luckpot is committed to protecting your personal data in accordance with the Philippine Data Privacy Act of 2012. This Policy explains what we collect, how we use it, and the rights you hold as a luckpot member.
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), luckpot members hold the following rights with respect to their personal data. This summary does not replace the full sections below.
You may request a copy of the personal data luckpot holds about you, the purposes for which it is processed, and the parties with whom it has been shared.
You may request correction of any inaccurate, incomplete, or outdated personal data recorded on your luckpot account, subject to identity verification requirements.
You may request deletion of personal data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations under PAGCOR and AMLA regulations.
You may object to the processing of your personal data for direct marketing purposes. You may also object to processing carried out on the basis of legitimate interest in certain circumstances.
Where technically feasible, you may request a copy of your personal data in a structured, commonly used, machine-readable format for transfer to another data controller.
You have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe luckpot has violated your data privacy rights under RA 10173.
In this Privacy Policy, the following terms have the meanings set out below unless the context otherwise requires:
luckpot acts as the Data Controller in respect of all personal data collected from users of the luckpot.one platform and associated services. As Data Controller, luckpot determines the purposes for which personal data is processed and the manner in which such processing is carried out, in accordance with the DPA and applicable PAGCOR licensing conditions.
luckpot has appointed a Data Protection Officer (DPO) as required under Section 21 of RA 10173. The DPO is responsible for ensuring luckpot's compliance with the DPA, advising on data protection obligations, monitoring policy implementation, and serving as the primary point of contact for data subject rights requests and NPC inquiries.
luckpot collects personal data in several categories depending on your relationship with the platform. The following table describes the principal data categories and the specific data points collected within each:
| Data Category | Specific Data Points |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, gender (where provided on ID document) |
| Contact Data | Philippine mobile number, email address, residential address |
| KYC / Identity Verification Data | Government-issued Philippine ID type and number (PhilSys, SSS, UMID, driver's licence, or passport), photographic copy of ID document, selfie or liveness check image where required |
| Financial Data | GCash account number (partial), Maya account number (partial), bank account names and numbers (partial) associated with deposit and withdrawal transactions, transaction amounts, transaction dates |
| Account & Gaming Data | Username, account creation date, login history (timestamp, device type, IP address), game session records, wager history, win and loss records, balance history, bonus and promotion participation records |
| Device & Technical Data | IP address, browser type and version, operating system, device identifier, screen resolution, referring URL, session duration |
| Communications Data | Content and metadata of support chat transcripts, email correspondence, and any other communications submitted to luckpot |
| Responsible Gaming Data | Deposit limit settings, loss limit settings, self-exclusion status and history, session reminder preferences |
Certain data — including full legal name, date of birth, Philippine mobile number, and KYC identity document — is mandatory for account registration and verification. Without this data, luckpot cannot create a verified account or permit access to real-money gaming services as required by PAGCOR licensing conditions. Other data, such as optional profile preferences, is provided voluntarily and does not affect account functionality if not supplied.
luckpot collects personal data directly from you when you: register an account on luckpot.one; complete KYC identity verification; make a deposit or withdrawal; submit a support request; participate in a promotion or survey; or communicate with luckpot through any channel. You are responsible for the accuracy and completeness of all personal data you provide to luckpot. Providing false or misleading information during registration or KYC constitutes a breach of luckpot's Terms & Conditions and may result in account suspension.
luckpot's platform automatically collects certain technical and behavioural data when you access the website or use gaming services. This includes server log data (IP address, request timestamps, HTTP status codes), browser and device fingerprint data, session activity records (pages visited, game sessions initiated, wager events), and cookies and similar tracking technologies as further described in Section 9 of this Policy.
luckpot may receive personal data about you from third-party sources in limited circumstances, including: identity verification service providers used to validate KYC documents; payment processors (GCash, Maya, BPI, BDO, Metrobank, 7-Eleven Cliqq) that confirm transaction status; fraud detection and anti-money laundering screening services; and PAGCOR or AMLC as required under regulatory information-sharing obligations. Data received from third parties is held and processed under the same security standards as data collected directly.
luckpot processes personal data for the following purposes, each supported by a lawful basis under RA 10173:
✅ Legal basis summary: Most processing at luckpot is carried out on the basis of contractual necessity or legal obligation. Direct marketing is the only purpose conducted on the basis of consent, and consent may be withdrawn at any time without affecting the legality of processing carried out prior to withdrawal.
luckpot does not sell, rent, or trade personal data to third parties for commercial purposes. Personal data is shared only in the following circumstances and with the following categories of recipients:
luckpot strictly prohibits the sale, assignment, or commercial transfer of personal data to any third party for advertising, profiling, or marketing purposes unrelated to luckpot's own platform. Any third-party marketing integration used by luckpot (e.g., analytics tools) is configured to anonymise or pseudonymise user data at the point of collection.
luckpot retains personal data for no longer than is necessary for the purposes for which it was collected, subject to minimum retention periods mandated by applicable Philippine law:
Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with luckpot's data destruction procedures.
luckpot implements the following technical security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction:
luckpot's organisational data protection measures include regular mandatory data privacy training for all staff with access to personal data, contractual data processing agreements with all third-party processors, a documented incident response plan for personal data breaches, and periodic data protection impact assessments for high-risk processing activities.
In the event of a personal data breach that is likely to affect your rights and freedoms, luckpot will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required under the DPA. Where the breach is likely to result in a high risk to affected Data Subjects, luckpot will also notify the relevant individuals without undue delay, providing sufficient information to allow them to take protective measures.
🔒 Note on Your Responsibility: While luckpot implements comprehensive security measures, the security of your account also depends on you keeping your login credentials, OTP codes, and registered mobile device secure. Never share your password or OTP with anyone, including luckpot support staff, who will never request them.
luckpot uses the following categories of cookies and similar tracking technologies when you access luckpot.one:
You may manage non-essential cookies through your browser's privacy settings. Most modern browsers allow you to view, block, or delete cookies. Blocking strictly necessary or fraud detection cookies may impair the functionality of the luckpot platform, including login and game access. luckpot does not use advertising or cross-site tracking cookies on luckpot.one.
To exercise any of the rights described in this Policy — including access, rectification, erasure, objection, or data portability — submit a written request to luckpot's Data Protection Officer at [email protected] with the subject line "Data Privacy Request – [Your Account Username]." Your request must include sufficient information to verify your identity, including your registered mobile number and the type of government ID used during KYC.
luckpot will acknowledge receipt of your request within 3 business days and will provide a substantive response within 15 business days from the date a complete and verifiable request is received. Where a request is particularly complex or involves a large volume of data, luckpot may extend this period by a further 15 business days, with written notification explaining the reason for the extension.
Certain rights under the DPA are subject to limitations. In particular, the right to erasure may not be exercisable where luckpot is required to retain data to comply with a legal obligation (such as AMLA or PAGCOR record-keeping requirements), to establish or defend a legal claim, or where the data is necessary for the performance of a contract still in effect. luckpot will clearly explain any applicable limitation when responding to an erasure or portability request.
If you are unsatisfied with luckpot's response to your privacy rights request, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the government authority responsible for enforcing RA 10173 and investigating complaints against data controllers. Details of the NPC's complaint process are available through the NPC's official channels. luckpot will cooperate fully with any NPC investigation.
The luckpot platform is strictly prohibited to individuals under the age of 21. luckpot does not knowingly collect, process, or retain any personal data from individuals under 21 years of age. The minimum age is enforced through mandatory KYC verification using a government-issued Philippine identity document at the point of registration.
If luckpot becomes aware that personal data has been collected from a person under 21 — whether as a result of false information provided during registration, a failed age verification process, or any other circumstance — it will immediately suspend the associated account, delete or securely isolate the personal data of the minor, and report the incident to PAGCOR as required under licensing conditions. Any funds deposited by a minor will be handled in accordance with PAGCOR's prescribed procedures for underage account incidents.
Parents or guardians who believe their minor child has registered or attempted to register on luckpot.one should contact luckpot's Data Protection Officer immediately at [email protected].
luckpot's primary data processing operations are carried out within the Philippines. However, certain third-party service providers — including cloud infrastructure providers, KYC verification platforms, and game software providers — may process personal data in jurisdictions outside of the Philippines.
Where personal data is transferred outside the Philippines, luckpot ensures that such transfers are made only to entities that provide an adequate level of data protection, whether through: (a) applicable adequacy determinations by the NPC; (b) contractual clauses binding the recipient to DPA-equivalent obligations; (c) binding corporate rules where the recipient is part of a group with certified privacy standards; or (d) the explicit informed consent of the Data Subject in cases where no other transfer mechanism applies.
Players may request information about the specific countries to which their data may be transferred and the safeguards in place by contacting luckpot's Data Protection Officer.
luckpot may send promotional communications — including bonus offers, event notifications, new game announcements, and VIP program updates — to registered members who have provided consent to receive such communications at the time of registration or subsequently through their account notification preferences. Marketing communications are sent via SMS to the registered Philippine mobile number and/or via email to the registered email address.
Consent to receive marketing communications may be withdrawn at any time by: (a) updating notification preferences in the luckpot account settings; (b) replying "STOP" to any SMS marketing message; or (c) submitting an opt-out request to [email protected]. Withdrawal of marketing consent does not affect the receipt of essential transactional communications — such as deposit confirmations, withdrawal notifications, OTP security messages, and account alerts — which are sent as part of the contract and cannot be disabled while the account is active.
luckpot may use account activity data (including game preferences, deposit frequency, and promotional participation history) to personalise bonus offers and communication content for individual members. This personalisation is carried out on the basis of luckpot's legitimate interest in providing relevant and timely information to its members. Players may object to personalised marketing by contacting luckpot's DPO.
luckpot reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance from the NPC or PAGCOR, changes to luckpot's data processing practices, or updates to the platform's technical infrastructure. Where amendments are material — meaning they significantly alter the way personal data is processed or affect Data Subject rights — luckpot will provide at least 7 days' advance notice by posting the updated Policy on luckpot.one and, where reasonably practicable, notifying registered members via email or in-account notification.
The version of this Privacy Policy with the highest "Last Updated" date displayed at the top of this page is the version currently in force. Continued use of the luckpot platform after the effective date of an amended Policy constitutes acceptance of the amendments. Members who object to material changes should cease using the platform and submit an account closure request, following which any legally required retention periods will govern the further processing of their personal data.
All data privacy enquiries, rights requests, and concerns should be directed to luckpot's Data Protection Officer. luckpot is committed to responding to all privacy enquiries promptly and transparently.
For unresolved complaints, you may also contact the National Privacy Commission of the Philippines (NPC) through its official website and complaint channels. luckpot will cooperate fully with any NPC-initiated investigation and will provide all requested documentation within the timeframes specified by the NPC.
📌 Related Policy Documents: This Privacy Policy should be read alongside luckpot's Terms & Conditions and Responsible Gaming Policy, both of which contain additional provisions that affect how your personal data and account information are handled.