gr99 Privacy Policy

Introduction

gr99 operates an online casino and sports betting platform serving players across Bangladesh. In the course of providing our services — which include cricket betting, live casino games, slot games, and instant payment processing via bKash, Nagad, Rocket, and Upay — gr99 necessarily collects and processes certain personal data about the individuals who register and play on the Platform.

gr99 takes its data protection responsibilities seriously. This Policy sets out in plain terms what personal data we collect from you, the legal basis on which we process it, how it is stored and protected, with whom it may be shared, and what rights you have in relation to your own data. If at any point you have a question about how gr99 handles your personal information, our support team is available 24/7 via live chat on the Platform.

In this Policy, "gr99", "we", "us", and "our" refer to the gr99 platform and its operators. "You" and "your" refer to any natural person who accesses or uses the Platform, whether as a registered account holder or as a visitor.

Personal Data We Collect

gr99 collects the following categories of personal data from users of the Platform:

2.1 Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you meet the 21+ minimum age requirement).
• Nationality and country of residence.
• A copy of your government-issued photo ID (National ID card, passport, or driving licence) when KYC verification is required.

2.2 Contact Data

• Email address registered to your gr99 account.
• Mobile phone number linked to your account or payment method.
• Residential address (where required for enhanced KYC).

2.3 Financial Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers used for deposits and withdrawals.
• Bank account details (where provided for bank transfer withdrawals).
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method references.

2.4 Account & Activity Data

• gr99 username and encrypted password hash.
• Login timestamps, session durations, and device identifiers.
• Betting history: sports markets wagered on, casino games played, stake amounts, and outcomes.
• Bonus and promotion usage history.
• Responsible gaming preferences (deposit limits, session limits, self-exclusion status).

2.5 Technical Data

• IP address at the time of registration and each login.
• Browser type, version, and operating system.
• Device type (desktop, mobile, tablet) and screen resolution.
• Referring URL and pages visited within the gr99 Platform.
• Cookie identifiers (see Section 6).

2.6 Communications Data

• Records of live chat conversations with gr99 customer support.
• Email correspondence sent to or received from gr99 support.
• Records of any complaints, disputes, or escalation requests.

How We Collect Your Data

gr99 collects personal data through the following means:

• Direct submission: Data you provide when completing the gr99 account registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting customer support.
• Automated collection: Technical and activity data collected automatically when you access and use the Platform, via server logs, session tracking, and cookies (see Section 6).
• Third-party verification services: Identity and age verification data returned by KYC service providers that gr99 engages to verify the information you have submitted.
• Payment processors: Transaction confirmation data returned by bKash, Nagad, Rocket, Upay, and other payment processors in connection with your deposits and withdrawals.
• Game providers: Game session data (rounds played, outcomes, RTP statistics) provided by third-party game studios including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, and NetEnt in connection with games hosted on the Platform.

Purpose & Legal Basis for Processing

gr99 processes personal data only where it has a lawful basis for doing so. The table below summarises the primary purposes for which gr99 processes your data and the corresponding legal basis for each:

gr99 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review.

Sharing Your Personal Data

gr99 does not sell your personal data. We may share your personal data with third parties only in the following circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment service providers, to the extent necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged by gr99 to verify your age, identity, and source of funds in accordance with our legal obligations.
• Game software providers: Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt, and other studio partners, who require session data to operate the games you play on the Platform.
• IT and platform infrastructure providers: Cloud hosting, security, and technical service providers engaged by gr99 to operate and maintain the Platform securely.
• Law enforcement and regulatory authorities: Where gr99 is required by applicable law, court order, or regulatory instruction to disclose personal data. gr99 will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of gr99's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom gr99 shares personal data are required to process that data in a manner consistent with this Policy and to implement appropriate technical and organisational security measures.

Cookies & Tracking Technologies

gr99 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website when you visit it. Cookies allow the Platform to recognise your device on subsequent visits and to remember certain preferences and session states.

gr99 uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your gr99 account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without preventing you from using the Platform.
• Functional cookies: Remember your preferences such as language settings and responsible gaming limit configurations, so you do not need to re-enter them on each visit.
• Analytics cookies: Collect anonymous, aggregated data about how users navigate and interact with the Platform. This data is used by gr99 to identify usability issues and improve the player experience. No personally identifiable information is collected via analytics cookies.
• Performance cookies: Monitor Platform response times, error rates, and technical performance to help gr99's engineering team identify and resolve issues quickly.

You may configure your browser to refuse all cookies or to alert you when cookies are being set. Please note that disabling strictly necessary cookies will affect your ability to log in and use the gr99 Platform. gr99 does not use third-party advertising or behavioural tracking cookies.

Data Security

gr99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the gr99 Platform.
• AES-256 encryption for sensitive data at rest, including payment details and identity documents.
• Bcrypt hashing with salt for all stored account passwords — gr99 never stores passwords in plaintext.
• Role-based access controls ensuring that gr99 staff can access personal data only to the extent strictly necessary for their job function.
• Regular security vulnerability assessments and penetration testing of the Platform infrastructure.
• Two-factor authentication available for player accounts and mandatory for internal staff accounts with data access.
• Automated anomaly detection systems that flag unusual login patterns or transaction behaviour for security review.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gr99 will notify affected players without undue delay and will take prompt remedial action.

While gr99 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your gr99 Login credentials and for notifying gr99 support immediately if you suspect unauthorised access to your account.

Data Retention

gr99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active gr99 account and for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with applicable financial regulations.
• KYC documents: Retained for a minimum of 5 years following account closure or the completion of the relevant verification process.
• Betting and gaming history: Retained for the duration of your active account and for up to 2 years following account closure, unless a longer period is required for dispute resolution or regulatory purposes.
• Customer support communications: Retained for up to 3 years from the date of the communication, or longer where the communication forms part of a formal complaint or legal claim.
• Technical and analytics data: Retained in aggregated, anonymised form indefinitely. Raw technical logs are retained for a maximum of 12 months.
• Marketing preference data: Retained until you withdraw your consent or close your account.

When personal data is no longer required, gr99 will either securely delete it or anonymise it so that it can no longer be associated with any individual.

Your Privacy Rights

As a gr99 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, please contact gr99 customer support via live chat or by email at [email protected].

• Right of access: You have the right to request a copy of the personal data that gr99 holds about you. gr99 will respond to verified access requests within 30 days.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held by gr99. You may update many account details directly through the Platform's account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to gr99's legal retention obligations. Where gr99 is required by law to retain certain data, we will inform you of this at the time of your request.
• Right to restriction: You may request that gr99 restrict the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to gr99 in a structured, commonly used, machine-readable format, and to request that it be transferred directly to another service provider where technically feasible.
• Right to withdraw consent: Where gr99 processes your data on the basis of your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object: You have the right to object to the processing of your personal data where gr99 relies on legitimate interests as the legal basis, unless gr99 can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

gr99 will not charge a fee for handling privacy rights requests made in good faith. gr99 may request verification of your identity before acting on a request to ensure that personal data is not disclosed to an unauthorised party.

Children & Minors

The gr99 Platform is strictly intended for adults aged 21 and above. gr99 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory part of the account registration process and is enforced through gr99's KYC procedures.

If gr99 discovers or is notified that personal data has been collected from a person under 21 years of age, gr99 will immediately close the relevant account and delete all associated personal data, returning any Real Money Balance in accordance with our Terms & Conditions. If you have reason to believe that a minor has registered a gr99 account, please contact our support team immediately via live chat.

Third-Party Links & Integrations

The gr99 Platform may display references to or integrations with third-party game providers and payment processors. While gr99 selects its partners carefully and requires them to maintain appropriate data protection standards, gr99 is not responsible for the privacy practices of independent third parties.

Game providers such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, and NetEnt operate under their own privacy policies in relation to game session data. Payment processors such as bKash, Nagad, and Rocket process transaction data under their own terms and privacy policies. gr99 recommends that you review the privacy documentation of any third-party service with which you interact in connection with your use of the Platform.

Policy Updates & Amendments

gr99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services offered on the Platform. The effective date at the top of this Policy will be updated whenever a change is made.

Where an amendment materially affects your rights or the way in which gr99 processes your personal data, gr99 will notify registered account holders by email to the address associated with their gr99 account at least 14 days before the change takes effect. For non-material changes (such as corrections of typographical errors or clarifications that do not alter the substance of the Policy), gr99 may update the Policy without advance notice.

Your continued use of the gr99 Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy. If you do not agree with the amended Policy, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.

Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how gr99 has handled your personal data, please get in touch using the following contact details:

• Live Chat: Available 24/7 directly on the gr99 Platform — recommended for fastest response.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in your subject line.
• Response Time: gr99 aims to acknowledge all privacy-related enquiries within 2 business days and to resolve them within 30 days of receipt.
• Operating Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6).

gr99 takes every privacy concern seriously and will respond to all enquiries promptly and with the care they deserve.