Lucky798 Privacy Policy – Our Commitment to Protecting Members' Personal Data in Malaysia

1 Introduction & Scope of This Policy

Lucky798 recognises that privacy is more than a legal requirement — it is a fundamental right that deserves to be respected. This Privacy Policy provides a comprehensive and transparent account of how Lucky798 collects, uses, stores, and protects the personal data of all members who use our platform at lucky798.com.

This document applies to all registered Lucky798 members residing in Malaysia, covering every interaction made through the website, any Lucky798-related mobile applications (where available), and all communications between members and our customer support team via live chat, email, or Telegram.

By registering and using the Lucky798 platform, you consent to the collection and use of your personal data as described in this policy. If you disagree with any part of this policy, we encourage you to contact us before continuing to use the platform, as certain platform functions may require specific data processing in order to operate correctly.

2 Types of Personal Data We Collect

Lucky798 collects data in two main categories — data you provide directly to us, and data collected automatically as you use the platform:

Lucky798 does not collect credit or debit card numbers directly — all financial transactions are processed through secure third-party payment gateways such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and the FPX system managed by Malaysian banks. Lucky798 only receives transaction confirmations, not your full card details.

3 Purposes for Using Personal Data

Lucky798 uses members' personal data solely for legitimate, disclosed purposes. Every use of data has a clear legal basis under Malaysia's PDPA 2010:

• Account Management: Verifying your identity at login, processing new registrations, managing your account profile, and providing access to all Lucky798 services.
• Financial Transaction Processing: Verifying incoming deposits, processing withdrawal requests, resolving transaction disputes, and providing transaction history in your account.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, multi-account abuse, automated bots, and any other security threats to the Lucky798 platform and its members.
• Customer Support: Handling enquiries, complaints, and technical support requests submitted via live chat, email, or Telegram in Bahasa Melayu.
• Legal Compliance: Meeting reporting obligations to the relevant Malaysian authorities, including Anti-Money Laundering (AML) and KYC requirements.
• Platform Improvements: Analysing usage patterns in aggregate (not at an individual level) to improve interface design, select new games, and enhance the overall Lucky798 user experience.
• Service Communications: Sending important account notifications, security updates, changes to terms, and relevant promotional information — provided you have given consent to receive marketing communications.

4 Data Sharing with Third Parties

Lucky798 operates on the principles of minimal and purposeful data sharing. We do not sell, rent, or disclose members' personal data to third parties for their own marketing purposes, under any circumstances. However, there are limited situations where data sharing is necessary to operate Lucky798's services:

• Payment Service Providers: Payment gateways that process deposit and withdrawal transactions (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX) receive only the minimum transaction data required to process payments. All such providers are bound by strict data protection agreements with Lucky798.
• Game Providers: Game providers such as Pragmatic Play, Evolution Gaming, Microgaming and others receive only anonymised session data required to operate games within the Lucky798 platform. No personally identifiable information is shared with game providers.
• Malaysian Legal Authorities: Lucky798 will disclose personal data to the relevant Malaysian authorities when required by a court order, official investigation notice, or other legal obligation. In such situations, Lucky798 will comply with the legal requirement while taking all reasonable steps permitted by law to protect member privacy.
• Auditors & Professional Advisors: Audit firms, legal counsel, and security consultants engaged by Lucky798 may have limited access to personal data within the scope of their work, and all are bound by contractual confidentiality obligations.

In all of the above cases, Lucky798 ensures that only the minimum necessary data is shared, and that all data recipients have adequate data protection measures in place. Lucky798 remains accountable for the protection of members' personal data even when it is shared with approved third parties.

5 Lucky798 Data Security Measures

Data security is Lucky798's number one technical priority. We continually invest in the latest infrastructure and security practices to protect every bit of personal data entrusted to us by our members:

• Data Encryption in Transit: All communications between your browser and Lucky798's servers are protected with TLS 1.3 protocol and 256-bit SSL encryption — the same standard used by leading banking institutions in Malaysia.
• Data Encryption at Rest: Sensitive data stored in Lucky798's database — including passwords (stored as irreversible hashes) and identity information — is encrypted using industry-leading encryption algorithms.
• Layered Access Controls: Access to members' personal data within Lucky798's internal systems is restricted according to the principle of least privilege — staff may only access the data necessary to carry out their specific duties.
• Real-Time Threat Monitoring: Lucky798's security monitoring system operates 24 hours a day to detect and respond to threats or unauthorised access attempts in real time.
• Regular Penetration Testing: Independent cybersecurity firms are engaged to conduct regular penetration testing to identify and patch vulnerabilities before they can be exploited.
• Incident Response Plan: Lucky798 has a detailed security incident response plan in place. In the event of a data breach affecting members' personal information, Lucky798 is committed to notifying affected members within 72 hours of the incident being confirmed, in line with international data protection best practices.

6 Cookies & Tracking Technologies

Lucky798 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Below are the types of cookies used and their purposes:

• Essential Cookies (Required): These cookies are required for the Lucky798 platform to function properly — including maintaining your login session, ensuring session security, and saving your language preferences. The platform cannot operate without them.
• Functional Cookies: These cookies store the preferences you have set on the Lucky798 platform — such as favourite games, display settings, and notification preferences — so you do not need to reconfigure them each time you use the platform.
• Analytics Cookies: Lucky798 uses aggregated analytics data to understand how members use the platform — which pages are visited most, which games are most popular, and where users encounter difficulties. This data is used in aggregated form only and does not identify any individual.

You can control cookie usage through your web browser settings. However, disabling essential cookies may affect the functionality of the Lucky798 platform, and you may be unable to log in or use certain features properly. For non-essential cookies, you may change your preferences at any time without materially affecting your account.

7 Data Retention Period

Lucky798 does not retain your personal data for longer than necessary for the stated purposes. Our general principle is to store data for the minimum period required by Malaysian law and legitimate operational needs:

• Active Account Data: Retained for as long as your account remains active in the Lucky798 system.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the transaction date, in accordance with Malaysia's financial reporting and anti-money laundering requirements.
• Gaming Records: Retained for five (5) years for dispute resolution, audit, and compliance analysis purposes.
• Support Communication Logs: Retained for three (3) years from the date of last interaction.
• Closed Account Data: Upon account closure, personal data not required by law will be deleted or anonymised within 90 days. Data retained under legal obligations will be kept for the period specified by the applicable law.

Once the retention period expires, data will be securely deleted using methods that ensure it cannot be recovered, or fully anonymised so it can no longer be linked to any individual.

8 Your Rights as a Data Owner

Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding your personal data held by Lucky798. We are committed to facilitating the exercise of these rights without undue obstacles:

To exercise any of the rights above, contact Lucky798's Privacy Officer by email at privacy@lucky798.com with the subject line "PDPA Rights Request", along with your account number and the type of request. Lucky798 will acknowledge receipt within 2 business days and resolve it within the timeframes stated above.

9 Protection of Children's Data

The Lucky798 platform is strictly for individuals aged 18 years and above. Lucky798 does not knowingly collect or process personal data of individuals under the age of 18 under any circumstances.

During the registration process, all applicants are required to confirm that they are at least 18 years of age. Lucky798 also conducts age verification through its KYC process, cross-referencing the stated date of birth against official Malaysian identity documents.

10 Cross-Border Data Transfers

In operating the Lucky798 platform, certain member personal data may be processed by technical service providers operating outside Malaysia — in particular, international game providers and cloud infrastructure providers that support Lucky798's operations.

In all cases of cross-border data transfers, Lucky798 ensures a level of protection equivalent to that required under Malaysia's PDPA 2010 through:

• Contractually binding data processing agreements with all third-party providers who receive member data.
• Security assessment prior to engaging any new provider that will have access to member personal data.
• Minimum data transfer — only data strictly necessary for the specific purpose will be transferred, not the member's full profile.

Lucky798 is committed to ensuring that the privacy protection of Malaysian members remains consistent, regardless of where data is physically processed or stored within our service ecosystem.

11 Privacy Policy Amendments

Lucky798 reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, changes in Malaysian law, or changes to the services we offer. Each new version will display a clear update date at the top of the document.

For material amendments — changes that significantly affect how we use your personal data or your rights as a member — Lucky798 will send a notification to your registered email address at least 14 days before the changes take effect. Continued use of the Lucky798 platform after the effective date constitutes acceptance of the updated policy.

12 Contact Lucky798's Privacy Officer

Lucky798 has appointed a Privacy Officer responsible for ensuring compliance with this policy and handling all privacy-related enquiries from members. If you have any questions, concerns, or wish to exercise your privacy rights, we are here to help:

For formal requests relating to PDPA rights — such as data access, correction, or deletion — please email privacy@lucky798.com with a clear subject line and include your account number to expedite the process. Lucky798 is committed to responding to all requests within 2 business days and resolving them within the legally prescribed timeframe.

If you are dissatisfied with how Lucky798 has handled your privacy request after contacting us, you have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner under PDPA 2010. Contact details for this authority are available on the official website of the Malaysian Ministry of Communications and Digital.