How b99a Collects, Uses, and Protects Your Personal Data

This Privacy Policy ("Policy") describes how b99a ("b99a", "we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("Players", "Users", "you") who register an account on, visit, or otherwise interact with the b99a platform accessible at b99a.io and any associated mobile or browser-based interfaces.

This Policy applies to all personal data processing activities carried out by b99a in connection with the operation of its online betting and casino platform, including sports betting markets, live casino games, crash games, slots, promotional campaigns, and customer support services. It applies regardless of whether you access b99a from a desktop browser, a mobile browser, or any other supported device.

By registering an account on b99a or by continuing to use the platform after the effective date of this Policy, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not register an account and must discontinue your use of the b99a platform.

This Policy should be read alongside the b99a Terms & Conditions, which govern the overall contractual relationship between you and b99a. In the event of any conflict between this Policy and the Terms & Conditions on a privacy-related matter, this Policy shall take precedence.

b99a acts as the data controller in respect of all personal data collected through the b99a platform. As data controller, b99a determines the purposes and means by which your personal data is processed. All data protection queries, access requests, and complaints should be directed to the b99a data protection contact using the details provided in Section 16 of this Policy.

b99a is committed to handling all personal data in accordance with applicable data protection standards and the responsible gaming obligations relevant to its operations in the Bangladesh market. b99a takes its role as data controller seriously and has implemented internal policies, technical safeguards, and staff training programmes to ensure that your data is handled with care and integrity at every stage of its lifecycle.

b99a collects personal data across several categories depending on the nature of your interaction with the platform. The categories of personal data we may collect include:

Category	Examples	When Collected
Identity Data	Full legal name, date of birth, gender, National Identity Card (NID) number, passport number	Account registration and KYC verification
Contact Data	Email address, mobile number, residential address (including city — Dhaka, Chittagong, Sylhet, etc.)	Account registration and profile updates
Financial Data	Mobile banking account references (bKash, Nagad, Rocket), bank account identifiers, transaction history, deposit and withdrawal records	Payment processing
Account Activity Data	Login history, betting history, game play sessions, bonus redemptions, wagering records	Ongoing platform use
Technical Data	IP address, device type, browser type and version, operating system, session duration, referring URL	Automatic collection on platform access
Communications Data	Support chat transcripts, email correspondence, feedback submissions	Support and communications interactions
Verification Documents	Scanned copies or photographs of NID, passport, utility bills, payment method proof	KYC verification process

b99a does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data except where expressly required by applicable law or where you have provided such information voluntarily in the context of a responsible gaming assessment.

b99a collects personal data through the following means:

• Direct interactions: Data you provide when registering your account, completing KYC verification, making deposits or withdrawals, contacting customer support, participating in promotions, or updating your account profile.
• Automated technical collection: Data collected automatically as you navigate and use the b99a platform, including IP addresses, device identifiers, browser characteristics, and session behaviour, collected via server logs, cookies, and similar technologies (see Section 9).
• Third-party payment processors: Transactional confirmation data received from payment partners such as bKash, Nagad, Rocket, Upay, SureCash, and supported Bangladeshi banks when you initiate a deposit or withdrawal through their systems.
• Identity verification providers: Where b99a uses third-party services to assist in verifying the authenticity of identity documents submitted during the KYC process, those providers may return verification results to b99a.
• Fraud and risk screening services: Data received from third-party fraud detection partners used to identify suspicious account activity, protect platform integrity, and comply with anti-money laundering obligations.

b99a processes your personal data on one or more of the following legal bases depending on the specific processing activity involved:

• Contractual necessity: Processing is necessary to perform the contract between you and b99a — specifically, to operate your account, process your bets and transactions, provide customer support, and deliver the services you have requested.
• Legal obligation: Processing is necessary for b99a to comply with applicable legal obligations, including anti-money laundering requirements, responsible gaming obligations, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing is necessary for the purposes of b99a's legitimate business interests, including platform security, fraud prevention, improving service quality, and conducting internal analytics, provided that those interests are not overridden by your fundamental privacy rights.
• Consent: Where b99a relies on your consent as the legal basis for processing — for example, for sending optional marketing communications — you have the right to withdraw that consent at any time through your account settings without affecting the lawfulness of processing that took place before withdrawal.

b99a uses the personal data it collects for the following purposes:

• To create, manage, and maintain your b99a account and to verify your identity and eligibility to use the platform.
• To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, SureCash, and supported Bangladeshi bank accounts.
• To calculate, record, and settle bets placed on sports markets including BPL, IPL, T20 World Cup, ICC tournaments, and other live events.
• To deliver casino game sessions, crash game rounds (including Slide and Limbo), and slot play on the b99a platform.
• To administer bonuses, promotions, and seasonal offers, and to verify compliance with applicable wagering requirements.
• To conduct KYC verification and ongoing due diligence as required by responsible gaming and anti-money laundering standards.
• To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, and other violations of the b99a Terms & Conditions.
• To provide customer support through your account dashboard and to maintain records of support interactions for quality assurance purposes.
• To send you account-related communications, including transaction confirmations, security alerts, and policy update notifications, to your registered email address.
• To conduct internal analytics and platform improvement activities aimed at enhancing the b99a user experience for Bangladeshi players.
• To implement and monitor responsible gaming tools, including deposit limits, session controls, and self-exclusion, in accordance with our Responsible Gaming policy.

b99a does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. b99a may share your personal data with the following categories of third parties only to the extent necessary for the specific purpose identified:

• Payment processors: bKash, Nagad, Rocket, Upay, SureCash, Dutch-Bangla Bank, BRAC Bank, and City Bank receive only the transaction data necessary to process your deposit or withdrawal request. b99a does not share your full identity data with payment processors beyond what is required for transaction completion and fraud screening.
• Identity verification providers: Third-party KYC and identity verification services that assist b99a in confirming the authenticity of documents submitted by players during the verification process. These providers are bound by strict confidentiality obligations.
• Game software providers: Casino game, crash game, and slot providers (such as Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi) may receive a session identifier or anonymised player reference necessary to deliver the game session. These providers do not receive your full identity data.
• Fraud and security partners: Third-party fraud detection and cybersecurity services that assist b99a in protecting platform integrity and identifying suspicious account activity.
• Legal and regulatory authorities: Where required by applicable law, court order, or lawful request from a competent regulatory or law enforcement authority, b99a may be obligated to disclose personal data. b99a will notify the affected player of such disclosure requests to the extent permitted by law.
• Professional advisors: Legal counsel, accountants, and auditors engaged by b99a under obligations of professional confidentiality, where access to personal data is necessary in connection with their professional services.

All third parties with whom b99a shares personal data are required to handle that data in accordance with applicable data protection standards. b99a uses contractual safeguards including data processing agreements to enforce these obligations on third-party service providers.

Financial data — including mobile banking account references, bank account identifiers, and transaction records denominated in Bangladeshi Taka (৳) — is treated with the highest level of protection within the b99a platform. b99a does not store full payment credentials such as complete mobile banking PINs, full bank account numbers beyond the minimum necessary reference, or card numbers (where applicable) on its own servers.

All payment transactions on b99a are processed through the secure APIs of the respective payment provider. When you initiate a deposit via bKash or Nagad, for example, the transaction is authenticated directly within that provider's secure environment, and only a transaction confirmation reference is returned to b99a. This design minimises the volume of sensitive financial data held by b99a at any point in time.

Transaction records including deposit amounts, withdrawal amounts, dates, times, and payment method references are retained by b99a for the period specified in Section 11 of this Policy, primarily to support account management, responsible gaming monitoring, dispute resolution, and compliance with applicable financial record-keeping obligations.

b99a uses cookies and similar tracking technologies on its platform to ensure that the site functions correctly, to remember your session preferences, and to understand how players interact with different areas of the site in aggregate. The categories of cookies used by b99a are as follows:

• Strictly necessary cookies: These cookies are essential for the b99a platform to operate and cannot be disabled. They include session cookies that maintain your logged-in state, security cookies that protect against cross-site request forgery, and cookies that remember your language and region preferences.
• Functional cookies: These cookies remember choices you have made — such as your preferred currency display or notification settings — to provide a more personalised experience. Disabling these cookies may reduce the functionality available to you on the platform.
• Analytics cookies: b99a uses privacy-respecting analytics tools to understand aggregate platform usage patterns — such as which sections of the site receive the most visits and where players encounter navigation difficulties. These analytics do not identify you as an individual and are used solely to improve the platform.

b99a does not use third-party advertising cookies or behavioural tracking cookies that build profiles of your activity across other websites. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the b99a platform.

b99a implements a layered approach to data security designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. The technical and organisational security measures in place at b99a include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and b99a servers.
• Encryption at rest for sensitive data categories stored in b99a's database infrastructure.
• Industry-standard password hashing using bcrypt or equivalent algorithms — your password is never stored in plain text.
• Role-based access controls ensuring that b99a staff can only access personal data to the extent required for their specific job function.
• Regular penetration testing and security audits conducted by independent cybersecurity specialists.
• Automated monitoring systems that detect and alert on unusual access patterns or potential account compromise in real time.
• Multi-factor authentication requirements for b99a administrative access to systems holding personal data.
• Documented incident response procedures to ensure that any personal data breach is identified, contained, and notified to affected players in a timely manner.

Despite these measures, no platform can guarantee absolute security. Players are reminded that they share responsibility for the security of their own account by choosing a strong, unique password for b99a, not sharing their login credentials with any third party, and notifying b99a support immediately if they suspect their account has been compromised.

b99a retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or responsible gaming obligations. The general retention principles applied by b99a are as follows:

• Active account data: Retained for the full duration of your account's active status on the b99a platform.
• Transaction and betting records: Retained for a minimum of five years following the date of the transaction to satisfy financial record-keeping and responsible gaming monitoring obligations.
• KYC verification documents: Retained for a minimum of five years following account closure or the date of the most recent verification activity, consistent with anti-money laundering obligations.
• Support communications: Retained for three years following the closure of the support interaction, to support quality assurance and dispute resolution.
• Technical and log data: Generally retained for a rolling period of twelve months, after which it is automatically purged from b99a's active systems.
• Closed or suspended accounts: Core identity and transaction data retained for a minimum of five years following account closure to support legal, regulatory, and responsible gaming obligations before being securely deleted or anonymised.

When data reaches the end of its retention period, b99a will either securely delete it using industry-standard data destruction methods or irreversibly anonymise it so that it can no longer be attributed to any identifiable individual.

As a registered player on b99a, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact b99a using the details in Section 16:

• Right of access: You have the right to request a copy of the personal data that b99a holds about you, along with information about how it is being processed.
• Right to rectification: If you believe that any personal data b99a holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed.
• Right to erasure: In certain circumstances, you have the right to request that b99a delete your personal data. This right is subject to limitations where retention is required by law, for the defence of legal claims, or for the fulfilment of contractual obligations.
• Right to restriction: You may request that b99a restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing of your personal data where that processing is based on b99a's legitimate interests. b99a will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

b99a will respond to all data rights requests within 30 days of receipt. In cases of complexity or where a large volume of requests is received simultaneously, b99a may extend this period by a further 60 days, in which case you will be notified of the extension and the reason for it.

The b99a platform is strictly restricted to individuals aged 21 years or older. b99a does not knowingly collect personal data from individuals under the age of 21. Account registration on b99a requires the provision of date of birth, and b99a will reject registration attempts where the provided date of birth indicates the applicant is under 21.

If b99a becomes aware that personal data has been collected from an individual under the age of 21 — whether through a registration error, the provision of a false date of birth, or any other means — b99a will take immediate steps to close the associated account, return any real-money balance where it is possible to do so, and permanently delete the personal data collected, in accordance with its responsible gaming obligations.

Parents and guardians who believe that a minor in their care has registered an account on b99a are urged to contact b99a support immediately using the contact details in Section 16. b99a treats all such reports as a priority and will act on them without delay.

b99a primarily processes the personal data of its Bangladeshi player base within its secure server infrastructure. Where data is transferred to or processed by third-party service providers whose operations are located outside Bangladesh — for example, cloud infrastructure providers or international game software vendors — b99a takes steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy.

These safeguards may include contractual clauses requiring the recipient to process data to the standard described in this Policy, or the use of service providers who maintain certifications under recognised international data security frameworks. If you would like further information about the specific safeguards applied to international transfers of your data, please contact b99a using the details in Section 16.

b99a reserves the right to update or amend this Privacy Policy at any time. The effective date displayed at the top of this page indicates when the current version came into force. Where amendments are material — meaning they substantially affect how your personal data is processed or your rights in relation to it — b99a will notify registered players via their registered email address or through an in-platform notification before the updated Policy takes effect.

Your continued use of the b99a platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree to a revised Policy, you must discontinue your use of the platform and may request account closure as described in the Terms & Conditions.

b99a encourages all players to review this Policy periodically so they remain informed about how their data is being protected. The version history of this Policy is available on request through the support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 12, want to report a suspected privacy breach, or have concerns about how b99a is handling your personal data, please contact the b99a data protection team through the support section of your account dashboard or via the email address below.

All data rights requests and privacy-related enquiries are handled by the b99a compliance and data protection team. Please note that the email address below is provided as plain text for written reference only — it is not a clickable link.

Data enquiries email: [email protected]

b99a aims to acknowledge all data-related enquiries within 48 hours and to provide a substantive response within 30 days. Support is available 24 hours a day, 7 days a week on Bangladesh Standard Time (BST, UTC+6), including national holidays such as Victory Day (December 16) and Independence Day (March 26).

Last updated: January 2026  |  Version: 2.0  |  Language: English  |  Platform: b99a.io