Your Privacy Matters — 99ba Data Protection Commitment

1. Introduction & Scope

This Privacy Policy ("Policy") is published by 99ba ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals ("you", "Player", "User") who access or use the 99ba website at https://99ba.io and all associated services, games, features, and communications (collectively, the "Service").

99ba is committed to handling your personal information with transparency, integrity, and care. This Policy sets out in precise terms what personal data we collect, the purposes for which it is processed, the legal grounds upon which that processing rests, how long data is retained, with whom it may be shared, and the specific rights you hold with respect to your information.

This Policy applies to all players registered from Bangladesh and internationally, and governs data collected through the website, mobile-responsive interface, customer support interactions, promotional campaigns, and payment processing flows. It should be read alongside the 99ba Terms & Conditions and Responsible Gaming policy, both of which are incorporated into the broader contractual framework governing your use of the platform.

2. Personal Data We Collect

99ba collects personal data through several distinct channels: directly from you during registration and account management, automatically through your use of the platform, and from trusted third-party partners where permitted and necessary. The categories of data collected are detailed below.

• Full legal name as it appears on your official identity document.
• Date of birth — used to verify that you meet the 21+ minimum age requirement.
• Residential address including city (e.g., Dhaka, Chittagong, Sylhet, Khulna) and postcode.
• Email address — primary communication channel for account notifications and support.
• Mobile phone number — used for account verification and security alerts.
• Username and encrypted password — credentials for platform access.

• Copies of government-issued identity documents such as National Identity Card (NID), passport, or driving licence.
• Proof of address documents such as utility bills, bank statements, or mobile financial service (MFS) statements from providers including bKash, Nagad, or Rocket.
• Selfie or live photograph submitted for biometric identity matching where required.

• Deposit and withdrawal amounts denominated in Bangladeshi Taka (৳).
• Payment method references — including mobile financial service (MFS) account numbers for bKash, Nagad, Rocket, and Upay, and bank account details for DBBL, BRAC Bank, City Bank, and Islami Bank. Full account numbers are masked; only the last four digits are retained post-verification.
• Transaction timestamps, transaction IDs, and processing status records.
• Bonus credits received, wagering activity, and withdrawal history.

• IP address and approximate geolocation derived from it.
• Device type, operating system, and browser version.
• Session duration, pages visited, game titles played, bet amounts, and game outcomes.
• Clickstream data and interaction logs used for platform improvement and fraud detection.
• Cookie identifiers and similar tracking technology data (see Section 6).

• Records of all support communications submitted via email to [email protected], including the content of messages and any attachments.
• Feedback and survey responses submitted voluntarily.
• Preferences for marketing communications where consent has been given.

3. How We Use Your Data

99ba processes personal data for clearly defined purposes only. We do not use your data for any purpose that is incompatible with the reason it was originally collected without your explicit consent or a valid legal basis.

4. Legal Basis for Processing

Every instance of data processing at 99ba is grounded in one or more of the following recognised legal bases:

• Contractual necessity: Processing required to perform the contract between you and 99ba — including account registration, payment processing, game delivery, and customer support.
• Legal obligation: Processing necessary to comply with applicable laws and regulations, including KYC identity verification, anti-money laundering (AML) procedures, and the retention of financial records.
• Legitimate interests: Processing that serves 99ba's genuine operational interests — such as fraud prevention, platform security, responsible gaming monitoring, and service analytics — where those interests are not overridden by your privacy rights.
• Consent: Processing that you have explicitly opted into, such as receiving promotional and marketing communications from 99ba. You may withdraw consent at any time by contacting support or updating your notification preferences within your account.

5. Data Sharing & Disclosure

99ba does not sell, rent, or trade your personal data to any third party. Data may be shared externally only in the limited circumstances described below, and always subject to appropriate contractual and technical safeguards.

We share data with carefully selected third-party service providers who assist in delivering the 99ba platform. These include payment processors (bKash, Nagad, Rocket, Upay, DBBL, BRAC Bank, City Bank), identity verification providers, game technology suppliers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), cloud infrastructure providers, and customer support platforms. All service providers are contractually bound to process your data only on 99ba's instructions and in accordance with applicable data protection standards.

99ba may disclose personal data to law enforcement agencies, regulatory authorities, or judicial bodies where required or permitted by law — for example, in connection with the investigation of suspected fraud, money laundering, or other criminal activity, or pursuant to a valid legal order, subpoena, or court judgment.

In the event of a merger, acquisition, restructuring, or sale of all or part of 99ba's business, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and of any material changes to the terms governing your data prior to the transfer taking effect.

99ba may share aggregated, anonymised statistical data — such as total active player counts, aggregate betting volumes, or platform usage trends — with partners or for public reporting purposes. Such data contains no personally identifiable information and cannot be used to identify any individual player.

6. Cookies & Tracking Technologies

99ba uses cookies and similar technologies (such as local storage objects and session tokens) to operate and secure the platform, deliver a consistent user experience, and analyse aggregate usage patterns. The types of cookies we use are detailed below.

99ba does not deploy third-party advertising or cross-site behavioural tracking cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to log in and use the platform securely.

7. Data Retention Periods

99ba retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, and to comply with applicable legal and regulatory obligations. The key retention periods we apply are set out below.

• Active account data: Retained for the full duration of your account's active status plus a minimum of 5 years following permanent account closure, to satisfy anti-money laundering record-keeping requirements.
• KYC verification documents: Retained for a minimum of 5 years following the conclusion of the business relationship, in accordance with financial compliance standards.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Support communications: Retained for up to 3 years from the date of the interaction, unless the communication relates to an ongoing dispute or legal matter.
• Technical and usage logs: Retained for up to 24 months for security monitoring and fraud detection, then deleted or anonymised.
• Marketing consent records: Retained for 3 years from the date consent was last confirmed or the date of the most recent marketing interaction.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted, anonymised beyond re-identification, or archived in accordance with 99ba's internal data lifecycle procedures.

8. Security Measures

99ba implements a comprehensive programme of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes the following controls:

• Encryption in transit: All data transmitted between your device and 99ba servers is protected by 256-bit SSL/TLS encryption. HTTPS is enforced across the entire platform with HTTP Strict Transport Security (HSTS) enabled.
• Encryption at rest: Sensitive personal data stored in our databases — including identity documents, payment references, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All internal staff with data access are subject to confidentiality obligations and receive regular data protection training.
• Password security: Passwords are never stored in plain text. All account passwords are hashed using a cryptographically strong one-way hashing algorithm with per-user salting.
• Intrusion detection: 99ba's infrastructure is monitored continuously for anomalous activity, unauthorised access attempts, and potential security incidents using automated detection systems.
• Incident response: In the event of a confirmed data security incident affecting your personal data, 99ba will notify affected players promptly and take immediate remedial action.

9. Your Data Rights

As a player whose personal data is processed by 99ba, you are entitled to exercise the following rights in relation to your information. All requests are handled at no charge and responded to within a reasonable time frame of no longer than 30 days from the date the request is received.

• Right of access: You may request a copy of all personal data that 99ba holds about you, together with information about the purposes for which it is processed, the categories of data held, and the recipients with whom it has been shared.
• Right to rectification: You may request that any inaccurate or incomplete personal data held about you be corrected or updated. You may also update certain account information directly through your account dashboard.
• Right to erasure: You may request that your personal data be deleted where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing based on legitimate interests. This right is subject to overriding legal retention obligations (see Section 7).
• Right to restriction: You may request that 99ba restrict the processing of your data in certain circumstances — for example, while a rectification request is under review, or where you have objected to processing pending verification of legitimate grounds.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to the processing of your personal data where that processing is based on 99ba's legitimate interests, including profiling for responsible gaming monitoring purposes. You also have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request", including your registered email address and a description of the right you wish to exercise. We may ask you to verify your identity before processing the request.

10. Minors & Age Restriction

The 99ba platform is strictly intended for adults aged 21 and above. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Registrations that are found to have been made by persons under this minimum age will be immediately closed, all associated data will be deleted from our active systems, and any deposits will be returned in accordance with our age verification procedures.

11. Changes to This Policy

99ba reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal obligations. When material changes are made, we will notify registered players by email to the address associated with their account and will display a prominent notice on the platform. The "Last updated" date at the top of this Policy will be revised accordingly.

Your continued use of the 99ba platform following notification of a policy update constitutes your acknowledgement of the revised Policy. We recommend reviewing this page periodically to stay informed of how your data is being handled. Previous versions of this Policy are available upon written request to [email protected].

12. Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or 99ba's data processing practices, please contact our Data Protection Officer (DPO) using the details below. We are committed to responding to all privacy-related enquiries promptly and in good faith.

• Contact Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Policy Enquiry" or "Data Rights Request"
• Support Hours: 24 hours a day, 7 days a week
• Languages: English and Bengali
• Response Target: Initial acknowledgement within 24 hours; substantive response within 10 business days

If you are not satisfied with 99ba's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in your jurisdiction. 99ba will cooperate fully with any such regulatory enquiry.