99x99 Privacy Policy

Section 1

Data We Collect

When you interact with the 99x99 platform, we collect personal data that falls into the following categories. We collect only what is necessary for the specific purpose described, in keeping with our minimal data principle.

1.1 Registration Data

When you create a 99x99 account, we collect the following information:

• Your full legal name as it appears on your government-issued identification document.
• A valid email address that you own and actively use.
• A Bangladesh mobile number for account verification and two-factor authentication purposes.
• Your date of birth, collected solely to verify that you meet the 18+ age requirement.
• Your chosen username and an encrypted version of your account password. We do not store passwords in plain text.

1.2 Identity Verification Data

In accordance with our anti-money laundering (AML) obligations and responsible gaming commitments, 99x99 may request the following verification documents at various stages of account operation:

• A copy of a government-issued photo identification document (national ID card, passport, or driving licence).
• Proof of address documentation dated within 90 days (e.g., utility bill or bank statement).
• Proof of ownership of the registered payment method (e.g., a screenshot of your bKash, Nagad, or Rocket wallet showing your registered name).

1.3 Financial Transaction Data

To process deposits and withdrawals in Bangladeshi Taka (৳ BDT), we collect and retain records of:

• The payment method used (e.g., bKash, Nagad, Rocket, Upay, bank name).
• Transaction amounts, timestamps, and reference numbers.
• The mobile wallet number or bank account number associated with your registered payment method. We do not store full card numbers or banking PINs.

1.4 Technical and Device Data

When you access the 99x99 platform, our servers automatically collect certain technical data, including:

• Your IP address and approximate geographic location (country/city level only).
• Browser type, version, and operating system.
• Device type (desktop, mobile, tablet) and screen resolution.
• Pages visited, session duration, and navigation path within the platform.
• Referring URL (the page you were on before arriving at 99x99).

1.5 Customer Support Data

When you contact the 99x99 support team via email or live chat, we retain records of your communications, including the content of messages, attachments you provide, and the outcome of the support interaction. This data is used exclusively for resolving your enquiry and improving service quality.

Section 2

How We Use Your Data

99x99 processes personal data only for the specific, lawful purposes described below. We do not use your data for any purpose that is incompatible with the reason it was originally collected.

Section 3

Data Sharing & Third Parties

99x99 does not sell, rent, or trade your personal data to any third party. We share personal data only with the categories of recipients listed below, and only to the minimum extent necessary to fulfil the stated purpose.

3.1 Payment Processing Partners

To process deposits and withdrawals, 99x99 shares relevant financial transaction data with our payment processing partners, including the operators of bKash, Nagad, Rocket, and Upay integrations, as well as our banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) and card networks (Visa, Mastercard). These partners receive only the transaction data necessary to execute the payment and are contractually prohibited from using your data for any other purpose.

3.2 Identity Verification Services

Where 99x99 uses a third-party identity verification provider to assist with document verification (e.g., validating a national ID or passport), that provider receives a copy of the submitted documents solely for the purpose of verification. Verified documents are not retained by the verification provider beyond the period required to complete the check.

3.3 Technology Infrastructure Providers

99x99 uses third-party technology providers for hosting, cloud infrastructure, and platform security. These providers process data on our behalf under strict data processing agreements and may not use your data for their own purposes. All infrastructure providers used by 99x99 maintain industry-standard security certifications.

3.4 Game Software Providers

Game studios whose products are available on the 99x99 platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive anonymised or pseudonymised session data for the purpose of game performance monitoring and fairness auditing. No personally identifiable information (name, email, payment details) is shared with game studios.

3.5 Legal and Regulatory Disclosure

99x99 may disclose personal data to competent authorities, law enforcement agencies, or financial intelligence units where required to do so by applicable law, a valid court order, or a lawful regulatory request. In such cases, 99x99 will disclose only the minimum data required and will notify the affected player where legally permitted to do so.

Section 4

Cookies & Tracking Technologies

The 99x99 platform uses cookies and similar browser-based storage technologies to provide a functional, secure, and consistent experience. The following table describes the categories of cookies we use and their purpose.

99x99 does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or any cross-site tracking technology. Our analytics data is anonymised before processing and is never shared with advertising networks.

Most browsers allow you to control or delete cookies through their settings. If you choose to disable strictly necessary cookies, please be aware that core platform features — including login and payment processing — will not function correctly. Instructions for managing cookies can be found in the help documentation of your browser.

Section 5

Data Retention & Storage

99x99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our anti-money laundering obligations. The following retention periods apply as a general guide:

• Active account data (registration details, preferences, communication history): Retained for the duration of the active account relationship, plus 5 years following account closure.
• Financial transaction records (deposit and withdrawal history, payment method details): Retained for a minimum of 5 years from the date of the transaction, in compliance with applicable financial record-keeping requirements.
• Identity verification documents (ID copies, proof of address): Retained for 5 years following account closure or the date of the last transaction, whichever is later.
• Customer support communications: Retained for 2 years from the date of the last interaction.
• Technical and device logs: Retained for 90 days on a rolling basis, after which they are automatically purged from our systems.
• Marketing consent records: Retained for the duration of the consent and for 3 years following withdrawal of consent, as evidence of the original opt-in.

All personal data held by 99x99 is stored on secure servers. We apply logical access controls, ensuring that only authorised 99x99 personnel with a legitimate operational need can access personal data. Access is logged and audited on a regular basis.

Section 6

Data Security Measures

99x99 takes the security of your personal data seriously. We implement a layered set of technical and organisational security measures to protect your data against unauthorised access, accidental loss, alteration, or disclosure. Our core security measures include:

• Encryption in transit: All data transmitted between your device and the 99x99 platform is encrypted using TLS 1.2 or higher, with 256-bit AES symmetric encryption for session data.
• Encryption at rest: Sensitive personal data fields — including identity documents, payment method identifiers, and verification records — are encrypted in our database using AES-256 at rest.
• Password hashing: Account passwords are never stored in plain text. We use a robust cryptographic hashing algorithm with individual salting so that no two password hashes are identical, even for identical passwords.
• Two-factor authentication (2FA): 99x99 offers optional 2FA for all registered accounts. We strongly recommend enabling 2FA from your account security settings to add a second layer of protection beyond your password.
• Access controls: Access to personal data within 99x99's internal systems is governed by role-based access controls. Employees can access only the data categories required for their specific job function.
• Regular security auditing: Our platform undergoes periodic security reviews, including vulnerability assessments of our web application and payment integration endpoints.
• Incident response: In the event of a data security incident that poses a risk to your personal data, 99x99 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.

While 99x99 implements robust security measures, no digital platform can guarantee absolute security. You play an important role in keeping your account secure by maintaining a strong, unique password and enabling 2FA. If you believe your account has been compromised, contact support immediately at [email protected].

Section 7

Your Privacy Rights

As a 99x99 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us in writing at [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within 3 business days and aim to fulfil it within 30 calendar days.

7.1 Right of Access

You may request a copy of all personal data that 99x99 holds about you. We will provide this in a structured, commonly used format. This is sometimes referred to as a Subject Access Request (SAR).

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update certain information directly from your account settings dashboard; for data that cannot be self-updated (such as identity verification records), contact support.

7.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where there is no overriding legal basis for continued processing. Please note that certain data categories (financial transaction records, AML documentation) are subject to mandatory retention periods and cannot be erased on request during that period.

7.4 Right to Restrict Processing

In certain circumstances — for example, where you have contested the accuracy of data we hold, or where you have objected to processing — you may request that we restrict our use of your data to storage only while the matter is resolved.

7.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and processing is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to have it transferred to another service provider where technically feasible.

7.6 Right to Withdraw Consent

Where 99x99 processes your data on the basis of your consent (for example, for promotional communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7.7 Right to Object

You have the right to object to processing of your personal data where 99x99 relies on legitimate interest as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for the establishment, exercise, or defence of legal claims.

Section 8

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how 99x99 has handled your personal data, please contact our support team using the details below. All privacy-related enquiries are handled by a dedicated member of the 99x99 operations team.

8.1 Response Timeframes

99x99 is committed to responding to all privacy-related requests within the following timeframes:

• General privacy enquiries: Acknowledged within 3 business days; resolved within 10 business days.
• Subject Access Requests (data copies): Fulfilled within 30 calendar days of identity verification.
• Erasure requests: Reviewed and actioned within 30 calendar days, subject to mandatory retention obligations.
• Data rectification requests: Completed within 5 business days for straightforward corrections.

8.2 Complaints

If you are not satisfied with how 99x99 has handled your personal data or responded to a privacy rights request, you are entitled to escalate your complaint in writing to [email protected] with the subject line "Privacy Complaint — Escalation". We will conduct a senior review of your complaint and respond within 15 business days.

8.3 Policy Updates

99x99 may update this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or platform features. The effective date at the top of this document will be updated whenever a material change is made. We recommend reviewing this Privacy Policy at intervals to stay informed. Where a change materially affects your rights, 99x99 will notify registered players via their registered email address prior to the change taking effect.