99db Privacy
Policy

99db ("we", "us", "our") operates the online betting and casino platform accessible at 99db.io (the "Platform"). We are committed to protecting the privacy and personal data of every player, visitor, and user who interacts with the 99db Platform. This Privacy Policy sets out in plain, formal terms how we collect, use, store, share, and protect your personal information, and what rights you have in relation to that information.

This Privacy Policy applies to all personal data processed by 99db in connection with the operation of the Platform, including data collected during account registration, identity verification, payment processing, customer support interactions, promotional activities, and general browsing of the Platform.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a privacy-related matter, this Privacy Policy shall prevail.

The most current version of this Privacy Policy is always available on this page and is identified by its effective date shown in the page header above. We recommend you review this page periodically.

99db collects personal data that falls into the following categories. We collect only the data that is necessary for the purposes described in Section 4 of this Privacy Policy.

2.1 Identity Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify you meet the 21+ age requirement)
• Gender (where voluntarily provided)
• Nationality and country of residence
• National Identity Card (NID) number or passport number (collected during KYC verification)
• A copy of your identity document and, where required, a selfie or live facial image for identity matching

2.2 Contact Data

• Email address
• Mobile phone number
• Residential address including district, division, and postal code within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar)

2.3 Account & Credentials Data

• Username chosen at registration
• Hashed password (we never store passwords in plain text)
• Account creation date and timestamp
• Account status history (active, suspended, self-excluded, closed)

2.4 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and methods (bKash, Nagad, Rocket, Upay, Visa, Mastercard, bank transfer)
• Mobile wallet account identifiers associated with your transactions (e.g., bKash number, Nagad number)
• Partial payment card details (last four digits only — full card numbers are never stored by 99db)
• Transaction reference numbers and status records
• Account balance history
• Bonus credit and wagering history

2.5 Betting & Gaming Activity Data

• Bet placement records including sport, event, market, odds, stake, and outcome
• Casino and slot game session records including game title, provider, session duration, bet size, and result
• Win/loss history
• Responsible gaming tool usage (e.g., deposit limits set, cooling-off periods applied)

2.6 Technical & Device Data

• IP address at time of registration and subsequent logins
• Device type, operating system, and browser type and version
• Device identifiers where available
• Session timestamps and duration
• Geolocation data (country and city level, derived from IP address)

2.7 Communications Data

• Records of live chat conversations with the 99db support team
• Email correspondence between you and 99db
• Records of any complaints or formal queries submitted

99db collects personal data through the following channels and mechanisms:

3.1 Data You Provide Directly

You provide data directly to us when you register an account, complete identity verification (KYC), make a deposit or withdrawal request, contact our support team, respond to a survey or promotion, or update your account profile. The accuracy of this data is your responsibility and you must keep it current.

3.2 Data Collected Automatically

When you access the 99db Platform, our systems automatically collect certain technical and device data, including your IP address, browser characteristics, session timing data, and page interaction data. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 6 of this Privacy Policy.

3.3 Data From Third Parties

We may receive personal data about you from the following categories of third parties:

• Identity verification providers: Where we use a third-party KYC service to validate your identity documents, that provider will return a verification result and may share relevant identity data with us.
• Payment processors: Our payment partners (including bKash, Nagad, Rocket, Upay, and card processing networks) share transaction confirmation data and, where relevant, risk or fraud signals with us.
• Fraud and risk management services: We may receive risk scores, device fingerprint data, or fraud indicators from specialist third-party services that help us protect the integrity of the Platform.
• Analytics providers: Aggregated and anonymised behavioural data may be received from analytics platforms to help us improve Platform performance and user experience.

The table below sets out the purposes for which 99db processes your personal data and the legal basis relied upon for each purpose.

Where we rely on legitimate interests as our legal basis, we have assessed that our interests in processing your data are not overridden by your rights and freedoms, taking into account the nature of the data, the reasonable expectations of players using an online betting platform, and the safeguards we have in place.

Where we rely on consent as our legal basis (primarily for direct marketing), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. See Section 11 for details on managing marketing preferences.

5.1 Service Providers (Data Processors)

We share personal data with carefully selected third-party service providers who process data on our behalf under written data processing agreements. These providers are contractually bound to process your data only on our instructions and to maintain appropriate security measures. Categories of service providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard network processors, and banking partners including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank — to facilitate deposits and withdrawals.
• KYC and identity verification providers: To verify your identity documents and age at registration and on an ongoing basis.
• Game studio providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studio partners — to deliver casino and slot game content. These providers receive only the session data necessary to operate the game (e.g., player ID, currency, stake).
• Fraud and risk management providers: To detect and prevent fraud, money laundering, and account abuse.
• Cloud infrastructure and hosting providers: To store Platform data securely.
• Customer support platform providers: To manage live chat and email support interactions.
• Analytics providers: To analyse aggregated and anonymised Platform usage data.

5.2 Legal and Regulatory Disclosures

99db may disclose your personal data to law enforcement authorities, regulators, courts, or other government bodies in Bangladesh or other applicable jurisdictions where we are legally required or compelled to do so, or where we believe disclosure is necessary to prevent fraud, money laundering, or serious harm. We will notify you of any such disclosure where we are legally permitted to do so.

5.3 Business Transfers

In the event that 99db undergoes a merger, acquisition, corporate restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. We will notify you of any such transfer and of any resulting changes to this Privacy Policy.

5.4 Cross-Border Transfers

Some of our service providers operate outside Bangladesh. Where personal data is transferred internationally, we take steps to ensure that an equivalent level of protection is applied, including the use of contractual safeguards. By using the 99db Platform, you acknowledge that your data may be processed in jurisdictions outside Bangladesh.

99db uses cookies and similar tracking technologies on the Platform to ensure it functions correctly, to remember your session and preferences, to detect fraud, and to analyse how players use the Platform. The table below summarises the categories of cookies we use.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will impair your ability to use the Platform, including logging in and placing bets.

In addition to cookies, we may use web beacons, pixel tags, and local storage objects for similar analytical and security purposes. These technologies are governed by the same principles as cookies under this Privacy Policy.

99db implements a layered approach to data security that includes the following technical and organisational measures:

• Encryption at rest and in transit: Personal data stored in our databases is encrypted at rest. All data in transit is protected by TLS 1.2 or higher.
• Password hashing: Account passwords are stored using industry-standard one-way hashing with salting. We never store or transmit plain-text passwords.
• Access controls: Access to personal data within 99db is restricted to staff who require it for legitimate operational purposes. Access is controlled by role-based permissions and is subject to audit logging.
• Two-factor authentication (2FA): Internal systems holding personal data are protected by multi-factor authentication requirements for all staff access.
• Regular security testing: We conduct regular vulnerability assessments and penetration testing of the Platform and underlying infrastructure.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that affects your personal data, we will notify you in accordance with applicable law.
• Staff training: All 99db staff with access to personal data receive data protection and security training as part of their onboarding and on a periodic basis thereafter.

While we take all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials and for notifying us immediately at [email protected] if you believe your account has been compromised.

99db retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following retention periods apply as a general guide:

On expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised aggregate data (for example, statistical reporting on Platform usage) may be retained indefinitely as it no longer constitutes personal data.

Where you request deletion of your personal data before the end of a retention period, we will assess the request against our legal obligations. We may be required to retain certain data — for example, KYC and transaction records — regardless of your deletion request, and will inform you of this where applicable.

Subject to applicable law and any overriding legal obligations on our part, you have the following rights in relation to the personal data that 99db holds about you:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is being used. We will respond to access requests within 30 days.
• Right to Rectification: If you believe that any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it. You can update basic contact and profile data directly through your account settings; for identity data changes, please contact support.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Erasure requests are subject to our legal data retention obligations (see Section 8).
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain circumstances — for example, where you contest its accuracy or where you have objected to processing and we are assessing that objection.
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, including profiling. You also have an absolute right to object to processing of your data for direct marketing purposes.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact our support team by email at [email protected] with the subject line "Data Rights Request" and a description of your request. Please include your registered username and email address so we can identify your account. We will acknowledge your request within 5 business days and provide a substantive response within 30 days, or notify you if a longer period is required due to the complexity or volume of requests.

The 99db Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that we have collected personal data from a person under 21 — whether through a registration attempt, a KYC review, or any other means — we will take immediate steps to suspend the associated account, delete the personal data collected, and reverse any financial transactions associated with the account to the extent technically possible.

If you believe that a person under the age of 21 has registered or attempted to register an account on the 99db Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

Parents and guardians are encouraged to use parental control software and filtering tools to prevent minors from accessing online gambling platforms. 99db supports responsible parenting initiatives and cooperates fully with any credible report of underage access.

99db may send you promotional communications — including information about bonuses, seasonal campaigns, new game launches, BPL and cricket betting promotions, and other offers — where you have provided explicit consent to receive such communications at registration or through your account settings.

We may communicate with you via email, SMS, or in-platform notifications, depending on the preferences you set. We will never send unsolicited marketing communications to individuals who have not opted in, and we will never share your contact details with third parties for their own marketing purposes.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your account settings dashboard;
• Clicking the "unsubscribe" link included in any marketing email we send you; or
• Contacting our support team at [email protected] with the subject line "Unsubscribe".

Please note that withdrawing marketing consent does not affect the delivery of transactional communications that are necessary for the operation of your account — for example, deposit confirmation emails, withdrawal status notifications, identity verification requests, and responsible gaming alerts. These communications are essential to our contract with you and cannot be opted out of while your account remains active.

The 99db Platform does not contain links to external third-party websites for general browsing purposes. However, certain game content is delivered directly from third-party studio providers' platforms (e.g., Evolution Gaming's live dealer studio environment, Pragmatic Play's game server). When you launch a game from a third-party provider, your session data — including player ID, currency, and bet amounts — is transmitted to that provider's systems as necessary to operate the game.

Each third-party game provider operates under their own privacy policy and data processing terms. 99db has entered into data processing agreements with all studio providers that govern the use of player data in connection with game delivery. These agreements require providers to use player data only for the purpose of delivering the game session and to maintain appropriate security measures.

99db is not responsible for the privacy practices of third-party game studio providers beyond the contractual obligations described above. We recommend that you review the privacy policies of any third-party providers whose content you access through the Platform if you have specific concerns about how they handle your data.

99db reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform functionality. When we make material changes to this Privacy Policy, we will notify you through one or more of the following methods:

• A prominent notice displayed on the Platform homepage or login screen;
• An in-platform notification sent to your account; or
• An email notification sent to the email address registered to your account.

The updated Privacy Policy will be identified by a revised effective date shown at the top of this page. Where changes are material and require your fresh consent — for example, if we introduce a new category of data processing that requires consent as its legal basis — we will request that consent explicitly before the new processing begins.

Your continued use of the 99db Platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any changes, you must discontinue use of the Platform and may request account closure by contacting support.

We strongly encourage you to review this Privacy Policy periodically. The date shown at the top of this page always reflects the version currently in effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 99db processes your personal data, please contact our support team using the details below. All privacy-related enquiries are handled by our designated data protection team.

When contacting us about a data rights request or privacy concern, please include your registered username, the email address associated with your 99db account, and a clear description of your request or concern. This will allow us to locate your account records and respond as efficiently as possible.

We are committed to resolving all privacy-related enquiries fairly and promptly. If you are not satisfied with our response, you may have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.