information: Details of the payment methods you use (bank account number, DuitNow information, or digital wallet details). Please note that we do not store credit or debit card numbers directly — this is handled by certified third-party payment processors.
• Communications: Records of your correspondence with our customer support team, including live chat, email, and any feedback you have provided.

Automatically Collected Data:

• Technical Data: IP address, web browser type and version, device operating system, screen resolution, and time zone settings.
• Usage Data: Pages visited, time spent on each page, navigation patterns, games played, total bets placed, and transaction history.
• Location Data: General location based on IP address for jurisdiction verification and legal compliance purposes. We do not collect the precise GPS location of your device.
• Cookie Data: Session data, language preferences, and analytics data collected through cookies and similar tracking technologies.

3How We Use Your Data

Every piece of data we collect has a clear and legitimate purpose. We use your personal data for the following purposes:

• Account Management: Creating, verifying, and maintaining your account; processing logins and managing active sessions; recovering accounts with forgotten passwords.
• Transaction Processing: Processing deposits, withdrawals, and other financial transactions; sending transaction receipts and statements; investigating any transaction disputes.
• Legal Compliance: Meeting KYC and AML (Anti-Money Laundering) requirements; verifying user age; reporting suspicious activity to the relevant authorities as required by law.
• Platform Security: Detecting and preventing fraud, multi-account usage, and other unauthorized activity; protecting the platform from cyberattacks and abuse.
• Service Improvement: Analyzing usage patterns to improve user experience; testing new features; monitoring platform performance; resolving technical issues.
• Service Communications: Sending important notifications related to your account, transactions, and policy changes; delivering promotional information to users who have given their consent.
• Responsible Wagering: Monitoring betting patterns to identify signs of problem gambling; enforcing user-defined limits; supporting self-exclusion programs.

4Data Disclosure to Third Parties

Mrlucky does not sell or trade your personal data to third parties for their own marketing or commercial purposes. However, there are certain situations where we need to share your information with specific parties:

• Service Provider: Companies that help us operate the platform, including payment processing providers (DuitNow, FPX, Touch 'n Go, Boost), cloud service providers, and analytics firms. They are only permitted to use your data for the purposes we specify and are bound by strict confidentiality agreements.
• Legal Requirements: When required by law, court order, or direction from a lawful authority. This includes cooperation with law enforcement agencies in financial crime or fraud investigations.
• Security Protection: When we believe disclosure is necessary to protect the rights, property, or safety of mrlucky, our users, or the public.
• Business Transfers: In the event of a company merger, acquisition, or asset sale, user data may be transferred as part of that transaction. You will be notified before your data becomes subject to a different privacy policy.

In all of the above cases, we ensure that any data sharing is carried out to the minimum extent necessary and is accompanied by appropriate data protection agreements.

5Data Security

We invest seriously in security infrastructure to ensure your personal data is fully protected. The key security measures we implement include:

• Data Encryption in Transit: All communications between your browser and the mrlucky platform are encrypted using TLS 1.3 with a 256-bit SSL certificate – the highest security standard currently available.
• Data Encryption at Rest: Sensitive data stored in our databases, including KYC information and financial details, is encrypted using AES-256 encryption.
• Strict Access Controls: Access to user data is restricted to staff who genuinely require it to perform their duties. All access is logged, monitored, and periodically audited.
• Two-Factor Authentication: Our internal administration system requires multi-factor authentication (MFA) for every login, reducing the risk of unauthorised access.
• 24/7 Security Monitoring: A real-time threat detection system operates around the clock to identify and respond to any suspicious activity.
• Regular Penetration Testing: We conduct regular security audits by independent security experts to identify and address any system vulnerabilities before they can be exploited.

6Cookies & Tracking Technologies

The mrlucky platform uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as maintaining your login session and remembering your security preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information about how you use the platform — most frequently visited pages, error messages received, and similar data. This information is used to improve platform performance.
• Functional Cookies: Remembering choices you have made such as language settings, region, and display preferences so you do not need to reconfigure them each time you visit the platform.
• Analytics Cookies: Helping us understand aggregate usage patterns to plan platform improvements. This data cannot be used to personally identify you.

You can manage cookie settings through your web browser preferences. However, disabling certain cookies may affect the functionality of the mrlucky platform. For more information on managing cookies, please refer to your browser's help documentation.

7Your Rights as a User

Under Malaysia's PDPA and mrlucky's privacy commitments, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to Rectification: If your data is inaccurate or incomplete, you have the right to request a correction. You may also update most of your profile information directly through your account settings.
• Right to Erasure: Under certain circumstances, you may request deletion of your personal data. Please note that we may be required to retain certain data in accordance with legal obligations even after your account is closed.
• Right to Object to Processing: You may object to the processing of your data for specific purposes, particularly for direct marketing.
• Right to Withdraw Consent: You may withdraw consent previously given for specific data processing at any time. Such withdrawal does not affect the validity of any processing carried out prior to that point.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your privacy rights have been violated.

To exercise any of the above rights, please contact our support team via live chat on the platform. Your request will be processed within 7 business days.

8Data Retention Period

Mrlucky retains your personal data for as long as needed to fulfil the purpose for which it was collected, or as required by law. The following are general guidelines for our retention periods:

• Active Account Data: Retained for the duration your account is active plus 5 years after account closure, to comply with financial and audit legal requirements.
• Transaction Records: Retained for 7 years in accordance with Malaysian accounting and tax legal requirements.
• KYC Documents: Retained for 5 years after the business relationship ends in accordance with AMLA (Anti-Money Laundering Act) requirements.
• Communication Logs: Customer support correspondence records are retained for 2 years for quality control and reference purposes.
• Analytics Data: Anonymised usage data is retained for up to 3 years for trend analysis and platform improvement purposes.

Once the retention period expires, your data will be securely deleted or anonymised in accordance with established data deletion procedures.

9Children's Privacy

The mrlucky platform is exclusively for users aged 18 and aboveWe do not intentionally collect, store, or process personal data from individuals under the age of 18.

If we find that we have collected data from someone under the age of 18 without proper age verification, we will take immediate steps to:

• Deleting all personal data associated with that individual.
• Closing the associated account and processing any remaining balance in accordance with established procedures.
• Reviewing our age verification procedures to prevent similar incidents.

If you believe that a minor has registered on our platform, please notify us immediately through our customer support team.

10Changes to the Privacy Policy

Mrlucky reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. When we make material changes, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on the platform at least 14 days before the changes take effect.
• For highly material changes, a notification will be sent directly to the email address registered in your account.

We encourage you to review this Privacy Policy periodically. Continued use of the mrlucky platform after any changes take effect constitutes your acceptance of the updated policy.

11Contact Us About Privacy

If you have any questions, concerns, or requests regarding your privacy and personal data protection, please do not hesitate to contact us. Our privacy team is ready to provide the assistance and clarification you need.

• Live Chat: Available 24 hours a day, 7 days a week at mrlucky.onl – the fastest way to get a response.
• Email: [email protected] – for written enquiries requiring a detailed response.
• Response Time: Live chat enquiries are responded to within minutes; email enquiries within 1–2 business days.

We are committed to addressing every privacy enquiry seriously and providing a clear, satisfactory response to each of our users.