1 Who We Are
This Privacy Policy applies to Spin Lucky ("the Platform," "we," "us," "our") and governs the collection, use, storage, and disclosure of personal data relating to players who register and use Spin Lucky at spinlucky-app.com. Spin Lucky is a licensed online gaming and sports betting platform that serves players based in Pakistan and operates under the terms of its applicable gaming licence.
For the purposes of data protection, Spin Lucky is the data controller — meaning we decide how and why your personal data is processed. If you have any questions about this Privacy Policy or about how your personal data is being handled, you can contact us at support@spinlucky-app.com at any time. We aim to respond to all privacy-related queries within five business days.
This Privacy Policy should be read alongside our Terms and Conditions and our Responsible Gaming policy, both of which form part of the complete agreement between you and Spin Lucky. By registering an account and using the platform, you confirm that you have read and understood this Privacy Policy.
This policy was last updated on 1 July 2025. Spin Lucky reviews its Privacy Policy at least once per year and whenever significant changes are made to how data is collected or processed. When this policy changes, the date at the top of the page is updated and registered players are notified by email for significant changes.
2 What Personal Data Spin Lucky Collects
Spin Lucky collects personal data in two broad categories: information you provide directly, and information generated automatically when you use the platform. Here is a complete breakdown of both.
Information You Provide Directly
Information Collected Automatically
- IP address and approximate geographic location (city/region level — not GPS coordinates).
- Device type, operating system, browser type and version.
- Pages visited, time spent on each page, links clicked, and navigation path through the platform.
- Betting and gaming activity — game sessions, bet history, win/loss records, and stake amounts.
- Login timestamps, session duration, and logout activity.
- Cookie and similar tracking technology data (see Section 8 for full cookie details).
3 How Spin Lucky Collects Your Data
Spin Lucky collects your personal data through the following means:
- Directly from you when you register, complete KYC verification, make a deposit, contact customer support, or update your account settings.
- Automatically through the platform via server logs, session tracking, and cookies placed on your device when you visit or use the Spin Lucky platform.
- From payment processors when you make deposits or withdrawals — Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners share transaction confirmation data with Spin Lucky to verify payment status.
- From identity verification services used to validate the authenticity of KYC documents submitted during the verification process.
- From fraud prevention and AML screening services that cross-reference account and transaction data against regulatory watchlists as required by our licensing obligations.
Spin Lucky does not purchase personal data from data brokers or build player profiles using data sourced from outside the platform without the player's knowledge.
4 How We Use Your Personal Data
Spin Lucky uses the personal data it holds for the following specific purposes:
- Account operation: Creating and maintaining your player account, verifying your identity, processing logins, and managing your account settings.
- Payment processing: Executing deposit and withdrawal transactions in PKR via your chosen payment method, reconciling account balances, and maintaining financial records.
- Regulatory compliance: Meeting Know Your Customer (KYC), Anti-Money Laundering (AML), and responsible gaming obligations required by our gaming licence. This includes verifying your age, identity, and source of funds where required.
- Platform security and fraud prevention: Detecting and preventing fraudulent activity, duplicate account creation, bonus abuse, and any other conduct that violates our Terms and Conditions.
- Customer support: Responding to your queries, investigating complaints, and resolving disputes.
- Responsible gaming: Monitoring account activity to identify patterns that may indicate problem gambling behaviour, applying the responsible gaming tools you have set, and reaching out where welfare concerns arise.
- Platform improvement: Analysing aggregated, anonymised usage data to understand how the platform is being used and to improve features, performance, and user experience.
- Marketing communications (with your consent only): Sending promotional offers, bonus notifications, and platform news to players who have opted in. See Section 13 for full details.
Spin Lucky does not use your personal data to make fully automated decisions that produce significant legal or similarly significant effects on you — for example, automated account closures — without human review being part of the process.
5 Legal Basis for Processing
Every instance of personal data processing at Spin Lucky rests on one of the following legal bases:
- Contractual necessity: Most core data processing — account creation, payment processing, bet settlement, customer support — is necessary to deliver the services you signed up for. Without this processing, Spin Lucky cannot operate your account.
- Legal obligation: KYC verification, AML screening, age verification, and the maintenance of financial records are required by applicable law and our gaming licence conditions. We cannot remove or skip these processes even if asked to do so.
- Legitimate interests: Fraud detection, platform security, and aggregated analytics for platform improvement are processed under legitimate interests — we have a genuine business need and the processing does not override your rights.
- Consent: Marketing communications by email or SMS are only sent where you have expressly opted in. You can withdraw this consent at any time.
6 Who Spin Lucky Shares Your Data With
Spin Lucky shares personal data with third parties only where there is a specific, legitimate reason for doing so. We do not sell your data. The categories of third parties that may receive your data are as follows:
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking networks, and Visa/Mastercard processing partners receive the minimum data necessary to execute your transactions. These providers operate under their own privacy policies and data protection obligations.
- Identity verification services: Third-party KYC vendors that validate the authenticity of the identity documents you submit during account verification. These vendors are contractually prohibited from using your data for any purpose other than verification.
- Fraud and AML screening services: Regulatory compliance tools that screen account and transaction data against watchlists as required by our licence conditions.
- Technology infrastructure providers: Cloud hosting, database, and security services that Spin Lucky uses to operate the platform. These providers process data on behalf of Spin Lucky under strict data processing agreements.
- Regulatory and law enforcement authorities: Where required by law, court order, or regulatory direction, Spin Lucky may be obliged to disclose player data. We will challenge requests we consider unlawful to the extent permitted by applicable law.
- Game content providers: Where you play games from third-party providers integrated into the Spin Lucky platform, those providers may receive limited session data necessary to run the game. This data does not include your financial details.
All third-party providers with whom Spin Lucky shares personal data are required to maintain appropriate technical and organisational data security measures and are prohibited from using your data for their own marketing purposes or sharing it with further parties without authorisation.
7 KYC Verification and Identity Data
Spin Lucky is required under its gaming licence to verify the identity and age of all players before processing their first withdrawal. This process — Know Your Customer (KYC) — involves the collection and verification of identity documents.
KYC documents typically requested by Spin Lucky include:
- A clear copy of a valid Pakistani CNIC or passport.
- In some cases, a selfie or live photo holding the document for liveness verification.
- Proof of payment method — for example, a screenshot of your Easypaisa account showing your registered name and mobile number.
- Proof of address or source of funds for players who make large deposits or withdrawals, at Spin Lucky's discretion.
KYC documents are transmitted to Spin Lucky's servers using SSL encryption. They are stored securely and are only accessible to staff members who require access for verification and compliance purposes. KYC documents are not shared with any third party except the identity verification service used to validate their authenticity, and regulatory authorities where legally required.
Spin Lucky retains KYC documents for as long as required by applicable anti-money laundering regulations — typically a minimum of five years from the date of account closure. After this period, documents are securely deleted.
If your KYC documents are rejected during verification, you will receive a clear explanation of why and be given the opportunity to resubmit. Spin Lucky's support team is available to assist with the verification process at any time via live chat or email.
8 Cookies and Tracking Technologies
Spin Lucky uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device when you visit the platform. Cookies serve specific functional purposes and help Spin Lucky run the platform efficiently and securely. Here is a breakdown of the types of cookies Spin Lucky uses:
You can manage your cookie preferences through your browser settings. Note that disabling essential cookies will affect your ability to use the platform. Spin Lucky does not use third-party advertising cookies or cross-site tracking cookies.
9 Data Retention
Spin Lucky retains personal data for only as long as is necessary for the purposes for which it was collected, or as required by law. Here is a summary of the key retention periods that apply:
At the end of applicable retention periods, personal data is securely deleted or irreversibly anonymised. Spin Lucky does not retain data beyond regulatory or legitimate business requirements.
10 Data Security
Spin Lucky takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, and destruction. Specific security measures in place include:
- SSL/TLS encryption for all data in transit between your device and Spin Lucky's servers.
- Encryption at rest for sensitive data stored in Spin Lucky's databases, including identity documents and payment details.
- Two-factor authentication (2FA) requirements for account actions that involve financial transactions.
- Role-based access controls limiting staff access to personal data on a need-to-know basis — your KYC documents, for example, are only accessible to the compliance team.
- Regular security audits and penetration testing of the platform infrastructure.
- Secure deletion protocols for data that has reached the end of its retention period.
No digital platform can guarantee absolute security against all possible threats. If Spin Lucky becomes aware of a data breach that is likely to result in risk to players' rights and freedoms, we will notify affected players and relevant authorities within the timeframe required by applicable data protection law.
You also have a role in keeping your data secure. Use a strong, unique password for your Spin Lucky account. Do not share your login details with anyone. If you suspect unauthorised access to your account, contact Spin Lucky support immediately — we can freeze your account while the situation is investigated.
11 Your Data Rights
As a Spin Lucky player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at support@spinlucky-app.com with the subject line "Data Rights Request." We will acknowledge your request within five business days and provide a substantive response within 30 days.
12 Children and Minors
Spin Lucky is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and you believe that a minor has created a Spin Lucky account, please contact us immediately at support@spinlucky-app.com. Upon confirmation, we will close the account and delete all associated personal data promptly, subject only to data that must be retained under AML regulations.
Spin Lucky uses age verification as part of the KYC process to identify and remove under-age accounts. We take this obligation seriously and invest in age verification tools to ensure that the platform is not accessible to minors.
13 Marketing Communications
Spin Lucky will only send you marketing communications — including promotional emails, SMS bonus alerts, and push notifications — if you have expressly opted in to receive them. Opting in is voluntary and you can opt out at any time through the following methods:
- Through your account settings under "Notification Preferences."
- By clicking the unsubscribe link at the bottom of any marketing email from Spin Lucky.
- By replying STOP to any marketing SMS.
- By contacting support@spinlucky-app.com and requesting removal from all marketing communications.
Opting out of marketing communications does not affect transactional communications — Spin Lucky will still send you account security alerts, deposit/withdrawal confirmations, KYC status updates, and other messages that are necessary to operate your account.
Opt-out requests are processed within 5 business days. After opting out, you may receive one or two final communications while your preferences are updated across our systems — this is a technical delay, not a failure to honour your request.
14 Changes to This Privacy Policy
Spin Lucky reviews this Privacy Policy regularly and updates it when changes are made to how we collect or process personal data, when our services change in a way that affects data processing, or when required by changes in applicable law or regulation.
When this policy is updated, the "Last updated" date at the top of the page is revised. For significant changes — for example, changes to the categories of data we collect, the third parties we share data with, or your rights — Spin Lucky will notify registered players by email in advance of the changes taking effect.
Continued use of the Spin Lucky platform after an updated Privacy Policy is published constitutes acceptance of the revised policy. If you disagree with changes to the Privacy Policy, you may close your account by contacting our support team.
15 Contact Us and Data Complaints
For any question about this Privacy Policy, to exercise your data rights, or to raise a concern about how your personal data has been handled, contact Spin Lucky's data protection team:
- Email: support@spinlucky-app.com — use the subject line "Privacy / Data Rights Request" for fastest routing.
- Live Chat: Available 24/7 through your logged-in Spin Lucky account for general privacy queries.
Spin Lucky aims to resolve all privacy-related queries and requests within 30 days. For complex requests involving large amounts of data or detailed regulatory questions, we may extend this period to 60 days — if so, we will notify you of the extension and the reason within the initial 30-day period.
If you are not satisfied with how Spin Lucky has responded to a privacy complaint after our internal process is complete, you have the right to escalate your complaint to the relevant data protection authority or to the dispute resolution mechanism specified in our Terms and Conditions. Contact us first — in our experience, most privacy concerns can be resolved directly and quickly without the need for escalation.
Spin Lucky's support team handles privacy queries with the same priority as account and payment issues. You will not be passed around or made to wait unreasonably when raising a legitimate data concern. We take privacy seriously and we back that up with responsive, substantive replies.