Your Privacy Matters to Us

The following Privacy Policy (“Policy”) outlines the collection, processing, and utilisation of Personal Data on the Luckywise website (“Platform”), made available by Gaveta Decimal, Lda., with registered office at Rotunda Eng. Edgar Cardoso No. 23, Sala F, having tax identification number 514677856, registered with the Commercial Registry Office of Vila Nova de Gaia under the same number, with a share capital of € 600,000 euros (“Gaveta Decimal”).

This Policy explains Gaveta Decimal’s data protection practices and informs users (“Users” or “Data Subjects”) about how to exercise their rights. This document is aligned with Regulation (EU) 2016/679 ("GDPR") and applicable legislation.

Please read this Policy carefully before using the Platform, as it contains important information about Users’ rights and obligations, along with conditions, limitations, and exclusions that may apply.

By using the Platform, clicking “I Accept” when prompted, or indicating acceptance in an adjoining box, Users confirm that they understand and agree to comply with this Policy in its entirety.

If Users do not agree with this Policy, they should refrain from accessing or using the Platform.

Use of this website is only for individuals aged 18 or older, due to its content related to games of chance, even if only for entertainment purposes.

This website is an independent project and has no official connection with the Euromillions operator. All features are provided solely for informational and recreational purposes.

The Controller of the Personal Data collected through the Platform is Gaveta Decimal. For questions relating to privacy and data protection, Users may contact Gaveta Decimal through the following e-mail address: hello@lucky-wise.com

Gaveta Decimal only processes Users' Personal Data when duly authorised to do so. For the lawful processing of Personal Data, the GDPR requires an adequate legal basis for each specific processing activity.

The processing of Personal Data is lawful when at least one of the following conditions is met:

• The Data Subject has given explicit consent to the processing of their Personal Data for one or more specific purposes.
• The processing is necessary for the performance of a contract to which the Data Subject is a party or to take steps at the request of the Data Subject before entering into a contract.
• The processing is necessary for compliance with a legal obligation to which the Controller is subject.
• The processing is necessary to protect the vital interests of the Data Subject or another natural person.
• The processing is necessary for the purposes of Gaveta Decimal’s legitimate interests or those of Third Parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject, which require the protection of Personal Data).

In this context, the following Personal Data is processed on the Platform:

Gaveta Decimal processes the above Personal Data on the Platform for the following purposes:

User Account Creation and Management

• Purpose: To create, verify, and manage User accounts, enabling them to access and use the Platform's services.
• Lawful Basis: Performance of a contract (GDPR Article 6(1)(b)) – this processing is necessary to provide services as agreed in the Terms & Conditions governing the access and use of the Platform.

Communication with Users

• Purpose: To send account-related communications, such as verification emails, password reset links, and important updates concerning the Platform’s Terms & Conditions, Privacy Policy, and Cookies Policy.
• Lawful Basis: Performance of a contract (GDPR Article 6(1)(b)) – necessary to ensure the User can access the services provided in the Platform. Legitimate interest (GDPR Article 6(1)(f)) may also be applicable for essential updates that Users need to stay informed about.

User Support and Service Assistance

• Purpose: To assist Users with queries, technical support, or other assistance requests.
• Lawful Basis: Performance of a contract (GDPR Article 6(1)(b)) – necessary to fulfill User support obligations under the Platform’s Terms & Conditions.

Marketing Communications (if applicable)

• Purpose: To send promotional emails or newsletters (if the User has opted in).
• Lawful Basis: Consent (GDPR Article 6(1)(a)) – Users must provide explicit consent to receive marketing communications, which they can withdraw at any time.

Legal Compliance

• Purpose: To comply with legal and regulatory requirements, such as record-keeping obligations, responding to legal requests, or ensuring compliance with tax laws or other regulations.
• Lawful Basis: Legal obligation (GDPR Article 6(1)(c)) – necessary to comply with applicable laws and regulations that Gaveta Decimal is subject to.

Security and Fraud Prevention

• Purpose: To detect, prevent, and respond to security incidents, fraud, or illegal activities.
• Lawful Basis: Legitimate interest (GDPR Article 6(1)(f)) – protecting Users' accounts and ensuring a secure platform is a legitimate interest that aligns with User expectations and legal obligations.

Personal Data collected through the Platform is processed in strict compliance with applicable legislation and stored in dedicated databases created for this purpose. This Personal Data is maintained in a format that permits the identification of Data Subjects only for as long as is necessary for the purposes for which it is processed.

The retention period for Personal Data varies according to the purpose for which the information is used. Nonetheless, there are legal requirements that mandate the retention of certain Personal Data for a specific period.

In the absence of any such legal requirements, Personal Data will be stored and retained only for the minimum period necessary for the purposes for which it was collected or subsequently processed, or as long as the account remains active and, if no other term applies, for a period of one year after the account being closed, to safeguard the obligations, interactions, and transactions carried out, after which it will be deleted.

Users' Personal Data collected through the Platform is not shared with third parties without their consent, except in cases where such transmission or communication is necessary to fulfil Gaveta Decimal’s legitimate interests, to perform a contract entered into with Users, to take steps at the request of the Data Subject prior to entering into a contract, or where necessary to meet a legal obligation to which Gaveta Decimal is subject.

Accordingly, Gaveta Decimal may need to communicate or provide access to Users' Personal Data to third parties collaborating with it, primarily to ensure the proper operation and security of all services available on the Platform. These third parties may include external consultants, cooperation partners, and information technology support services. Gaveta Decimal ensures that each of these third parties upholds the confidentiality of Personal Data by entering into Data Processing Agreements with them.

Our website may contain links to external sites. We are not responsible for the privacy practices or content of those external sites.

Furthermore, as previously outlined, Gaveta Decimal may share Users' Personal Data with third parties under specific conditions where there is a good faith belief that it is necessary for the following purposes:

• Compliance with applicable laws or responding to judicial orders.
• Responding to requests from public or governmental authorities, particularly for national security or law enforcement purposes.
• Safeguarding the vital interests of Users, customers, or other third parties. This includes efforts to prevent spam, deter fraudulent activities related to our products, and avert potential loss of life or serious injury.
• Operating and maintaining the security and integrity of the Platform, including the prevention or cessation of any attacks on Gaveta Decimal’s computer systems or networks.
• Protecting Gaveta Decimal’s rights, interests, or property.
• Enforcing Gaveta Decimal’s Terms & Conditions.

Additionally, Gaveta Decimal may use and share aggregated non-personal information with Third Parties for marketing, advertising, and analytics purposes.

The Personal Data collected by Gaveta Decimal may be stored and processed in London, UK or in any other country where Gaveta Decimal, its affiliates, subsidiaries, or service providers have operational facilities. The choice of storage locations is determined by principles of operational efficiency, performance improvement, and the creation of redundancies to protect data in the event of disruptions or other issues.

Gaveta Decimal is committed to ensuring that the Personal Data collected is processed in accordance with the terms outlined in this Policy and in compliance with the requirements of relevant legislation, irrespective of where the Personal Data is located.

In line with this commitment, Gaveta Decimal may transfer Personal Data from the European Economic Area to Third Countries. Should such transfers occur, Gaveta Decimal is dedicated to ensuring that each transfer complies with applicable legal requirements, especially concerning the adequacy assessment of data protection in the destination country and adherence to mandatory standards for such transfers.

For more details on the European Commission's decisions regarding the adequacy of Personal Data protection in countries where Gaveta Decimal processes Personal Data, please refer to this link:

To ensure the security and strict confidentiality of Users' Personal Data, Gaveta Decimal processes all provided information with absolute discretion, in line with internal security and confidentiality policies and procedures, which are periodically updated as needed and in accordance with legal requirements.

Taking into account the nature, scope, context, and purpose of the Personal Data processing, as well as potential risks to the rights and freedoms of the Data Subjects, Gaveta Decimal commits to implementing appropriate technical and organisational measures both at the initial stage of defining the means of processing and throughout the processing itself.

In general, Gaveta Decimal adopts the following security measures:

• Regular audits to evaluate the effectiveness of technical and organisational measures in place.
• Ongoing awareness-raising and training for staff involved in Personal Data Processing activities.
• Pseudonymisation and encryption of Personal Data, where justified.
• Mechanisms that guarantee the ongoing confidentiality, availability, integrity, and resilience of information systems.
• Systems to restore information systems and access to Personal Data promptly in the event of a physical or technical incident.

Under the GDPR, Data Subjects have several rights that empower them to exercise greater control over their Personal Data. These rights include:

• Right of Access: The right to access their Personal Data.
• Right to Rectification: The right to request corrections to any inaccuracies in their Personal Data.
• Right to Erasure: The right to have their Personal Data erased in certain circumstances.
• Right to Restriction of Processing: The right to request the restriction of Personal Data Processing.
• Right to Portability: The right to obtain their Personal Data in a portable format for transfer.
• Right to Object: The right to object to specific Processing activities.
• Right to Lodge a Complaint: The right to lodge a complaint with a Data Protection Authority.

If the processing activity is based on consent, Data Subjects can withdraw their consent at any time (Right to Withdraw Consent). However, this withdrawal will not affect the lawfulness of any processing activities conducted based on consent prior to its withdrawal.

To exercise any of these rights, Data Subjects can contact Gaveta Decimal through the following email address: hello@lucky-wise.com. Responses to such requests will be provided within one month, although this timeframe may be extended in certain situations (e.g., due to the complexity of the request).

Gaveta Decimal reserves the right to change this Policy at any time. In the event of a change to the Policy, the “Last Updated Date,” available at the end of this page, will also be updated. If the change is substantial, a notice will be placed on the Platform.

Continuing to use the Platform after the “Last Updated Date” will signify Users’ acceptance of and consent to these alterations.

This Policy, as well as the collection, processing, or transmission of Users’ Personal Data, is governed by the provisions of the GDPR and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation, or execution of this Policy, or which are related to the collection, processing, or transmission of each User’s Personal Data, shall comply with the rules established in the Platform’s Terms & Conditions.

Date of last update: 18 November 2025