Your Privacy Matters at lt89

1 Introduction

lt89 is Bangladesh's trusted online casino and sports betting platform, accessible at lt89.io. We take the privacy and security of our players' personal data extremely seriously. This Privacy Policy sets out in clear, plain English what personal information we collect from you, why we collect it, how we use it, how long we retain it, and what rights you have in relation to it.

This policy applies to all users of the lt89 platform, including registered Account holders, casual visitors to our website, and any individual who contacts our support team. It applies to personal data collected through our website, mobile-optimised browser interface, and any other digital touchpoint operated by lt89.

lt89 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We collect only what we need, use it only for the purposes described in this policy, and take robust technical and organisational measures to keep it safe at all times.

2 Data Controller

For the purposes of this Privacy Policy, lt89 acts as the data controller in respect of your personal data. As data controller, lt89 determines the purposes and means of processing your personal information and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions about this Privacy Policy or wish to exercise any of your data rights described in Section 11, you may contact our designated privacy point of contact using the details set out in Section 15 of this policy.

All data protection correspondence should be directed to [email protected] with the subject line "Privacy Request — [Your Account Username]". lt89 will acknowledge receipt within two (2) business days and provide a substantive response within fourteen (14) business days of the verified request.

3 Data We Collect

The following table summarises the categories of personal data that lt89 collects and the specific data points within each category:

lt89 does not collect or process special categories of sensitive personal data (such as health data, biometric data used for identification, racial or ethnic origin, political opinions, or religious beliefs) except where expressly required by applicable responsible gaming regulations — for example, where a player discloses a gambling addiction in the context of a self-exclusion request.

4 How We Collect Your Data

lt89 collects personal data through the following channels and mechanisms:

4.1 Direct Collection

Data that you provide directly to lt89, including:

• Completing the registration form when opening a new Account
• Submitting KYC (Know Your Customer) documentation for identity and age verification
• Making a deposit or requesting a withdrawal via bKash, Nagad, Rocket, or Upay
• Contacting lt89 customer support via live chat, email, or WhatsApp
• Completing a responsible gaming tool request (deposit limit, cool-off, self-exclusion)
• Participating in a promotion, tournament, or competition hosted on the lt89 platform
• Submitting feedback or completing a player satisfaction survey

4.2 Automated Collection

Data that lt89 collects automatically when you use the platform, including:

• Technical data collected via server logs (IP address, browser fingerprint, access timestamps)
• Gaming session data recorded by the platform's game management system
• Cookie and tracking pixel data — see Section 10 for full details
• Device and operating system information transmitted by your browser

4.3 Third-Party Sources

In limited circumstances, lt89 may receive personal data about you from trusted third parties, including:

• Identity verification service providers used to validate KYC documentation
• Payment processors who confirm the status of deposit and withdrawal transactions
• Fraud prevention and anti-money-laundering (AML) screening providers
• Game content providers (such as Pragmatic Play, Evolution Gaming, and Ezugi) who process gaming session data on their certified platforms

In all cases, lt89 only receives the minimum data necessary from third-party sources to fulfil the specific purpose for which that data is used.

5 How We Use Your Data

lt89 uses the personal data it collects for the following purposes:

• Account Administration: Creating, managing, and maintaining your lt89 Account, including password resets, account updates, and notification delivery
• Identity & Age Verification (KYC): Confirming that you are who you say you are and that you meet the 21+ age requirement before allowing deposits or withdrawals
• Payment Processing: Facilitating deposits in ৳ BDT via bKash, Nagad, Rocket, and Upay, and processing withdrawal requests to your verified payment method
• Fraud Prevention & AML Compliance: Detecting and preventing fraud, money laundering, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms & Conditions
• Responsible Gaming: Monitoring gaming behaviour for signs of problem gambling, administering self-exclusion requests and deposit limits, and delivering reality-check notifications
• Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance
• Platform Improvement: Analysing aggregated usage data to improve the lt89 platform, personalise game recommendations, and optimise the user experience
• Legal & Regulatory Compliance: Fulfilling lt89's obligations under applicable law, including record-keeping, reporting, and responding to lawful requests from authorities
• Marketing Communications (Consent Only): Sending you promotional offers, bonus announcements, tournament invitations, and seasonal campaigns (such as BPL or Eid promotions) where you have given explicit consent and have not subsequently opted out

6 Legal Basis for Processing

lt89 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and lt89 — i.e., to operate your Account, process payments, settle bets, and deliver the gaming services you have registered to use
• Legal Obligation: Processing required to comply with applicable law, including KYC/AML obligations, age verification requirements, record-keeping duties, and responses to lawful regulatory or law enforcement requests
• Legitimate Interests: Processing that is necessary for lt89's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and platform analytics — provided those interests are not overridden by your privacy rights
• Consent: Processing for marketing communications (email, SMS, push notifications) where you have given explicit, freely given, informed, and specific consent. You may withdraw your consent at any time by contacting [email protected] or updating your Account preferences — withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal

7 Sharing Your Data

lt89 does not sell, rent, or commercially disclose your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

7.1 Service Providers

lt89 works with carefully selected third-party service providers who process personal data on lt89's behalf, strictly in accordance with our instructions and applicable data protection law. These include:

• KYC and identity verification providers
• Payment processing partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank)
• Fraud detection and AML screening providers
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) — limited to gaming session data necessary to operate certified games
• Cloud infrastructure and data hosting providers
• Customer support platform providers (live chat and ticketing systems)
• Email and SMS communication service providers (for account notifications and, where consented, marketing)

All service providers engaged by lt89 are subject to contractual data protection obligations that require them to process personal data only for the specified purpose, to maintain appropriate security measures, and to delete or return data upon termination of the service relationship.

7.2 Legal & Regulatory Disclosure

lt89 may disclose your personal data to government bodies, law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law or a valid legal order. lt89 will, where legally permissible, notify you of such disclosure in advance.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of lt89's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy commitments of the successor entity will be communicated to you in advance.

8 Data Retention

lt89 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with lt89's data destruction procedures. Where data is anonymised rather than deleted, it may be retained indefinitely for aggregate analytics purposes, as anonymised data no longer constitutes personal data.

9 Security Measures

lt89 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data in transit between your device and lt89's servers is encrypted using industry-standard SSL/TLS protocols
• Encryption at Rest : Sensitive personal data stored in lt89's databases is encrypted at rest using AES-256 encryption
• Role-Based Access Controls: Access to personal data is restricted to authorised lt89 personnel on a strict need-to-know basis, enforced through role-based access control systems
• Multi-Factor Authentication: Administrative access to lt89's internal systems requires multi-factor authentication (MFA)
• Segregated Data Storage: Personal data, financial records, and gaming data are stored in logically segregated systems to limit the blast radius of any potential security incident
• Penetration Testing: lt89's platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities
• Incident Response Plan: lt89 maintains a documented data breach response procedure. In the event of a security incident that poses a risk to your personal data, lt89 will notify affected players without undue delay
• Staff Training: All lt89 personnel with access to personal data receive regular data protection and information security training

While lt89 takes every reasonable precaution to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for keeping your lt89 Account credentials (username and password) confidential and for logging out of your Account when using shared devices. If you suspect that your Account has been compromised, please contact lt89 support immediately at [email protected].

10 Cookies & Tracking Technologies

lt89 uses cookies and similar tracking technologies on its platform to ensure functionality, enhance your experience, and analyse usage patterns. A cookie is a small text file that is stored on your device when you visit a website. lt89 uses the following categories of cookies:

10.1 Strictly Necessary Cookies

These cookies are essential for the lt89 platform to function. They enable core features such as Account login sessions, security token management, and payment flow continuity. These cookies cannot be disabled without rendering the platform non-functional.

10.2 Performance & Analytics Cookies

These cookies collect anonymised or aggregated information about how players use the lt89 platform — for example, which pages are visited most frequently, how long players spend on each page, and what errors they encounter. This data helps lt89 improve its platform over time. lt89 uses privacy-respecting analytics tools that do not share your data with advertising networks.

10.3 Functional Cookies

These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming reminders — to provide a more personalised experience across sessions. Disabling these cookies may affect certain convenience features of the platform.

10.4 Marketing Cookies

lt89 does not use third-party advertising cookies or retargeting pixels. Where lt89 uses first-party cookies to track promotional campaign performance (e.g., whether you claimed a welcome bonus after clicking a specific link), this is done solely to measure the effectiveness of lt89's own promotions and does not involve sharing your data with external ad networks.

11 Your Data Rights

As a player of lt89, you have the following rights with respect to your personal data. To exercise any of these rights, contact lt89's support team at [email protected] with the subject line "Data Rights Request — [Your Account Username]". lt89 will respond within fourteen (14) business days of verifying your identity.

• Right of Access: You may request a copy of the personal data that lt89 holds about you, along with information about how it is being processed
• Right to Rectification: If any personal data that lt89 holds about you is inaccurate or incomplete, you may request that it be corrected or updated
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Note that lt89 is legally required to retain certain data (such as KYC records and financial transaction records) for specified periods even after Account closure, as set out in Section 8
• Right to Restriction of Processing: You may ask lt89 to temporarily restrict the processing of your personal data — for example, while a rectification request is being resolved
• Right to Data Portability: You may request that lt89 provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), either to you directly or for transfer to another service provider
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. lt89 will cease marketing communications immediately upon receipt of a verified objection
• Rights Related to Automated Decision-Making: Where lt89 makes decisions about your Account using automated processing (such as automated fraud detection), you have the right to request human review of that decision
• Right to Withdraw Consent: Where lt89 processes your data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing

lt89 will not charge a fee for handling standard data rights requests. Where a request is manifestly unfounded or excessive, lt89 reserves the right to charge a reasonable administrative fee or to refuse the request, providing written reasons for doing so.

12 Minors & Age Verification

lt89 is strictly an adults-only platform. The lt89 service is available exclusively to individuals who are aged 21 years or older. lt89 does not knowingly collect personal data from individuals under the age of 21.

All players are required to pass a mandatory age and identity verification process (KYC) before making their first deposit or placing their first wager. KYC documentation must confirm that the player is a real person who is 21 years of age or older at the time of registration.

If lt89 discovers or reasonably suspects that personal data has been collected from an individual under the age of 21, lt89 will:

• Immediately suspend the Account in question pending investigation
• Permanently close the Account if the age violation is confirmed
• Return any deposits made by the underage player to the payment source
• Securely delete all personal data associated with the underage Account

If you are a parent or guardian and believe that an individual under the age of 21 has opened an Account with lt89 using your details or their own, please contact [email protected] immediately. lt89 will investigate and act without delay.

13 International Data Transfers

lt89 primarily stores and processes personal data within secure data centres. In limited circumstances, the use of certain third-party service providers (such as game content providers including Pragmatic Play, Evolution Gaming, Ezugi, and NetEnt, or cloud infrastructure providers) may involve the transfer of personal data to servers located outside Bangladesh.

Where such international transfers occur, lt89 takes the following steps to ensure that your personal data is afforded an equivalent level of protection:

• Transfers are made only to service providers who are contractually bound to maintain data protection standards that are at least equivalent to those described in this Privacy Policy
• lt89 conducts due diligence assessments on all third-party service providers before engaging them, including review of their data protection and information security practices
• Contractual data protection clauses are incorporated into all agreements with service providers who process personal data on lt89's behalf
• The minimum necessary personal data is transferred for the specific purpose — lt89 does not share full player profiles with game content providers; only the data necessary to operate a certified gaming session is transmitted

By registering an Account with lt89 and accepting this Privacy Policy, you acknowledge and consent to the international transfer of your personal data in the limited circumstances described above, subject to the protections set out in this section.

14 Changes to This Privacy Policy

lt89 reserves the right to update or amend this Privacy Policy at any time. Such changes may be made to reflect updates to applicable law, changes in lt89's data processing practices, or improvements in the clarity of our privacy disclosures.

When lt89 makes a material change to this Privacy Policy, the following steps will be taken:

• The updated Privacy Policy will be published at lt89.io/privacy-policy with a revised "Last Updated" date at the top of the document
• Registered Account holders will be notified of material changes via email or an in-platform notification at least seven (7) days before the changes take effect
• Where a change requires fresh consent (for example, a new category of data processing that was not previously disclosed), lt89 will seek that consent from affected players before the new processing begins

Your continued use of the lt89 platform after the effective date of any changes to this Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the updated Privacy Policy, you should cease using the lt89 platform and may request Account closure by contacting [email protected].

lt89 recommends that all players review this Privacy Policy periodically — at minimum, when they receive a notification of changes — to remain informed about how their personal data is being handled.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way lt89 handles your personal data, please contact our support team using any of the following channels. Please include your Account username and a brief description of your enquiry to help us respond as efficiently as possible.

• Email: [email protected] — use subject line "Privacy Request — [Username]"
• WhatsApp: +880 1700-000000
• Live Chat: Available 24/7 directly on the lt89 platform
• Response Time: Acknowledgement within 2 business days; full response within 14 business days of identity verification
• Hours: Bangladesh Standard Time (BST, UTC+6), 24 hours a day, 7 days a week

lt89 is committed to resolving all privacy-related enquiries fairly, transparently, and without undue delay. Our team handles all data rights requests with the utmost confidentiality. We will never share the fact that you have submitted a data rights request with any third party, except where required by law.