lu777 Privacy Policy — Your Data, Protected

lu777 collects personal information from players in Bangladesh through several channels: during the account registration process, as part of ongoing account use, during the KYC (Know Your Customer) identity verification process, and automatically through your use of the lu777 platform via cookies and similar technologies. The categories of information lu777 collects are described below.

Registration information: When you create a lu777 account, you are required to provide your full legal name, date of birth, residential address, email address, and a chosen username and password. This information is necessary to create and identify your account and to verify that you meet the minimum age requirement of 18 years.

Identity verification (KYC) documents: Before processing your first withdrawal, lu777 is required to verify your identity. This involves collecting a copy of your Bangladesh National Identity Card (NID), passport, or other government-issued photo identification document. In some cases, a proof of residential address (such as a utility bill or bank statement) may also be requested. These documents are collected solely for identity verification and anti-money laundering compliance purposes.

Payment and transaction information: lu777 records all financial transactions associated with your account, including deposits via bKash, Nagad, Rocket, Upay, and bank transfer, all withdrawal requests and their processing status, wager amounts, game results, and bonus redemption history. Payment instrument details (such as your bKash account number or bank account number) are recorded to the extent necessary for transaction processing and anti-fraud monitoring.

lu777 also collects the following categories of information automatically when you use the platform:

lu777 does not knowingly collect personal information from any person under the age of 18. If lu777 becomes aware that a minor has provided personal information during registration, the account will be immediately suspended and the information will be deleted or anonymised in accordance with lu777's data retention procedures.

lu777 does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. Your data may, however, be shared with specific categories of third parties where strictly necessary to operate the platform and fulfil our legal and regulatory obligations. All third parties with whom lu777 shares personal data are contractually required to handle that data in accordance with applicable data protection standards and to use it only for the specific purposes for which it was disclosed.

• Payment service providers: When you make a deposit or request a withdrawal, your payment instrument details and transaction data are shared with the relevant payment provider — such as bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, or Visa/Mastercard — to the extent necessary to process the transaction. These providers operate under their own privacy policies and data protection obligations.
• Game software providers: lu777's casino and sports betting content is powered by third-party game providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. When you play a game supplied by one of these providers, certain technical data (such as session identifiers and game outcome data) is processed by the relevant game provider's systems. No personally identifiable registration data is shared with game providers beyond what is technically necessary for game session management.
• Identity verification services: lu777 may engage specialist KYC and identity verification service providers to assist in processing and authenticating identity documents submitted by players during the KYC process. These providers act as data processors on lu777's behalf and are bound by strict data processing agreements.
• Analytics providers: lu777 uses analytics tools to understand platform usage patterns. Where such tools involve the processing of usage or device data, they are configured to anonymise or pseudonymise data to the fullest practical extent before transmission.
• Law enforcement and regulatory authorities: lu777 may disclose personal information to law enforcement agencies, financial intelligence units, or other regulatory bodies in Bangladesh or internationally where required to do so by law, court order, or regulatory directive. lu777 may also proactively share information where there is a reasonable suspicion of money laundering, fraud, or other serious criminal activity.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of lu777's business operations, player personal data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer via the registered email address associated with their account prior to completion of the transfer where reasonably practicable.

lu777 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or to comply with applicable legal, regulatory, and operational requirements. The retention periods applied to different categories of personal data are as follows:

• Account registration data: Retained for the lifetime of your active lu777 account, and for a minimum period of five years following account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC identity documents: Retained for a minimum of five years from the date of submission or the date of account closure, whichever is later, to satisfy ongoing regulatory and AML compliance obligations.
• Transaction records: All deposit, withdrawal, wager, and bonus transaction records are retained for a minimum of five years from the date of each transaction. This period may be extended where a transaction is the subject of an ongoing investigation, dispute, or legal proceeding.
• Customer support communications: Support emails, chat transcripts, and related correspondence are retained for a period of three years from the date of the most recent communication in a given support thread.
• Analytics and usage data: Anonymised analytics data is retained for up to 24 months. Where usage data can be attributed to an individual player, it is anonymised or deleted within 12 months of collection.
• Marketing preferences: Records of your marketing opt-in or opt-out status are retained for the lifetime of your account and for three years following account closure, to demonstrate compliance with consent obligations.

Where lu777 determines that personal data is no longer required for any lawful purpose, it will be securely deleted or anonymised so that it can no longer be linked to an individual. Secure deletion procedures include overwriting of digital storage and appropriate disposal of any physical documents containing personal information.

lu777's servers are hosted in facilities with industry-standard physical and logical access controls. Server locations are selected to ensure a level of data protection broadly consistent with the security standards lu777 applies to all player data, regardless of geographic location.

lu777 employs a layered security architecture designed to protect the personal and financial information of all Bangladesh players against unauthorised access, disclosure, alteration, and destruction. The core security measures in place include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the lu777 platform is encrypted using Transport Layer Security (TLS) with 256-bit encryption keys. This ensures that your login credentials, personal data, and payment information cannot be intercepted in transit.
• Access controls: Access to player personal data within lu777's internal systems is restricted on a strict need-to-know basis. Staff members are granted access only to the specific categories of data required to perform their job function. All internal data access is logged and subject to regular audit review.
• Password security: Player account passwords are stored using one-way cryptographic hashing. lu777 does not store passwords in readable form and cannot retrieve your password — only reset it via the registered email address. lu777 strongly recommends that all players use a strong, unique password for their account and enable two-factor authentication where available.
• Fraud monitoring systems: lu777 operates continuous automated monitoring of account activity, transaction patterns, login behaviour, and device fingerprints to detect and respond to suspicious activity in real time. Where a security threat is detected, lu777 may temporarily suspend account access pending investigation.
• Incident response: In the event of a data security incident affecting player personal information, lu777 has an incident response procedure designed to contain the incident, assess its scope, and notify affected players as promptly as practicable. Notifications will be sent to the registered email address associated with affected accounts.

While lu777 takes all reasonable steps to protect your personal information, no online platform can guarantee absolute security against all possible threats. Players are encouraged to take their own precautions, including using a strong and unique password, not sharing account credentials with any third party, logging out of the platform when using a shared or public device, and contacting [email protected] immediately if they suspect any unauthorised access to their account.