burger icon

Privacy Policy

This Privacy Policy explains how Luckywins, operating via the website luckywins-aussie.com, collects, uses, discloses and protects personal information of players and other visitors. It is intended to help you understand our data practices so that you can make informed decisions when using our services. This Policy applies to all users who access or use our website, register an account, participate in gaming activities, contact customer support, or otherwise interact with us. By using our services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is effective from 1 January 2026 and supersedes all earlier versions.

Who We Are

OBSERVE: Identify the operators, legal details and contacts responsible for data processing. EXPAND: Clarify group structure and roles in processing. REFLECT: Present a clear point of accountability for users.

The online casino service offered under the brand Luckywins on https://luckywins-aussie.com (the "Website") is owned and operated by:

  • Dama N.V., a public limited liability company incorporated under the laws of Curaçao, with registration number 152125 and registered address at Scharlooweg 39, Willemstad, Curaçao ("Dama N.V."). Dama N.V. is the main data controller for processing of personal data in connection with the operation of the Website.
  • Friolion Limited, a company incorporated under the laws of Cyprus, registration number HE 419102, with registered office in Cyprus (address not specified), acts as a payment processing subsidiary and may process personal data on behalf of Dama N.V. in connection with payment and billing operations.

Dama N.V. is licensed and regulated for e-gaming activities by Antillephone N.V. under licence number 8048/JAZ2020-013, issued on behalf of the Government of Curaçao. Licence status can be verified via the licence validator link available in the Website footer (note: the validator reference to luckywins.com reflects the original licence domain but applies to this brand operation).

For all matters relating to privacy and data protection, including the exercise of your rights, you may contact our data protection contact point:

While Dama N.V. is established in Curaçao, this Privacy Policy is tailored for users located in Australia and aims to align with recognised international data protection standards, including the EU General Data Protection Regulation (GDPR) and the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), to the extent applicable.

What Personal Data We Collect

OBSERVE: Identify all categories of data collected through the Website and related services. EXPAND: Include direct, indirect and inferred data, including cookies and behavioural profiles. REFLECT: Clearly structure categories so users understand the scope of processing.

Account and Identification Data

  • Registration data: Full name, username, password, date of birth, country of residence, preferred currency, and other information required to create and manage an account.
  • Contact details: E-mail address, telephone number (where provided), postal address (where requested for verification or payment purposes), and preferred language of communication.
  • Verification (KYC/AML) data: Copies or details of identity documents (passport, national ID, driver's licence), proof of address (utility bill, bank statement), payment ownership confirmation, and information obtained from third-party verification services, to the extent permitted by applicable law.

Technical and Usage Data

  • Technical identifiers: IP address, device identifiers, operating system, browser type and version, device settings, language settings, and approximate location derived from IP address.
  • Log data: Dates and times of access, login attempts, page views, session duration, referring URLs, clickstream data, and error logs generated when using the Website or our mobile-optimised interfaces.

Gaming, Transaction and Behavioural Data

  • Gaming activity: Game selections, betting history, wager amounts, wins and losses, game session times, bonuses used, participation in tournaments or promotions, and in-game behaviours relevant for responsible gambling monitoring.
  • Payment and financial data: Deposits, withdrawals, payment method type (e.g. credit/debit card, e-wallet, bank transfer, cryptocurrency where applicable), transaction identifiers, amounts, currencies, payment status and limited card or account details as permitted by payment schemes (we do not store full card PANs where prohibited and rely on payment processors for secure tokenisation).
  • Behavioural and preference data: Your interactions with banners and offers, click behaviour, preferred games, frequency of play, communication preferences, and responsiveness to marketing campaigns, which may be used to create user segments or profiles for service personalisation and risk management.

Communications and Support Data

  • Customer support records: Content of e-mails, live chat logs, complaint correspondence, and internal notes documenting how an issue was handled.
  • Feedback and surveys: Information you provide when responding to surveys, giving feedback, or participating in research or testing initiatives.

Cookies and Similar Technologies

  • Cookies: Small text files placed on your device to support core functionality, security, analytics and marketing. Cookies may be session-based (deleted when the browser is closed) or persistent (stored for a defined period).
  • Similar technologies: Web beacons, pixels, tags, SDKs and local storage used to measure ad performance, understand user flows and remember your choices.
  • Third-party tracking: Where enabled and subject to your consent, third-party analytics and advertising providers may place their own cookies or tags to measure usage of the Website and to deliver personalised advertising in accordance with their own privacy policies.

We collect most personal data directly from you when you use the Website. Certain technical and behavioural data are collected automatically through cookies and similar technologies. We may also obtain limited information from third parties (e.g. identity verification providers, payment processors and anti-fraud databases) where required to meet our legal and regulatory obligations.

Legal Basis for Processing

OBSERVE: Identify the legal grounds that justify each main processing activity. EXPAND: Map purposes to bases such as consent, contract, legal obligation and legitimate interests, with AU-aligned reasoning. REFLECT: Provide transparent explanations so users understand why processing is lawful.

Performance of a Contract

  • We process personal data that is necessary to enter into and perform our contract with you, including:
    • Setting up and maintaining your Luckywins account;
    • Enabling participation in games, promotions and tournaments;
    • Processing deposits, bets, wins, withdrawals and account balances;
    • Providing customer support, troubleshooting and service notifications;
    • Managing account settings, preferences and self-exclusion tools.

Compliance with Legal and Regulatory Obligations

  • We process certain data to comply with obligations imposed by:
    • Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) laws and regulations;
    • Know Your Customer (KYC) and age-verification requirements to prevent underage gambling;
    • Tax and accounting obligations, record-keeping and reporting duties to competent authorities;
    • Gambling licensing conditions imposed by our regulator in Curaçao and any other relevant authorities; and
    • Applicable consumer protection, privacy and responsible gambling requirements, including those under Australian law where applicable.

Legitimate Interests

  • We rely on legitimate interests (balanced against your rights and freedoms) for processing necessary to:
    • Maintain the security and integrity of our systems, prevent fraud and abuse, investigate suspicious activity and enforce our Terms and Conditions;
    • Monitor gameplay to identify problematic gambling patterns and support responsible gambling measures;
    • Improve the Website, user experience, product offering and service quality through analytics and usage statistics;
    • Protect our legal rights, pursue or defend claims, respond to regulatory or law enforcement requests in line with applicable law; and
    • Carry out limited direct marketing to existing customers, where permitted, provided that you can opt out at any time.

Consent

  • We rely on your consent where required by law, for example:
    • Sending electronic marketing communications (e-mails, SMS, push notifications) about products, bonuses and offers, where consent is required and where such messages go beyond what is permitted under legitimate interests;
    • Using certain non-essential cookies and similar tracking technologies for advertising or advanced analytics purposes;
    • Sharing data with certain advertising partners for personalised marketing, where this is not otherwise justified by another legal basis.
  • You may withdraw your consent at any time through your account settings, by following the unsubscribe link in our communications or by contacting us. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Purpose of Processing

OBSERVE: List all main purposes for which personal data is used. EXPAND: Show linkage between operational, legal, security, and marketing needs. REFLECT: Organise purposes into clear categories for user understanding.

Provision and Management of Casino Services

  • Creating and administering user accounts, verifying eligibility and age.
  • Operating games, calculating bets and payouts, managing bonuses and loyalty programs.
  • Processing deposits and withdrawals and maintaining transaction histories.
  • Providing customer support, responding to questions and resolving technical or account issues.

Legal, Regulatory and Responsible Gambling Compliance

  • Carrying out KYC and AML/CTF checks, sanctions and risk screenings.
  • Monitoring transactions and behaviour to detect and report suspicious activity.
  • Implementing responsible gambling measures, such as self-exclusion, deposit limits and activity monitoring for early signs of harm.
  • Maintaining records required by licensing and tax authorities, and responding to regulatory requests.

Security, Fraud Prevention and Service Integrity

  • Ensuring the technical security of our Website and infrastructure.
  • Preventing unauthorised access, account takeover, abuse of bonuses, collusion and other violations of our Terms and Conditions.
  • Conducting security audits, system testing and incident investigation.

Analytics, Personalisation and Service Improvement

  • Analysing usage data to understand how players interact with the Website.
  • Measuring performance of games, promotions and features to guide improvements.
  • Personalising content and offers, such as recommending games or promotions based on your preferences and activity, subject to applicable consent requirements.

Marketing and Communications

  • Sending service messages, such as transaction confirmations, security alerts and changes to terms or this Privacy Policy.
  • Providing marketing communications (where permitted) regarding promotions, bonuses, tournaments, new products or partner offers.
  • Running surveys and feedback campaigns to better understand user satisfaction.

Corporate and Legal Purposes

  • Protecting our rights, property and interests, including debt recovery where applicable.
  • Managing business operations, including audits, reporting, risk management and corporate transactions (such as mergers, acquisitions or restructuring, subject to appropriate safeguards).

Disclosure & Sharing

OBSERVE: Identify categories of recipients and conditions for disclosures. EXPAND: Address payment partners, service providers, regulators, affiliates and advertising networks. REFLECT: Emphasise limited, purpose-bound and safeguarded sharing.

Group Companies and Affiliates

  • Intra-group transfers: We may share personal data within the Dama N.V. group and with Friolion Limited as our payment processing subsidiary for purposes of operating the Website, processing payments, fulfilling legal obligations, conducting internal reporting and ensuring consistent service standards.
  • Affiliates and marketing partners: Limited data (e.g. anonymous or aggregated performance metrics) may be shared with affiliate partners who promote Luckywins to measure campaign performance. Personal data will only be shared with such partners for direct marketing purposes where permitted by law and, where required, with your consent.

Payment and Financial Service Providers

  • We share necessary personal and transaction data with banks, payment processors, card schemes, e-wallet providers, and other financial intermediaries to:
    • Process deposits and withdrawals;
    • Perform AML/CTF and fraud checks; and
    • Resolve payment disputes and chargebacks.

Service Providers (Processors)

  • We engage carefully selected third-party service providers who act on our instructions, including:
    • IT hosting, maintenance and security providers;
    • Game content providers and platform integrators;
    • Customer support tools, communication platforms and CRM systems;
    • Analytics, business intelligence and anti-fraud service providers; and
    • Marketing agencies and newsletter services (subject to consent where required).
  • These providers are bound by contractual obligations to protect personal data and to use it only for the specified purposes.

Regulators, Authorities and Legal Recipients

  • We may disclose personal data to:
    • Gambling regulators, AML regulators and other competent authorities in Curaçao and other relevant jurisdictions when required by law or licence conditions;
    • Law enforcement agencies, courts or government authorities in response to lawful requests or to assert or defend legal claims;
    • External auditors or professional advisers (lawyers, accountants) subject to confidentiality obligations.

Advertising and Analytics Partners

  • Subject to your consent where required, we may allow third-party analytics and advertising partners to collect or receive certain information (e.g. device and usage data) via cookies and similar technologies for the purposes of measuring performance and, where applicable, delivering personalised advertising. These partners process data under their own privacy policies.

Business Transfers

  • In connection with any actual or potential merger, acquisition, asset sale, restructuring or insolvency event involving Dama N.V. or its group, personal data may be transferred to a new owner or successor entity, subject to appropriate confidentiality and data protection safeguards and consistent with this Privacy Policy.

We do not sell your personal data as that term is commonly understood. Any sharing is limited to what is necessary, proportionate and permitted under applicable law.

International Transfers

OBSERVE: Determine cross-border flows from Curaçao and Cyprus to other regions. EXPAND: Describe safeguards such as contractual protections and security measures. REFLECT: Provide users with assurance regarding international transfers, including for Australian users.

Locations of Processing

  • Your personal data may be processed and stored in:
    • Curaçao, where Dama N.V. is established and operates core gaming infrastructure;
    • Cyprus, where Friolion Limited provides payment processing and certain support services; and
    • Other countries where our selected service providers or hosting partners operate data centres, which may include jurisdictions within the European Economic Area (EEA) and other regions.

Safeguards for International Transfers

  • We take steps designed to ensure that international transfers of personal data are carried out in compliance with applicable data protection laws, including by:
    • Entering into data processing and data transfer agreements incorporating recognised safeguards (such as contractual clauses that reflect, where appropriate, concepts similar to the EU Standard Contractual Clauses);
    • Requiring service providers to implement robust technical and organisational security measures;
    • Limiting transfers to what is necessary for the relevant purposes described in this Policy; and
    • Regularly reviewing the level of protection offered by third countries and recipients.

Regional Compliance Note for Australian Users

  • For users located in Australia, we take reasonable steps to ensure that overseas recipients do not breach the privacy standards that are comparable to those set out in the Australian Privacy Principles, including through contractual commitments and vendor due diligence. By using the Website, you acknowledge that your personal data may be transferred to, and processed in, countries outside Australia, which may have different data protection laws than those in your home jurisdiction. Nevertheless, we will protect your personal data in accordance with this Privacy Policy.

Data Retention

OBSERVE: Establish retention periods aligned with legal and operational needs. EXPAND: Distinguish between categories and specify criteria for extension or deletion. REFLECT: Provide clear, indicative timeframes and explain user-initiated deletion.

General Retention Principles

  • We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting and reporting requirements, to resolve disputes and to enforce our agreements.
  • When determining the appropriate retention period, we consider:
    • The amount, nature and sensitivity of the personal data;
    • The potential risk of harm from unauthorised use or disclosure;
    • The purposes of processing and whether these can be achieved by other means; and
    • Applicable legal and regulatory requirements in relevant jurisdictions.

Indicative Retention Periods

  • Account and identification data: Retained for the lifetime of your active account and, after closure, typically for up to five (5) years, or longer where required by AML/CTF, tax or gambling regulations.
  • KYC/AML documentation: Copies of identity and verification documents are usually kept for at least five (5) years after the end of the business relationship or the date of the last transaction, in line with regulatory requirements.
  • Gaming and transaction history: Retained for a minimum of five (5) years from the date of the relevant transaction or account closure, to comply with regulatory, accounting and dispute resolution requirements.
  • Technical, log and security data: Retained for a period appropriate to security and operational needs, generally between six (6) months and five (5) years, depending on the nature of the logs and legal obligations.
  • Marketing data: Retained until you opt out of marketing or withdraw consent, after which we will stop using your data for marketing and may keep a minimal record of your preference to ensure compliance with your request.
  • Customer support and complaint records: Retained for up to seven (7) years after resolution, or longer if necessary for legal purposes.

Deletion and Anonymisation

  • When personal data is no longer required, we will either securely delete it or irreversibly anonymise it so that it can no longer be associated with you. Anonymised data may be retained and used for statistical, analytical or research purposes.
  • If you request deletion of your personal data, we will delete or anonymise data that we are not legally required or otherwise entitled to retain. Certain data must be retained for legal, regulatory or legitimate interest reasons as outlined above.

Your Rights

OBSERVE: Identify core data subject rights aligned with GDPR-style standards and AU expectations. EXPAND: Explain each right, conditions, and how to exercise it, including timelines and cost. REFLECT: Provide a practical procedure and clarify limitations where legal obligations override requests.

Overview of Your Rights

  • Right of access: You may request confirmation as to whether we process your personal data and obtain a copy of such data, together with information about the processing (sources, purposes, categories, recipients, retention periods).
  • Right to rectification: You may request correction of inaccurate personal data and completion of incomplete data. Where possible, you can update certain information directly in your account settings.
  • Right to deletion ("right to be forgotten"): You may request deletion of your personal data where:
    • The data is no longer necessary for the purposes for which it was collected;
    • You withdraw consent where consent was the sole legal basis;
    • You object to processing and there are no overriding legitimate grounds; or
    • The data has been unlawfully processed or must be deleted to comply with a legal obligation.
    We may not be able to delete data that we must retain to comply with AML/CTF, gambling, tax or other legal obligations or to establish, exercise or defend legal claims.
  • Right to restriction of processing: You may request that we restrict processing in certain circumstances, e.g. while we verify the accuracy of data or assess an objection, or where processing is unlawful and you prefer restriction to deletion.
  • Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, including profiling. We will stop processing unless we demonstrate compelling legitimate grounds overriding your interests or where necessary for legal claims. You also have an unconditional right to object to processing for direct marketing, including profiling for such purposes.
  • Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request to receive the personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted directly to another controller.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing prior to withdrawal.
  • Right not to be subject to certain automated decisions: If we engage in automated decision-making that produces legal or similarly significant effects for you, we will ensure that appropriate safeguards are in place and that you can request human review, express your point of view and contest the decision, in accordance with applicable law.

How to Exercise Your Rights

  • Submit your request by contacting us at [email protected] or [email protected], clearly indicating:
    • Your identity (we may ask for additional information to verify that you are the account holder or authorised representative);
    • The right you wish to exercise; and
    • Any relevant details that will help us process your request efficiently (for example, specific data or time periods).
  • We generally respond within thirty (30) calendar days of receiving a valid request. If your request is complex or we receive numerous requests, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and reasons.
  • We provide responses and exercise of rights free of charge. However, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded, excessive or repetitive, as permitted by applicable law.

Nothing in this section limits any additional rights you may have under applicable Australian privacy law or other local legislation. Where such laws grant you stronger rights or protections, we will act in accordance with those standards to the extent they apply to our operations.

Cookies & Tracking Technologies

OBSERVE: Categorise cookies and explain why they are used. EXPAND: Distinguish functional, analytics and advertising tools and management options. REFLECT: Provide users with practical control mechanisms.

Types of Cookies Used

  • Strictly necessary cookies (functional / security): These cookies are essential for operating the Website and enabling core features, such as logging in, maintaining sessions, securing transactions, preventing fraud and remembering your privacy preferences. The Website cannot function properly without them.
  • Preference cookies: These cookies remember your choices (e.g. language, region, display settings) to provide a more personalised experience.
  • Analytics and performance cookies: These cookies collect information about how visitors use the Website (pages visited, time spent, error messages) to help us understand performance, detect issues and improve our services. Data is typically aggregated and used for statistical purposes.
  • Advertising and targeting cookies: These cookies may be set by us or our advertising partners to build a profile of your interests and show you relevant adverts on our Website or other sites. They may also be used to limit how often you see an ad and to measure the effectiveness of campaigns. These cookies operate by uniquely identifying your browser or device.
  • Third-party cookies: Certain cookies are placed by third parties (e.g. analytics providers, ad networks, social media platforms) that provide services to us. These providers may use the information gathered in accordance with their own privacy policies.

Cookie Management

  • Internal controls: Where available, you can manage certain cookie preferences through the cookie banner or settings panel displayed when you first visit the Website or via your account or privacy settings.
  • Browser settings: Most web browsers allow you to block or delete cookies, or to receive alerts before a cookie is stored. Please refer to your browser's help section for instructions. Blocking or deleting cookies may affect your ability to use some features of the Website, especially strictly necessary cookies.
  • Opt-out from analytics and advertising: Some third-party providers offer dedicated opt-out tools for their services. Links to these tools, where relevant, may be provided in our cookie interface or within this Policy in future updates.

By continuing to use the Website after being presented with our cookie banner, you agree to the use of cookies as described here, subject to any choices you make. You can change your cookie preferences at any time.

Data Security

OBSERVE: Identify threats and necessary safeguards for an online casino environment. EXPAND: Detail technical, organisational and procedural controls. REFLECT: Provide assurance by referencing recognised standards and incident response principles.

Technical and Organisational Measures

  • Encryption: We use industry-standard encryption technologies, including TLS 1.2 or higher, to protect data in transit between your device and our servers. Where appropriate, we also apply encryption or pseudonymisation to data at rest.
  • Access controls: Access to personal data is restricted to authorised personnel and service providers who require it to perform their duties. Access rights are granted on a need-to-know and least-privilege basis and are regularly reviewed.
  • Authentication and account security: We support strong password policies and employ mechanisms to detect and mitigate unauthorised access. Multi-factor authentication may be implemented for internal systems and may be offered to users where feasible.
  • Network and infrastructure security: Our systems are protected by firewalls, intrusion detection and prevention systems and other security technologies designed to prevent unauthorised access and attacks.
  • Data minimisation and segregation: We limit collection to what is necessary for identified purposes and, where possible, logically segregate data to reduce risk and support compliance.

Governance, Training and Audits

  • Policies and procedures: We maintain internal policies and procedures governing information security, data protection, incident response, access control and acceptable use.
  • Staff awareness: Employees and contractors with access to personal data receive training on data protection, confidentiality and security obligations and are bound by confidentiality agreements.
  • Testing and audits: We conduct periodic security assessments, vulnerability scans and, where appropriate, external audits or certifications to evaluate the effectiveness of our controls. We strive to align our practices with internationally recognised security standards such as ISO/IEC 27001 and SOC 2, where applicable to our operations and service providers.

Incident Response

  • We maintain procedures for identifying, assessing and responding to suspected data breaches or security incidents.
  • In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and, where required by law, relevant authorities without undue delay, describing the nature of the breach, likely consequences and measures taken or proposed to address it.

While we implement robust security measures, no system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your account credentials and for using appropriate security measures on your own devices.

Complaints & Contacts

OBSERVE: Provide channels to raise queries or complaints. EXPAND: Outline internal handling and escalation to authorities. REFLECT: Ensure transparency, timelines and user empowerment.

Contacting Us

  • If you have questions, concerns or complaints about this Privacy Policy or our handling of your personal data, you may contact us at:

Internal Complaint Procedure

  1. Submission: Send your complaint or enquiry, including relevant details (such as account ID, approximate dates and a description of the issue) to one of the contact e-mail addresses above.
  2. Acknowledgement: We will acknowledge receipt of your complaint as soon as reasonably practicable, typically within five (5) business days.
  3. Assessment and investigation: We will review your complaint, may request additional information where necessary, and will investigate the matter internally, involving our data protection and compliance teams where appropriate.
  4. Response: We aim to provide a substantive response within thirty (30) calendar days of receiving a complete complaint. If we cannot meet this timeframe, we will inform you of the reason for the delay and the expected date of response.
  5. Further steps: If you are not satisfied with our response, you may request that the matter be escalated within our organisation for further review.

Escalation to Supervisory Authorities

  • Australian users: If you are located in Australia and believe we have not handled your personal information in accordance with applicable privacy law, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
  • Other jurisdictions: Depending on your location, you may have the right to lodge a complaint with your local data protection authority or with the authority in the jurisdiction where you believe an infringement occurred.
  • Licensing authority: For issues related to gambling regulation rather than privacy specifically, you may also contact our licensing authority in Curaçao via the validator and contact links provided in the Website footer.

We encourage you to contact us first so that we can attempt to resolve your concern directly, but you have the right to contact a supervisory authority at any time.

Updates

OBSERVE: Recognise that policies evolve over time. EXPAND: Explain how users will be informed, versioning and notice periods. REFLECT: Provide mechanisms for user choice in light of changes.

Changes to This Privacy Policy

  • We may update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, regulatory guidance or technological developments.
  • Each version of the Policy will be identified by an effective date and, where appropriate, a version number. Material changes will be highlighted or summarised.

Notification Procedures

  • Website notifications: We will publish the updated Privacy Policy on https://luckywins-aussie.com. For material changes, we may display a prominent notice (e.g. banner or pop-up) on the Website.
  • E-mail alerts: Where feasible and appropriate, we will notify registered users of significant changes by e-mail sent to the address associated with their account.
  • Account dashboard alerts: Where available, we may provide in-account notifications or messages outlining key changes.

Advance Notice and Your Options

  • For changes that materially affect your rights or how we use your personal data, we will endeavour to provide at least thirty (30) days' advance notice before the changes come into effect, unless immediate implementation is required by law or to protect our services or users.
  • If you do not agree with the updated Privacy Policy, you may choose to close your account and stop using the Website before the changes take effect. Continued use of the Website after the effective date will constitute your acceptance of the updated Policy.

Last updated: January 2026.