tl89 Privacy Policy

Section 1

Introduction

This Privacy Policy ("Policy") describes how tl89 ("tl89", "we", "us", "our"), the operator of the online gaming platform at tl89.io, collects, uses, stores, shares, and protects the personal data of individuals ("Player", "User", "You") who access or use the tl89 platform, including its website, mobile-optimised interface, games, live betting markets, and customer support services.

tl89 is committed to handling your personal data with transparency, fairness, and security. This Policy is intended to give you a clear and comprehensive understanding of our data practices so that you can make an informed decision about using our services.

This Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy, both of which are accessible from the footer of every tl89 page. By registering an account or using any part of the tl89 platform, you confirm that you have read and understood this Policy and consent to the data practices described herein.

Section 2

Data We Collect

tl89 collects personal data across several categories. The specific data collected depends on the nature of your interaction with the platform — whether you are browsing as a guest, completing registration, making a deposit, or contacting support.

2.1 Registration & Identity Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address and mobile phone number
• Residential address (including city and division in Bangladesh)
• Username and encrypted password

2.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (national ID card or passport)
• Proof of address documents issued within the last three months
• Selfie photographs submitted for liveness and identity checks
• Proof of ownership of payment methods used on the account

2.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and methods (bKash, Nagad, Rocket, Upay, bank card details)
• Account balances and bonus balances at each transaction point
• Wagering history — game titles, bet amounts, outcomes, and timestamps
• Partial payment instrument identifiers (e.g., last four digits of a card, mobile wallet number)

2.4 Technical & Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session duration, page views, and in-platform navigation events
• Cookies and similar tracking technologies (see Section 6)

2.5 Communications Data

• Content of messages sent to tl89 via live chat, email, or support ticket
• Records of telephone or chat support interactions where applicable
• Feedback, complaint, and dispute records

Section 3

How We Use Your Data

tl89 uses collected personal data for the following specific purposes. We process data only for the purposes listed and do not repurpose data without providing prior notice and, where required, obtaining fresh consent.

tl89 uses aggregated and anonymised data — from which individual players cannot be identified — for internal business analytics, product development, and reporting purposes. This aggregated data is not subject to the same restrictions as personal data under this Policy.

Section 4

Legal Basis for Processing

tl89 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to provide the services described in the Terms and Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, know-your-customer (KYC) obligations, and any other legal requirements imposed by the jurisdiction of tl89's operating licence.
• Legitimate interests: Processing carried out to pursue tl89's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services — provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications, optional cookies, and any other purpose for which tl89 explicitly requests and records your consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Section 5

Data Sharing & Third Parties

tl89 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data with third parties only in the following circumstances and only to the extent strictly necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are bound by applicable financial data protection standards.
• KYC & identity verification providers: tl89 uses regulated third-party identity verification services to confirm player age and identity in compliance with anti-money laundering requirements. These providers are contractually prohibited from using your identity documents for any purpose other than the verification requested by tl89.
• Game software providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymous player identifier to deliver game content. These providers do not receive your full identity or financial data.
• Fraud prevention and security services: tl89 uses specialist third-party services for device fingerprinting, IP reputation analysis, and transaction risk scoring to protect the platform and its players from fraud and abuse.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory request, tl89 may disclose personal data to law enforcement, financial intelligence units, or other competent authorities. tl89 will notify affected players of such disclosures where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of tl89's assets, player data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third-party service providers engaged by tl89 are required to sign data processing agreements that mandate compliance with applicable data protection standards and restrict the use of personal data to the specific services being provided.

Section 6

Cookies & Tracking Technologies

tl89 uses cookies and similar technologies (including local storage and session tokens) to operate the platform, remember your preferences, maintain session security, and gather aggregate analytics data. The following categories of cookies are used on the tl89 platform:

• Strictly necessary cookies: Essential for the operation of the platform. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without affecting the functionality of the platform.
• Performance cookies: Used to measure page load times, server response performance, and platform reliability. Data collected is aggregated and not linked to individual player identities.
• Analytics cookies: Used to understand how players navigate the tl89 platform — which pages are most visited, how long sessions last, and where players encounter difficulties. Analytics data is processed in anonymised or pseudonymised form.
• Preference cookies: Used to remember your account settings, display preferences, and language selections so that they persist across sessions.

tl89 does not place third-party advertising or retargeting cookies on your device. You will not see tl89 advertisements on other websites as a result of cookies placed during your visit to tl89.io.

Section 7

Data Retention

tl89 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, comply with legal obligations, and resolve any outstanding disputes or enforcement actions. The following retention periods apply as a general guideline:

• Account and identity data: Retained for the lifetime of the account plus a minimum of 5 years following account closure, to satisfy AML and KYC record-keeping requirements.
• Financial and transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial crime prevention obligations.
• KYC verification documents: Retained for a minimum of 5 years following account closure or the completion of the relevant verification process.
• Customer support communications: Retained for 3 years from the date of the most recent interaction, unless the communication is relevant to an ongoing dispute, in which case it is retained until the dispute is fully resolved.
• Marketing preferences and consent records: Retained for 3 years from the date of the most recent consent event or until consent is withdrawn, whichever is earlier.
• Technical and device data (logs): Retained for a maximum of 12 months in identifiable form, after which they are aggregated or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of individual identities.

Section 8

Data Security

tl89 implements a comprehensive set of technical and organisational security measures to protect your personal and financial data against unauthorised access, disclosure, alteration, or destruction. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and tl89 servers.
• Encrypted storage of sensitive data at rest, including passwords (hashed using bcrypt or equivalent), payment instrument details, and KYC documents.
• Role-based access controls ensuring that employee access to personal data is restricted to the minimum level necessary to perform their job function.
• Multi-factor authentication for all internal administrative systems that can access personal data.
• Regular security audits and penetration testing carried out by independent third-party security specialists.
• Incident response procedures that specify the steps tl89 will take in the event of a data breach, including timely notification of affected players and relevant authorities where required by law.

Section 9

International Data Transfers

tl89 operates globally and some of the third-party service providers engaged by tl89 — including KYC verification providers, game studios, and cloud infrastructure partners — may process personal data outside of Bangladesh. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, tl89 will take appropriate safeguards to ensure that your data remains protected to the standards described in this Policy.

Safeguards employed for international transfers include contractual data processing agreements incorporating internationally recognised standard contractual clauses, as well as technical security requirements that apply regardless of where data is processed. By using the tl89 platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Bangladesh for the purposes described in this Policy.

Section 10

Your Data Rights

As a player on the tl89 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with sufficient information to verify your identity. tl89 will respond to all valid requests within 30 calendar days.

• Right of access: You may request a copy of the personal data tl89 holds about you, including the categories of data, the purposes for which it is processed, and the recipients with whom it has been shared.
• Right to rectification: You may request that inaccurate or incomplete personal data held about you be corrected or completed without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis exists, or where processing is unlawful. This right is subject to overriding legal retention obligations — for example, tl89 cannot delete transaction records that are required to be retained for AML compliance purposes.
• Right to restrict processing: You may request that tl89 restrict the processing of your personal data in certain circumstances, such as where the accuracy of the data is contested or where you have objected to processing pending verification of tl89's legitimate grounds.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that tl89 provide your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You may object at any time to the processing of your personal data where that processing is based on tl89's legitimate interests. tl89 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Section 11

Children's Privacy

The tl89 platform is strictly restricted to individuals aged 21 years and above. tl89 does not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory step of the registration and KYC process, and tl89 employs automated and manual checks to identify and remove underage accounts.

If tl89 discovers or is notified that personal data belonging to a person under 21 has been collected, it will immediately suspend the relevant account, delete the personal data in accordance with applicable law, and report the matter to relevant safeguarding authorities where required. If you have reason to believe that a minor has registered an account on tl89, please notify us immediately at [email protected].

Section 12

Marketing Communications

tl89 sends promotional and informational communications by email and SMS only to players who have provided explicit opt-in consent. Marketing communications may include information about new games, seasonal promotions (such as BPL season offers, Eid bonuses, and Pohela Boishakh specials), deposit bonus offers, and platform updates.

You may withdraw consent for marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by tl89.
• Sending a written opt-out request to [email protected] from the email address registered on your account.
• Updating your communication preferences through your account settings page.

Withdrawal of marketing consent does not affect tl89's ability to send you transactional communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts. These service communications are sent on the basis of contractual necessity and cannot be unsubscribed from while your account remains active.

Section 13

Third-Party Links

The tl89 platform may contain links to third-party websites or services — for example, links to game provider information pages or payment processor portals — that are not operated by tl89. This Privacy Policy applies solely to the tl89 platform and does not extend to any third-party website or service. tl89 is not responsible for the privacy practices or the content of third-party sites, and we encourage you to review the privacy policy of any external site you visit.

Section 14

Changes to This Privacy Policy

tl89 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the types of data we collect, the purposes for which we use it, or the parties with whom we share it — tl89 will provide advance notice by email to the address registered on your account and/or by displaying a prominent notice on the platform for a reasonable period before the changes take effect.

Non-material clarifications, corrections of typographical errors, or updates to reflect new legal requirements may be made without prior notice. The effective date at the top of this Policy indicates when the current version came into force. Previous versions of this Policy are available upon written request to [email protected].

Your continued use of the tl89 platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated practices. If you do not agree with the changes, you must stop using the platform and close your account before the changes take effect.

Section 15

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way tl89 handles your personal data, please contact our Data Privacy team. We are committed to resolving all privacy-related enquiries promptly and transparently.

Email: [email protected] (plain text — not a clickable link)

Response time: Within 30 calendar days for data rights requests; within 5 business days for general privacy enquiries.

Language: English

Operating hours: 24/7, Bangladesh Standard Time (BST, UTC+6)