Privacy
Policy

This Privacy Policy ("Policy") is published by luke33 ("we", "us", "our", or "the Platform"), the operator of the online gaming platform accessible at luke33.pro. This Policy describes how luke33 collects, processes, stores, and protects personal data belonging to registered members, prospective members, and visitors to the platform.

luke33 is committed to handling all personal information responsibly, transparently, and in full compliance with applicable international data protection standards. We recognise that members across Pakistan — from Karachi and Lahore to Faisalabad and Islamabad — place trust in us when they share their personal data, and we take that responsibility seriously.

By creating a luke33 account, accessing the platform, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the luke33 platform immediately.

luke33 collects personal data across several categories, depending on how you interact with the platform. The following table summarises the main categories of data we may hold about you:

Where luke33 is required to collect personal data to comply with legal or regulatory obligations — such as KYC and anti-money laundering requirements — failure to provide that data may result in luke33 being unable to open or maintain your account.

luke33 collects personal data through a number of methods, both direct and automated. These include:

• Direct Submission: Data you actively provide during registration, account verification, cashier transactions, customer support interactions, survey responses, or competition entries.
• Automated Technologies: Cookies, web beacons, pixel tags, and similar tracking technologies that automatically record technical and usage data when you access the luke33 platform. See Section 07 for the full Cookies Policy.
• Third-Party Identity Verification Providers: luke33 may use third-party KYC and age-verification services to confirm the identity and eligibility of members. These providers may supply us with verification status data in addition to the documents you submit directly.
• Payment Processors: When you make deposits or withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, or Cash OTC, the relevant payment provider may share transaction reference data with luke33 to enable reconciliation.
• Fraud Detection & Risk Management Tools: luke33 uses automated fraud detection systems that may collect and analyse behavioural and technical data to identify suspicious activity.
• Publicly Available Sources: In limited circumstances, luke33 may supplement member data with information obtained from publicly available records or commercial data providers, strictly for identity verification or fraud prevention purposes.

luke33 processes personal data only for defined, legitimate purposes. We do not sell your personal data to third parties for their own marketing purposes under any circumstances. The purposes for which we process your data include:

• Account Management: Creating, maintaining, and administering your luke33 account, including processing deposits and withdrawals in PKR via your selected payment method.
• Identity & Age Verification: Confirming that you meet the 21+ age requirement and satisfying our KYC obligations under applicable licensing conditions.
• Service Delivery: Making games, sports betting markets, live casino tables, and all other platform features available to you in a functional and personalised manner.
• Customer Support: Responding to your enquiries, processing complaints, and resolving disputes in a timely manner through live chat and email.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and administering self-exclusion, deposit limit, and cooling-off requests where applicable.
• Legal & Regulatory Compliance: Meeting anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations, as well as responding to lawful requests from regulatory or law enforcement authorities.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraud, collusion, money laundering, and other prohibited conduct on the platform.
• Marketing Communications: Sending you promotions, bonus offers, and relevant platform updates — but only where you have provided consent or where a legitimate interest applies. You may opt out of marketing communications at any time via your account settings.
• Platform Improvement: Analysing aggregated usage data to improve the performance, design, and content of the luke33 platform.

luke33 processes personal data on the basis of one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered luke33 member — including account operation, game provision, and transaction processing.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML, KYC, and licensing requirements imposed by our international gaming regulator.
• Legitimate Interests: Processing undertaken for luke33's legitimate business interests where those interests are not overridden by your data protection rights. This includes fraud detection, platform security, and general business analytics.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of direct marketing communications. You retain the right to withdraw this consent at any time without affecting the lawfulness of any prior processing.

luke33 does not sell, rent, or trade your personal data. We may share your data with carefully selected third parties only in the following circumstances, and only to the extent strictly necessary:

• Payment Service Providers: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and other payment processors require access to relevant transaction data to facilitate deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party services engaged by luke33 to conduct identity checks and age verification on prospective and existing members.
• Game Content Providers: Software providers supplying games to the luke33 platform may receive anonymised session and gameplay data for RNG certification and audit purposes.
• Fraud Prevention & AML Services: Specialist third-party providers engaged to screen transactions and member activity for fraud, money laundering, and other financial crime indicators.
• Regulatory & Law Enforcement Authorities: Where required by law, court order, or regulatory directive, luke33 will disclose personal data to the competent authority. We will always seek to notify you of such disclosure unless legally prohibited from doing so.
• Professional Advisors: Legal, financial, and audit advisors engaged by luke33 may access personal data on a strictly confidential, need-to-know basis.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of luke33's business assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party recipients of personal data are required to maintain appropriate technical and organisational security measures and to process data only for the specified purpose.

The luke33 platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies do not contain executable code and cannot transmit viruses.

• Strictly Necessary Cookies: Required for core platform functionality, including session management, login authentication, and security token validation. These cookies cannot be disabled without impairing the platform's operation.
• Performance Cookies: Collect anonymised data about how members use the platform — such as which pages are visited most frequently — to help luke33 improve platform performance and content.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and display options to provide a more personalised experience on repeat visits.
• Targeting & Analytics Cookies: Used to understand member engagement with promotional content and to measure the effectiveness of marketing campaigns. These are only deployed where you have provided consent.

You may control cookie preferences through your browser settings. Note that disabling non-essential cookies may affect certain non-critical features of the luke33 platform. luke33 does not use cookies to track your activity on third-party websites unrelated to our services.

luke33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following general retention periods apply:

• Account Data: Retained for the duration of your active membership plus a minimum of five (5) years following account closure, in compliance with AML and licensing record-keeping requirements.
• Financial & Transaction Data: Retained for a minimum of five (5) years from the date of the relevant transaction, in accordance with anti-money laundering obligations.
• KYC & Identity Documents: Retained for the period required by our licensing authority, typically five (5) years following the end of the business relationship.
• Support & Communications Data: Retained for up to three (3) years following the resolution of the relevant support interaction or dispute.
• Marketing Preference Records: Retained for the duration of your membership and for a reasonable period thereafter to demonstrate compliance with consent and opt-out records.
• Technical & Usage Logs: Retained for up to twelve (12) months, after which aggregated or anonymised versions may be retained indefinitely for analytical purposes.

When data is no longer required, luke33 will securely delete or anonymise it. Where complete deletion is not immediately possible (for example, where data exists in backup archives), it will be securely quarantined and deleted at the earliest practicable opportunity.

luke33 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the luke33 platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data at rest — including financial records and identity documents — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within luke33's systems is restricted to authorised personnel on a strict need-to-know basis. All staff with access to member data are subject to confidentiality obligations.
• Two-Factor Authentication: luke33 recommends and supports two-factor authentication (2FA) for member accounts to provide an additional layer of account security.
• Regular Security Audits: The luke33 platform and its underlying infrastructure undergo regular third-party security assessments, penetration testing, and vulnerability scanning.
• Incident Response: luke33 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to members' rights and freedoms, affected members will be notified in accordance with applicable legal requirements.

Depending on applicable data protection law, you may hold the following rights in relation to the personal data that luke33 holds about you:

• Right of Access: You may request a copy of the personal data luke33 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. You can update most account data directly through your luke33 account profile.
• Right to Erasure: In certain circumstances, you may request that luke33 delete your personal data. Note that this right is subject to our legal and regulatory obligations — we may be required to retain certain data regardless of an erasure request.
• Right to Restriction: You may request that luke33 restrict the processing of your data in certain circumstances, for example while a correction request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for direct marketing purposes. You may opt out of marketing communications at any time via your account settings.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact the luke33 data protection team at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) days of receiving a valid request. We may need to verify your identity before processing your request.

As an internationally licensed gaming platform serving members across Pakistan, luke33 may transfer personal data to, and process it in, countries other than your country of residence. This may occur where our hosting infrastructure, third-party service providers, or game content suppliers are located in different jurisdictions.

Whenever personal data is transferred internationally, luke33 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection law. These safeguards may include:

• Transfers to countries recognised as providing an adequate level of data protection by the relevant regulatory authority.
• Standard contractual clauses or data processing agreements imposing equivalent data protection obligations on the receiving party.
• Binding corporate rules where transfers are made within the luke33 group of companies.

If you would like further information about the international transfer safeguards applicable to your personal data, please contact us at [email protected].

The luke33 platform is strictly intended for individuals aged 21 years and above. luke33 does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. If you are under 21, you must not register an account, access any real-money features, or submit any personal data to the platform.

If luke33 becomes aware that personal data has been collected from an individual under the age of 21 — whether through age verification failure, parental report, or any other means — the following steps will be taken immediately:

• The account will be suspended and access to all real-money features revoked without delay.
• Any balance in the account will be assessed in accordance with applicable responsible gaming and regulatory guidelines.
• All personal data associated with the account will be deleted to the extent permitted by law.
• The matter may be reported to the relevant regulatory or child protection authority where required by law.

luke33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or platform features. When material changes are made, luke33 will notify registered members by email or through a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy will be revised accordingly whenever changes are published. Your continued use of the luke33 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should discontinue use of the platform and request account closure.

Minor clarifications or administrative updates that do not materially affect your rights or the way in which your data is processed may be made without advance notice. We encourage you to review this Policy periodically to stay informed about how luke33 protects your information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way luke33 processes your personal data, please contact our data protection team using the details below. We aim to respond to all data-related enquiries within thirty (30) days of receipt.

• Email: [email protected]
• Live Chat: Available 24/7 via the luke33 platform
• Response Time: Within 6 hours for general support; within 30 days for formal data rights requests
• Subject Line: Please use "Privacy Policy Enquiry" or "Data Rights Request" when contacting us by email so your message is routed to the correct team promptly

luke33 is committed to resolving all privacy-related concerns directly and in good faith. If you remain dissatisfied after contacting us, you retain the right to escalate your complaint to the relevant data protection authority in your jurisdiction.