cd99 Privacy Policy — How We Protect Your Personal Data

1. Introduction

This Privacy Policy (the "Policy") sets out the basis on which cd99 collects, processes, stores, and protects personal data relating to registered players, prospective players, and visitors to https://cd99.io (the "Platform"). cd99 is committed to handling all personal data responsibly, transparently, and in accordance with applicable data protection principles.

By registering an account on cd99, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the terms of this Policy, you should not use the cd99 Platform. This Policy should be read alongside the cd99 Terms & Conditions and Responsible Gaming Policy.

2. Who We Are

cd99 operates the online betting and casino platform at https://cd99.io, providing sports betting (including cricket, BPL, IPL, T20 World Cup, and international football), live casino games, slots, and card games to players in Bangladesh. For the purposes of data protection, cd99 is the data controller responsible for your personal data collected through the Platform.

All data-related enquiries, access requests, correction requests, and complaints may be directed to the cd99 data team at [email protected]. We will acknowledge your communication within two business days and provide a substantive response within ten business days.

3. Data We Collect and How

3.1 Data You Provide Directly

cd99 collects personal data that you provide to us when you: register an account (name, date of birth, mobile number, email address); complete identity verification by submitting a National Identity Card, passport, or other government-issued document; make a deposit or request a withdrawal using bKash, Nagad, Rocket, Upay, or a supported bank account; contact our support team via email at [email protected]; or update your account preferences and responsible gaming settings.

3.2 Data Collected Automatically

When you access the cd99 Platform, certain technical data is collected automatically by our systems. This includes your IP address, the type of device and browser you are using, your operating system, the pages of the Platform you visit, the time and duration of your sessions, and referring URLs. This information is used primarily for platform security, fraud detection, and service improvement and is not used to identify you personally outside of a security or fraud investigation context.

3.3 Data from Third Parties

In some circumstances, cd99 may receive personal data about you from third parties. This includes identity verification data from KYC service providers, fraud-screening signals from payment processor partners (such as bKash and Nagad), and, where applicable, information provided by responsible gaming support organisations where you have consented to share data with cd99 as part of a self-exclusion or reintegration process.

4. Legal Basis for Processing

cd99 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing that is necessary to create and administer your cd99 account, process your deposits and withdrawals, and provide the betting and gaming services you have requested.
• Legal Obligation: Processing required to comply with applicable law, including identity verification obligations, anti-money-laundering record-keeping, and responding to lawful requests from government or regulatory bodies.
• Legitimate Interests: Processing carried out in the legitimate interests of cd99 or third parties, where those interests are not overridden by your data protection rights. This includes fraud prevention, platform security, responsible gaming monitoring, and service improvement analytics.
• Consent: Processing based on your freely given, specific consent — principally the sending of promotional emails and SMS marketing communications. You may withdraw this consent at any time without detriment to your account.

5. How We Use Your Data

cd99 uses the personal data it collects for the following purposes:

• Creating, maintaining, and administering your cd99 player account.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels.
• Verifying your identity and age (21+) in accordance with our responsible gaming obligations.
• Detecting, investigating, and preventing fraudulent activity, collusion, money laundering, and other prohibited conduct as defined in the cd99 Terms & Conditions.
• Monitoring gaming activity to identify indicators of problem gambling and providing responsible gaming interventions where appropriate.
• Communicating with you about your account, transactions, security alerts, and platform updates.
• Sending promotional communications, bonus offers, and seasonal promotions (including BPL season, Eid, and Pohela Boishakh offers) where you have opted in to receive such communications.
• Analysing aggregated, anonymised usage data to improve the performance, content, and user experience of the cd99 Platform.
• Responding to support queries and resolving complaints.
• Complying with applicable legal and regulatory obligations.

6. Sharing Your Data

cd99 does not sell or rent your personal data to any third party. We share personal data only in the following limited circumstances:

6.1 Payment Service Providers

To process your deposits and withdrawals, cd99 shares the minimum necessary financial identifiers (such as your registered mobile number) with the relevant payment service provider — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, or City Bank. These providers process your data under their own privacy policies and are bound by applicable financial regulations.

6.2 Identity Verification Partners

cd99 engages reputable third-party KYC and identity verification providers to assist with document verification. These providers process identity data strictly on behalf of cd99 and are contractually prohibited from using your data for any purpose other than completing the verification service.

6.3 Technology and Infrastructure Providers

cd99 uses third-party cloud hosting, content delivery, and analytics services to operate the Platform. These providers act as data processors under instruction from cd99 and are bound by data processing agreements that restrict how they may use any data they encounter.

6.4 Game Content Providers

Live casino and slot game studios — including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe — may receive anonymised session data necessary to operate their games within the cd99 Platform. These providers do not receive your full identity data or financial records as part of this arrangement.

6.5 Legal and Regulatory Disclosure

cd99 may disclose personal data where required to do so by a valid legal order, court order, government authority, or regulatory body. In such cases, cd99 will disclose only the minimum data required to comply with the relevant obligation and will, where legally permissible, notify you of the disclosure.

7. Cookies and Tracking Technologies

The cd99 Platform uses cookies and similar tracking technologies to support core platform functions and to improve your experience. The following categories of cookies may be set when you use the Platform:

• Essential Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your cd99 account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without preventing the Platform from working.
• Functional Cookies: Remember your preferences, such as your preferred language, display settings, and responsible gaming notification preferences, so you do not have to reset them on each visit.
• Analytics Cookies: Collect anonymised data about how visitors use the Platform — which pages are visited most, how long sessions last, and where navigation errors occur. This data is used exclusively to improve the Platform and is not linked to your individual identity.
• Security Cookies: Assist cd99's fraud-detection systems by capturing device fingerprint signals that help identify unusual access patterns. These cookies do not track your activity on other websites.

cd99 does not use third-party advertising or retargeting cookies. No cookie data is shared with advertising networks or social media platforms.

8. Data Retention

cd99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, subject to any legal obligations that require longer retention. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active account plus a minimum of five years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five years from the date of the transaction.
• KYC documentation: Retained for the duration of your active account plus five years post-closure.
• Support communications: Retained for three years from the date of the last communication in each support thread.
• Marketing preference records: Retained for the duration of your account and for two years after account closure, to demonstrate compliance with consent requirements.
• Technical and log data: Typically retained for 90 days, unless a security investigation or legal hold requires longer retention.

When a retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

9. Data Security

cd99 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the cd99 Platform.
• Encryption of sensitive data at rest within cd99's databases, including financial identifiers and identity document references.
• One-way cryptographic hashing with salting for all account passwords — cd99 staff cannot access or recover your password.
• Role-based access controls that restrict staff access to personal data strictly to those who need it to perform their job function.
• Regular security assessments and penetration testing of the Platform infrastructure.
• Incident response procedures for detecting, containing, and notifying affected players of any data breach in a timely manner.

While cd99 takes all reasonable steps to protect your data, no internet transmission is completely secure. You are responsible for ensuring that your own device is secure and that you do not share your cd99 login credentials with any third party.

10. Children and Minors

The cd99 Platform is strictly intended for adults aged 21 years and above. cd99 does not knowingly collect personal data from any person under the age of 21. If cd99 discovers or is notified that a person under 21 has registered an account or provided personal data, the account will be closed immediately, all data will be deleted promptly, and any funds deposited will be returned through the original payment channel where possible.

If you believe that a minor has registered an account on cd99, please contact us immediately at [email protected] so that we can investigate and take the appropriate action without delay.

11. Marketing Communications

cd99 may send you promotional communications — including bonus offers, seasonal promotions tied to events such as Eid, BPL season, and Pohela Boishakh, and platform news — by email or SMS, but only where you have explicitly opted in to receive such communications during registration or via your account settings.

You may opt out of marketing communications at any time by updating your preferences in your cd99 account settings or by emailing [email protected] with the subject line "Unsubscribe". Opting out of marketing communications will not affect the delivery of essential account communications such as deposit confirmations, withdrawal notifications, security alerts, and support responses.

cd99 does not share your contact details with third-party marketers and does not send marketing communications on behalf of any other brand or entity.

12. Changes to This Policy

cd99 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data processing or a new third-party sharing arrangement — cd99 will notify registered players by email or by a prominent notice on the Platform prior to the change taking effect. The effective date shown at the top of this document will be updated to reflect the date the revised Policy comes into force. Your continued use of the cd99 Platform after any update constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically so that you remain informed about how cd99 protects your personal data.

13. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a complaint about how cd99 has handled your personal data, please contact the cd99 data team:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Request — [Your Registered Username]"
• Response Time: Acknowledgement within 2 business days; full response within 10 business days
• Available: 24 hours a day, 7 days a week, including Bangladesh public holidays

cd99 takes all privacy complaints seriously and will investigate each complaint thoroughly. If you are not satisfied with cd99's response to your complaint, you may have the right to escalate the matter through appropriate legal channels available in your jurisdiction.