Privacy Policy
Who is responsible
LuckyWins is operated by Novatrix SRL, a company incorporated in Costa Rica under registration number 3-102-893958. Novatrix SRL is the Data Controller for your personal data and has appointed a Data Protection Officer who answers questions about how your data is handled. Our services are meant only for adults aged 18 or over, and we do not knowingly collect data from younger people.
Data we collect
We work with several groups of data. Identity data covers your name and username, your gender, nationality and date of birth, and the numbers of your ID or passport. Contact details include your home address and proof of address, email and phone number. Financial data covers bank and card details and documents on the source of your funds or wealth. We also keep transaction data on deposits and withdrawals, gaming data such as the games you play, log-in times, bets, bonuses and responsible gaming measures, technical data such as IP address, browser, time zone and operating system, and your marketing preferences.
Why we use it
We process data to run your account, handle payments, confirm your identity, answer your questions and give you access to promotions, which is needed to perform our contract with you. Anti-money laundering checks, identity checks, responsible gaming measures and regulatory reports are legal obligations. Fraud and bonus-abuse prevention, analytics, security monitoring and AI-assisted support tools rest on our legitimate interest. Marketing is based on your consent or our legitimate interest.
Where data comes from
Most data comes from you when you register, play or contact us. We also receive data from verification services, banks and payment providers, anti-money laundering and politically exposed person databases, regulators and responsible gaming registers, and from affiliate, advertising and analytics partners that may share pseudonymous data.
Who receives it
Depending on the purpose, data may go to companies of our group, game studios, payment providers, marketing partners if you agreed to marketing, email and live chat software providers, identity and fraud check tools, our lawyers and consultants, and to authorities when the law requires it. OpenAI, Google Gemini and Anthropic act as data processors with restricted access to support messages. Third parties may use your data only for the purpose we set, never for their own.
Transfers and retention
When data leaves the European Economic Area, we use safeguards such as the Standard Contractual Clauses of the European Commission. We keep data only as long as its purpose requires. Anti-money laundering rules oblige us to keep it for at least five years after your account is closed, so an erasure request cannot be completed before then.
Your rights
Under the GDPR and PIPEDA you may withdraw consent, access and correct your data, ask for deletion, restrict or object to processing, request portability, opt out of marketing and complain to a data protection authority. We do not normally make fully automated decisions about you, and if we ever do, we will tell you separately where the law requires it.
Keeping your account safe
Your player account opens only with your own ID and password, and you can switch on two-factor authentication for extra protection. Keep your log-in details to yourself. Questions about this policy can go to our Data Protection Officer or to our support team by email or live chat.