Privacy Policy for 99ar

1 Data We Collect and Why

99ar collects personal data from players in Bangladesh through several channels: the registration process, ongoing account activity, customer support interactions, and automatic technical collection during platform use. The categories of data we collect and the specific purposes behind each are set out below.

Registration and Identity Data

When you create a 99ar account, we collect the following information to establish and verify your identity, prevent fraud, and comply with our Know Your Customer (KYC) obligations:

• Full legal name — as it appears on your National Identity Card (NID) or passport
• Date of birth — to confirm you are aged 18 or above, which is a strict eligibility requirement
• Residential address — including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi) and postal code
• Mobile number — used for account security, transaction OTP codes, and support communications
• Email address — used for account notifications, password recovery, and promotional communications where consent has been given
• Username and hashed password — your chosen login credentials; passwords are stored only in a cryptographically hashed format and are never visible to 99ar staff

Financial and Payment Data

To process deposits and withdrawals in Bangladeshi Taka (৳ BDT) via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported bank transfers (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank), we collect:

• Mobile banking account numbers (bKash/Nagad/Rocket) registered in your name
• Bank account or card details for supported payment methods
• Transaction reference IDs and timestamps for all deposits and withdrawals
• Transaction amounts in BDT

99ar does not store full card numbers. Card payments are processed through tokenised gateways and 99ar retains only a masked reference number (e.g., last four digits) for dispute resolution purposes.

KYC Verification Documents

When identity verification is triggered — such as at your first significant withdrawal or upon our compliance team's request — we may collect scanned copies or photographs of the following documents:

• National Identity Card (NID)
• Passport (biographical data page)
• Driving licence
• Recent utility bill, bank statement, or government correspondence (for address verification)

These documents are stored in an encrypted document management system and are accessible only to authorised compliance personnel. They are used solely for identity verification and are not shared with third parties except as required by applicable law.

Technical and Usage Data

When you access 99ar through a browser or mobile device, certain technical data is automatically collected to maintain platform security, diagnose technical issues, and generate aggregate usage analytics:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Session start and end times, pages visited, and features used
• Game session logs (game ID, wager amounts, outcomes, timestamps) — used for dispute resolution and responsible gaming monitoring
• Referring URL (the web address you visited before arriving at 99ar)

2 How We Use Your Personal Data

99ar uses the personal data it collects exclusively for the purposes described below. We do not use your data for purposes incompatible with those stated at the point of collection without first notifying you and, where required, obtaining fresh consent.

Marketing Communications

If you opt in to marketing communications during registration or subsequently via your account settings, 99ar may send you information about promotions, seasonal bonuses (such as BPL, IPL, Eid, or Pohela Boishakh campaigns), new game releases from studios such as Pragmatic Play, Evolution Gaming, and Spribe, and other platform updates. You may withdraw consent at any time by updating your notification preferences in your account settings, or by contacting support at [email protected]. Withdrawal of consent does not affect the lawfulness of communications sent prior to that withdrawal.

3 Data Sharing and Third-Party Disclosure

99ar does not sell, rent, or trade your personal data. Disclosure of your data to third parties occurs only in the specific, limited circumstances described below, and always under appropriate contractual or legal safeguards.

Service Providers and Data Processors

99ar engages a small number of carefully selected third-party service providers to support platform operations. These providers act as data processors on our behalf, meaning they process your data only according to 99ar's documented instructions and are contractually prohibited from using it for their own purposes. Categories of service providers include:

• Payment processing partners — including the technical intermediaries that facilitate bKash, Nagad, Rocket, Upay, Visa, and Mastercard transactions. These providers receive only the transaction data necessary to process each payment.
• KYC and identity verification providers — third-party tools that assist in verifying NID documents and cross-checking identity data against relevant databases.
• Game content providers — studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi supply game software and may receive anonymised session identifiers for game integrity and RNG audit purposes. They do not receive your name, contact details, or payment information.
• Cloud infrastructure and hosting providers — 99ar's platform is hosted on secure cloud infrastructure. Hosting providers have access to server-level data but are bound by strict data processing agreements and do not have access to application-level personal data in readable form.
• Customer support platform — the software powering 99ar's live chat and support ticketing system processes support conversation data.

Legal and Regulatory Disclosure

99ar may disclose personal data to governmental bodies, law enforcement agencies, or financial intelligence units where required to do so by applicable law, a court order, or a binding regulatory directive. In such cases, 99ar will disclose only the minimum data required to satisfy the legal obligation and will notify the affected player where it is legally permissible to do so.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of 99ar's assets, player data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to this Privacy Policy that may result from it, with a minimum of 30 days' notice before any change takes effect.

4 Cookies and Tracking Technologies

99ar uses cookies and similar technologies (such as local storage and session tokens) to ensure the platform functions correctly, to maintain the security of your logged-in session, and to collect aggregate, anonymised analytics about how players interact with the site. The following table summarises the categories of cookies used on 99ar.

99ar does not use advertising cookies, retargeting pixels, or any third-party cookies that track your behaviour across other websites. No data from 99ar cookies is shared with advertising networks or social media platforms.

Managing Cookies

You may control, restrict, or delete cookies through your browser's settings at any time. Please note that disabling strictly necessary cookies will prevent the platform from functioning correctly — in particular, you will not be able to maintain a logged-in session or complete transactions. Disabling functional or analytics cookies will not affect your ability to play games or make deposits and withdrawals, though some display preferences may be reset on each visit.

5 Data Retention and Storage

99ar retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, or to resolve disputes. The table below summarises our standard retention periods by data category.

When the applicable retention period expires, data is securely deleted or irreversibly anonymised in accordance with 99ar's internal data destruction procedures. Physical document copies (if any) are shredded and electronic records are overwritten or deleted from all backup systems within 90 days of the scheduled destruction date.

Data Storage Location

99ar stores player data on secure cloud servers. All servers used to store personal data are configured with encryption at rest. Backup copies are maintained in geographically separate secure facilities and are subject to the same access controls and encryption standards as primary storage. Data is not transferred to jurisdictions that do not provide an adequate level of data protection without appropriate safeguards in place.

6 Your Privacy Rights as a 99ar Player

As a player registered on 99ar, you have the following rights with respect to your personal data. To exercise any of these rights, please contact the 99ar privacy team at [email protected] with the subject line "Privacy Rights Request", including your registered username and a description of your request. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

Right of Access

You have the right to request a copy of the personal data that 99ar holds about you. We will provide a structured summary of your data in a readable format, including the categories of data held, the purposes for which it is processed, and any third parties to whom it has been disclosed.

Right to Rectification

If any personal data held by 99ar is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating a phone number) can be made directly through your account settings panel. Corrections to identity data (name, date of birth) require submission of supporting documentation to the KYC team.

Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been processed unlawfully. Please note that 99ar may be required by law to retain certain data (particularly financial records and KYC documents) for a specified period even after account closure. In such cases, we will delete what we legally can and inform you of what must be retained and why.

Right to Restrict Processing

You may request that 99ar restrict the processing of your data in certain circumstances — for example, if you contest the accuracy of data held and we are in the process of verifying it, or if you have objected to processing and we are assessing whether legitimate grounds override your objection.

Right to Withdraw Marketing Consent

If you have previously consented to receive marketing communications from 99ar, you may withdraw that consent at any time through your account notification preferences or by emailing [email protected]. Withdrawal of marketing consent does not affect processing carried out before the withdrawal and does not affect your ability to use the platform.

7 Data Security Measures

99ar takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated regularly to keep pace with evolving security standards.

Technical Security Controls

• SSL/TLS encryption in transit: All data transmitted between your browser or mobile device and 99ar's servers is encrypted using TLS 1.2 or higher. The padlock symbol in your browser address bar confirms an active encrypted connection.
• Encryption at rest: Personal data and KYC documents stored on 99ar's servers are encrypted using AES-256 encryption. Encryption keys are managed separately from the encrypted data.
• Password hashing: Player passwords are never stored in plain text. They are processed using a one-way cryptographic hashing algorithm with salting, meaning that even in the event of a data breach, your original password cannot be recovered from the stored hash.
• Access controls: Access to personal data within 99ar's systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific role. Access is controlled through role-based permissions and requires multi-factor authentication.
• Network security: 99ar's infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning. Penetration testing is conducted periodically by qualified third-party security professionals.

Organisational Security Measures

• All 99ar staff who handle personal data receive mandatory data protection training upon joining and refresher training annually.
• Internal data processing policies set out the procedures for handling, storing, and disposing of personal data securely.
• Data breach response procedures are in place to detect, contain, and respond to security incidents promptly. In the event of a breach that is likely to result in a risk to player rights, affected players will be notified without undue delay.

8 Policy Updates and Contact Information

99ar reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. When we make material changes to this policy — that is, changes that affect your rights or the way we process your data in a significant manner — we will notify you by email to the address registered on your account and by displaying a prominent notice on the 99ar platform, with a minimum of 14 days' advance notice before the changes take effect.

Minor or administrative updates (such as typographic corrections, clarifications that do not alter meaning, or updates to contact details) may be made without prior notice. The "Last updated" date at the top of this page will always reflect the date of the most recent change. You are encouraged to review this Privacy Policy periodically. Continued use of the 99ar platform after the effective date of any updated version of this policy constitutes your acceptance of the revised terms.

The current version of this Privacy Policy is always available at https://99ar.net/privacy-policy. Previous versions are available on request by contacting the 99ar privacy team.

Contact the 99ar Privacy Team

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how your personal data is being handled, please contact us using the details below. All privacy-related correspondence is handled confidentially by the 99ar data protection team.

• Email: [email protected] (subject line: "Privacy Rights Request")
• Live Chat: Available 24/7 on the 99ar platform — Bangladesh Standard Time (BST, UTC+6)
• WhatsApp: +880 1700 000000

We aim to acknowledge all privacy correspondence within 5 business days and to provide a full response within 30 calendar days. If you are not satisfied with our response to your privacy query, you have the right to escalate your concern through 99ar's formal complaints process, details of which will be provided in our response to your initial contact.