Privacy Policy mrluck – Our Commitment to Protecting Your Personal Data

1. Introduction & Scope of This Privacy Policy

This Privacy Policy explains how mrluck ("we", "Platform") collects, uses, stores, and protects your personal information ("you", "member") when you use the mrluck.win website and the mrluck mobile app.

We are committed to complying with Malaysia's Personal Data Protection Act 2010 (PDPA) and the highest international data protection standards. Every action we take regarding your personal data is grounded in the principles of transparency, necessity, and robust protection.

This Policy applies to all mrluck platform users — including website visitors, registered members, and former members whose accounts are still within the defined data retention period. By using our platform, you agree to the terms of this Privacy Policy.

2. Types of Personal Data We Collect

Mrluck only collects data that is strictly necessary to provide a safe and effective service. Below are the categories of data we collect and the purpose of each:

We do not collect sensitive data such as medical information, religious beliefs, or political views except in very limited situations and with your explicit consent. Biometric data such as fingerprints or facial recognition is not collected by the mrluck platform.

3. How We Use Your Personal Data

Every piece of information we collect has a clear and legitimate purpose. mrluck uses your personal data for the following:

• Account management: Create, verify, and manage your member account, including the KYC process and required identity verification.
• Transaction processing: Process deposits, withdrawals, and all other financial transactions accurately and securely using your chosen local payment methods.
• Customer support: Respond to enquiries, resolve complaints, and provide technical support when needed.
• Platform security: Detect and prevent fraud, money laundering, bonus abuse, and any activity that violates our terms of service.
• Personalised experience: Recommend games, promotions, and relevant content based on your usage habits on the platform.
• Legal compliance: Fulfil applicable legal and regulatory obligations, including reporting requirements to relevant authorities where required by law.
• Platform improvement: Analyse aggregated, anonymised usage data to improve the performance, design, and functionality of the mrluck platform.
• Marketing communications: Send information about the latest promotions and offers — only if you have opted in to receive such communications.

4. Information Sharing & Disclosure

Mrluck does not sell, rent, or transfer your personal data to third parties for their own marketing purposes. However, there are certain situations where we may need to share your information with others:

• Service providers: Third-party companies that assist us in operating the platform, such as payment service providers (FPX, DuitNow, TNG), licensed game providers, and customer support platforms. All such providers are bound by strict confidentiality agreements.
• Legal requirements: When we are required by law, court order, or direction from a competent authority to disclose certain information.
• Fraud prevention: Sharing necessary information with fraud prevention agencies or regulatory bodies to protect the platform and all members from illegal activity.
• Business transfer: Should mrluck be involved in a merger, acquisition, or asset sale, member data may be transferred as part of that transaction with appropriate prior notice given to members.

In all data sharing instances, we ensure recipients adhere to data protection standards equivalent to or higher than our own. We do not permit service providers to use your data for any purpose beyond what has been specified in their agreement with us.

5. Data Security Measures

Protecting your personal data is mrluck's top priority. We implement multiple layers of technical and organizational security to keep your information safe at all times:

• SSL/TLS 256-bit encryption: All data transmitted between your device and mrluck servers is encrypted using the latest industry-standard security protocols. This means no third party can intercept or read your data in transit.
• Stored data encryption: Sensitive data such as financial information and KYC documents are encrypted at rest in our database, not only during transmission.
• Strict access control: Only staff who genuinely need access to specific data are permitted to do so. Every access is logged and continuously monitored.
• Regular security testing: Our systems undergo regular penetration testing and security audits by independent experts to identify and address any vulnerabilities.
• Two-factor authentication (2FA): Members are encouraged to enable 2FA for an extra layer of account protection. Internal staff who access our systems are required to use 2FA.
• Incident response plan: mrluck has a clear incident response procedure in place. In the event of a data breach, we will notify affected members within 72 hours of the incident being identified.

6. Cookies, Pixels & Tracking Technologies

Mrluck uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

• Essential cookies (required): Required for core platform functions such as login sessions, account security, and language preferences. These cookies cannot be disabled as the platform cannot function properly without them.
• Performance cookies: Collect information about how you use the platform — such as most frequently visited pages and response times — to help us improve the user experience. This data is collected anonymously.
• Functional cookies: Remember your preferences such as display settings, preferred language, and login details (if you choose to be remembered).
• Analytics cookies: Helps us understand overall platform usage patterns through aggregated data. This information is used solely for internal improvement purposes.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect platform functionality. To disable non-essential cookies, go to your browser settings and follow the relevant instructions for your browser.

7. Your Rights Regarding Personal Data

Under Malaysia's PDPA and mrluck's policy, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of each of these rights:

To exercise any of the above rights, contact our privacy team by email at [email protected] or via Live Chat within the platform. We will verify your identity before processing any personal data request to keep your account secure.

8. Data Retention Period

Mrluck does not retain your personal data longer than necessary. Retention periods depend on the type of data and applicable legal requirements:

• Active account data: Retained for the duration that your account remains active and in use on our platform.
• Data after account closure: Core records are retained for 7 years after account closure to comply with Malaysia's financial and tax legal requirements.
• Transaction records: Retained for a minimum of 7 years in accordance with anti-money laundering (AML) compliance requirements.
• Support communication logs: Retained for 3 years after your last interaction for reference and dispute resolution purposes.
• Technical data and logs: Server logs and technical data are retained for 12 months for security and troubleshooting purposes.
• Marketing data: Deleted within 30 days after you withdraw your marketing consent.

Once the retention period ends, data is securely deleted using methods that ensure it cannot be recovered. For data in physical format, secure destruction is carried out in accordance with our records management procedures.

9. Third-Party Links & Services

The mrluck platform features games and content supplied by licensed third-party providers. When you use these third-party games or services, the respective provider's privacy policy may also apply in addition to ours.

Mrluck is not responsible for the privacy practices or content of third-party websites or applications. We recommend reading the privacy policy of each third-party service you use. However, all third-party providers working with mrluck are required to comply with our data protection standards as a condition of our partnership agreement.

10. Changes to This Privacy Policy

Mrluck reserves the right to modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. We are committed to notifying you of any significant changes.

• Notification of significant changes: You will receive notice via your registered email or an in-platform notification at least 14 days before any significant changes take effect.
• Minor changes: Spelling corrections, language clarifications, or contact information updates may be made without prior notice.
• Last updated: The latest update date is always displayed at the top of this page. Check that date to ensure you are always reading the most current version.
• Implied consent: Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.

11. Contact Our Privacy Team

If you have any questions, concerns, or wish to exercise your rights regarding your personal data, you may reach us through the following channels:

• Privacy email: [email protected] (subject: "Privacy Enquiry")
• Live Chat: Available 24/7 via the chat icon within the mrluck platform
• Response time: We aim to respond to all privacy-related enquiries within 3 business days

For requests involving data access, correction, or deletion, please include the following in your request: your full name, mrluck account number (if applicable), and a brief description of your request. We will verify your identity before processing any changes to protect the security of your data.