Privacy Policy — xx99900

1 Information We Collect

xx99900 collects personal data through several channels: information you provide directly when registering or using the platform, information generated automatically by your use of the platform, and in some cases information received from trusted third-party partners. We collect only the data that is reasonably necessary to provide our services, comply with legal obligations, and protect the security of the platform.

Information You Provide Directly

When you create an account on xx99900, we collect the following categories of personal data:

• Identity data: Full legal name, date of birth, gender, and nationality as provided during registration or KYC verification.
• Contact data: Mobile phone number, email address, and residential address in Bangladesh (city, district, and postal area).
• Identity document data: Copies of your National Identity Card (NID), passport, or driver's licence submitted for age and identity verification purposes.
• Financial data: Payment method details including bKash account number, Nagad account number, Rocket number, Upay number, bank account details, or card details (Visa/Mastercard) used for deposits and withdrawals. We do not store full card numbers; card transactions are processed via PCI-DSS-compliant third-party payment processors.
• Communications data: The content of messages you send to our support team via live chat, email, or any other communication channel.
• Responsible gaming data: Self-exclusion requests, deposit limit preferences, and cooling-off period selections that you submit voluntarily through our responsible gaming tools.

Information Collected Automatically

When you access xx99900, certain technical data is collected automatically by our systems:

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage and behavioural data: Pages visited, games played, bet amounts and frequencies, session duration, navigation paths, and in-platform search queries.
• Transaction data: A full record of all deposits, withdrawals, bets placed, game results, bonus activations, and account balance changes associated with your account.
• Location data: Approximate geographic location derived from your IP address, used to verify that you are accessing the platform from an eligible location and to comply with geolocation-based restrictions.
• Cookie and tracking data: Data collected via cookies and similar technologies as described in Section 5 of this policy.

2 How We Use Your Data

xx99900 uses the personal data it collects for specific, documented purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we process personal data are set out in the table below:

Marketing Communications

If you have opted in to receive marketing communications, xx99900 may send you promotional emails or SMS messages about bonuses, new games, cricket betting events such as BPL and IPL, and seasonal offers tied to occasions such as Eid or Pohela Boishakh. You can withdraw your consent to receive marketing communications at any time by contacting support@xx99900 or by following the unsubscribe instructions in any marketing message we send.

Withdrawing marketing consent does not affect the lawfulness of processing that occurred before you withdrew consent, and it does not affect your ability to use the xx99900 platform or receive transactional communications related to your account.

3 Legal Basis for Processing

xx99900 processes personal data on one or more of the following legal bases depending on the specific processing activity:

• Contractual necessity: Processing required to deliver the service you requested when creating an account and agreeing to our Terms & Conditions. Without this processing, we cannot provide casino games, sports betting, or payment services.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, age verification obligations, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing carried out for purposes that serve the legitimate interests of xx99900 or third parties, provided those interests are not overridden by your fundamental rights. This includes fraud prevention, platform security, internal analytics, and responsible gaming monitoring.
• Consent: Processing for which you have given clear, informed, and freely withdrawable consent — most commonly for marketing communications and for the placement of non-essential cookies on your device.

Where we rely on legitimate interests as our legal basis, we carry out a balancing assessment to confirm that the processing is proportionate and that your interests and rights are appropriately considered. You have the right to object to processing carried out on legitimate interest grounds; see Section 7 for details.

4 Data Sharing and Disclosure

xx99900 does not sell your personal data to third parties under any circumstances. We share personal data only in the following limited and controlled circumstances:

Service Providers and Technology Partners

We share data with carefully selected third-party service providers who assist in delivering the xx99900 platform. These include payment processors handling BDT transactions via bKash, Nagad, Rocket, Upay, and banking partners; game software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi who operate the games available on our platform; identity verification and KYC technology providers; cloud hosting and infrastructure providers; and customer support software providers. All service providers are contractually bound to process your data only on our instructions and to maintain appropriate security standards.

Legal and Regulatory Disclosure

xx99900 may disclose personal data to competent authorities, law enforcement agencies, courts, or regulatory bodies where we are legally required to do so, where disclosure is necessary to protect the vital interests of a person, or where disclosure is required to establish, exercise, or defend legal claims. We will notify you of any such disclosure where legally permissible.

Business Transfers

In the event that xx99900 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer and of any material changes to this Privacy Policy that result from it.

5 Cookies and Tracking Technologies

xx99900 uses cookies and similar tracking technologies (such as local storage and session storage) to operate the platform, remember your preferences, and understand how the platform is used. Cookies are small text files placed on your device when you visit the platform.

Types of Cookies We Use

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. However, disabling essential cookies will prevent you from logging in to or using the xx99900 platform. For more information about managing cookies, refer to your browser's help documentation.

6 Data Retention

xx99900 retains personal data for as long as is necessary for the purposes for which it was collected, subject to any longer retention periods required by law. Our standard retention schedule is as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years after permanent account closure, to comply with anti-money laundering and record-keeping obligations.
• Transaction and betting records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC and identity document data: Retained for a minimum of 5 years after the end of the account relationship, or longer if required by applicable regulations.
• Customer support communications: Retained for 2 years from the date of the last communication in a support thread, unless the communication relates to a dispute or legal matter, in which case it is retained until final resolution plus 1 year.
• Marketing preference data: Retained for as long as you hold an active account, and for 1 year after account closure to record the history of your consent decisions.
• Analytics and behavioural data: Aggregated and anonymised analytics data may be retained indefinitely as it can no longer be linked to an individual. Raw behavioural logs are retained for up to 13 months.

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. If you request deletion of your data before the end of its standard retention period, we will assess the request and delete what is legally permissible to delete, retaining only data that is required by law or for legitimate legal defence purposes.

7 Your Data Rights

As a user of xx99900, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at support@xx99900 with the subject line "Data Rights Request". We will respond within 30 days of receiving a valid request.

• Right of access: You have the right to request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For account details such as email address and phone number, you can update these directly in your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where the data has been unlawfully processed. This right is subject to our legal obligations to retain certain data as described in Section 6.
• Right to restriction: You have the right to request that we restrict processing of your data in certain circumstances — for example, while a dispute about accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing, we will cease that processing immediately.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

8 Data Security Measures

xx99900 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following measures:

• SSL/TLS encryption: All data transmitted between your browser or device and the xx99900 platform is encrypted using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser's address bar when using the platform.
• Data encryption at rest: Sensitive personal data stored in our databases — including identity document copies and financial data — is encrypted at rest using strong encryption algorithms.
• Access controls: Access to personal data within xx99900 is restricted on a strict need-to-know basis. Staff access is role-based, audited, and requires strong authentication. No staff member has unrestricted access to the full dataset of all players.
• Payment security: xx99900 does not store raw card numbers or full bKash/Nagad credentials. Payment transactions are handled by PCI-DSS-compliant processors. Our platform receives only tokenised references to payment instruments.
• Regular security testing: Our platform infrastructure is subject to regular security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach that poses a risk to your rights and freedoms, xx99900 will notify affected users without undue delay and take all reasonable steps to contain and remediate the breach.

While xx99900 takes all reasonable measures to protect your data, no online platform can guarantee absolute security. You also have a role to play in protecting your account — use a strong, unique password, do not share your login credentials, and contact support@xx99900 immediately if you suspect unauthorised access to your account.

This Privacy Policy was last reviewed and updated on 1 January 2026. xx99900 reserves the right to update this policy at any time to reflect changes in our data practices, applicable law, or platform features. Material changes will be communicated to registered users via email or an in-platform notice before they take effect. We encourage you to review this policy periodically to stay informed about how we protect your data.