luke91 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") explains how luke91 ("luke91," "we," "us," or "our") collects, uses, discloses, and safeguards personal information about individuals ("you," "your," or "User") who access or use the luke91 Platform, including the website at luke91.app and the Android application.

By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy should be read alongside the luke91 Terms & Conditions and Responsible Gaming Policy, which together govern your use of the Platform.

2 Data Controller Information

luke91 acts as the data controller in respect of personal data collected through the Platform. As data controller, luke91 determines the purposes and means of processing your personal information.

For any data-related queries or to exercise your rights under this Policy, you may contact our Data Protection team via the support channels listed in Section 14 of this Policy. We endeavour to respond to all data-related requests within 30 calendar days.

3 Data We Collect

luke91 collects personal data from you in the following categories:

• Registration Data: Full name, date of birth, mobile number (including JazzCash or Easypaisa-registered numbers), username, and account password (stored in hashed form only).
• Identity Verification (KYC) Data: Copies of government-issued identification documents (such as CNIC or Passport), proof of address, and, where required, proof of payment method ownership. This data is collected to comply with anti-money-laundering obligations and to verify player age.
• Financial Data: Payment method identifiers (JazzCash account number, bank account details, USDT wallet addresses), transaction history, deposit and withdrawal records, and account balance information. Full payment credential data (e.g., full bank account numbers) is processed by our payment partners and is not stored in full by luke91.
• Transaction and Gaming Data: Records of all betting activity, casino game sessions, game preferences, bet amounts, and outcomes. This data is retained for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.
• Technical Data: IP address, device type (Android device model, OS version), browser type, session timestamps, login history, and in-app navigation data. This data is collected automatically when you access the Platform.
• Communications Data: Records of any communications you have with luke91 support, including live chat transcripts, email correspondence, and support ticket content.
• Responsible Gaming Data: Self-imposed limits, cool-off periods, and self-exclusion requests. This data is treated with the highest level of confidentiality.

4 How We Use Your Data

luke91 processes your personal data for the following purposes:

• To create and manage your account, including verifying your identity and age (18+ requirement), processing deposits and withdrawals in PKR, and providing access to the Platform's games and betting markets.
• To fulfil our legal and regulatory obligations, including anti-money-laundering checks, responsible gaming monitoring, and compliance with applicable international gaming regulations.
• To communicate with you about your account, including transaction confirmations, security alerts, promotional offers (where you have consented), and important policy updates.
• To investigate and resolve disputes, respond to support requests, and prevent fraud and other prohibited activities.
• To improve the Platform, including analysing usage patterns, testing new features, and optimising the user experience for Pakistani players on Android devices.
• To enforce our Terms & Conditions and other platform policies, including detecting and preventing bonus abuse, multi-accounting, and other breaches.

5 Legal Basis for Processing

luke91 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions, including account management, payment processing, and provision of gaming services.
• Legal Obligation: Processing necessary to comply with applicable legal obligations, including KYC/AML verification, responsible gaming monitoring, and regulatory reporting.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, Platform security, dispute resolution, and service improvement, where such interests are not overridden by your rights and interests.
• Consent: Where we process data on the basis of your consent (such as for optional marketing communications), you may withdraw that consent at any time by contacting our support team or updating your account preferences.

6 Cookies and Tracking Technologies

The luke91 Platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure user experience. The following categories of cookies may be used:

• Essential Cookies: Required for the Platform to function, including session management, authentication, and security features. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and saved game selections, to improve your experience on return visits.
• Analytical Cookies: Used to collect aggregated data about Platform usage patterns, which helps us identify areas for improvement. Data collected through analytical cookies is anonymised where possible.

You may control cookie settings through your browser or device settings. Please note that disabling essential cookies may impair your ability to use the Platform.

7 Data Sharing and Third Parties

luke91 does not sell or rent your personal data to third parties. We may share your data with the following categories of third parties only where strictly necessary:

• Payment Processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Skrill, and cryptocurrency processors receive transaction data necessary to process your deposits and withdrawals.
• Game Providers: Licensed casino game suppliers (including but not limited to Evolution Gaming, Pragmatic Play, PG Soft, and Ezugi) receive minimal session data required to operate their games within the Platform.
• Identity Verification Services: Third-party KYC providers who assist with document verification and AML screening, operating under strict data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or regulatory obligation, we may disclose personal data to competent authorities.

All third-party data processors engaged by luke91 are required to handle your data in accordance with applicable data protection standards and are contractually prohibited from using your data for any purpose other than the specific service they provide to us.

8 International Data Transfers

Due to the international nature of our gaming infrastructure, your personal data may be transferred to and processed in countries outside Pakistan. Where such transfers occur, luke91 ensures that appropriate safeguards are in place to protect your data, including contractual protections and data processing agreements that impose equivalent privacy protections to those described in this Policy.

9 Data Retention

luke91 retains personal data for the following periods, unless a longer retention period is required by applicable law:

• Account and registration data: For the duration of your account and for a minimum of five years following account closure, to comply with AML and gaming regulatory obligations.
• Transaction and gaming records: Minimum five years following the date of the relevant transaction, for regulatory compliance and dispute resolution purposes.
• KYC documentation: For the period required by applicable AML regulations, typically five years following the end of the business relationship.
• Support communications: Minimum two years from the date of the communication, or longer where the communication relates to an ongoing dispute or legal matter.
• Technical log data: Typically 12 months, unless retained longer for fraud investigation or security purposes.

Upon expiry of the applicable retention period, data is securely deleted or anonymised in accordance with our internal data disposal procedures.

10 Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by luke91:

• Right of Access: Request a copy of the personal data we hold about you.
• Right of Rectification: Request correction of inaccurate or incomplete personal data.
• Right of Erasure: Request deletion of your personal data, subject to legal retention obligations (e.g., AML record-keeping requirements).
• Right to Restrict Processing: Request that we limit the processing of your data in certain circumstances.
• Right to Data Portability: Request a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to processing based on legitimate interests where your interests and rights override ours.
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection team through the support channels listed in Section 14. We will respond to all requests within 30 calendar days. Certain rights may be limited where data retention is required by law.

11 Children's Privacy

The luke91 Platform is strictly for individuals aged 18 years and over. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that data has been collected from a minor, we will immediately delete that data and close the associated account. If you have reason to believe that a minor has registered on the Platform, please notify us immediately via our support channels.

luke91 takes the protection of minors very seriously and maintains age verification procedures as part of our responsible gaming framework. For more information, please visit our Responsible Gaming page.

12 Security Measures

luke91 implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive stored data including KYC documents and financial information.
• Role-based access controls ensuring that employee access to personal data is limited to what is strictly necessary for their role.
• Two-factor authentication available for player accounts to prevent unauthorised access.
• Regular security audits, penetration testing, and vulnerability assessments of Platform infrastructure.
• Automated fraud detection and anomalous activity monitoring systems operating 24 hours a day.

Despite these measures, no data transmission or storage system can be guaranteed to be 100% secure. If you believe your account security has been compromised, contact our support team immediately.

13 Changes to This Policy

luke91 reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify registered users via in-platform notification or to the registered contact details associated with their account. The date at the top of this Policy indicates when it was last updated.

Your continued use of the Platform following notification of any amendments constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by luke91, please contact us through the following channels:

• In-app live chat: Available 24 hours a day through the Android app or Platform website — this is the fastest route for data access or deletion requests.
• Email: [email protected] (plain text only — copy this address manually; it is not a clickable link).

Our support team is English-speaking and serves players across Pakistan, including Karachi, Lahore, Islamabad, Rawalpindi, and Faisalabad. We will acknowledge all data-related requests within 48 hours and respond in full within 30 calendar days.