Your privacy is a foundational commitment at 99luck. This policy explains exactly what data we collect, why we collect it, and how we keep it safe.
Last Updated: January 2026Your Privacy Matters: This Privacy Policy ("Policy") describes how 99luck ("the Company", "we", "us", "our") collects, uses, stores, discloses, and protects personal information provided by users ("Player", "you", "your") of the 99luck Platform located at https://99luck.cam. By registering an Account or using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.
99luck is committed to protecting the privacy and personal data of all individuals who interact with our Platform. We recognize that trust is the foundation of a lasting relationship with our Players, and we take our data protection responsibilities seriously. This Policy sets out our practices in plain, accessible language while adhering to internationally recognized data protection principles, including purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
This Policy applies to all personal data processed in connection with the 99luck Platform, including data collected through our website, customer support channels, payment processing infrastructure, and any other touchpoints through which you interact with us. It applies equally to all registered Players, whether accessing the Platform from Jakarta, Surabaya, Bali, Bandung, Medan, Yogyakarta, or any other location in Indonesia.
We do not sell, rent, or trade your personal information to unaffiliated third parties for their independent commercial use. Where data is shared with third parties, it is strictly limited to service providers acting on our behalf and regulatory authorities as required by applicable law.
For the purposes of this Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including name, identification number, location data, IP address, or one or more factors specific to that person's identity. |
| "Processing" | Any operation performed on Personal Data, whether automated or manual — including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion. |
| "Data Controller" | 99luck, which determines the purposes and means by which Personal Data is processed. |
| "Data Processor" | Any third-party service provider that processes Personal Data on behalf of 99luck under a written data processing agreement. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their Personal Data for a stated purpose. |
| "KYC Data" | Identity verification documents and information collected during the Know Your Customer process, including government-issued IDs, selfie photographs, and proof-of-payment-method materials. |
| "Sensitive Data" | A subset of Personal Data warranting heightened protection, including financial account details, government identification numbers, and biometric data. |
The categories of Personal Data we collect from and about our Players include the following:
3.1 Identity & Registration Data
3.2 Financial & Transaction Data
3.3 Technical & Usage Data
3.4 Communications Data
99luck collects Personal Data through the following channels and mechanisms:
We process your Personal Data only for specific, legitimate purposes. The table below sets out each primary purpose and the corresponding data categories involved:
| Purpose | Data Categories Used |
|---|---|
| Account creation & management | Identity data, contact data, login credentials |
| Identity verification (KYC) | KYC data, identity documents, selfie photographs |
| Processing deposits & withdrawals | Financial data, transaction history, payment method identifiers |
| Fraud prevention & AML compliance | Identity data, financial data, technical data, communications data |
| Customer support delivery | Identity data, account data, communications data |
| Responsible gaming monitoring | Usage data, transaction history, self-exclusion records |
| Marketing communications (opt-in only) | Contact data, marketing preferences, usage data |
| Platform improvement & analytics | Technical data, usage data, aggregated behavioral data |
| Legal & regulatory compliance | All categories, as required by applicable law or regulatory directive |
We will not use your Personal Data for any purpose that is incompatible with those listed above without providing advance notice and, where required, obtaining your explicit consent.
99luck processes your Personal Data on one or more of the following legal grounds, depending on the specific processing activity:
99luck does not sell, rent, or otherwise transfer your Personal Data to third parties for their independent commercial use. We may share your data only in the following limited and controlled circumstances:
All third-party Data Processors engaged by 99luck are required to execute binding data processing agreements that obligate them to process your data only on our documented instructions, to maintain appropriate technical and organizational security measures, and to delete or return data upon termination of the service relationship.
We retain your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, including the satisfaction of any legal, regulatory, accounting, or reporting obligations. The following retention periods apply as a general guide:
| Data Category | Retention Period |
|---|---|
| Account & identity data | Duration of account relationship plus 5 years after closure |
| KYC documents | Duration of account relationship plus 5 years after closure |
| Financial transaction records | 7 years from the date of each transaction (AML compliance) |
| Customer support communications | 3 years from the date of the last interaction |
| Marketing preference records | Until consent is withdrawn, plus 1 year thereafter |
| Technical & usage logs | 13 months on a rolling basis |
| Self-exclusion records | Minimum 5 years from the date of self-exclusion request |
At the expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that renders re-identification impossible. Where data is anonymized rather than deleted, the resulting aggregated data may be retained indefinitely for statistical and analytical purposes without restriction.
99luck implements a comprehensive suite of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes the following controls:
Your Role in Security: While we invest heavily in platform-side security, the safety of your Account also depends on the measures you take. Use a strong, unique password for your 99luck Account, never share your login credentials with anyone, and contact our support team immediately at [email protected] if you suspect unauthorized access to your Account.
The 99luck Platform uses cookies and similar tracking technologies to deliver a functional, personalized, and secure user experience. A cookie is a small text file placed on your device by a website you visit. Cookies do not contain executable code and cannot access other data on your device.
We use the following categories of cookies:
You can manage your cookie preferences through your browser settings at any time. Disabling non-essential cookies will not prevent you from using the Platform, though certain personalization features may be affected. Please note that clearing cookies will log you out of your active session.
Subject to applicable law and certain conditions, you have the following rights in respect of your Personal Data held by 99luck:
To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". We will respond to all verified requests within thirty (30) calendar days. In complex cases requiring additional review, we may extend this period by a further thirty (30) days, with written notification of the extension provided to you within the initial period.
We may need to verify your identity before processing a rights request to ensure that personal data is not disclosed to unauthorized parties. You will not be charged for making a rights request unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply.
The 99luck Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect, use, or store Personal Data belonging to any person under the age of 21. Age verification is a mandatory step in our registration and KYC process, and we deploy automated and manual controls to detect and prevent underage access.
If we become aware that Personal Data has been collected from a person under 21 years of age, we will immediately suspend the associated Account, delete the data in question, reverse any transactions where technically feasible, and take appropriate follow-up action. If you are a parent or guardian and believe that a minor has registered an Account on our Platform, please contact us immediately at [email protected] so that we can take prompt remedial action.
As an internationally operated Platform, some of your Personal Data may be transferred to, stored in, or processed by systems located in countries outside Indonesia. This may occur when we engage Data Processors such as cloud hosting providers, KYC vendors, or game content studios based in other jurisdictions.
Wherever Personal Data is transferred internationally, 99luck ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia. These safeguards may include:
By using the 99luck Platform and providing your Personal Data, you acknowledge and consent to such international transfers where they are necessary to deliver the services you have requested.
99luck reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or service offerings. When material changes are made to this Policy, we will notify registered Players by sending an email to the address on file and by displaying a prominent notice on the Platform for a period of no less than fourteen (14) days prior to the revised Policy taking effect.
The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. Your continued use of the Platform after the stated effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with a revised Policy, you should cease using the Platform and request account closure before the effective date.
We encourage you to review this Policy periodically, even in the absence of a formal notification, to stay informed about how we protect your Personal Data.
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 99luck processes your Personal Data, please contact our Privacy team using the details below. All privacy-related communications should be submitted in English or Indonesian and should clearly state the nature of your inquiry or request.
If you believe that 99luck has not adequately addressed your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction or to seek resolution through the dispute process described in our Terms & Conditions. We are committed to working constructively with you and with any regulatory authority to resolve privacy complaints fairly and efficiently.
Responsible Gaming & Privacy: Information you provide in connection with responsible gaming tools — including self-exclusion requests, deposit limits, and session reminders — is treated with the highest level of confidentiality and is used solely to deliver the protections you have requested. For more information, visit our Responsible Gaming page.
Six core pillars underpin the way 99luck handles your personal data — from collection through to secure deletion.
All data transmitted to and from the 99luck Platform is protected by TLS 1.2+ encryption. Stored personal and financial records are encrypted at rest using AES-256, ensuring your information is unreadable to unauthorized parties at every stage.
We collect only the Personal Data that is genuinely necessary to deliver our services, comply with legal obligations, and keep the Platform secure. We do not gather data speculatively or hold it longer than required by our documented retention schedule.
Your personal information is never sold, rented, or traded to unaffiliated third parties for their independent commercial purposes. Data sharing is limited strictly to service providers bound by processing agreements, and to regulatory authorities where legally required.
You have clear, exercisable rights to access, correct, delete, restrict, or port your Personal Data at any time. Submit a request to our Privacy team and we will respond within 30 days — no fees, no barriers, and no bureaucratic runaround.
Our Platform infrastructure undergoes independent penetration testing and security assessments on a scheduled basis. Any identified vulnerabilities are remediated promptly, and our security posture is reviewed continuously against evolving threat landscapes.
In the unlikely event of a data breach posing a high risk to your rights, 99luck will notify affected Players without undue delay. We maintain a documented incident response procedure to ensure swift, transparent, and effective handling of any security incidents.
Our support team is available around the clock to address any data protection concerns. You can also review our related policies for a complete picture of how 99luck operates.