Your Privacy Matters to Us

Information We Collect

9a99 collects personal information from you through several channels: directly when you register an account or contact support, automatically when you use the platform, and occasionally from third-party sources such as payment providers and identity verification services. The categories of personal data we collect are described in detail below.

Information You Provide Directly

When you register a 9a99 account or interact with our platform, you provide us with the following categories of personal data:

• Identity Data: Your full legal name as it appears on your government-issued identification document, date of birth, and gender.
• Contact Data: Your email address and Bangladeshi mobile phone number registered on the account.
• Residential Data: Your home address, including district and division within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).
• KYC Documentation: Copies of your national identity card (NID), passport, or other government-issued identification documents submitted during the Know Your Customer verification process.
• Financial Data: Your payment method details, including mobile financial service wallet numbers (bKash, Nagad, Rocket, Upay) and bank account references used for deposits and withdrawals. We do not store full debit or credit card numbers on our servers.
• Support Communications: Records of your correspondence with our customer support team, including chat transcripts, email exchanges, and any attachments you provide.
• Account Preferences: Responsible gaming settings, notification preferences, and any self-imposed deposit limits or session restrictions you configure on your account.

Information Collected Automatically

When you access the 9a99 platform, certain technical and behavioural data is collected automatically through our servers, analytics tools, and cookies:

Information from Third Parties

9a99 may receive personal data about you from the following third-party sources in limited and specific circumstances:

• Payment Processors: Transaction confirmation data, payment status updates, and fraud signals from bKash, Nagad, Rocket, Upay, and banking partners.
• Identity Verification Services: Results of document authenticity checks and age verification from third-party KYC providers.
• Fraud Detection Partners: Risk scores, device fingerprint data, and flagged transaction patterns from security service providers.
• Game Providers: Game session records, round outcomes, and RNG audit data from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi for dispute resolution and fair play verification purposes.

How We Use Your Data

9a99 processes your personal data only for legitimate, defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The following table summarises the primary purposes for which we use your personal data, together with the lawful basis for each processing activity.

Marketing Communications

9a99 may send you promotional emails or SMS notifications about bonuses, seasonal offers (such as Eid promotions, BPL season specials, or ICC T20 World Cup betting offers), and new game launches where you have given explicit consent to receive such communications. You may withdraw your marketing consent at any time by updating your account notification preferences or by contacting support at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

Data Sharing & Disclosure

9a99 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the specific, limited circumstances described below, and only to the extent necessary to fulfil the stated purpose.

Service Providers and Processors

We engage trusted third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These processors act solely on 9a99's documented instructions and are not permitted to use your data for their own purposes. Categories of processors include:

• Payment Processing Partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — for transaction execution and confirmation.
• Identity Verification Providers: Third-party KYC and document verification services used to authenticate identity documents and confirm age.
• Game Technology Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Habanero, Spribe, and Ezugi — game session and round data is shared for game operation, audit, and dispute resolution purposes.
• Fraud Prevention and Security Services: Providers of device fingerprinting, IP reputation analysis, and transaction risk scoring tools.
• Cloud Infrastructure and Hosting Providers: Secure server hosting and content delivery services that store and transmit platform data under strict confidentiality agreements.
• Customer Support Platform Providers: Live chat and ticketing system providers that process support communications on our behalf.

Legal and Regulatory Disclosure

9a99 may disclose your personal data to regulatory bodies, law enforcement agencies, or other governmental authorities where we are legally required to do so. This includes disclosure in response to:

• A valid court order, subpoena, or other legal process.
• A request from a competent regulatory or law enforcement authority in connection with an investigation into money laundering, fraud, terrorism financing, or other criminal activity.
• Compliance with anti-money laundering (AML) reporting obligations where a suspicious transaction report (STR) is required.

Where legally permissible, 9a99 will notify you of such a disclosure request before complying. However, in many law enforcement contexts, 9a99 may be legally prohibited from notifying you of the disclosure.

Business Transfers

In the event that 9a99 undergoes a merger, acquisition, corporate restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to how your data is processed via the email address registered on your account, with a reasonable opportunity to exercise your data rights prior to the transfer taking effect.

Cookies & Tracking Technologies

The 9a99 platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. This section explains what cookies we use, why we use them, and how you can manage your cookie preferences.

What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember information about your visit — such as your preferred language, session state, and account login status — making your next visit easier and the platform more useful to you.

Types of Cookies We Use

Managing Cookie Preferences

You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies, restrict third-party cookies, or receive a notification when a cookie is set. Please note that disabling essential cookies will impair your ability to log in and use core platform features. The following guidance applies to commonly used browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Microsoft Edge: Settings → Cookies and Site Permissions → Manage and Delete Cookies.
• Samsung Internet (common on Android devices in Bangladesh): Settings → Privacy → Cookie Controls.

Data Security Measures

9a99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme is aligned with industry best practices for online gambling platforms and includes the following controls.

Technical Safeguards

• SSL/TLS Encryption: All data transmitted between your device and 9a99 servers is encrypted using 256-bit SSL/TLS encryption. The padlock icon in your browser confirms this protection is active during every session.
• Encryption at Rest: Sensitive personal data, including identity documents and financial records, is encrypted at rest in our secure database infrastructure using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff members can only access the specific data required to perform their role. All access is logged and subject to regular audit.
• Two-Factor Authentication: 9a99 supports two-factor authentication (2FA) for account logins, providing an additional layer of protection against unauthorised account access.
• Penetration Testing: Regular independent security testing is carried out on the 9a99 platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Firewall and Intrusion Detection: Enterprise-grade firewall protection and real-time intrusion detection systems monitor all traffic to and from 9a99 servers around the clock.

Organisational Safeguards

• All staff with access to personal data undergo mandatory data protection and security training as part of their onboarding and at regular intervals thereafter.
• 9a99 maintains a formal data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, affected users will be notified without undue delay, with details of what happened, what data was affected, and what steps are being taken.
• Third-party service providers are vetted for security compliance before being granted access to any 9a99 data, and are bound by contractual data processing agreements that specify security requirements.

Data Retention Policy

9a99 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of personal data we hold.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

Your Privacy Rights

As a user of 9a99, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact our data support team at [email protected] with the subject line "Data Rights Request". We will respond to all verified requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data that 9a99 holds about you, together with information about how it is being used. This is sometimes called a Subject Access Request (SAR). We will provide this information free of charge in a structured, commonly used format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay. You can update basic account details (email address, mobile number) directly through your account settings; for identity data corrections, please contact support.
• Right to Erasure: You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and there is no other lawful basis for processing), or where you object to processing and there are no overriding legitimate grounds. Please note that we may be unable to fulfil erasure requests where we are required by law to retain the data (e.g., AML record-keeping obligations).
• Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while an accuracy dispute is being resolved, or where you have objected to processing and we are considering whether our legitimate grounds override your objection.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to request that we transmit it directly to another controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data where that processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is required for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 9a99 handles your personal data, please contact our customer support team. We are available 24 hours a day, 7 days a week, including Bangladesh public holidays.

Email: [email protected]

When contacting us about a privacy matter, please include "Privacy Enquiry" or "Data Rights Request" in the subject line of your email, along with your registered account username or email address, so that we can locate your account and respond efficiently.

Updates to This Privacy Policy

9a99 reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will notify registered users via the email address on file and update the effective date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of the platform following the publication of any updated Privacy Policy constitutes your acknowledgement of the changes.