lu99 Privacy Policy

1. Introduction

lu99 operates the online casino and sports betting platform available at https://lu99.pro (the "Platform"). This Privacy Policy sets out how lu99 collects, uses, stores, and protects the personal information of registered account holders and visitors. We are committed to handling personal data with transparency and integrity.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy. Terms defined in those documents carry the same meaning here unless separately defined.

2. Information We Collect

lu99 collects personal information in two main ways: information you provide directly when interacting with the Platform, and information collected automatically as you use it.

Information you provide to us:

• Registration data: your name, date of birth, mobile phone number (used as your primary account identifier), and any other details submitted during account creation.
• Identity verification documents: national identity card, passport, or other government-issued ID submitted as part of the KYC process.
• Financial information: payment method details linked to deposits and withdrawals, including bKash account numbers, Nagad wallet IDs, and card details for Visa or Mastercard transactions. Full card numbers are never stored by lu99.
• Support communications: messages, queries, and complaints submitted to the lu99 support team through any contact channel.

Information collected automatically:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and mobile network operator (e.g. Grameenphone, Robi, Banglalink).
• Usage data: pages visited, time spent on each page, games played, bet amounts, session durations, deposit and withdrawal history, and clickstream data.
• Cookie and tracking data: session cookies, persistent cookies, and similar technologies that help lu99 maintain session state and understand how users interact with the Platform. See Section 7 for full details.

3. How We Use Your Information

lu99 uses collected personal information solely for the specific purposes listed below. We do not use personal data for any purpose incompatible with these without your prior consent.

• Account management: to create, maintain, and administer your lu99 account, process deposits and withdrawals, resolve payment disputes, and communicate account-related information.
• Identity verification and KYC compliance: to verify your identity, confirm your age (21+ requirement), and meet anti-money laundering obligations.
• Platform security and fraud prevention: to detect and prevent fraudulent activity, unauthorised account access, multi-accounting, and other violations of the lu99 Terms & Conditions.
• Responsible gaming monitoring: to observe gaming behaviour for indicators of problem gambling, and to administer self-exclusion, deposit limits, and other responsible gaming tools requested by account holders.
• Customer support: to respond to queries, process complaints, and improve support quality. Communications may be recorded and retained for training and quality assurance purposes.
• Platform improvement and analytics: to analyse aggregated usage data, improve the user interface, test new features, and personalise the gaming experience where permitted. Analytics data is anonymised wherever practicable.

4. Legal Basis for Processing

lu99 processes personal data only where a valid legal basis exists. The bases on which lu99 relies are:

• Contractual necessity: processing required to perform the contract between lu99 and the account holder, including account registration, payment processing, and delivery of gaming services.
• Legal obligation: processing required to comply with anti-money laundering laws, age verification requirements, and other applicable legal or regulatory obligations.
• Legitimate interests: processing for fraud detection, platform security, responsible gaming monitoring, and analytics, where these interests are not overridden by the rights of the data subject.
• Consent: where lu99 sends direct marketing communications or uses non-essential cookies, this is done only on the basis of your prior consent, which you may withdraw at any time.

5. Sharing Your Information

lu99 does not sell, rent, or trade your personal data to third parties for commercial purposes. Data may be disclosed to the following categories of recipients only where strictly necessary and subject to appropriate safeguards:

• Payment processors: bKash, Nagad, Rocket, Upay, and card payment networks receive only the minimum data required to process transactions on behalf of lu99 account holders.
• Identity verification and KYC providers: third-party services used to verify the identity and age of account holders as required by compliance obligations.
• Fraud prevention and security providers: specialist services used to detect suspicious activity, bot traffic, and other threats to platform integrity.
• Law enforcement and regulatory authorities: lu99 will disclose personal data to law enforcement or regulatory bodies where required by law, court order, or in connection with investigation of suspected criminal activity.

All third-party recipients are required to handle personal data in accordance with applicable data protection standards and may not use it for any purpose beyond the specific service they provide to lu99.

6. Payment Data and Financial Information

lu99 gives special attention to the security of financial information. Transactions processed via bKash, Nagad, Rocket, and Upay are handled through the secure APIs of those respective providers. lu99 retains transaction records — including transaction IDs, amounts, timestamps, and the last four digits of card numbers where applicable — for account management, dispute resolution, and AML compliance. Full card numbers and mobile banking PINs are never stored on lu99 servers.

If lu99 suspects a payment is linked to fraudulent activity or money laundering, we are legally obligated to suspend that transaction and report it to the appropriate authorities. Affected account holders will not be notified of such reports where notification would compromise an ongoing investigation.

7. Cookies and Tracking Technologies

lu99 uses cookies and similar technologies to keep the Platform functioning correctly, to remember your session, and to understand how users interact with the site. A cookie is a small text file placed on your device when you visit a website. Cookies do not contain executable code and cannot access other data on your device.

Types of cookies lu99 uses:

• Essential cookies: strictly necessary for the Platform to function, including session authentication tokens, security cookies, and language-preference cookies. Disabling these will break core Platform features.
• Analytics cookies: collect aggregated, anonymised data about how users navigate the Platform. This helps identify low-performing pages, reduce load times, and optimise the mobile experience for Bangladesh users on varying network conditions.
• Preference cookies: remember choices you make on the Platform — such as your preferred language version — so these settings persist across sessions without requiring re-selection on each visit.

You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality. lu99 does not use third-party advertising cookies or cross-site tracking technologies.

8. Data Retention

lu99 retains personal data only as long as necessary to fulfil the purposes for which it was collected, or as required by law. General retention periods: account data is kept for the duration of the account relationship and for five (5) years after account closure; transaction records are retained for a minimum of five (5) years from the transaction date in line with AML record-keeping obligations; support communications are retained for two (2) years from the date of the last interaction.

Where personal data is no longer required for any legitimate purpose, lu99 will delete or irreversibly anonymise it. Data may be held longer where an ongoing legal dispute, investigation, or regulatory obligation requires its preservation.

9. Your Rights Over Your Personal Data

lu99 respects your rights over your personal data. You may exercise any of the following rights by contacting lu99 support at the details provided in Section 13. lu99 will acknowledge your request within 5 business days and aim to resolve it within 30 days.

• Right of access: request a copy of the personal data lu99 holds about you, together with information about how it is used and with whom it has been shared.
• Right to rectification: request correction of any inaccurate or incomplete personal data held by lu99. Minor corrections such as phone number updates can often be made directly via your account settings.
• Right to erasure: request deletion of your personal data where it is no longer necessary for its original purpose, where you withdraw consent, or where it has been unlawfully processed. This right is subject to lu99's legal retention obligations.
• Right to restrict processing: request that lu99 limit processing of your data in certain circumstances — for example, while the accuracy of disputed data is being verified.
• Right to object: object to processing based on legitimate interests, including responsible gaming profiling. lu99 will cease that processing unless it can demonstrate compelling grounds that override your interests.

To exercise any of these rights, contact lu99 support at [email protected]. Note that exercising certain rights — such as erasure — may require account closure where account operation depends on the data in question. lu99 charges no fee for good-faith rights requests.

10. Data Security

lu99 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These include SSL/TLS encryption for all data in transit, encrypted storage of sensitive account data at rest, access controls limiting data access to authorised personnel on a need-to-know basis, regular security assessments of the Platform, and multi-factor authentication options for account access.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a personal data breach likely to result in risk to account holders' rights and freedoms, lu99 will notify affected individuals without undue delay and take immediate steps to contain and remediate the breach.

11. Children's Privacy and Age Restriction

lu99 is an adults-only platform for users aged 21 and above. lu99 does not knowingly collect personal data from any person under the age of 21. If lu99 discovers that personal data has been collected from someone under 21, that data will be deleted immediately and the associated account closed. If you are a parent or guardian and believe a minor has registered on lu99 or provided personal information, contact support immediately at [email protected].

12. Changes to This Privacy Policy

lu99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the structure of the Platform. When material changes are made, lu99 will update the "Last updated" date at the top of this page and, where changes are significant, will make reasonable efforts to notify registered account holders via their registered contact details.

Your continued use of lu99 following publication of a revised Privacy Policy constitutes acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how lu99 protects your personal data.

13. Contact and Data Queries

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a potential data security issue, please contact the lu99 support team. All data-related requests are handled with strict confidentiality.

Email us at: [email protected]