Privacy Policy — How lu9 Handles Your Personal Data

1. Who We Are

lu9 ("we", "us", "our") operates the online betting and casino platform accessible at lu9.bet. lu9 is the data controller responsible for personal data collected through the Platform. For any privacy-related enquiry, you may contact our data protection team at [email protected]. We aim to respond to all privacy enquiries within 10 business days.

2. Legal Basis for Processing

lu9 processes your personal data on the following legal grounds:

• Contract performance: processing necessary to operate your account, process deposits and withdrawals, and deliver the betting and gaming services you have requested.
• Legal obligation: processing required to comply with anti-money laundering (AML) laws, age verification requirements, and financial record-keeping obligations.
• Legitimate interests: processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving service quality — where those interests are not overridden by your data protection rights.
• Consent: processing for optional purposes such as marketing communications, where you have given explicit and freely withdrawable consent at registration or subsequently.

3. How We Use Your Data

lu9 uses the personal data we collect for the following purposes:

• Creating, verifying, and managing your lu9 account, including enforcing the one-account-per-player rule.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard in Bangladeshi Taka (BDT).
• Verifying your age (21+) and identity in compliance with responsible gaming and AML obligations.
• Detecting and preventing fraud, money laundering, and other prohibited conduct on the Platform.
• Operating responsible gaming tools including deposit limits, loss limits, cooling-off periods, and self-exclusion.
• Providing customer support and resolving disputes relating to bets, transactions, or account issues.
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and security alerts — these are not optional as they are necessary for account operation.
• Sending optional marketing communications about lu9 promotions, bonuses, and new game releases — only where you have opted in.
• Conducting aggregate analytics to understand how players use the Platform and improve our products and services.
• Complying with applicable legal requirements, including responding to lawful requests from competent authorities.

4. Sharing Your Data

4.1  lu9 does not sell your personal data. We share personal data only with the following categories of trusted third parties, and only to the extent necessary for the purposes described in this Policy:

• Payment processors: bKash, Nagad, Rocket, Upay, and our card payment gateway partners require transaction data to execute deposits and withdrawals. Each payment partner operates under its own privacy and security standards.
• Identity verification providers: third-party KYC service providers who assist us in verifying player identity and age documents. These providers are bound by strict data processing agreements.
• Game software providers: providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised session data as required to operate their games on the Platform. They do not receive your name, payment details, or contact information.
• Analytics providers: anonymised and aggregated usage data may be processed by analytics tools to help lu9 understand overall Platform performance. No individually identifiable data is shared for this purpose.
• Legal and regulatory authorities: lu9 will disclose personal data to competent authorities where required to do so by applicable law, court order, or to protect the legal rights and safety of lu9 and its players.

4.2  Where lu9 engages third-party data processors, we require them to handle your data securely, use it only for the specified purpose, and comply with standards equivalent to those set out in this Policy. We do not transfer your data to processors in jurisdictions without adequate data protection safeguards without implementing appropriate protective measures.

5. Cookies Policy

5.1  lu9 uses the following types of cookies on the Platform:

• Strictly necessary cookies: essential for the Platform to function — for example, keeping you logged in during a session. These cannot be disabled without impairing platform functionality.
• Preference cookies: used to remember your language and display settings so you do not have to re-enter them on each visit.
• Analytics cookies: anonymised identifiers used to track aggregate page views, feature usage, and session durations. These help lu9 understand how players navigate the Platform so we can improve it.

5.2  lu9 does not use third-party advertising cookies or behavioural tracking technologies that build profiles of individual users for advertising retargeting purposes. You may manage browser-level cookie settings at any time through your device's browser settings menu. Blocking strictly necessary cookies may impair your ability to log in and use the Platform.

6. Data Security

6.1  lu9 implements technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include SSL/TLS encryption for all data in transit, hashed password storage (we never store plain-text passwords), role-based access controls limiting which staff can access player data, and regular security reviews of our platform and third-party integrations.

6.2  Despite these measures, no internet transmission or electronic storage system is completely secure. lu9 cannot guarantee absolute data security. In the event of a data breach that is likely to result in a risk to your rights, lu9 will notify affected players within a reasonable timeframe and take steps to mitigate potential harm.

6.3  You play an important role in keeping your account secure. Use a strong, unique password for your lu9 account, do not share it with anyone, and contact [email protected] immediately if you suspect unauthorised access to your account.

7. Data Retention

7.1  lu9 retains personal data for as long as your account remains open and for a period thereafter as required by law or legitimate business need. The following retention periods apply as general guidance:

• Account data (name, email, username): retained for the duration of the account and for up to 2 years after permanent closure, unless a longer period is required by law.
• KYC/identity documents: retained for up to 5 years from the date of submission, or longer if required by applicable AML obligations.
• Financial transaction records: retained for up to 7 years from the date of the transaction to comply with financial record-keeping requirements.
• Gameplay logs and bet history: retained for up to 3 years from the date of the recorded activity, used to resolve disputes and support responsible gaming reviews.
• Support communications: retained for up to 2 years from the date of the last interaction, used to maintain service quality and resolve recurring issues.
• Marketing consent records: retained for as long as your consent is active, plus 1 year after withdrawal of consent, to demonstrate compliance.

7.2  Upon expiry of the applicable retention period, personal data is securely deleted or pseudonymised so that it can no longer be attributed to you as an individual.

8. Children & Minors

lu9 is strictly intended for players aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If lu9 discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be permanently closed. If you believe a person under the age of 21 has registered on lu9, please notify us at [email protected] immediately.

9. Links to Third-Party Services

The lu9 Platform does not contain links to external third-party websites. However, payment processing redirects (for example, to the bKash or Nagad payment interface) are governed by those providers' own privacy policies. lu9 is not responsible for the privacy practices of third-party payment providers. We encourage you to review the privacy policies of bKash, Nagad, Rocket, Upay, Visa, and Mastercard before providing payment information to them.

10. Changes to This Policy

10.1  lu9 reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered players via email or a prominent notice on the Platform at least 7 days before the change takes effect. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

10.2  Continued use of lu9 after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with a material change, you should close your account before the change takes effect by contacting [email protected].

11. Contact & Complaints

For any privacy-related enquiry, request to exercise your rights, or complaint about how lu9 handles your personal data, please contact our data protection team at: [email protected]. We aim to acknowledge all privacy enquiries within 3 business days and to provide a substantive response within 10 business days.