l399 Privacy Policy

This Privacy Policy ("Policy") describes how l399 ("we", "us", "our") collects, uses, stores, and discloses information about users ("you", "your") of the l399 platform available at l399.app (the "Platform"). This Policy applies to all users who access or use the Platform from Bangladesh and any other permitted jurisdiction. By registering an account or using any service on the Platform, you acknowledge that you have read, understood, and agree to this Policy in full.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy. l399 reserves the right to update this Policy at any time. Where changes are material, we will make reasonable efforts to notify registered users via the Platform. The most current version of this Policy will always be available on this page with an updated effective date. Continued use of the Platform after any update constitutes your acceptance of the revised Policy.

l399 processes personal data only for specific, legitimate purposes. We do not process your data beyond what is necessary for those purposes. The primary uses of personal data collected on the Platform are as follows:

• To create, verify, and maintain your l399 account and to comply with our age-verification and KYC obligations.
• To process deposits and withdrawals and to maintain accurate financial records in line with regulatory requirements.
• To provide customer support, resolve disputes, and respond to account-related queries.
• To monitor Platform use for fraud detection, security incidents, and prohibited conduct in accordance with our Terms & Conditions.
• To personalise your experience on the Platform, including game recommendations, promotional offers relevant to your activity, and responsible gaming alerts.
• To send service communications including deposit confirmations, withdrawal notifications, and security alerts to your registered email address or mobile number.

l399 does not use your personal data to deliver unsolicited third-party advertising. Any promotional communications from l399 are directly related to the Platform's own products and services, and you may opt out of marketing communications at any time by contacting our support team.

l399 processes personal data only where a valid legal basis exists. The legal bases on which l399 relies are as follows:

• Contractual necessity — processing required to fulfil the Terms & Conditions you have agreed to and to deliver the services you have requested.
• Legal obligation — processing required to comply with applicable laws including anti-money laundering regulations, age-verification requirements, and financial reporting obligations.
• Legitimate interests — processing for fraud prevention, platform security, service improvement, and responsible gaming monitoring where these interests are not overridden by your rights.
• Consent — where we rely on consent as a basis for processing (for example, for optional marketing communications), you may withdraw that consent at any time by contacting our support team.

l399 takes the privacy of financial data with particular seriousness. All financial transaction data is encrypted in transit and at rest. l399 does not store full mobile wallet account numbers or bank account details on its servers — payment authentication is handled exclusively by the respective payment providers using tokenised references. l399 maintains only the transaction metadata (amount, date, method reference, and outcome) required for financial record-keeping.

In the event of a suspected fraudulent transaction or a dispute raised by you or your payment provider, l399 may conduct an internal review of transaction data. The outcome of any such review will be communicated to you in writing via your registered email address within a reasonable timeframe. l399's internal financial records are audited periodically to ensure data integrity and accuracy.

l399 uses cookies and similar tracking technologies to operate the Platform, improve user experience, and support security and fraud-detection functions. Cookies are small text files stored on your device. The types of cookies used on the Platform include:

• Essential cookies — required for the Platform to function correctly, including session management, login state, and security tokens. These cannot be disabled without disrupting Platform functionality.
• Analytical cookies — used to understand how users interact with the Platform, which pages are visited most frequently, and where technical errors occur. This data is aggregated and anonymised where possible.
• Functional cookies — used to remember your preferences such as language settings, session time limits you have set, and responsible gaming tool configurations.

You may adjust cookie preferences through your browser or device settings. Disabling essential cookies will impair your ability to use the Platform. l399 does not use third-party advertising cookies or behavioural tracking cookies for cross-site advertising purposes.

l399 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Account data and transaction records are retained for a minimum of 5 years from the date of account closure to comply with financial regulations and anti-money laundering obligations. Communications data is retained for a minimum of 2 years. Usage and behavioural data in an identifiable form is retained for no longer than 2 years from the date of collection.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where you have requested erasure of your personal data and there is no overriding legal obligation to retain it, l399 will complete the deletion within 30 days of receiving your request and will confirm the deletion to your registered email address.

As a user of the l399 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a substantive response within 30 days.

• Right of access — you may request a copy of all personal data held about you by l399, free of charge, once per calendar year.
• Right to rectification — you may request correction of any inaccurate or incomplete personal data held about you. Account details may also be updated directly via your account settings screen.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to overriding legal retention obligations.
• Right to restriction — you may request that l399 restrict processing of your personal data in certain circumstances, for example while a rectification request is being investigated.
• Right to object — you may object to the processing of your personal data where l399 relies on legitimate interests as the legal basis, including for direct marketing communications.

l399 will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. l399 reserves the right to verify your identity before processing any data rights request to protect against unauthorised access to another person's data.

l399 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include 256-bit SSL encryption for all data in transit, encrypted storage for data at rest, role-based access controls limiting staff access to personal data on a need-to-know basis, regular penetration testing and security audits, and multi-factor authentication for administrative access to Platform systems.

In the event of a personal data breach that is likely to result in a risk to users' rights, l399 will take immediate steps to contain the breach and will notify affected users without undue delay. Notification will be sent to your registered email address and will describe the nature of the breach, the data involved, and the steps l399 is taking to address it. l399 cannot guarantee absolute security given the inherent risks of online platforms; however, we commit to maintaining industry-standard protections at all times.

The l399 Platform is strictly intended for adults aged 21 and above. l399 does not knowingly collect personal data from any individual under the age of 21. If we become aware that personal data has been collected from a person under 21 without appropriate verification, we will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that a minor has accessed the Platform or provided personal data to l399, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

l399 reserves the right to update or replace this Privacy Policy at any time. The effective date shown at the top of this page will be updated whenever a new version is published. Where changes are material — for example, where we introduce a new category of data collection or a new sharing arrangement — l399 will notify registered users via the Platform or by email before the changes take effect. Minor clarifications and formatting updates may be made without specific notice. Your continued use of the Platform following any update constitutes acceptance of the revised Policy. If you do not agree with any changes, you should stop using the Platform and may request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or to how l399 processes your personal data, please contact our support team. We aim to acknowledge all privacy queries within 5 business days and to resolve them within 30 days. For data rights requests, please include "Data Rights Request" in the subject line of your message to ensure prompt routing to the correct team.

Email: [email protected]