li89 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

li89 operates the online casino and sports betting platform accessible at li89.io, serving players primarily located in Bangladesh. For the purposes of this Privacy Policy, li89 acts as the data controller in respect of all personal data collected through the Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which li89 handles your personal data, please contact our dedicated privacy support team:

All privacy-related correspondence must be sent from the email address registered to your li89 Account so that we can verify your identity before processing any data request. If you contact us from an unregistered email address, we may ask you to re-submit your request from your registered address or provide alternative proof of identity.

li89 collects personal data at several points during your relationship with the Platform. The table below sets out each category of data, the specific items within that category, and the reason li89 needs it:

li89 does not collect or store full payment card numbers. Where card payments are facilitated through a third-party payment processor, card data is handled exclusively by that processor under its own PCI-DSS certified environment and is never transmitted to or stored on li89 servers.

li89 processes your personal data only where a lawful basis exists for doing so. The primary legal bases relied upon are as follows:

• Performance of a Contract: The majority of data processing at li89 is necessary to provide the services you have contracted for — registering your account, processing deposits and withdrawals, operating games, and settling bets. Without this processing, li89 cannot perform its contractual obligations to you.
• Legal Obligation: li89 is required by applicable laws and regulations — including anti-money laundering (AML) legislation, know-your-customer (KYC) requirements, and financial crime prevention rules — to collect, verify, and retain certain categories of personal data. This processing is mandatory and cannot be refused or restricted by you without triggering account restrictions.
• Legitimate Interests: li89 processes certain data, particularly Technical Data and Gaming Data, to pursue its legitimate business interests in operating a secure, fair, and commercially sustainable platform. These interests have been assessed to ensure they do not override your fundamental data rights.
• Consent: Where li89 sends you direct marketing communications by email or SMS, this processing is carried out on the basis of your explicit prior consent. You may withdraw consent to marketing communications at any time by updating your notification preferences in your account settings or by contacting our support team.

The personal data li89 collects is used exclusively for the following purposes:

• Account Management: Creating, maintaining, and securing your li89 Account; processing login requests; enforcing the one-account-per-person policy; and managing account closures or suspensions.
• Age and Identity Verification: Confirming that every player on the Platform is at least 21 years of age, as required by li89's responsible gaming commitment and applicable age restriction policies.
• Payment Processing: Facilitating deposits via bKash, Nagad, Rocket, Upay, and supported bank channels; processing withdrawal requests to verified payment methods; and reconciling transaction records.
• AML and Fraud Prevention: Monitoring transaction patterns to detect money laundering, terrorist financing, payment fraud, identity theft, and bonus abuse; filing mandatory reports with competent authorities where required by law.
• Game Operation and Bet Settlement: Recording all game sessions and bet outcomes; resolving player disputes; generating account statements; and auditing game integrity.
• Responsible Gaming Monitoring: Analysing gaming behaviour patterns to identify potential problem gambling indicators; applying player-requested limits and self-exclusion restrictions; and following up with at-risk players where li89's responsible gaming protocols require intervention.
• Customer Support: Responding to support enquiries; resolving complaints; and maintaining records of interactions for quality assurance and training purposes.
• Platform Security: Detecting and blocking unauthorised access attempts; identifying and mitigating bot activity; preventing account takeover attacks; and maintaining the integrity of the Platform infrastructure.
• Marketing Communications (Consent-Based Only): Sending you promotional offers, bonus notifications, and seasonal campaign communications — including those tied to BPL season, IPL, Eid, Pohela Boishakh, and other relevant events — where you have given your explicit prior consent to receive such communications.
• Legal Compliance: Meeting record-keeping requirements; responding to lawful requests from competent authorities; and defending li89's legal rights in disputes or proceedings.

li89 does not use automated decision-making processes (including profiling) that produce legal or similarly significant effects on you without human review. Where algorithmic tools are used to flag accounts for review (for example, in fraud detection), a human member of the compliance team reviews the flag before any account action is taken.

li89 does not sell your personal data to any third party. li89 may share your personal data with the following categories of recipient, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners receive the transaction data and account identifiers necessary to process deposits and withdrawals. Each payment partner operates under its own privacy policy and applicable financial regulations.
• Identity Verification Services: Third-party KYC and identity verification providers may receive your identity documents and personal details for the purpose of completing the verification process. li89 engages only reputable, certified verification service providers.
• Game Studio Partners: Providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi receive session data — including player ID and bet information — necessary to operate their games on the Platform. These providers are bound by contractual data protection obligations.
• IT and Cloud Infrastructure Providers: li89 uses third-party server hosting and cloud infrastructure services. Data stored on these platforms is subject to strict contractual data processing agreements and is not accessible to the provider for any purpose other than infrastructure operation.
• Fraud Detection and AML Service Providers: Specialist third-party services may assist li89 in screening transactions and player activity against financial crime databases. Data shared for this purpose is limited to what is strictly necessary.
• Competent Authorities: li89 will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where required to do so by applicable law, valid legal process, or court order. li89 will notify you of any such disclosure where it is legally permitted to do so.

li89 uses cookies and similar tracking technologies to operate the Platform correctly, maintain your session, and improve your experience. A cookie is a small text file placed on your device by a website. Cookies cannot run programmes or deliver viruses to your device; their sole function is to store small amounts of data.

li89 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as maintaining your logged-in session, remembering items in your account, and applying your security preferences. These cookies cannot be disabled without affecting the Platform's operation.
• Performance and Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform — for example, which pages are visited most frequently and whether error messages are encountered. This data is used solely to improve Platform performance. No personally identifiable information is collected via analytics cookies.
• Functional Cookies: These cookies remember preferences you have set — such as your preferred language and notification settings — so that the Platform can provide a more personalised experience on subsequent visits.
• Security Cookies: These cookies support li89's fraud detection and account security systems by identifying unusual login patterns or access from unfamiliar devices, helping to protect your account from unauthorised access.

li89 does not use third-party advertising cookies or behavioural targeting cookies that track your activity across websites other than li89.io.

li89 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account and Identity Data: Retained for the lifetime of your Account and for a minimum of 5 years following permanent Account closure, in order to comply with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, as required by applicable financial crime prevention legislation.
• KYC Documents: Retained for a minimum of 5 years following Account closure or the completion of the KYC process, whichever is the later.
• Gaming and Betting History: Retained for 3 years from the date of each game session or bet, for dispute resolution, auditing, and regulatory compliance purposes.
• Customer Support Records: Retained for 2 years from the date of the final interaction in each support case, for quality assurance and dispute resolution purposes.
• Marketing Preference Records: Consent records are retained for the duration of your Account and for 2 years following Account closure, to demonstrate compliance with consent obligations.
• Technical and Security Logs: Retained for 12 months on a rolling basis, for security monitoring and incident investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and business analytics purposes.

li89 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and li89 servers is protected using 256-bit SSL/TLS encryption. li89.io enforces HTTPS across the entire Platform; unencrypted HTTP connections are redirected automatically.
• Encryption at Rest: Sensitive data fields stored in li89 databases — including identity document information and financial data — are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to systems containing personal data is restricted to li89 personnel and contractors on a strict need-to-know basis. All access is logged and subject to periodic review. Privileged access requires multi-factor authentication.
• Password Security: Player account passwords are stored using one-way cryptographic hashing. li89 staff cannot retrieve your password in plain text. You are responsible for maintaining the confidentiality of your account credentials.
• Penetration Testing: li89 engages independent security specialists to conduct regular penetration tests and vulnerability assessments of the Platform infrastructure.
• Incident Response: li89 maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, li89 will notify you promptly and take all appropriate remedial action.

Subject to applicable law, you have the following rights in respect of the personal data li89 holds about you:

• Right of Access: You may request a copy of all personal data li89 holds about you. li89 will provide this in a structured, readable format within 30 days of receiving a valid request.
• Right to Rectification: If any personal data li89 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update most account details directly in your account settings; for changes to identity data, please contact support.
• Right to Erasure: You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. This right is subject to li89's legal obligation to retain certain data categories for defined periods (see Section 7). li89 will inform you if any requested deletion cannot be carried out in full and explain the reason.
• Right to Restriction: You may request that li89 restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is carried out on the basis of your consent or the performance of a contract, you may request that li89 provide your personal data in a portable, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object to processing carried out on the basis of li89's legitimate interests. li89 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please send your request to [email protected] from your registered email address, clearly stating the right you wish to exercise and providing sufficient detail to allow li89 to identify your account and the specific data concerned. li89 will respond within 30 days. In complex cases this period may be extended by a further 30 days, in which case li89 will notify you of the extension and the reason for it.

li89 is strictly an adults-only platform. No person under the age of 21 is permitted to register an account, use any service, or access any feature of the Platform. li89 does not knowingly collect personal data from any individual under the age of 21.

If li89 discovers that personal data has been collected from a person under the age of 21 — whether through fraudulent registration or any other means — li89 will immediately close the relevant account, delete the associated personal data (subject to any mandatory AML retention obligations), and void all transactions associated with that account.

If you are a parent or guardian and you believe that a person under your care has registered an account on li89, please contact our support team immediately at [email protected]. We will investigate and take prompt action. li89 supports the use of parental control software to restrict access to gambling websites for households with minors.

li89 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, the services li89 offers, or the ways in which li89 processes personal data. The "Effective" date at the top of this page indicates when the current version came into force.

Where changes to this Privacy Policy are material — for example, where li89 introduces a new category of data processing or changes the basis on which data is shared with third parties — li89 will provide at least 14 days' advance notice by posting a prominently displayed notice on the Platform and, where practicable, sending an email notification to your registered email address.

Where changes are non-material — for example, minor clarifications to existing descriptions that do not alter the substance of the processing — li89 may update the Policy without prior individual notice, relying solely on the updated "Effective" date as the notification mechanism.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any material change to this Privacy Policy, you should close your Account before the effective date of the change and request deletion of your personal data in accordance with the process described in Section 9.

The current version of this Privacy Policy is always available at li89.io/privacy-policy. Previous versions are available upon request by contacting [email protected].