to99 Privacy Policy

Introduction

to99 (referred to in this document as "we", "us", "our", or "the Platform") is committed to protecting the privacy and personal data of every player who uses the to99 online casino and sports betting platform at to99.ws. This Privacy Policy sets out in clear, formal terms what personal data we collect about you, how and why we use it, who we may share it with, how long we retain it, what your rights are, and how to contact us if you have any concerns about your data.

By registering an account on to99 or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. This Policy should be read alongside the to99 Terms and Conditions, which together form the complete agreement between you and to99 governing your use of the platform.

Privacy at a Glance

1Who We Are

to99 is an online casino and sports betting platform operated at to99.ws, serving players in Bangladesh. For the purposes of this Privacy Policy, to99 is the data controller — meaning we are the entity that determines the purposes and means of processing your personal data. We take our responsibilities as data controller seriously and process all personal data in accordance with applicable data protection principles.

If you have any questions about how to99 handles your personal data, or if you wish to exercise any of your data rights described in this Policy, you may contact us at any time using the contact details provided at the end of this document.

2What Personal Data We Collect

to99 collects personal data from you in three principal ways: directly from you when you register or interact with the platform, automatically as you use the platform, and from third parties such as payment processors and identity verification providers. The specific categories of data we collect are set out below.

Account and Identity Data

• Full name and date of birth — collected at registration for account creation and age verification (21+ requirement).
• Residential address in Bangladesh (district, city, full postal address) — collected for KYC verification and to confirm your location for regulatory compliance purposes.
• National ID Card number, passport number, or other government-issued ID details — collected as part of KYC before withdrawals are processed.
• Mobile phone number — used for account communication, two-factor authentication, and payment verification.
• Email address — used for account notifications, security alerts, promotional communications (where consented), and correspondence relating to your account.

Financial and Transaction Data

• Payment method identifiers — bKash account number, Nagad account number, Rocket account number, or bank account details used to fund your to99 account. to99 does not store complete payment credentials; only identifying reference data sufficient to process transactions and match withdrawals to verified accounts.
• Deposit and withdrawal history — full transaction records including amounts (in BDT), timestamps, payment method used, and transaction status.
• Betting and gaming history — a complete record of all wagers placed, games played, results, and winnings or losses on your to99 account.
• Bonus and promotion records — details of bonuses claimed, wagering requirement progress, and promotional campaign participation.

Technical and Usage Data

• Device and browser information — device type, operating system, browser version, screen resolution, and device identifiers. Collected automatically when you access to99 via browser on your mobile or desktop.
• IP address and approximate location data — used to identify your general geographic region (city level), detect suspicious login activity, and help prevent fraud.
• Session data and activity logs — pages visited, features used, time spent on the platform, clicks, and navigation patterns. Used to improve platform performance and detect unusual activity that may indicate account compromise.

3How We Use Your Personal Data

to99 uses your personal data for the following specific purposes. Each purpose is tied to a legitimate business or legal reason, and we do not use your data for purposes that are incompatible with the purpose for which it was originally collected:

• Account creation and management — to register your account, authenticate your logins, manage account settings, and maintain your player profile on to99.
• Identity and age verification (KYC) — to confirm your identity, verify that you are aged 21 or above, and meet our anti-money-laundering obligations before processing withdrawals.
• Processing deposits and withdrawals — to receive and send payments via bKash, Nagad, Rocket, and supported Bangladeshi banks, and to maintain accurate financial records of all transactions.
• Platform operations and game delivery — to provide access to casino games, sports betting markets, live dealer games, and all other features of the to99 platform, and to ensure those features function correctly for you.
• Security and fraud prevention — to monitor your account activity for signs of unauthorised access, suspicious betting patterns, bonus abuse, money laundering, or any other conduct that may indicate a breach of our Terms and Conditions.
• Responsible gaming compliance — to operate and enforce deposit limits, session time limits, self-exclusion periods, and reality checks, and to identify players whose pattern of play may indicate problem gambling, in line with our Responsible Gaming commitments.
• Marketing and promotional communications — to send you information about to99 bonuses, promotions, and platform updates that we think may interest you. This applies only where you have provided your consent to receive such communications. You may withdraw consent at any time by contacting [email protected].

to99 does not use your personal data for automated decision-making that produces significant legal or similarly significant effects on you without human review. Where our automated systems flag an account for review (for example, for suspected fraud or responsible gaming concerns), a member of our team will conduct a manual review before any material action is taken.

4Legal Basis for Processing Your Data

to99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity — processing is necessary to perform the contract between you and to99 (i.e. the Terms and Conditions you agreed to when registering). This covers account management, payment processing, game access, and customer support.
• Legal obligation — processing is necessary for to99 to comply with applicable laws, including anti-money-laundering (AML) regulations, age verification requirements, and financial record-keeping obligations.
• Legitimate interests — processing is in to99's legitimate interests to protect the security and integrity of the platform, prevent fraud, and improve the player experience, where those interests are not overridden by your data protection rights.
• Consent — where to99 processes your data for marketing and promotional communications, or for any other purpose where consent is the appropriate legal basis, we will ask for your explicit consent before processing. You may withdraw your consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

5How We Share Your Personal Data

to99 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the extent necessary for the relevant purpose:

Service Providers and Data Processors

• Payment processors — bKash, Nagad, Rocket, Upay, and partner Bangladeshi banks receive transaction data necessary to process your deposits and withdrawals. These providers process payment data under their own privacy frameworks and are not permitted to use your data for their own purposes beyond processing the transaction.
• KYC and identity verification providers — third-party identity verification services may receive your identity documents and personal details for the purpose of completing KYC checks. These providers are contractually bound to process your data only for verification purposes and to maintain appropriate security standards.
• Game providers — live casino and slot game providers such as Evolution Gaming, Ezugi, Pragmatic Play, and Spribe may receive session data and bet records relating to game rounds you participate in, to the extent necessary for game operation and dispute resolution.
• IT and platform infrastructure providers — cloud hosting, security monitoring, and technical operations service providers who support the running of the to99 platform. These providers access personal data only as necessary to perform their services and are bound by data processing agreements.

Disclosure Required by Law

to99 may disclose your personal data to regulatory authorities, law enforcement agencies, or courts if required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity, or to protect the rights, property, or safety of to99, its players, or the public.

6Cookies and Tracking Technologies

to99 uses cookies and similar tracking technologies to operate the platform, improve your experience, and keep your session secure. A cookie is a small text file placed on your device by a website when you visit it. to99 uses the following categories of cookies:

Types of Cookies We Use

• Strictly necessary cookies — required for the platform to function. These enable core features such as maintaining your login session, remembering your account preferences, and processing transactions. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies — collect anonymous, aggregated information about how players use to99, such as which pages are visited most frequently and where players encounter errors. This data helps us improve the platform. These cookies do not identify you personally.
• Functional cookies — remember your preferences such as language settings and display options so you do not have to re-configure the platform each time you visit.
• Security cookies — used to detect and prevent fraudulent login attempts, session hijacking, and other security threats. These cookies are essential to protecting your account.

You may manage your cookie preferences through your mobile browser settings. Please note that disabling certain categories of cookies may affect the functionality of the to99 platform. to99 does not use third-party advertising cookies or cross-site tracking cookies.

7Data Retention

to99 retains your personal data for as long as is necessary for the purposes for which it was collected, subject to any longer retention period required by applicable law. The following general retention guidelines apply:

• Active account data — retained for the full duration of your account's active lifetime, plus a period after account closure to comply with legal obligations.
• Financial and transaction records — retained for a minimum of 5 years after the transaction date, in line with standard financial record-keeping requirements applicable to online payment processing in Bangladesh.
• KYC and identity verification documents — retained for as long as your account remains open and for a period of at least 5 years after your account is closed, to allow for regulatory review if required.

When your data is no longer required for any legal, contractual, or operational purpose, to99 will securely delete or anonymise it. In cases where complete deletion is not immediately practicable (for example, because data is held in backup archives), to99 will isolate the data and prevent it from being further processed until deletion is complete.

8Data Security Measures

to99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include but are not limited to:

• SSL/TLS encryption — all data transmitted between your device and the to99 platform is encrypted using industry-standard SSL/TLS protocols, preventing interception by third parties during transmission.
• Access controls — access to personal data within to99's systems is restricted on a need-to-know basis. Staff members can only access personal data relevant to their specific role, and all access is logged and auditable.
• Secure data storage — personal data is stored on secure servers with physical and logical access controls, regular security patch management, and continuous monitoring for intrusion or anomalous activity.
• Incident response — to99 maintains a data breach response procedure. In the event of a data breach that poses a risk to your rights and freedoms, to99 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

9Your Data Rights

to99 respects your rights over your personal data. The following rights are available to you as a data subject. To exercise any of these rights, please contact us at [email protected]. We will respond to all verified data rights requests within 30 days of receipt:

• Right of Access You have the right to request a copy of the personal data to99 holds about you, and to be informed about the purposes for which it is processed, the categories of data held, and who it has been shared with.
• Right to Rectification You have the right to request correction of any inaccurate or incomplete personal data to99 holds about you. We will correct inaccurate data promptly upon a verified request.
• Right to Erasure You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing. This right is subject to to99's legal obligations to retain certain data for regulatory compliance periods.
• Right to Restriction You have the right to request that to99 restricts the processing of your personal data in certain circumstances, such as while the accuracy of the data is being contested or while an objection to processing is being considered.
• Right to Data Portability You have the right to receive a copy of personal data you have provided to to99 in a structured, commonly used, machine-readable format, where technically feasible and where processing is based on your consent or on a contract.
• Right to Object You have the right to object to to99's processing of your personal data where processing is based on legitimate interests. You also have an absolute right to object to processing of your data for direct marketing purposes at any time.

to99 will not charge a fee for processing data rights requests submitted in good faith. However, to99 reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive, or to refuse to act on such requests. Where to99 declines to act on a request, we will explain the reasons in writing.

10Children's Privacy

The to99 platform is strictly intended for adults aged 21 and above. to99 does not knowingly collect personal data from individuals under the age of 21. Our registration process includes an age declaration requirement, and we conduct KYC verification which includes date of birth confirmation before processing any financial transactions. If to99 discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age, we will promptly delete that data and close the associated account.

11Payment Data and Financial Privacy

to99 takes the security of your financial data with the highest level of seriousness. The following specific protections apply to payment and financial data collected and processed on the to99 platform:

• to99 does not store complete bKash, Nagad, Rocket, or bank account credentials on its own servers. Payment processing is handled by the respective payment provider's own secure infrastructure. to99 retains only the minimum reference data needed to reconcile transactions and process withdrawals to verified accounts.
• All financial transaction data is transmitted over SSL-encrypted connections. Payment data is never transmitted in plain text and is never included in non-secure email communications.
• to99 conducts AML (anti-money-laundering) transaction monitoring as required. Where a transaction is flagged for AML review, the data involved may be retained for an extended period and may be disclosed to relevant regulatory or law enforcement authorities if required by law.

to99 will never ask you to share your full bKash PIN, mobile banking password, or bank account PIN via email, phone, or any platform message. Any communication purporting to be from to99 that requests such sensitive financial credentials should be treated as fraudulent and reported to [email protected] immediately.

12Responsible Gaming and Your Data

to99 uses personal data — including your gaming history, deposit patterns, session duration data, and account activity — as part of its Responsible Gaming program. This use of your data is in to99's legitimate interests and is consistent with its commitment to player welfare. Specifically, to99's Responsible Gaming data processing includes:

• Monitoring play patterns to identify accounts showing signs of problem gambling, such as rapidly increasing deposit volumes, failed withdrawal requests following large losses, or significantly extended session durations.
• Maintaining records of self-exclusion and cooling-off periods requested by players, to ensure those restrictions are enforced accurately and cannot be circumvented.
• Using deposit limit and session time limit data to enforce the responsible gaming controls you have set on your account.

13Third-Party Links

The to99 platform does not include links to third-party websites for commercial, affiliate, or referral purposes. Any links that appear on the platform are solely to service providers integral to the operation of to99 (such as payment processors or game providers) and are not general browsing recommendations. to99 is not responsible for the privacy practices or content of any third-party website or service that may be referenced in connection with those service relationships.

14Changes to This Privacy Policy

to99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the features available on the platform. When we make material changes to this Policy, we will publish the revised version on the to99 website and update the "Last updated" date at the top of this document. Where required by applicable law or where changes materially affect your rights, we will notify you of the changes via your registered contact details before the revised Policy takes effect.

Your continued use of the to99 platform after the revised Privacy Policy takes effect constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must stop using the platform and may request account closure by contacting [email protected].

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to99's handling of your personal data, please contact our support team. We are committed to responding to all privacy-related enquiries promptly and transparently.

Our support team operates on Bangladesh Standard Time (BST, UTC+6) and will respond to privacy-related requests within 3 business days in most cases. For urgent matters such as a suspected data breach affecting your account, please mark your email subject line as "URGENT — Privacy" and we will prioritise your request accordingly.