Privacy Policy —
How luki22 Handles Your Data

This Privacy Policy ("Policy") is published by luki22, accessible at luki22.cam ("Platform", "we", "us", "our"). It describes how luki22 collects, uses, stores, shares and protects personal data relating to users ("you", "your", "User") who access this Platform.

luki22 is an English-language online gaming information and education platform serving users across Pakistan, including those in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. The Platform provides informational content on sports betting, casino games, responsible gambling and related topics. luki22 is not a gambling operator and does not process financial transactions on behalf of users or gambling operators.

This Policy is incorporated by reference into our Terms & Conditions and should be read alongside that document. Where this Policy uses capitalised terms, those terms carry the meanings defined in our Terms & Conditions unless separately defined below.

The following terms have the meanings set out below throughout this Policy:

For the purposes of applicable data protection law, the Data Controller responsible for personal data processed through the luki22 Platform is:

Where you have any question about the identity of the Data Controller or the basis on which your data is processed, please contact us using the email address above or refer to Section 16 of this Policy.

luki22 collects only the personal data necessary for the operation and improvement of this information platform. The categories of personal data we may collect are set out in the table below:

luki22 processes personal data only where a lawful basis for doing so exists. The applicable lawful bases for luki22's data processing activities are as follows:

• Legitimate Interests: Processing of technical and usage data is carried out on the basis of luki22's legitimate interest in operating a functional, secure and improving information platform. This interest has been balanced against user rights and is not overridden by user interests in ordinary circumstances.
• Consent: Where non-essential cookies are placed on your device, this is done only with your prior consent obtained via the cookie consent mechanism. Consent may be withdrawn at any time by adjusting your browser settings.
• Contractual Necessity: Where you contact us and provide personal data, processing of that data is necessary to respond to your enquiry and fulfil any obligation arising from your communication with us.
• Legal Obligation: luki22 may process or retain personal data where required by applicable law, including valid legal orders or regulatory requirements.

Personal data collected by luki22 is used solely for the following purposes:

• Platform Operation: To deliver, maintain and improve the technical performance of the luki22 website, ensure content is displayed correctly across devices, and identify and resolve technical errors;
• Security & Fraud Prevention: To detect, investigate and prevent unauthorised access, abuse, or fraudulent use of the Platform;
• Analytics & Improvement: To understand how users navigate the Platform, which content is most useful, and where the user experience can be improved — using aggregated or anonymised data wherever practicable;
• Responding to Enquiries: To handle and respond to messages, questions or responsible gambling enquiries submitted via email or any contact mechanism on the Platform;
• Legal Compliance: To comply with applicable legal obligations, including retention requirements and response to lawful authority requests;
• Cookie Management: To record and honour your cookie preferences and ensure non-essential cookies are only placed with your consent.

luki22 does not use personal data for direct marketing, automated profiling for commercial purposes, or any purpose incompatible with those listed above. If a new processing purpose arises, this Policy will be updated accordingly and users notified where reasonably practicable.

luki22 uses cookies and similar tracking technologies to provide platform functionality, remember user preferences and gather aggregated usage analytics. The types of cookies used on this Platform are described below:

You may manage, restrict or delete cookies at any time through your browser settings. Please note that disabling essential cookies may impair Platform functionality. Browser-level cookie management instructions are typically found in the browser's Help or Settings section. Withdrawing consent for analytics or functional cookies will not affect any processing already completed on the basis of prior consent.

luki22 does not sell, rent, trade or disclose personal data to third parties for their own commercial or marketing purposes. Personal data may be shared only in the following strictly limited circumstances:

• Service Providers (Data Processors): luki22 engages third-party service providers to assist with platform hosting, analytics, security monitoring and technical maintenance. These providers process data only on luki22's instruction, under written agreements that include appropriate data protection obligations, and only to the extent necessary to deliver the relevant service;
• Legal Requirements: luki22 may disclose personal data to competent authorities, courts or regulators where required to do so by applicable law, a court order, or a valid regulatory request. We will endeavour to notify affected users of such disclosure where permitted by law;
• Business Transfers: In the event of a merger, acquisition, asset sale or similar corporate transaction involving luki22, personal data held at the time of the transaction may be transferred to the successor entity, subject to equivalent data protection obligations;
• Protection of Rights: Where disclosure is reasonably necessary to protect the rights, property or safety of luki22, its users or the public, personal data may be shared with relevant parties on a strictly necessary basis.

In all cases, data sharing is subject to appropriate safeguards and is limited to the minimum information required for the specific purpose.

luki22 operates a Platform that may be hosted on servers located outside Pakistan. As a result, personal data you provide or that is collected automatically may be transferred to, stored in, and processed in countries other than Pakistan.

Where such international transfers occur, luki22 ensures that appropriate safeguards are in place to protect your personal data, including:

• Transfers to countries or territories recognised as providing an adequate level of data protection;
• Use of standard contractual clauses or equivalent mechanisms with data processors located outside recognised adequate territories;
• Application of technical security measures to protect data in transit and at rest.

Pakistani users should be aware that data transferred outside Pakistan may be subject to the laws of the destination country, which may differ from Pakistan's own data protection framework, including the Prevention of Electronic Crimes Act 2016. By using this Platform, you acknowledge and accept that your data may be processed in other jurisdictions under the safeguards described above.

luki22 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Indicative retention periods by data category are:

Following expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents identification of individual users. Where anonymisation rather than deletion is applied, the resulting anonymised data is no longer considered personal data and may be retained indefinitely for aggregated statistical purposes.

luki22 implements technical and organisational security measures proportionate to the risk associated with the personal data we process. These measures include, but are not limited to:

• Encrypted Connections: Platform communications are transmitted over encrypted HTTPS connections to protect data in transit between users' devices and our servers;
• Access Controls: Access to systems that handle personal data is restricted to authorised personnel who require such access to perform their responsibilities;
• Security Monitoring: Server logs and security tools are used to detect and respond to unusual access patterns, potential intrusion attempts or data anomalies;
• Vendor Assessments: Third-party service providers with access to personal data are assessed for appropriate security practices prior to engagement and under ongoing contractual obligations;
• Regular Reviews: Security measures are reviewed periodically and updated in response to emerging threats or changes to data processing activities.

Subject to applicable law, users of luki22 may have the following rights in relation to their personal data. The availability and scope of these rights may vary depending on the jurisdiction in which you are located and the legal basis for the relevant processing activity.

To exercise any of the above rights, please contact luki22 at [email protected] (plain text — not a clickable link), clearly identifying the right you wish to exercise and providing sufficient information for us to locate your data. We aim to respond to all valid requests within 30 calendar days. Complex or numerous requests may take longer, in which case we will notify you of the extended timeframe.

We may need to verify your identity before processing a data rights request. This is to protect your data from unauthorised access by third parties.

luki22 provides content relating to online gambling, which is an adults-only activity. This Platform is strictly not intended for use by persons under the age of 18, or the higher minimum age required by the operator or license jurisdiction applicable to you.

luki22 does not knowingly collect personal data from persons under the age of 18. If you believe that a minor has provided personal data to luki22, please contact us immediately at [email protected] (plain text — not a clickable link) and we will take prompt steps to delete that data from our systems.

Persons under 18 must not access this Platform. By using luki22, you confirm that you are at least 18 years of age or meet the higher minimum age requirement applicable to your circumstances. Being aged 18 or over does not, by itself, confirm that gambling is lawful in Pakistan under applicable local laws.

luki22 acknowledges the specific context of Pakistani users and notes the following matters relevant to data protection in Pakistan:

• Prevention of Electronic Crimes Act 2016 (PECA): Pakistani users should be aware that PECA and related regulations govern certain aspects of data and electronic communications in Pakistan. luki22 is not registered as a data processor under Pakistani law and this Policy is not a representation of PECA compliance.
• State Bank of Pakistan (SBP) Regulations: luki22 does not process financial transactions and has no engagement with SBP-regulated payment systems. References to payment providers such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on this Platform are contextual only and do not involve data sharing with those providers.
• Pakistan Telecommunication Authority (PTA): luki22 does not claim registration with or approval from PTA. Pakistani users accessing this Platform do so under the terms of their internet service provider and applicable local regulations.
• Cross-Border Data Flows: Data transferred outside Pakistan is subject to the international transfer safeguards described in Section 9. Users in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar should note that such transfers may result in their data being subject to foreign legal jurisdiction.

luki22 reserves the right to update, amend or replace this Privacy Policy at any time, in response to changes in data processing activities, applicable law, platform features or regulatory guidance. Updated versions of this Policy will be published on this page with a revised "Last Updated" date.

Where changes are material — meaning they significantly affect how personal data is processed or the rights available to users — luki22 will, where practicable, publish a prominent notice on the Platform homepage to draw attention to the update. However, it remains each user's responsibility to review this Policy periodically.

Your continued use of luki22 following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, please discontinue use of the Platform and, where applicable, submit a data deletion request as described in Section 12.

If you have any questions, concerns or requests relating to this Privacy Policy, data processing activities, cookie usage, or the exercise of your data rights, please contact luki22 using the details below. Email addresses are provided as plain text only — they are not clickable links.

luki22 is available to users across Pakistan. If you are contacting us about a responsible gambling concern alongside a privacy matter, please also refer to our Responsible Gambling page for additional guidance and self-management tool information.