1. Scope and eligibility
This policy applies to customers, visitors and account holders using Lucky Card. The service is intended for adults aged 18 or older and is not directed to children.
2. Data we collect
Account and identity information
- Name, email address, Nigerian phone number, encrypted password credentials, customer ID and referral code.
- Verification records, including whether a phone number or email verification challenge was completed.
Gift-card transaction information
- Gift-card brand, currency, face value, card format, customer notes and submitted card code where provided.
- Images selected by you, such as gift-card photographs, review evidence and rejection evidence.
- Quoted and approved payout amounts, price-rule snapshots, review decisions and transaction history.
Wallet, bank and withdrawal information
- Bank name, account name and account number supplied for withdrawals.
- Wallet entries, rewards, withdrawal requests, transfer references, transfer receipts and rejection reasons.
Referral and support information
- Referrer relationship, referral commission rate, qualifying transactions and credited rewards.
- Messages, complaints and information you provide when contacting support.
Security and technical information
- Session identifiers, login activity, approximate request time, hashed network address, browser or device user-agent and security audit events.
- We do not sell advertising identifiers, contacts, precise location, call logs or unrelated files. Lucky Card only accesses a camera or selected image when you choose to take or upload evidence.
3. Why we use data
We use data to create and secure accounts; verify contact details; calculate prices; receive, review and settle gift-card transactions; maintain wallets and rewards; process withdrawals; prevent fraud, duplicate payments and abuse; provide support; maintain audit records; comply with legal duties; and improve reliability and performance.
4. Legal grounds and consent
We process data where necessary to provide the service you request, to comply with legal obligations, with your consent where required, and for legitimate interests such as account security, fraud prevention, dispute resolution and service improvement. You may withdraw optional consent, but this will not affect processing already lawfully completed.
5. When data is shared
Lucky Card does not sell personal data. Data may be disclosed only as necessary to:
- cloud hosting, storage, backup, security, email and SMS providers acting on our instructions;
- bank-account validation, payment or transfer providers used to complete withdrawals;
- professional advisers, auditors and insurers under confidentiality duties;
- courts, regulators, law-enforcement bodies or other parties where disclosure is legally required or necessary to prevent fraud or protect users; or
- a successor in a legitimate merger, financing or business transfer, subject to appropriate safeguards and notice.
6. International processing
Lucky Card serves customers in Nigeria, while infrastructure or service providers may process data in other countries. We use contractual, organisational and technical safeguards intended to protect data when it is processed across borders.
7. Security
We use access controls, password hashing, encrypted storage for gift-card codes, bank-account details and uploaded evidence, session protection, request limits, audit logs and encrypted network transport when HTTPS is enabled. No system is completely secure, so users should protect their password and report suspected misuse immediately.
8. Retention
- Account data is retained while the account is active and while reasonably needed to provide the service.
- On a valid deletion request, data not required for another lawful purpose will be deleted or irreversibly anonymised within 30 days.
- Transaction, wallet, withdrawal, fraud-prevention and audit records may be retained for up to seven years where reasonably required for accounting, disputes, security or legal compliance.
- Encrypted backups are access-restricted and normally cycle out within 90 days after deletion from the live system, unless preservation is legally required.
9. Your choices and rights
You may request access, correction, a copy, restriction, objection or deletion of your personal data, subject to applicable law. You may also complain to the Nigeria Data Protection Commission or another competent authority. We may verify your identity before acting on a request.
10. Account deletion
You can start an account-deletion request from the Account screen in Lucky Card or through our public Account Deletion page. Deleting the app from a device does not delete the account. We delete or anonymise associated data unless limited retention is necessary for fraud prevention, dispute handling, accounting or another legal obligation.
11. Changes to this policy
We may update this policy when the service or law changes. The new effective date will be shown on this page. Material changes will be communicated through the service where reasonably possible.
12. Contact
Privacy contact and account requests: privacy@luckycardng.com
Service: Lucky Card
Primary customer market: Nigeria