Privacy Policy — How 99ab Protects Your Personal Data

1. Information We Collect

When you interact with 99ab — whether by registering an account, making a deposit, placing a bet, contacting our support team, or simply browsing the platform — certain personal and technical information is collected. The categories of data we collect are set out below, along with the specific data points within each category.

1.1 Registration and Identity Data

When you create a 99ab account, we collect the information you provide directly during the registration process. This includes:

• Full legal name as it appears on your government-issued identity document.
• Date of birth, used to verify that you meet the minimum age requirement of 18 years.
• Residential address, including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or elsewhere in Bangladesh) and postal code.
• Email address, used for account communications, password recovery, and promotional messages where consent has been given.
• Bangladeshi mobile number, used for account verification, two-factor authentication, and mobile payment processing.
• Username and encrypted password. Passwords are stored using one-way cryptographic hashing and are never stored in plain text.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, which is mandatory before your first withdrawal can be processed, we collect copies of identity documents. These may include:

• Bangladesh National Identity Card (NID) — front and back scan or photograph.
• Passport — photo page scan.
• Driving licence — front and back scan where applicable.
• Proof of address documents such as a recent utility bill, bank statement, or government-issued correspondence dated within the past three months.
• Selfie photograph or live verification image for biometric matching where required by our KYC provider.

KYC documents are processed by 99ab's internal compliance team and, where required, by our third-party identity verification partner. Documents are stored securely and accessed only by authorised personnel with a verified business need.

1.3 Financial and Payment Data

When you make a deposit or request a withdrawal, we collect transaction data necessary to process the payment. This includes:

• Mobile Financial Service account number (bKash, Nagad, Rocket, or Upay) used for the transaction.
• Transaction ID (TrxID) submitted with mobile financial service deposits.
• Bank account name and number where bank transfer is used.
• Masked card number, card type, and card expiry date for Visa or Mastercard transactions. Full card numbers are never stored by 99ab — they are handled exclusively by our PCI-DSS compliant payment gateway partner.
• Deposit and withdrawal amounts, dates, and processing status.

1.4 Gaming Activity Data

We record your activity on the 99ab platform for operational, analytical, and responsible gaming purposes. This includes game sessions played, wagers placed, outcomes, bonus usage, and betting history across all product verticals including casino games, live dealer, sports betting, and Super Keno.

1.5 Technical and Device Data

When you access 99ab via a browser or mobile device, we automatically collect certain technical information. This includes your IP address, browser type and version, operating system, device type, screen resolution, session timestamps, pages visited, and referring URL. This data is used for fraud prevention, platform security, and aggregate analytics. It is not used to identify you as an individual except where a fraud investigation requires it.

1.6 Communications Data

If you contact 99ab's customer support team via email, live chat, or any other channel, we retain records of those communications, including your messages, attachments, and our responses. This data is held for quality assurance, dispute resolution, and regulatory compliance purposes.

2. How We Use Your Data

99ab uses the personal data we collect for the following specific purposes. We rely on one or more lawful bases for each processing activity, as described below.

Purpose	Data Used	Lawful Basis
Account creation and management	Registration data, identity data	Contract performance
Age verification and KYC compliance	Date of birth, identity documents	Legal obligation
Payment processing (deposits and withdrawals)	Financial and payment data	Contract performance
Anti-money laundering (AML) monitoring	Financial data, gaming activity	Legal obligation
Fraud prevention and security	Technical data, communications data	Legitimate interests
Responsible gaming monitoring	Gaming activity, registration data	Legal obligation / Legitimate interests
Customer support and dispute resolution	Communications data, account data	Contract performance
Platform analytics and improvement	Technical data, gaming activity (anonymised)	Legitimate interests
Promotional communications (where consented)	Email address, mobile number	Consent

99ab does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by law as part of our AML screening obligations.

3. Data Sharing and Disclosure

99ab does not sell, rent, or share your personal data with third parties for their independent marketing or commercial purposes. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

3.1 Service Providers and Technology Partners

We engage carefully selected third-party service providers who process data on our behalf under strict data processing agreements. These partners include our identity verification (KYC) provider, payment gateway operators, game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Spribe), cloud hosting and server infrastructure providers, and our customer support platform operator. Each provider is contractually obligated to process your data only for the purposes instructed by 99ab and to maintain appropriate technical and organisational security measures.

3.2 Legal and Regulatory Disclosure

We may disclose personal data to competent authorities, law enforcement bodies, financial intelligence units, or regulators where we are legally required to do so, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity, or to protect the rights and safety of 99ab, its players, or the public. In such cases, we disclose only the minimum data required to fulfil the legal obligation.

3.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of some or all of 99ab's business assets, personal data held about registered players may form part of the transferred assets. Where such a transfer occurs, the acquiring entity will be required to honour the commitments set out in this Privacy Policy or notify affected players of any material changes before those changes take effect.

4. Cookies and Tracking Technologies

99ab uses cookies and similar technologies (such as local storage and session storage) to enable core platform functionality, improve your user experience, and protect the security of your account. We do not use third-party advertising cookies or behavioural tracking cookies for marketing purposes.

4.1 Cookie Categories We Use

• Strictly Necessary Cookies: These cookies are essential for the 99ab platform to function. They enable your login session, maintain your account authentication state, store your language and display preferences, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your preferences, such as your chosen game lobby view, responsible gaming settings, and notification preferences. They are not used for tracking across external sites.
• Analytical Cookies: We use anonymised first-party analytics cookies to understand aggregate player behaviour on the platform — such as which game categories are most visited, where users drop off during the registration flow, and how pages perform across device types. This data is used exclusively for platform improvement. Individual players are not identified in analytical reports.
• Security Cookies: These cookies support fraud detection and account security functions. They record session fingerprints and flag unusual login behaviour for our security team to review. They are not shared with third parties.

4.2 Managing Cookies

You can control cookie behaviour through your browser settings. Most modern browsers allow you to block all cookies, block third-party cookies only, or clear existing cookies. Note that disabling strictly necessary cookies will prevent you from logging in and using core features of 99ab. Instructions for managing cookies in popular browsers are available in each browser's help documentation.

5. Data Retention and Storage

99ab retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods required by applicable laws and regulations. The following retention schedule applies to the main categories of data we hold.

Data Category	Retention Period	Reason
Account registration data	5 years from account closure	AML / legal obligation
KYC identity documents	5 years from account closure	AML / legal obligation
Financial transaction records	7 years from transaction date	Financial regulation / audit
Gaming activity history	5 years from account closure	Responsible gaming / disputes
Customer support communications	3 years from last interaction	Dispute resolution
Technical / device logs	12 months from collection	Security / fraud prevention
Marketing consent records	Until consent is withdrawn	Consent management

At the end of the applicable retention period, personal data is either permanently deleted from our systems or irreversibly anonymised so that it can no longer be attributed to any individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

6. Your Privacy Rights

As a player on 99ab, you have the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request". We will respond to all verified requests within 30 days of receipt.

Please note that some rights are subject to limitations where we have an overriding legal obligation to retain or process data — for example, AML and financial record-keeping requirements. Where a right cannot be fulfilled in full, we will explain why and advise on any available alternatives.

7. Data Security Measures

99ab employs a multi-layered approach to data security, combining technical controls, organisational policies, and staff training to protect your personal information against unauthorised access, disclosure, alteration, or destruction.

7.1 Technical Security Controls

• SSL/TLS Encryption: All data in transit between your device and 99ab's servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed automatically to prevent expiry-related vulnerabilities.
• Data Encryption at Rest: Sensitive data stored on 99ab's servers — including identity documents, KYC data, and payment records — is encrypted at rest using AES-256 or equivalent standards.
• Password Hashing: User passwords are stored as salted cryptographic hashes. Plain-text passwords are never stored or logged anywhere in our system.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Administrative access requires multi-factor authentication (MFA) and is logged for audit purposes.
• Firewall and Intrusion Detection: Our infrastructure is protected by network firewalls, web application firewalls (WAF), and automated intrusion detection systems that monitor for unusual access patterns in real time.
• Regular Security Audits: 99ab conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.

7.2 Organisational Security Measures

Access to player data within 99ab is granted only to employees and contractors who have a documented business need to access that data in order to perform their role. All staff with data access receive training on data protection obligations and are bound by confidentiality agreements. In the event of a data security incident that affects your personal information, 99ab will notify affected players and relevant authorities within the timeframes required by applicable law.

8. Updates to This Policy

99ab reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable laws, or the services we offer. When material changes are made, we will notify registered players via the email address associated with their account and/or via a prominent notice on the platform, prior to the changes taking effect.

The effective date at the top of this policy indicates when the current version was last reviewed and approved. We encourage you to review this policy periodically to remain informed about how 99ab handles your personal information. Your continued use of the platform following notification of a material change constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise a privacy right, or want to raise a concern about how 99ab handles your personal data, please contact us at [email protected]. Our support team is available 24 hours a day, 7 days a week, operating on Bangladesh Standard Time (UTC+6).