Privacy Policy — How l89 baji Protects Your Data

1 Information We Collect

l89 baji collects personal data only to the extent necessary to deliver a safe, reliable, and legally compliant online casino and sports betting service to players in Bangladesh. We do not collect data speculatively or beyond what our operational, legal, and security obligations require. The categories of information we collect fall into three broad groups: information you provide directly, information generated automatically during your use of the platform, and information received from third-party partners.

1.1 Information You Provide Directly

When you register an account on l89 baji, place a bet, make a deposit or withdrawal, contact our support team, or participate in a promotion, you may provide us with the following categories of personal information:

• Identity Data: Full legal name, date of birth, gender, and National Identity Card (NID) number or passport number as part of the KYC verification process.
• Contact Data: Email address, mobile phone number, and residential address (district and division within Bangladesh, or international address where applicable).
• Account Credentials: Chosen username and a hashed (never plaintext) version of your password.
• Financial Data: bKash account number, Nagad account number, Rocket number, Upay number, bank account details, or card details (Visa/Mastercard) used for deposits and withdrawals. Full card numbers are not stored on our servers — payment processing is handled by our certified payment partners.
• Verification Documents: Scanned or photographed copies of government-issued identity documents submitted during the KYC process, including NID cards, passports, and driving licences.
• Communications Data: The content of any messages sent to our support team via live chat, email, or any other support channel, including your contact history and the resolution of each interaction.

1.2 Information Collected Automatically

When you visit l89 baji and interact with the platform — whether on desktop or mobile — certain technical and behavioural data is collected automatically through our systems, cookies, and analytics tools:

• Device and Technical Data: IP address, browser type and version, operating system, device type (desktop, smartphone, tablet), screen resolution, and language settings.
• Usage Data: Pages visited, time and duration of each session, games played, bet amounts and frequencies, features accessed, and navigation paths through the platform.
• Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS location data unless you explicitly grant permission through a mobile browser prompt.
• Log Data: Server-side access logs recording timestamps, session identifiers, and platform events for security monitoring and fraud prevention purposes.

1.3 Information Received from Third Parties

In limited circumstances, we may receive information about you from third-party partners. This includes identity verification results from our KYC provider, transaction confirmation data from payment processors such as bKash, Nagad, and Rocket, and fraud risk signals from our security partners. We handle all third-party sourced data with the same degree of care and confidentiality as data you provide to us directly.

2 How We Use Your Information

Every use of your personal data at l89 baji is grounded in a specific, legitimate purpose. We do not process personal data for purposes that are incompatible with those disclosed at the time the data was collected. The table below summarises our primary processing purposes alongside the legal basis on which each rests.

2.1 Responsible Gaming Use of Data

l89 baji is committed to using player data proactively to support responsible gaming. Our systems monitor betting patterns and session durations to identify early indicators of problem gambling behaviour. Where such indicators are detected, our responsible gaming team may make direct contact via the registered email address or live chat to offer assistance, suggest the use of deposit limit or cool-off tools, or provide information about external support resources. This monitoring is conducted in the player's interest and is not used for commercial profiling purposes.

2.2 Marketing Communications

We will only send promotional emails, SMS messages, or in-platform notifications about offers, bonuses, and seasonal promotions if you have provided explicit consent to receive such communications during or after registration. You may withdraw your consent to receive marketing communications at any time by updating your account notification preferences or by contacting support at [email protected]. Withdrawal of marketing consent does not affect the legal processing of your data for contract or compliance purposes.

3 Sharing and Disclosure of Data

l89 baji does not sell, rent, or trade your personal data to third parties for their own commercial purposes under any circumstances. Data is shared only in the limited, specific circumstances described below, and always subject to contractual confidentiality obligations or legal requirements.

3.1 Service Providers and Partners

To operate the platform, we engage a small number of carefully vetted third-party service providers who process data strictly on our behalf and under our documented instructions. These include:

• Payment Processors: bKash, Nagad, Rocket, Upay, and banking partners receive transaction data necessary to process your deposits and withdrawals. Each processor operates under its own privacy policy and is subject to applicable Bangladeshi financial regulations.
• KYC and Identity Verification Providers: Our third-party KYC partner receives identity document images and personal data solely to conduct the age and identity verification required to comply with our anti-money-laundering obligations.
• Game Studio Providers: When you play games supplied by studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, session and game-outcome data may be shared with the relevant provider for game integrity and dispute resolution purposes. No financial data is shared with game studios.
• Analytics and Security Providers: Anonymised or pseudonymised usage data may be shared with analytics partners to support platform performance improvements and with security vendors to aid in fraud detection and DDoS protection.
• Cloud Infrastructure Providers: Our platform is hosted on enterprise-grade cloud infrastructure. Your data resides on servers that are protected by industry-standard physical and logical security controls.

3.2 Legal and Regulatory Disclosure

We may be required to disclose your personal data to government bodies, law enforcement agencies, or regulatory authorities where we are under a legal obligation to do so. Such disclosures will be made only to the extent required by applicable law, and we will notify you of any such disclosure where we are legally permitted to do so.

4 Cookies and Tracking Technologies

l89 baji uses cookies and similar tracking technologies to make the platform function correctly, to keep your session active while you are logged in, and to improve the overall experience for players. This section explains what cookies are, which types we use, and how you can manage your preferences.

4.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to remember information about your visit — such as your login session, language preferences, and which pages you have viewed. Cookies do not contain executable code and cannot access other files on your device.

4.2 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the platform to function and cannot be disabled. They manage your login session, maintain your wallet balance display, and protect against cross-site request forgery (CSRF) attacks. No personal data is shared with third parties through these cookies.
• Performance and Analytics Cookies: These cookies collect anonymised information about how visitors interact with the platform — which pages are visited most, where errors occur, and how load times vary across devices. This data is used to improve platform performance and user experience.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, last-used payment method, and display settings — so you do not have to re-enter them on every visit.
• Responsible Gaming Cookies: These cookies store your active deposit limit, cool-off period, and session time reminder settings locally to ensure these protections remain active consistently across sessions, even before the platform server confirms your settings.

4.3 Managing Cookie Preferences

You may manage non-essential cookie categories through your browser settings at any time. Most modern browsers allow you to block or delete cookies through the privacy or settings menu. Please be aware that disabling strictly necessary cookies will prevent the platform from functioning correctly — in particular, you will not be able to maintain a logged-in session. Disabling performance or functional cookies will not prevent you from using the platform but may reduce the convenience of your experience.

5 Data Retention and Storage

l89 baji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. We do not retain data indefinitely, and we apply structured review cycles to ensure that data no longer needed is securely deleted or anonymised.

5.1 Retention Periods by Data Category

• Account and Identity Data: Retained for the duration of your active account plus 5 years following account closure, in accordance with standard record-keeping obligations applicable to financial service providers.
• Transaction and Financial Data: Retained for 7 years from the date of the transaction to support financial audit trails and anti-money-laundering record-keeping requirements.
• KYC Verification Documents: Retained for 5 years following account closure or the last KYC review, whichever is later.
• Customer Support Communications: Retained for 3 years from the date of the last interaction, to support dispute resolution and quality assurance processes.
• Usage and Analytics Data: Anonymised and retained for up to 2 years for platform performance analysis. Identifiable usage logs are deleted within 90 days.
• Marketing Consent Records: Retained for 5 years from the date of consent or withdrawal, to demonstrate compliance with consent obligations.

5.2 Data Deletion and Anonymisation

When a retention period expires, data is either permanently deleted from our systems or irreversibly anonymised such that it can no longer be linked to any identifiable individual. Deletion requests submitted by players (see Section 6) are processed within 30 days, subject to any overriding legal obligation to retain specific records.

6 Your Privacy Rights

l89 baji respects your right to understand and control how your personal data is used. As a player on this platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our data privacy team at [email protected] with the subject line "Privacy Rights Request" and a clear description of the right you wish to exercise.

• Right of Access: You have the right to request a copy of all personal data we hold about you, along with information about how that data is being used and stored. We will provide this information within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay. For account details such as your email address, mobile number, and residential address, you may update these directly from your account dashboard.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis for processing applies. Please note that we may be required to retain certain data categories for regulatory compliance purposes even after an erasure request.
• Right to Restrict Processing: In certain circumstances, you may request that we temporarily halt the processing of your personal data — for example, while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) for the purpose of transferring it to another service provider.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing based on our legitimate interests, though we may be able to demonstrate compelling grounds that override your objection in specific cases.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

7 Security Measures We Apply

The security of your personal and financial data is a top operational priority at l89 baji. We apply a layered, defence-in-depth approach to information security that combines technical controls, operational procedures, and staff training to minimise the risk of unauthorised access, data loss, or misuse.

7.1 Technical Security Controls

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the l89 baji platform is encrypted using industry-standard 256-bit SSL/TLS protocols, ensuring that your login credentials, payment details, and personal information are protected in transit.
• Password Hashing: Account passwords are never stored in plaintext. They are processed through a one-way cryptographic hashing algorithm (bcrypt with a high work factor) before storage, meaning that even in the unlikely event of a database breach, your password cannot be recovered in readable form.
• Two-Factor Authentication (2FA): Players are encouraged to enable OTP-based two-factor authentication for their accounts. When 2FA is active, a one-time password is sent to your registered mobile number each time you log in from a new device or location.
• Firewall and Intrusion Detection: Our platform infrastructure is protected by enterprise-grade firewalls and real-time intrusion detection systems that monitor for anomalous access patterns, brute-force attempts, and other known attack vectors around the clock.
• Regular Security Audits: Our platform undergoes periodic third-party security assessments to identify and remediate vulnerabilities before they can be exploited. Findings from these audits are acted upon under a structured remediation programme.

7.2 Data Breach Procedures

In the event that a data breach occurs which is likely to result in a risk to your rights and freedoms, l89 baji will notify affected players without undue delay — and in any event within 72 hours of becoming aware of the breach — by email to the registered address on your account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures we are taking or propose to take to address the breach and mitigate its effects.

8 Changes to This Privacy Policy

l89 baji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made — that is, changes that significantly affect your rights or how we use your data — we will notify you by email to your registered address and by displaying a prominent notice on the platform for a period of at least 14 days before the changes take effect.

For minor, non-material updates (such as corrections of typographical errors or clarifications that do not alter the substance of any provision), the updated policy will be published on this page with an updated "Last Reviewed" date, and no individual notification will be sent. We encourage all players to review this Privacy Policy periodically to remain informed of how we protect their data.

Continued use of the l89 baji platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any updated version of this policy, you should cease using the platform and contact support at [email protected] to discuss the closure of your account and the handling of any remaining balance.