gd99 Privacy Policy — How We Handle Your Personal Data

01 About This Policy

This Privacy Policy ("Policy") describes the data practices of gd99 ("we", "us", "our", "the Platform") in connection with the website gd99.io and all associated services, including sports betting, live casino games, slots, and account management features. It applies to all registered users and visitors regardless of the device or network used to access the Platform.

By creating a gd99 Account or continuing to use the Platform after this Policy's Effective Date, you confirm that you have read and understood this document and consent to the data practices described herein. If you do not consent to this Policy, you must not use the gd99 Platform and should contact us to arrange account closure.

This Policy is to be read alongside the gd99 Terms & Conditions, which govern the overall relationship between gd99 and its registered users. In the event of any conflict between this Policy and the Terms & Conditions regarding data handling, this Privacy Policy takes precedence.

02 Data We Collect

2.1 Registration Data

When you create a gd99 Account, we collect the following information: full legal name, date of birth, residential address (including city and district within Bangladesh), email address, and mobile phone number. This data is required to open and maintain your account.

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer process, gd99 may request copies of identity documents including your National Identity Card (NID), passport, driver's licence, and proof of address. Where payment method verification is required, we may also request confirmation of ownership of the bKash, Nagad, Rocket, or bank account used for transactions.

2.3 Financial Data

gd99 records details of all deposit and withdrawal transactions associated with your account, including transaction amounts in BDT, dates, times, and the payment method used. gd99 does not store full bank account numbers, bKash PINs, or Nagad PINs. Sensitive payment credentials are handled exclusively by the respective payment service providers.

2.4 Activity & Usage Data

We automatically collect data about how you interact with the gd99 Platform, including pages visited, games played, wager amounts, session durations, device type, operating system, browser type, IP address, and referring URL. This data is used for platform optimisation, responsible gaming monitoring, and fraud detection.

2.5 Communications Data

When you contact gd99 Support via live chat or email, we retain a record of that communication — including the content of messages — for the purposes of resolving your enquiry, staff training, quality assurance, and where applicable, compliance record-keeping.

03 How We Use Your Data

gd99 processes personal data for the following specific purposes:

• Account administration: creating, maintaining, and securing your gd99 Account; verifying your identity and age eligibility (21+); and communicating important account notices.
• Payment processing: facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels; detecting and preventing payment fraud; and maintaining accurate financial records.
• Responsible gaming: monitoring wagering patterns to identify signs of problem gambling; enforcing deposit limits, self-exclusion orders, and cooling-off periods; and complying with responsible gaming obligations.
• Customer support: responding to account enquiries, technical issues, and formal complaints submitted via live chat or written correspondence to [email protected].
• Platform improvement: analysing aggregated and anonymised usage data to identify technical issues, improve game performance, optimise page layouts, and enhance the overall user experience.
• Marketing communications: where you have opted in, sending promotional offers, bonus notifications, and seasonal promotions (such as Eid, Pohela Boishakh, or BPL-related campaigns) via email or in-platform notification. You may opt out at any time.
• Legal and compliance obligations: maintaining records required under applicable regulations; responding to lawful requests from authorities; and preventing, detecting, and investigating fraud, money laundering, and other unlawful activity.

gd99 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where such processing is required to prevent fraud or enforce responsible gaming limits.

04 Legal Basis for Processing

gd99 processes personal data on one or more of the following legal bases, depending on the processing activity and the applicable regulatory framework:

• Contractual necessity: processing required to perform the gd99 Terms & Conditions contract with you — for example, opening your account, processing deposits, settling wagers, and processing withdrawals.
• Legitimate interests: processing where gd99 has a legitimate business interest that is not overridden by your privacy rights — for example, fraud detection, platform security, and service improvement through anonymised analytics.
• Legal obligation: processing required by applicable law — for example, maintaining financial transaction records, responding to lawful requests from law enforcement or regulatory authorities, and fulfilling anti-money laundering record-keeping requirements.
• Consent: processing based on your freely given, specific, and informed consent — for example, sending optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

05 Cookies & Tracking Technologies

5.1 What We Use

gd99 uses cookies — small text files placed on your device — and similar tracking technologies including web beacons and session tokens to deliver a functional, personalised, and secure platform experience. Cookies are not used to collect personally identifiable information beyond what is necessary for the purposes stated below.

5.2 Types of Cookies

• Essential cookies: required for core platform functions such as maintaining your logged-in session, remembering your currency preference, and ensuring the cashier operates correctly. These cannot be disabled without impairing platform functionality.
• Analytics cookies: used to understand how users navigate the gd99 Platform — including which games are most popular and where users encounter friction — so that we can improve the experience. Data collected is aggregated and anonymised where possible.
• Security cookies: used to detect and prevent fraudulent login attempts, multi-accounting, and bot activity. These cookies help protect the integrity of your gd99 Account.
• Preference cookies: used to remember settings you have selected, such as your chosen game lobby view or notification preferences, so that you do not need to re-enter them on each visit.

5.3 Managing Cookies

You may configure your browser to refuse or delete cookies at any time. Please note that disabling essential cookies will prevent you from logging in to your gd99 Account and using core platform features. For detailed instructions on managing cookies in your specific browser, please refer to your browser's help documentation.

06 Third-Party Data Sharing

gd99 does not sell, rent, or lease your personal data to third-party marketers or data brokers under any circumstances. Personal data may be shared with external parties only in the following strictly defined situations:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners receive only the transaction data strictly necessary to process your deposit or withdrawal request. Each provider operates under its own privacy policy and applicable financial regulations.
• Game content providers: providers such as Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt, and Microgaming may receive anonymised session identifiers to deliver game content and settle game outcomes. These providers do not receive your full name, contact details, or financial information.
• Identity verification partners: where gd99 uses a third-party KYC service to verify your identity documents, that service receives only the specific documents and data required for verification. All such partners are contractually bound to data protection standards consistent with this Policy.
• Legal and regulatory authorities: gd99 will disclose personal data where required to do so by a court order, regulatory direction, or other lawful legal process. gd99 will, where legally permitted, notify affected users of such disclosures.
• Fraud prevention and security services: gd99 may share data with fraud detection services and cybersecurity partners to identify and prevent unauthorised account access, multi-accounting, and money laundering. Data shared in this context is subject to strict confidentiality obligations.

07 Data Security

gd99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption across all pages and API endpoints of the gd99 Platform, ensuring that data transmitted between your device and our servers is protected in transit.
• Encryption of sensitive data at rest, including identity documents, financial records, and account credentials stored on gd99 infrastructure.
• Role-based access controls limiting internal staff access to personal data to those whose job function requires it, under a principle of least privilege.
• Regular security assessments, penetration testing, and vulnerability scanning of the gd99 Platform infrastructure.
• Two-factor authentication options available to users for additional account-level security.
• Audit logging of all access to sensitive personal data by internal staff, with anomaly detection in place to flag unusual access patterns.

While gd99 takes all reasonable precautions, no system is entirely immune from security risks. In the event of a data breach that is likely to result in a significant risk to affected users, gd99 will take prompt remediation steps and notify affected individuals in accordance with applicable obligations.

08 Data Retention

gd99 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any legal, regulatory, or contractual obligations that require longer retention. The following general retention periods apply:

• Active account data: retained for the full duration your gd99 Account remains open and active, plus a minimum period of five (5) years following account closure to satisfy financial record-keeping requirements.
• KYC and identity documents: retained for a minimum of five (5) years following the date the document was submitted, in line with anti-money laundering best practices.
• Financial transaction records: retained for a minimum of five (5) years from the date of each transaction.
• Support communications: retained for a period of three (3) years from the date of the communication, unless the matter relates to an unresolved legal or compliance issue.
• Marketing preferences and consent records: retained for the duration your account is active and for two (2) years following any withdrawal of consent, to demonstrate the history of your consent decisions.
• Usage and analytics data: anonymised or aggregated after thirteen (13) months from collection and retained in anonymised form indefinitely for statistical purposes.

When personal data reaches the end of its applicable retention period, gd99 will securely delete, destroy, or anonymise that data in a manner that makes re-identification impossible.

09 Your Privacy Rights

As a gd99 user, you hold the following rights with respect to the personal data we process about you. To exercise any of these rights, please contact us at [email protected] or via live chat. gd99 will respond to all valid requests within fourteen (14) business days.

• Right of access: you may request a copy of the personal data gd99 holds about you, along with information about how it is processed and on what legal basis.
• Right to rectification: if any personal data gd99 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: in certain circumstances — such as where data is no longer necessary for the purpose it was collected — you may request that gd99 delete your personal data. This right is subject to overriding legal retention obligations.
• Right to data portability: where processing is based on your consent or on a contractual basis, you may request that gd99 provide your personal data in a structured, commonly used, machine-readable format so that you may transfer it to another service provider.
• Right to object: you may object at any time to the processing of your personal data for direct marketing purposes. Upon receiving such an objection, gd99 will cease processing your data for that purpose without delay.
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.
• Right to restrict processing: in certain circumstances — for example, while gd99 verifies the accuracy of data you have disputed — you may request that processing be restricted to storage only, pending resolution.

10 Children's Privacy

gd99 is strictly an adults-only platform. Access to and use of gd99 is prohibited for individuals under the age of 21. gd99 does not knowingly collect personal data from persons under 21 years of age. If gd99 becomes aware that personal data has been collected from a person under the age of 21, that data will be immediately deleted and the associated account permanently closed.

If you are a parent or guardian and believe your child has registered a gd99 Account or submitted personal data to the Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action. gd99 takes underage access with the utmost seriousness and enforces age-verification checks as part of the standard KYC process.

11 Changes to This Privacy Policy

gd99 reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, applicable law, or platform features. When a material change is made, gd99 will notify registered users via in-platform notification or by email to the address associated with their account, with a minimum of seven (7) days' notice before the updated Policy takes effect.

The Effective Date displayed at the top of this Policy indicates when the current version came into force. Your continued use of the gd99 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you disagree with any change, you must cease using the Platform and contact support to arrange account closure before the amendment's effective date.

12 Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gd99 processes your personal data, please use the following contact channels. All privacy-related enquiries are handled by our dedicated support team, available around the clock, Bangladesh Standard Time (BST, UTC+6).

• Live Chat: the fastest way to reach us — available 24/7 inside your gd99 Account dashboard after login.
• Email: [email protected] — for formal written privacy requests and data subject rights submissions. Please include "Privacy Request" in the subject line and provide your registered account email address so we can locate your record. Responses are provided within 14 business days.
• Operating Hours: 24 hours a day, 7 days a week, including Eid and public holidays in Bangladesh.

gd99 takes all privacy complaints seriously. If you submit a written complaint and are not satisfied with the resolution gd99 provides, you retain the right to seek further recourse through whatever dispute resolution channels are available to you under applicable law in your jurisdiction.