l889 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy describes how l889 ("we", "us", "our") collects, processes, stores, shares, and protects personal data relating to individuals ("you", "the Player") who access or use the l889 Platform at l889.io, including any associated mobile applications, sub-domains, and related services.

This Policy applies to all personal data collected through the l889 Platform regardless of the device or method used to access it. It covers data collected at registration, during ongoing account use, through customer support interactions, via payment processing, and through automatic means such as cookies and server logs.

By creating an account or continuing to use the l889 Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy is incorporated by reference into the l889 Terms & Conditions. If any conflict exists between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail unless this Policy explicitly states otherwise.

For the purposes of this Privacy Policy, the data controller responsible for your personal data is the entity operating the l889 Platform under the brand name l889, reachable at l889.io. The data controller determines the purposes and means of processing your personal data as described in this Policy.

If you have any questions about the identity of the data controller, or wish to exercise any of your data rights, you may contact us directly at:

• Email: [email protected]
• Platform: l889.io
• Support hours: 24/7, Bangladesh Standard Time (UTC+6)

Where l889 engages third-party service providers to process data on its behalf (for example, payment processors or identity verification providers), those providers act as data processors under instruction from l889 and are bound by data processing agreements that restrict how they may use your data.

l889 collects the following categories of personal data. The specific data collected in each category depends on the nature of your interaction with the Platform:

l889 uses your personal data for the following purposes. Each purpose is linked to one or more legal bases described in Section 5:

• Account Management: Creating, maintaining, and securing your l889 player account, including password resets, two-factor authentication, and account notifications.
• Identity & Age Verification (KYC): Verifying that you meet the 21+ age requirement and that your identity matches your payment method, as required before withdrawal processing.
• Payment Processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported Bangladeshi banks.
• Service Delivery: Providing access to sports betting markets, live cricket betting, casino games, slots, fish shooting games, and all other l889 Platform features.
• Fraud & Security: Detecting and preventing fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorised account access.
• Regulatory Compliance: Meeting anti-money laundering (AML), know-your-customer (KYC), and responsible gaming obligations.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and improving the quality of our support service.
• Responsible Gaming: Monitoring betting patterns for signs of problem gambling and administering self-exclusion, deposit limits, and cool-off tools where requested.
• Platform Improvement: Analysing usage data in aggregate to identify technical issues, improve game performance, optimise the user interface, and develop new features.
• Marketing (where consented): Sending promotional emails, bonus offers, and personalised game recommendations to players who have opted in to marketing communications.

l889 does not use your personal data for automated decision-making that produces significant legal effects on you, except where required by law (for example, automated fraud scoring that may trigger account suspension pending human review).

l889 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform the contract between you and l889 (the Terms & Conditions). This covers account creation, payment processing, game access, and withdrawal management.
• Legal Obligation: Processing is required to comply with applicable laws, including anti-money laundering regulations, KYC requirements, and responsible gaming obligations.
• Legitimate Interests: Processing is necessary for l889's legitimate business interests, including fraud prevention, platform security, customer support quality, and aggregate analytics — provided those interests are not overridden by your fundamental rights.
• Consent: For marketing communications (email, SMS) and for the use of non-essential cookies, l889 relies on your freely given, specific, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

l889 uses cookies and similar tracking technologies (including local storage, session tokens, and pixel tags) to operate the Platform, remember your preferences, and collect usage analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session management cookies that keep you logged in, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cookies cannot be disabled without breaking the Platform.
• Functional Cookies: Remember your preferences such as language, display settings, and responsible gaming limits. Disabling these cookies may reduce Platform functionality but will not prevent access.
• Analytics Cookies: Used to collect aggregate, anonymised data about how players use the Platform — which pages are visited most, where users drop off in the registration flow, and which games are most popular. This data is used solely to improve the Platform and is not linked to individual player identities for marketing purposes.
• Security Cookies: Support fraud detection and multi-account identification by collecting device fingerprint data including browser version, screen resolution, installed fonts, and timezone offset.

l889 does not sell, rent, or trade your personal data. We share your data only where necessary and only with the following categories of trusted recipients, each bound by strict confidentiality and data processing obligations:

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported Bangladeshi banks receive the minimum personal and financial data necessary to process your deposit or withdrawal transaction.
• Identity Verification Providers: Third-party KYC service providers receive your identity documents and personal details to perform age and identity verification checks. These providers are contractually prohibited from using your data for any purpose other than verification.
• Game Technology Providers: Game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive a pseudonymous player identifier (not your real name or contact details) to facilitate game sessions and maintain fair play records.
• Fraud & Security Platforms: Anti-fraud and device fingerprinting service providers may receive technical data (IP address, device fingerprint) to support fraud detection and multi-account identification.
• Customer Support Tools: Support ticketing and live chat software providers may process the content of your support communications. These providers act as data processors under l889's instruction.
• Legal & Regulatory Authorities: l889 will disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law, a court order, or a binding legal request. Where legally permitted, l889 will notify you of such a disclosure.

Some of l889's third-party service providers (including game technology providers and cloud infrastructure partners) may be based outside Bangladesh and may process your personal data in jurisdictions with different data protection laws. Where such transfers occur, l889 ensures appropriate safeguards are in place, including:

• Contractual data processing agreements that impose obligations equivalent to applicable data protection standards on the receiving party.
• Use of providers that maintain recognised security certifications (such as ISO 27001 or SOC 2 Type II) and that operate within jurisdictions offering an adequate level of data protection.
• Pseudonymisation of player data where technically feasible before transfer, so that the receiving party receives the minimum identifiable information necessary to perform their function.

If you would like further information about the safeguards in place for any specific international transfer, please contact l889 support at [email protected].

l889 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to any overriding legal, regulatory, or compliance obligations. The following general retention periods apply:

At the end of the applicable retention period, personal data is securely and irreversibly deleted or anonymised so that it can no longer be linked to any individual. Where data is anonymised rather than deleted, the resulting anonymised dataset may be retained indefinitely for aggregate analytics purposes.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your personal data held by l889:

• Right of Access: You may request a copy of all personal data l889 holds about you. l889 will respond within 30 days of receiving a verified request.
• Right to Rectification: If any personal data held about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account information directly from your account settings; for identity data, contact support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where you object to processing and l889 has no overriding legitimate grounds. Note that this right is subject to l889's legal obligations to retain certain data (see Section 9).
• Right to Restriction: You may request that l889 restrict processing of your personal data in certain circumstances, for example where you contest the accuracy of data or have objected to processing pending verification of legitimate grounds.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing of your personal data that is based on legitimate interests, including profiling. l889 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time via your account settings or by contacting [email protected]. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

To exercise any of the above rights, submit a written request to [email protected] from the email address registered on your l889 account. l889 may need to verify your identity before processing your request. All requests are handled free of charge unless manifestly unfounded or excessive, in which case a reasonable fee may apply.

l889 implements a multi-layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• SSL/TLS Encryption in Transit: All communication between your browser or app and l889 servers is encrypted using current TLS protocols. Connections using outdated or insecure protocol versions are rejected.
• AES-256 Encryption at Rest: Sensitive data stored on l889 servers — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256.
• Access Controls: Access to personal data within l889's systems is restricted on a strict need-to-know basis. Staff access is controlled via role-based permissions, multi-factor authentication, and detailed audit logging.
• Intrusion Detection: l889's infrastructure is monitored 24/7 by automated intrusion detection systems that alert the security team to anomalous access patterns or suspected breaches.
• Penetration Testing: l889 commissions independent security assessments of its platform infrastructure on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: l889 maintains a documented data breach response plan that defines escalation procedures, notification timelines, and containment steps in the event of a security incident.

The l889 Platform is strictly intended for adults aged 21 years and above. l889 does not knowingly collect or process personal data relating to individuals under the age of 21. If l889 becomes aware that a registered account belongs to a person under 21, that account will be immediately suspended, the data will be handled in accordance with applicable law, and the matter may be referred to relevant authorities.

If you are a parent or guardian and believe that your child has registered an account with l889, please contact us immediately at [email protected] so that we can take appropriate action without delay.

With your consent, l889 may send you promotional communications including bonus offers, game recommendations, tournament announcements, and seasonal promotions relevant to the Bangladesh market (such as BPL match-day offers and Eid bonus campaigns). These communications may be delivered by email or SMS to the contact details registered on your l889 account.

l889 will never send marketing communications without your prior opt-in consent obtained at registration or subsequently through your account settings. You may opt out of all marketing communications at any time by:

• Using the unsubscribe link included in every promotional email sent by l889.
• Updating your communication preferences in your account settings under the "Notifications" or "Marketing" section.
• Contacting [email protected] directly and requesting removal from all marketing lists.

Opting out of marketing communications does not affect the delivery of transactional or service messages such as deposit confirmations, withdrawal notifications, account security alerts, and KYC status updates. These messages are necessary for the operation of your account and cannot be disabled while your account remains active.

l889 does not purchase or import third-party marketing lists. All players receiving l889 marketing communications have registered an account and provided explicit consent at some point during their account lifecycle. If you believe you have received a marketing communication in error, please contact [email protected] immediately.

l889 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the features and services offered on the Platform. When material changes are made, l889 will notify registered players by email to the address on file and/or by displaying a prominent notice on the Platform for a minimum of 14 days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the l889 Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease use of the Platform and contact [email protected] to close your account.

l889 maintains an archive of previous versions of this Privacy Policy. If you require a copy of any previous version, you may request one by contacting [email protected].

If you have any questions, concerns, or complaints about how l889 handles your personal data, or if you wish to exercise any of the data rights described in Section 10, please contact the l889 data support team using the details below:

• Email: [email protected]
• Subject Line: "Privacy Request — [Your Account Username]"
• Response Time: l889 aims to acknowledge all privacy-related requests within 48 hours and to provide a full response within 30 days.
• Support Hours: 24/7, Bangladesh Standard Time (UTC+6)

l889 takes all privacy complaints seriously and will investigate each complaint thoroughly. If you are not satisfied with our response to your complaint, you have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction.