1. Introduction
This Privacy Policy applies to luke 91 — the online sports betting and casino platform available at luke91.bet — and to all associated services, products, and communications provided under the luke 91 brand. It describes how luke 91 ("we", "us", "our") collects, processes, stores, and protects the personal data of registered players and visitors ("you", "your") in connection with your use of our platform.
We take data privacy seriously at luke 91. Our approach is built on a straightforward principle: we collect only the data we genuinely need to run the platform, comply with our legal obligations, and improve your experience. We do not sell your personal information. We do not share it with advertisers. And we do not use it in ways that go beyond what is described in this policy.
By registering an account at luke 91, using any part of our platform, or making a deposit, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This policy should be read alongside our Terms and Conditions and Responsible Gaming policy.
Plain language version: We collect your name, contact details, payment information, and gaming activity so we can run your account, verify your identity, process payments, and keep the platform safe. We protect that data, keep it only as long as we need to, and give you clear rights over it.
2. Data We Collect
luke 91 collects personal data in three main ways: information you provide to us directly, information generated automatically when you use the platform, and information we receive from third-party payment and verification providers.
| Category | Examples | Source |
|---|---|---|
| Identity Data | Full legal name, date of birth, CNIC or passport number, selfie photograph for verification | You, at registration or KYC verification |
| Contact Data | Email address, mobile number, residential city and province | You, at registration |
| Financial Data | Easypaisa/JazzCash/NayaPay/SadaPay wallet IDs, bank account details for IBFT, Visa/Mastercard card details (last 4 digits only stored), transaction history in PKR | You, via payment actions; payment processors |
| Gaming Activity | Bets placed, games played, stakes in PKR, winnings, session durations, game preferences, VIP Club tier and points balance | Automatically generated by platform use |
| Technical Data | IP address, device type, operating system, browser type and version, screen resolution, connection type (3G/4G/WiFi), time zone | Automatically generated, cookies and tracking |
| Communication Data | Live chat transcripts, email correspondence, support ticket content, feedback submitted through forms | You, via support interactions |
| Marketing Preferences | Email and SMS opt-in status, preferred communication channel, promotional response history | You, via account settings and marketing interactions |
2.1 Data You Choose Not to Provide
Some data at luke 91 is mandatory — without it, we cannot provide the service. Identity data and contact data are required to register. Financial data is required to process deposits and withdrawals. Where data is optional, we will make that clear at the point of collection. Choosing not to provide optional data will not affect your ability to use the core luke 91 platform.
3. How We Use Your Data
luke 91 uses your personal data for the following specific purposes. We do not use your data for any purpose not listed here without first seeking your explicit consent.
- Account creation and management: Creating your account, verifying your identity, maintaining your profile, and enabling you to log in securely from your device
- Processing deposits and withdrawals: Executing PKR transactions through Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, and Visa/Mastercard; reconciling your balance; issuing withdrawal payments to your verified account
- Providing gaming services: Delivering the betting markets, live casino, card games, Aviator, fishing games, and live cricket score features you access through your luke 91 account
- Identity verification and fraud prevention: Verifying that you are who you say you are, detecting suspicious account activity, preventing money laundering and financial crime, ensuring one account per person
- Customer support: Responding to your queries, resolving disputes, processing complaints, and maintaining records of our interactions for quality assurance and regulatory compliance
- Responsible gaming: Monitoring gaming patterns for indicators of problem gambling, enforcing deposit and session limits you have set, administering self-exclusion requests, and proactively reaching out where welfare concerns are identified
- Platform improvement: Analysing aggregate usage patterns to identify and fix technical issues, optimise game performance for Pakistani mobile devices, and develop new features that Pakistani players genuinely want
- Legal and regulatory compliance: Maintaining records as required by our gaming licence, responding to lawful requests from regulatory authorities, and fulfilling anti-money-laundering obligations
- Marketing communications: Sending promotional offers, bonus notifications, and game updates to players who have opted in — you can unsubscribe from these at any time through your account settings
4. Legal Basis for Processing
luke 91 processes your personal data on one of four legal bases depending on the purpose:
- Contract performance: Processing necessary to fulfil our obligations to you under the Terms and Conditions — account management, payment processing, game delivery, and customer support all fall under this basis
- Legal obligation: Processing required to comply with our gaming licence conditions, anti-money-laundering regulations, age verification requirements, and responses to lawful regulatory or law enforcement requests
- Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics — where those interests are not overridden by your right to privacy
- Consent: Marketing communications, optional personalisation features, and any non-essential cookies — you can withdraw consent for these at any time without affecting your access to the core platform
Your right to object: Where we process your data based on legitimate interests, you have the right to object at any time. Contact support@luke91.bet and we will review your request. Processing based on contract performance or legal obligation cannot be objected to without closing your account or terminating our legal relationship.
How luke 91 Keeps Your Data Safe
End-to-End SSL
All data transmitted between your phone or browser and luke 91 servers is encrypted using SSL/TLS. Your payment details and personal information are never transmitted in plain text.
Encrypted Storage
Sensitive data — including CNIC numbers, bank details, and verification documents — is stored in encrypted form. Even internal systems access this data through strict access control protocols.
Access Controls
Access to player personal data at luke 91 is restricted on a strict need-to-know basis. Support agents, finance staff, and developers each have access only to the data required for their specific role.
5. Data Sharing
luke 91 does not sell your personal data to any third party. We do not share it with advertising networks. We do not provide it to data brokers. Your information is shared only in the following specific, controlled circumstances:
5.1 Payment Processors
To execute your PKR deposits and withdrawals, luke 91 shares the minimum necessary transaction data with your chosen payment provider — Easypaisa, JazzCash, NayaPay, SadaPay, your bank for IBFT, or the relevant card network for Visa/Mastercard. These providers are bound by their own privacy policies and financial regulation. luke 91 does not share your full payment credentials with any party — we process these only within certified secure payment environments.
5.2 Identity Verification Partners
To complete KYC (Know Your Customer) verification, luke 91 may share identity documents with licensed third-party verification providers. These providers are contracted to use your data only for the verification process, to store it securely, and to delete it after verification is complete or the legal retention period expires.
5.3 Regulatory and Law Enforcement Authorities
luke 91 will disclose personal data to competent regulatory bodies, gaming authorities, financial intelligence units, or law enforcement agencies when required to do so by valid legal obligation or court order. We will notify affected players of such disclosure where legally permitted to do so.
5.4 Group Companies and Service Providers
Certain technical and operational functions at luke 91 are provided by contracted service providers — including hosting infrastructure, customer support platforms, and analytics tools. These providers operate under strict data processing agreements and are not permitted to use your data for any purpose other than providing the contracted service to luke 91.
Bottom line on sharing: We only share your data with the parties we need to in order to run your account, verify your identity, and process your money. None of those parties are permitted to use your data for their own marketing or commercial purposes.
6. Payments & KYC Verification
Because luke 91 operates as a real-money gaming platform processing PKR transactions, we are required under our gaming licence to conduct Know Your Customer (KYC) verification before processing withdrawals above certain thresholds, and in certain other circumstances including suspected fraud or unusual account activity.
6.1 What KYC Involves
KYC verification at luke 91 typically involves submitting a copy of a government-issued identity document — most commonly a Pakistani CNIC — and in some cases a selfie photograph for face-match verification. We may also request proof of address or proof of payment method ownership. These documents are reviewed by our verification team and, where necessary, by our contracted third-party verification provider.
6.2 Why We Need It
KYC exists to protect everyone on the platform. It prevents fraud, stops money laundering, ensures that minors cannot access gambling services, and verifies that withdrawals go only to the person who owns the account. Without KYC, the platform cannot safely process real PKR withdrawals — this is not a choice luke 91 has made; it is a legal obligation that every licensed gaming operator must comply with.
6.3 How Your Documents Are Handled
Identity documents submitted to luke 91 are stored in encrypted form in a system with restricted access. They are used only for verification purposes and are not shared with any party other than our contracted verification provider. Documents are retained for the minimum period required by our regulatory obligations and then securely deleted. Full card numbers are never stored at luke 91 — only the last four digits are retained for reference purposes, and all card payment processing takes place within PCI-DSS certified environments.
7. Cookies & Tracking Technologies
luke 91 uses cookies and similar technologies on our platform. A cookie is a small text file placed on your device when you visit a website. Cookies help us keep you logged in, remember your preferences, understand how you navigate the platform, and identify technical issues. We use the following categories of cookies:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Session management, login persistence, security tokens, fraud detection flags. These cookies are required for the platform to function. Without them, you cannot log in or place a bet. | No — essential to the service | |
| Remembering your language preference, last-used payment method, preferred game lobby tab, and other personalisation settings. | Yes, via account settings | |
| Aggregate data on page visits, navigation paths, load times, and feature usage — used to identify technical issues and improve the platform. No personally identifiable information is included in analytics data. | Yes, via cookie settings |
luke 91 does not use advertising or third-party marketing cookies. Your browsing on our platform is not tracked for retargeting purposes on other websites. You can manage your cookie preferences at any time through the Cookie Settings option in your account, or by adjusting your browser settings.
8. Data Retention
luke 91 retains your personal data only for as long as necessary for the purposes for which it was collected, or as required by our legal and regulatory obligations. The following retention periods apply:
- Account data and gaming history: Retained for the duration of your active account, plus a minimum of 5 years after account closure — required by our gaming licence and anti-money-laundering regulations
- Identity verification documents: Retained for 5 years after your account is closed or the verification is completed, whichever is later, in accordance with financial crime prevention requirements
- Transaction records: All PKR deposit and withdrawal records are retained for a minimum of 5 years after the transaction date
- Support communications: Live chat transcripts and email correspondence are retained for 3 years from the date of the interaction
- Marketing preferences: Retained until you withdraw consent or close your account, plus 1 year for audit purposes
- Technical logs: IP access logs and security logs are retained for 90 days unless an investigation is ongoing, in which case they are retained until the investigation concludes
When data is no longer required, it is securely deleted or anonymised so that it cannot be linked back to you. Anonymised aggregate data — such as total gaming session statistics with no individual identifiers — may be retained indefinitely for internal reporting purposes.
9. Data Security
luke 91 implements a layered security architecture to protect your personal data. We take our security obligations seriously — a data breach at a betting platform is not merely an inconvenience, it can expose financial and identity information that Pakistani players rely on us to protect.
Our security measures include: SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data at rest; role-based access control ensuring staff can only access data relevant to their specific function; multi-factor authentication required for all internal systems containing player data; regular third-party penetration testing of our platform infrastructure; and a dedicated security team monitoring for suspicious access patterns around the clock.
In the event of a data breach that is likely to result in risk to player rights and freedoms, luke 91 will notify affected players by email within 72 hours of becoming aware of the breach, where notification is technically possible. The notification will describe the nature of the breach, what data was affected, what steps we have taken in response, and what you should do to protect yourself.
Your role in security: The strongest security measures at luke 91 can be undermined by a weak or reused password on your end. Use a strong, unique password for your luke 91 account. Enable two-factor authentication. Never share your login details with anyone. If you receive a suspicious message claiming to be from luke 91 and asking for your password or payment details, report it to support@luke91.bet immediately.
10. Your Rights Over Your Data
As a player at luke 91, you have a number of rights over your personal data. These rights are real and we take them seriously — not as legal boilerplate but as genuine obligations we have toward you.
Right to Access
Request a copy of all personal data luke 91 holds about you. We will provide it within 30 days of a verified request.
Right to Rectification
Request correction of any inaccurate data we hold about you. Corrections to name, contact details, or date of birth may require supporting documentation.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purpose it was collected. This right is subject to legal retention obligations — some data must be kept for regulatory reasons.
Right to Restriction
Request that we restrict processing of your data in certain circumstances — for example, while you contest its accuracy or object to our use of it.
Right to Portability
Request your personal data in a structured, machine-readable format so you can transfer it to another service provider if you choose.
Right to Object
Object to processing based on legitimate interests, including marketing and analytics. Marketing opt-outs are effective immediately; other objections are reviewed within 30 days.
To exercise any of these rights, email support@luke91.bet with the subject line "Data Rights Request" and your registered account email. We will verify your identity before processing any request and respond within 30 days. Where a request is complex or numerous, we may extend this period by a further 60 days with prior notice.
11. Children's Privacy
luke 91 does not knowingly collect personal data from anyone under the age of 18. Our services are strictly for adults. We do not market to minors, and we implement age verification at registration and at the withdrawal stage to prevent under-age access to real-money gaming.
If you are a parent or guardian and believe that a child has registered at luke 91 without your knowledge, please contact us immediately at support@luke91.bet. We will investigate the matter, close the account if confirmed, and delete the associated personal data in accordance with applicable law.
12. International Data Transfers
luke 91 operates servers and infrastructure in multiple jurisdictions. Your personal data may be transferred to and processed in countries outside Pakistan. When we transfer data internationally, we ensure that appropriate safeguards are in place — including standard contractual clauses or equivalent data protection guarantees in our contracts with international service providers.
We do not transfer your personal data to countries that lack adequate data protection frameworks without ensuring that contractual protections equivalent to those described in this policy apply to the receiving party. If you have questions about where your data is processed, email support@luke91.bet.
13. Changes to This Policy
luke 91 may update this Privacy Policy from time to time as our services evolve, as regulation changes, or as we improve our data handling practices. When material changes are made, we will notify you by email to your registered address and by a prominent on-platform notice, at least 7 days before the updated policy takes effect.
The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the luke 91 platform after a revised policy takes effect constitutes acceptance of the updated terms. If you disagree with any changes to this policy, you should stop using the platform and close your account before the new policy takes effect — please contact support@luke91.bet for account closure assistance.
Previous versions of this policy are available on request by emailing support@luke91.bet with the subject line "Privacy Policy Archive Request".
14. Contact & Complaints
If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how luke 91 handles your personal data, please contact us through the following channels:
- Email: support@luke91.bet — use the subject line "Privacy Query" or "Data Rights Request" for faster routing
- Live Chat: Available 24/7 via the chat widget when logged in to your luke 91 account — average response under 90 seconds during peak hours
- FAQ: Visit our FAQ page — many common privacy questions are answered there without needing to contact support
If you are not satisfied with our response to a privacy complaint, you have the right to escalate to the independent dispute resolution body designated under our gaming licence or, for data protection matters, to the relevant data protection supervisory authority in your jurisdiction.
We aim to resolve privacy queries quickly. Simple data access requests are typically fulfilled within 5 business days. Formal complaints receive an acknowledgement within 24 hours and a full response within 10 business days. Complex cases may take up to 30 days — we will always communicate the timeline clearly.