Privacy Policy — by99

1. Data We Collect

by99 collects personal data from players in Bangladesh through several channels: directly when you register and use the platform, automatically through your browser and device as you interact with the site, and from third-party sources such as payment processors and identity verification partners. The categories of personal data we collect are described in full below.

1.1 Registration & Account Data

When you create a by99 account, we collect the following information that you voluntarily provide:

• Full legal name
• Date of birth (for age verification — 18+ only)
• Email address
• Mobile phone number
• Residential address (city, district, Bangladesh)
• Preferred payment method and associated account details (e.g., bKash or Nagad registered mobile number)
• Username and encrypted password

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) and anti-money-laundering (AML) obligations, by99 may request and retain copies of the following documents at the point of withdrawal or when triggered by our risk monitoring systems:

• National Identity Card (NID)
• Passport (photo page)
• Driving licence
• Proof of address (utility bill, bank statement, or similar document dated within three months)
• Payment method verification (screenshot or statement confirming ownership of the bKash, Nagad, Rocket, or Upay account used)

1.3 Financial Transaction Data

by99 records details of every financial transaction you conduct on the platform, including:

• Deposit amounts, timestamps, and originating payment method references
• Withdrawal requests, processed amounts, and destination payment method references
• Bonus credits, wagering activity, and promotional participation history
• Account balance history and transaction ledger entries

We do not store your full mobile wallet PIN, card number (if applicable), or raw payment credentials. Payment transactions are tokenised by the respective payment gateway (bKash, Nagad, Rocket, or Upay) before any reference data reaches by99's systems.

1.4 Technical & Usage Data

When you visit or use the by99 platform, we automatically collect certain technical information about your device and browsing behaviour, including:

1.5 Communications Data

If you contact by99 via live chat, email, or any other support channel, we retain records of those communications — including the content of messages, timestamps, and any files or screenshots shared — for quality assurance, dispute resolution, and compliance purposes.

2. How We Use Your Data

by99 processes your personal data only where a lawful basis exists for doing so. The primary lawful bases we rely on are: performance of a contract (to deliver the gaming services you have registered for), compliance with legal obligations (KYC, AML, age verification), legitimate interests (fraud prevention, platform security, responsible gaming monitoring), and — where required — your explicit consent (marketing communications).

2.1 Platform Operations

The core operational purposes for which by99 processes your data include:

• Creating and managing your by99 player account
• Processing deposits and withdrawals via bKash, Nagad, Rocket, and Upay
• Providing access to casino games, cricket betting, slots, bingo, fishing games, and live dealer tables
• Calculating and crediting bonuses, free spins, cashback rewards, and promotional incentives
• Detecting and preventing fraudulent activity, bonus abuse, and collusion
• Enforcing the one-account-per-player rule by cross-referencing registration details

2.2 Identity & Age Verification

by99 is legally and ethically obligated to verify that every player is aged 18 or above before they can make real-money wagers. The KYC data you submit is used exclusively for this verification purpose and for the fulfilment of anti-money-laundering obligations. KYC data is reviewed only by authorised compliance personnel and is not used for marketing or profiling purposes.

2.3 Responsible Gaming

by99 uses gameplay data, session duration, deposit frequency, and wagering pattern analysis as part of our responsible gaming programme. This data helps us identify players who may be showing signs of problem gambling behaviour, enabling our team to reach out proactively, apply self-requested account restrictions, or enforce mandatory cooling-off periods. Visit our Responsible Gaming page for full details on the tools available to you.

2.4 Customer Support

Communications data from your interactions with by99's support team is used to resolve queries, handle disputes, investigate complaints, and improve the quality of our support service. Support records are retained for a minimum of two years to provide context for ongoing or escalated issues.

2.5 Marketing Communications

With your explicit consent, by99 may send you promotional communications about new games, seasonal offers (such as Eid promotions, Pohela Boishakh bonuses, and BPL cricket betting offers), and platform updates. You may withdraw your consent to marketing communications at any time by contacting [email protected] or updating your communication preferences in your account settings. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to withdrawal.

3. Data Sharing & Disclosure We Never Sell Your Data

by99 does not sell, rent, lease, or trade your personal data to any third party for commercial or marketing purposes. We share personal data only in the specific, limited circumstances described below, and only to the minimum extent necessary for each purpose.

3.1 Payment Processing Partners

To process your deposits and withdrawals, by99 necessarily shares relevant transaction reference data with our payment processing partners — bKash, Nagad, Rocket, and Upay. The data shared is limited to the information required to execute and confirm each transaction (e.g., registered mobile number, transaction amount, unique reference ID). Each payment partner operates under its own privacy policy and data protection obligations.

3.2 Game Content Providers

by99 hosts games developed and operated by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game from one of these providers, limited technical data (such as a session token and anonymised player ID) is passed to the game provider's server to initiate and authenticate your game session. Game providers do not receive your name, contact details, or payment information.

3.3 Identity Verification Services

by99 may use third-party identity verification services to assist with KYC document checks. When this occurs, the identity documents you submit may be processed by the verification service's systems under a strict data processing agreement that limits use solely to identity verification and prohibits any further processing or disclosure.

3.4 Legal & Regulatory Obligations

by99 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where we are required to do so by applicable law, court order, or governmental authority. This includes disclosures made in connection with anti-money-laundering investigations, fraud inquiries, or tax reporting obligations. Where legally permitted, by99 will notify the affected player of such a disclosure request prior to compliance.

3.5 Business Transfers

In the event that by99 undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, player data may be transferred to the acquiring entity as part of that transaction. In such circumstances, by99 will take reasonable steps to ensure that the recipient entity agrees to process the transferred data in a manner consistent with this Privacy Policy, and will provide affected players with notice of the transfer and their options prior to the transaction being completed.

4. Cookies & Tracking Technologies

by99 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate the platform effectively, maintain your session state, and gather anonymous analytics data to improve the user experience for players across Bangladesh.

4.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to remember information about your visit — such as your preferred language, login session status, and certain platform settings — so that your next visit is smoother and more personalised. Cookies cannot execute programs or deliver viruses to your device.

4.2 Types of Cookies Used by by99

4.3 Managing Your Cookie Preferences

Strictly necessary cookies cannot be disabled as they are essential for the by99 platform to function correctly. For all other cookie categories, you may adjust your preferences through your browser's built-in cookie management settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Please note that disabling functional or analytics cookies may affect certain non-essential features of the platform.

Common browser cookie management guides:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
• Samsung Internet (common on Android devices in Bangladesh): Settings → Privacy → Smart Anti-Tracking
• Safari (iOS/macOS): Settings → Safari → Privacy & Security → Block All Cookies

5. Data Security

by99 takes the security of your personal data with the utmost seriousness. We have implemented a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, destruction, alteration, or disclosure.

5.1 Technical Security Measures

• 256-bit SSL/TLS encryption on all data in transit between your device and by99's servers.
• AES-256 encryption for sensitive data at rest, including KYC documents and payment references.
• Bcrypt password hashing — your account password is never stored in plain text. Even by99's own technical staff cannot read your password.
• Two-factor authentication (2FA) available for all player accounts, strongly encouraged.
• Web Application Firewall (WAF) protecting against common web-based attack vectors including SQL injection, cross-site scripting (XSS), and DDoS attempts.
• Automated intrusion detection systems that monitor for anomalous access patterns in real time and alert our security team immediately upon detection.
• Regular security patching of all platform infrastructure components on a defined schedule.

5.2 Organisational Security Measures

• Access to personal data is restricted on a strict need-to-know basis. Only authorised team members with a legitimate operational need may access player data.
• All by99 personnel with access to personal data undergo data privacy training and are bound by confidentiality obligations.
• KYC documents are accessible only to authorised compliance team members and are not shared with customer-facing support staff beyond what is necessary to resolve a specific query.
• by99 conducts periodic internal security reviews and engages external security professionals for penetration testing of the platform on a regular basis.

5.3 Data Breach Response

In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, by99 will take immediate steps to contain the breach, assess its scope, and notify affected players without undue delay. Notification will include a description of the nature of the breach, the categories and approximate number of players affected, the likely consequences of the breach, and the remedial measures by99 has taken or proposes to take.

6. Data Retention

by99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The following retention periods apply to the main categories of data we hold:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any individual. Anonymised, aggregated data (which contains no personally identifiable information) may be retained indefinitely for statistical and platform improvement purposes.

7. Your Privacy Rights

by99 respects your rights over your personal data. As a player registered on the by99 platform, you have the following rights regarding the personal data we hold about you:

Right of Access

You have the right to request a copy of the personal data by99 holds about you. Upon receipt of a verified access request, by99 will provide you with a structured summary of your data within 30 days. The first copy is provided free of charge; subsequent copies within a 12-month period may be subject to a reasonable administrative fee.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor updates (such as phone number or email address changes) can be made directly in your account settings. For changes to core identity data (name, date of birth), a KYC document supporting the change will be required before the update is applied.

Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where: (a) the data is no longer necessary for the purpose for which it was collected; (b) you have withdrawn consent and no other lawful basis exists for the processing; or (c) the data has been unlawfully processed. Please note that by99 may be required by law to retain certain categories of data (particularly financial transaction records and KYC documents) for defined periods even after a deletion request, as described in the Data Retention section above. In such cases, by99 will delete all data that is not subject to a mandatory retention obligation and will notify you of the data categories that must be retained and the reason why.

Right to Restrict Processing

You have the right to request that by99 restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data (pending verification) or where you have objected to processing (pending assessment of whether by99's legitimate interests override your interests).

Right to Data Portability

Where by99 processes your data by automated means on the basis of your consent or a contract, you have the right to receive a copy of the data you have provided to us in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to have that data transferred to another controller where technically feasible.

Right to Object to Marketing

You have the absolute right to object to the processing of your personal data for direct marketing purposes at any time, without needing to provide a reason. To exercise this right, email [email protected] with the subject line "Marketing Opt-Out" or adjust your communication preferences in your by99 account settings. Opt-out requests are processed within 5 business days.

8. Contact & Data Protection Officer

by99 takes its data protection responsibilities seriously. If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which by99 processes your personal data, please contact us using the details below. All privacy-related enquiries are handled by our dedicated data protection team.

Primary Support Contact

For general privacy questions, data rights requests, cookie-related enquiries, or marketing opt-out requests, contact us at:

Updates to This Privacy Policy

by99 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, platform features, or applicable legal requirements. When material changes are made, we will notify registered players by email (to the address associated with your account) and by displaying a prominent notice on the by99 platform for a minimum of 30 days prior to the changes taking effect.

The date at the top of this page ("Effective date: 1 January 2026") indicates when this version of the Privacy Policy was last reviewed and approved. Your continued use of the by99 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material changes, you have the right to close your account and request deletion of your data (subject to mandatory retention obligations) before the updated policy takes effect.

by99 recommends that all players review this Privacy Policy periodically — at minimum once every six months — to remain informed of how their personal data is being handled. The Privacy Policy is always accessible via the footer of every page on by99.club.