2xlucky Privacy Policy

2xlucky collects personal data that is necessary, adequate, and not excessive relative to the purposes for which it is collected, in accordance with the principles of the Philippine Data Privacy Act of 2012. The categories of personal data we collect are described below.

Registration Data:

• Full legal name as it appears on a government-issued ID.
• Date of birth (used to verify the 21+ age requirement for real-money gambling in the Philippines).
• Email address and mobile phone number.
• Residential address (province, city/municipality, barangay, postal code).
• Username and hashed account password.

Identity Verification (KYC) Data:

• Scanned or photographed copies of government-issued photo IDs — such as SSS ID, UMID, PhilHealth card, Philippine Driver's License, or valid Philippine Passport.
• Selfie or liveness verification image used to confirm identity document ownership.
• Proof of address documents (e.g., utility bill, bank statement, barangay certificate) where required.
• Source of funds declarations for large transactions, as required under AMLC regulations.

Financial & Transaction Data:

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references (e.g., GCash mobile number, BPI account reference).
• Bonus and promotion redemption history.
• Account balance snapshots at the time of any transaction dispute.

Technical & Usage Data:

• IP address and approximate geolocation at login.
• Device type, operating system, browser version, and screen resolution.
• Session duration, pages visited, and features used within the 2xlucky platform.
• Game activity logs including bets placed, game rounds, results, and timestamps.

Communications Data:

• Live chat transcripts and support ticket histories.
• Email correspondence relating to your account or any formal complaint.
• Feedback, survey responses, and promotional opt-in/opt-out preferences.

2xlucky processes your personal data only for specific, legitimate purposes that are disclosed to you at the time of collection or outlined in this Privacy Policy. We do not use your data in ways that are incompatible with these stated purposes.

• Account creation and management: To register your 2xlucky account, verify your identity, maintain your account profile, and provide you with platform access.
• Transaction processing: To process deposits and withdrawals via GCash, Maya, BPI, BDO, and other supported Philippine payment channels, and to maintain accurate financial records.
• Legal and regulatory compliance: To fulfill obligations under Philippine AML laws, PAGCOR licensing conditions, and NPC data privacy regulations — including mandatory record-keeping, suspicious transaction reporting, and identity verification requirements.
• Fraud prevention and platform security: To detect, investigate, and prevent unauthorized account access, bonus abuse, multi-accounting, money laundering, and other prohibited activities as defined in our Terms & Conditions.
• Customer support: To respond to your queries via live chat or email, process complaints, and improve our support response quality through transcript analysis.
• Platform improvement: To analyze aggregated, anonymized usage patterns and technical performance data to optimize game loading times, UI/UX design, and feature availability for Filipino players.
• Responsible gaming: To monitor gameplay patterns that may indicate problem gambling behavior, to apply self-exclusion restrictions when requested, and to communicate responsible gaming resources where appropriate.
• Marketing communications (opt-in only): To send you promotional offers, bonus notifications, and platform updates via email or SMS — only if you have explicitly opted in. You may withdraw this consent at any time.

2xlucky does not sell your personal data. We do not share your information with third-party advertisers, data brokers, or unrelated commercial entities. Personal data is shared only in the following limited and controlled circumstances:

• Payment processors: Your payment reference data is shared with licensed payment service providers (including GCash/GXI, Maya/Voyager Innovations, and accredited bank partners) solely to process your transactions. These processors operate under their own privacy policies and are bound by Philippine financial data protection regulations.
• Identity verification providers: KYC document data may be processed by accredited third-party identity verification platforms operating under data processing agreements that comply with RA 10173.
• Regulatory and law enforcement authorities: 2xlucky is legally obligated to disclose information to the Anti-Money Laundering Council (AMLC), PAGCOR, the National Privacy Commission, or law enforcement agencies when required by applicable Philippine law, court order, or regulatory directive — without prior notice to the account holder in certain circumstances.
• Technology and infrastructure providers: Cloud hosting, cybersecurity, and analytics service providers may process technical data on our behalf under strict contractual data processing agreements that prohibit secondary use of your data.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of 2xlucky's assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer in advance where practicable.

Any third party that receives your personal data from 2xlucky is contractually required to process it only for the specific purpose for which it was shared, to maintain appropriate security measures, and to comply with applicable Philippine data protection law.

2xlucky uses cookies and similar tracking technologies to operate the platform, remember your preferences, and understand how players engage with our site. Below is a plain-English breakdown of the cookie types we use.

You can manage or delete cookies through your browser settings at any time. Note that disabling essential or security cookies will prevent you from logging into your 2xlucky account. For instructions on managing cookies in Chrome, Firefox, or Safari, refer to your browser's help documentation.

2xlucky does not use third-party advertising cookies or allow ad networks to place tracking cookies on our platform.

2xlucky implements technical and organizational security measures appropriate to the sensitivity of the personal data we process. Our security framework includes, but is not limited to, the following:

• Encryption in transit: All data exchanged between your browser or app and 2xlucky servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive personal data — including identity documents, KYC records, and financial information — is encrypted in storage using AES-256 or equivalent standards.
• Access controls: Access to personal data is limited to authorized 2xlucky employees and contractors who require it to perform their job functions. Role-based access controls and audit logging are in place.
• Password security: Account passwords are stored as salted hashes — we never store plaintext passwords. Our systems enforce strong password requirements and support two-factor authentication (2FA).
• Penetration testing: 2xlucky conducts periodic security assessments and vulnerability testing to identify and remediate potential weaknesses before they can be exploited.
• Incident response: We maintain a documented data breach response plan. In the event of a data breach that is likely to affect your rights, 2xlucky will notify you and the National Privacy Commission within 72 hours of confirming the breach, as required by NPC Circular 16-03.

2xlucky retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

When personal data is no longer required and no legal retention obligation applies, 2xlucky securely deletes or anonymizes it in accordance with our internal data destruction procedures. Anonymized, aggregated data that cannot be traced back to any individual may be retained indefinitely for statistical and platform improvement purposes.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by 2xlucky. These rights may be exercised by contacting our Data Protection Officer (DPO) as described in Section 11.

• Right to be informed: You have the right to know what personal data 2xlucky collects about you, the purposes of processing, and how long it is retained — all of which are disclosed in this Privacy Policy.
• Right to access: You may request a copy of the personal data 2xlucky holds about you at any time. We will respond to verified access requests within 15 business days.
• Right to correction: If any of your personal data held by 2xlucky is inaccurate or incomplete, you may request that it be corrected. Account profile information can often be updated directly through your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected and where no legal retention obligation requires us to keep it.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on our legitimate interests, subject to applicable overriding grounds.
• Right to data portability: You may request that your personal data be provided to you in a commonly used, machine-readable format where technically feasible.
• Right to lodge a complaint: If you believe 2xlucky has processed your personal data in a manner that violates your rights under RA 10173, you may file a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Privacy Request." Please include your registered email address and a description of the right you wish to exercise. We may request identity verification before processing your request to protect against unauthorized access.

2xlucky is a real-money gambling platform strictly intended for individuals who are 21 years of age or older, in compliance with Philippine law governing participation in casino-style gambling activities. We do not knowingly collect personal data from any person under the age of 21.

Age verification is a mandatory step in the 2xlucky registration process. By creating an account, you represent and warrant that you are at least 21 years old. If 2xlucky discovers that an account has been created by a person under 21 years of age, the following actions will be taken immediately:

• The account will be permanently suspended and deactivated.
• Any deposits made will be refunded to the original payment method where identifiable and legally permissible.
• All personal data associated with the underage account will be securely deleted from our systems within 30 days, subject to any legal reporting obligations.
• The incident will be reported to relevant authorities if required by applicable Philippine child protection regulations.

The 2xlucky platform integrates with third-party services necessary for its operation, including payment gateways, identity verification providers, and cloud infrastructure partners. While we select these partners carefully and require them to meet our data protection standards through contractual agreements, 2xlucky is not responsible for the independent privacy practices of these third parties.

When you use GCash, Maya, or any other payment method to fund your 2xlucky account, you are also subject to the privacy policy of that payment provider. We encourage you to review the privacy policies of any third-party services you interact with in connection with your 2xlucky account.

2xlucky's platform does not contain links to unaffiliated third-party websites for advertising or commercial purposes. Any links present on the platform are limited to internal pages and regulated service providers directly integrated into the platform's operation.

2xlucky may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or NPC regulatory guidance. When material changes are made, we will notify registered players via email and/or a prominent notice on the 2xlucky platform at least seven (7) days before the updated Policy takes effect.

The effective date at the top of this document will be updated whenever changes are made. Your continued use of the 2xlucky platform after an updated Privacy Policy takes effect constitutes your acknowledgment of the revised terms. If you do not agree with any material change, you may close your account as described in our Terms & Conditions.

The most current version of this Privacy Policy is always available at https://2xlucky.app/privacy-policy. We recommend reviewing this page periodically to stay informed about how 2xlucky protects your personal information.

If you have questions about this Privacy Policy, wish to exercise your data privacy rights, or need to report a potential data privacy concern, please contact the 2xlucky Data Protection Officer (DPO) using the details below. All privacy-related requests are handled with strict confidentiality.