lu89 Privacy Policy

1About lu89 and This Policy

lu89 is an online casino and sports betting platform serving players in Bangladesh. As the data controller for personal data collected through the lu89 website and mobile interface, lu89 is responsible for how your personal information is collected, processed, stored and protected. This Privacy Policy sets out our data practices in full.

This policy applies to all personal data lu89 collects about you when you visit the site, register an account, make a deposit or withdrawal, participate in games or betting markets, contact our support team, or interact with any feature of the platform. It also applies to data we receive from third-party payment processors such as bKash, Nagad, Rocket and Upay in connection with transactions you initiate on lu89.

2What Personal Data We Collect

lu89 collects personal data in three ways: information you provide to us directly, information generated automatically by your use of the platform, and information received from third-party payment processors in connection with your transactions. The specific categories of data we collect are as follows:

Registration and Account Data

• Full name as provided at registration.
• Mobile phone number — used for account verification, transaction alerts and responsible gaming notifications.
• Date of birth — collected to verify that you meet the 21+ age eligibility requirement. This data is encrypted at rest.
• Username and encrypted password hash — used for account authentication. lu89 stores only a one-way hash of your password, never the plaintext value.
• KYC documentation (where requested): government-issued photo ID (e.g. National ID card, passport), proof of address, and payment method ownership confirmation. This documentation is used solely for age and identity verification and is stored in an encrypted document vault.

Transaction and Payment Data

• Deposit and withdrawal amounts, dates and transaction reference numbers.
• Payment method type and partial identifier (e.g. last four digits of a mobile wallet number or masked card number). Full payment credentials are processed by the payment provider and are never stored on lu89 servers.
• Account balance history, bonus credit and debit records.
• Responsible gaming tool settings, including deposit limits, session time limits and self-exclusion records.

Technical and Usage Data

• IP address — used for geolocation checks, fraud detection and security logging. IP addresses are not linked to browsing histories for profiling purposes.
• Device information: device type, operating system version, browser type and screen resolution. This data is used to optimise the platform experience and investigate technical support issues.
• Session activity logs: pages visited, games played, bets placed, session durations and click patterns. These logs are used for security monitoring, responsible gaming oversight and platform analytics. They are retained for a maximum of 12 months.

3How We Use Your Personal Data

lu89 processes your personal data exclusively for the purposes described in the table below. We do not use your data for any purpose beyond what is stated here without obtaining your explicit consent first.

4Legal Basis for Processing

lu89 processes your personal data on the following legal bases, depending on the purpose of the processing:

• Contractual necessity: processing required to fulfil our agreement with you as a registered player — including account management, payment processing and game provision.
• Legal obligation: processing required to comply with applicable law, including age verification, KYC requirements, anti-money laundering obligations and record-keeping requirements.
• Legitimate interests: processing for fraud prevention, platform security, responsible gaming monitoring and technical optimisation — where our legitimate interest in operating a safe platform does not override your privacy rights.
• Consent: for any optional data processing beyond the above — such as sending you promotional communications — we will request your explicit consent separately and you may withdraw it at any time.

5Payment Data and Financial Information

lu89 integrates with bKash, Nagad, Rocket, Upay and other approved Bangladesh payment channels to enable deposits and withdrawals in Bangladeshi Taka. When you initiate a payment transaction on lu89, the actual payment credentials (such as your full mobile wallet number, PIN or bank account details) are entered directly into the payment provider's secure interface and are never transmitted to or stored on lu89 servers.

lu89 receives only a transaction confirmation and a masked payment identifier from the payment provider after a successful transaction. This confirmation is stored in your transaction history for account management, dispute resolution and regulatory compliance purposes. lu89 uses this data to verify that deposits and withdrawals are processed to and from payment accounts registered in your name, in line with our anti-fraud obligations.

6Sharing Your Personal Data

lu89 does not sell, rent or transfer your personal data to third parties for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

Permitted Third-Party Recipients

• Payment processors (bKash, Nagad, Rocket, Upay and other approved providers): We share the minimum transaction data required to process your deposits and withdrawals. These providers operate under their own privacy policies and security standards.
• Game providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi and others): Session tokens and anonymised player identifiers are shared with game providers to authenticate game sessions. Game providers do not receive your personal registration data or payment information.
• KYC verification partners: Where we use a third-party identity verification service to process KYC documentation, your identity documents are shared with that service under a data processing agreement that restricts their use to verification purposes only.
• Regulatory and law enforcement authorities: We may disclose personal data to relevant authorities where required to do so by law, court order, or in connection with a regulatory investigation into suspected financial crime, fraud or money laundering.

All third parties who receive personal data from lu89 are bound by contractual data processing obligations that prohibit them from using that data for any purpose other than the specific service they provide to lu89. lu89 does not permit third-party recipients to sell or further share your data.

7Cookies and Tracking Technologies

lu89 uses cookies and similar tracking technologies to operate the platform, maintain your session state, detect fraudulent activity, and analyse how the platform is used. Cookies are small text files stored on your device by your browser. We do not use cookies to serve third-party advertising or to track your activity across other websites.

Types of Cookies We Use

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit, and security cookies used for CSRF protection and fraud detection. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Used to remember your preferences (such as language settings and responsible gaming tool configurations) between sessions. These improve your experience but are not essential to core platform operation.
• Analytics cookies: Used to collect anonymised data about how players navigate the platform — which pages are visited most, where players exit, and which features are used. This data is processed in aggregate form and is never linked back to individual player identities.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair platform functionality and may prevent you from logging in or completing transactions. lu89 does not use any third-party advertising or retargeting cookies.

8Data Retention

lu89 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and registration data: retained for the duration of your active account and for 5 years following account closure, to comply with financial record-keeping obligations.
• KYC documentation: retained for 5 years following account closure, in line with anti-money laundering record-keeping requirements. After this period, KYC documents are permanently deleted from our systems.
• Session activity logs and technical data: retained for a maximum of 12 months for security and responsible gaming monitoring purposes, after which they are anonymised or deleted.

Where you request deletion of your account and personal data, lu89 will action that request within 30 days, subject to our obligation to retain certain data for the statutory periods described above. Data that is subject to a legal retention obligation cannot be deleted ahead of schedule, but will be isolated from active use until the retention period expires.

9Your Privacy Rights

As a player on the lu89 platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact lu89 support with your account details. We will respond to all valid requests within 30 days.

• Right of access: You may request a copy of all personal data lu89 holds about you, including account data, transaction history and responsible gaming records.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held on your account. For security reasons, certain data corrections (such as name changes) may require identity verification.
• Right to erasure: You may request deletion of your personal data when you close your account, subject to our legal retention obligations. lu89 will confirm which data can be immediately deleted and which must be retained for the statutory period.
• Right to restrict processing: You may request that lu89 restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing based on legitimate interests.
• Right to data portability: You may request a copy of your personal data in a structured, machine-readable format to transfer to another service provider, where technically feasible.
• Right to object: You may object to the processing of your personal data where lu89 relies on legitimate interests as the legal basis. lu89 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.

To exercise any of the above rights, please contact our support team at [email protected] with the subject line 'Data Rights Request' and your registered account details. We will verify your identity before processing any data rights request to protect against unauthorised access to your personal data.

10Security Measures

lu89 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration or destruction. Our security measures include:

• SSL/TLS encryption on all data transmitted between your device and lu89 servers. All connections to lu89 are forced to HTTPS — unencrypted HTTP connections are not permitted.
• Encryption at rest for sensitive data categories including date of birth, KYC documentation, and responsible gaming records. Access to encrypted data stores is restricted to authorised lu89 systems only.
• Role-based access controls ensuring that lu89 staff can only access personal data relevant to their specific job function. Access logs are maintained and audited regularly.
• Automated fraud detection systems that monitor account activity in real time for indicators of unauthorised access, unusual transaction patterns, or coordinated abuse.

While lu89 implements industry-standard security measures, no system is completely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights, lu89 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

11Children's Privacy and Age Restriction

lu89 is strictly an adults-only platform. Players must be 21 years of age or older to register and use the service. lu89 does not knowingly collect personal data from individuals under the age of 21. If we discover that personal data has been collected from a person who is under 21, we will delete that data immediately and close the associated account. If you believe that a person under the age of 21 has registered on lu89, please contact our support team at [email protected] immediately so that we can take appropriate action.

12Changes to This Privacy Policy

lu89 reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this policy, we will notify registered players by posting a prominent notice on the platform and, where appropriate, by sending a notification to the contact details registered on your account. The updated policy will display the revised effective date at the top of the page.

Your continued use of lu89 after the effective date of any change to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with any change, please discontinue use of the platform and contact us to request account closure.

13Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact the lu89 support team. Our team handles all privacy enquiries in both English and Bengali and is available 24 hours a day, 7 days a week.

When contacting us about a data rights request, please include your registered account username and a brief description of your request. We aim to acknowledge all privacy enquiries within 48 hours and resolve them within 30 days.