Privacy Policy — How gl99 Protects Your Data

1. Introduction

gl99 ("the Platform", "we", "us", "our") operates the online betting and casino service accessible at gl99.io, serving players primarily located in Bangladesh. We are committed to protecting the privacy of all individuals who interact with our platform, including registered account holders, prospective players, and visitors to our website.

This Privacy Policy describes our practices with respect to the collection, use, storage, transfer, and deletion of personal data. It is designed to give you a clear and honest account of how your information flows through the gl99 platform and what safeguards are in place to protect it.

This Policy should be read alongside our Terms & Conditions, which govern the overall relationship between gl99 and its players. By using the gl99 platform, you agree to the collection and processing of your personal data in the manner described in this Policy.

We review and update this Policy regularly. The effective date at the top of this page indicates when the current version was last revised. Material changes will be communicated to registered account holders through the contact details held on file.

2. Data We Collect

gl99 collects personal data in the following categories:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where such information is voluntarily disclosed to our responsible gaming support team for the purpose of activating player protection tools.

3. How Data Is Collected

gl99 collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC, submitting support requests, or contacting us via email, live chat, or WhatsApp.
• Automated technologies: When you access the gl99 platform, our servers automatically record technical and usage data including your IP address, device identifiers, and browsing behaviour on the platform.
• Payment processors: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a linked bank account, transaction data is shared between your MFS provider or bank and gl99 to facilitate the payment.
• Identity verification providers: During KYC checks, we may use third-party identity verification services that process and validate documents such as your National Identity Card or passport on our behalf.
• Cookies and similar technologies: See Section 8 (Cookies & Tracking) for full details.

4. How We Use Your Data

gl99 uses personal data for the following purposes:

• Account management: Creating, maintaining, and securing your gl99 account; verifying your identity and age before activating full account functionality.
• Service delivery: Processing bets, casino game sessions, deposits, withdrawals, and bonus allocations in accordance with our Terms & Conditions.
• Fraud prevention and security: Detecting and preventing fraudulent activity, money laundering, account takeovers, collusion, and other prohibited conduct. We use automated systems and manual review processes for this purpose.
• Legal and regulatory compliance: Fulfilling our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and data protection requirements.
• Customer support: Responding to your enquiries, resolving disputes, and providing technical assistance.
• Responsible gaming: Monitoring account activity for indicators of problem gambling and reaching out proactively if our systems identify a player who may benefit from support tools.
• Marketing communications: Sending bonus offers, platform updates, and seasonal promotions to players who have opted in. You may withdraw consent at any time by contacting support.
• Platform improvement: Analysing aggregated usage data to improve the gl99 website, app interface, game selection, and payment experience.

gl99 does not use personal data for automated decision-making that produces significant legal effects on players, except where required by our fraud detection and AML compliance systems, in which case you have the right to request human review of any automated decision.

5. Legal Basis for Processing

gl99 processes personal data on the following legal bases:

• Contract performance: Processing necessary to deliver the betting, casino, and payment services you have signed up for. Without this processing, we cannot operate your gl99 account.
• Legal obligation: Processing required to comply with applicable laws, including KYC, AML, CTF, and data retention obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where our legitimate interests do not override your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications, where you have explicitly opted in. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Sharing Your Data

gl99 does not sell, rent, or trade personal data to third parties for commercial purposes. Data may be shared with the following categories of recipients solely to the extent necessary for the stated purpose:

• Game providers: Providers such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe receive the minimum data required (typically an anonymised player token and currency) to deliver their games within the gl99 platform.
• Payment processors and MFS providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC services that validate your identity documents on gl99's behalf.
• Fraud and AML screening services: Specialist third-party platforms that help gl99 detect suspicious activity and comply with anti-money laundering obligations.
• IT infrastructure providers: Cloud hosting, database, and CDN providers that store and serve platform data under strict data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable law, a court order, or a request from a competent government authority, gl99 may disclose personal data without prior notice to the account holder.

All third-party data processors engaged by gl99 are subject to written data processing agreements that restrict their use of personal data to the stated purpose and require appropriate technical and organisational security measures.

7. Payment Data & MFS Security

Given that gl99 primarily serves players in Bangladesh who use mobile financial services (MFS) including bKash, Nagad, and Rocket, we apply heightened care to the handling of payment-related personal data.

gl99 does not store your full MFS PIN, card CVV number, or full card number on its own servers. Payment credentials are transmitted directly to your MFS provider or card network via encrypted channels. gl99 retains only the last four digits of an MFS number and a transaction reference ID for internal reconciliation purposes.

All deposit and withdrawal transactions are logged with a timestamp (Bangladesh Standard Time, UTC+6), amount in BDT, and payment method identifier. This log is retained for a minimum of five (5) years in compliance with applicable financial regulations.

8. Cookies & Tracking Technologies

gl99 uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for core platform functionality, including session management, login state, and security tokens. These cannot be disabled without impairing platform operation.
• Functional cookies: Used to remember your preferences, such as language settings, preferred deposit method, and responsible gaming configuration.
• Analytics cookies: Aggregated, anonymised data about how players navigate the gl99 platform, used solely to improve the site structure and user experience. No identifiable personal data is transmitted to analytics providers.
• Fraud prevention cookies: Device fingerprinting and session integrity tokens used to detect and prevent account takeover, multi-accounting, and automated bot activity.

gl99 does not use third-party advertising or retargeting cookies. No data is shared with advertising networks, social media platforms, or data brokers for the purpose of serving targeted advertisements on other websites.

Most browsers allow you to manage cookie preferences through browser settings. Disabling strictly necessary cookies will affect your ability to log in and use the gl99 platform. Disabling functional or analytics cookies will not prevent access but may reduce the quality of your experience.

9. Data Retention

gl99 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Active account data: Retained for the full duration of the account's active life, plus a minimum of five (5) years following account closure, in compliance with AML and financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable regulatory guidance.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last interaction, to allow for dispute resolution.
• Marketing opt-in records: Retained for the duration of your consent plus two (2) years, to demonstrate compliance with consent obligations.
• Technical and usage logs: Retained for twelve (12) months, after which they are anonymised or deleted.

When personal data is no longer required and no legal obligation requires its retention, gl99 will securely delete or irreversibly anonymise it.

10. Security Measures

gl99 implements a range of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:

• 256-bit SSL/TLS encryption for all data in transit between your device and gl99 servers.
• AES-256 encryption at rest for sensitive stored data, including identity documents and financial records.
• One-way password hashing using industry-standard algorithms. Passwords are never stored in plain text and are never visible to gl99 staff.
• Role-based access controls ensuring that gl99 staff can only access personal data relevant to their specific job function. Access to player data is logged and audited.
• Intrusion detection and prevention systems monitoring platform infrastructure in real time for anomalous activity.
• Regular security assessments including vulnerability scanning and penetration testing conducted by qualified security professionals.
• Two-factor authentication (2FA) available to all players for additional account security.

While gl99 takes all reasonable precautions, no online platform can guarantee absolute security. In the unlikely event of a data breach that poses a risk to your rights and freedoms, gl99 will notify affected players without undue delay and will take immediate remediation steps.

11. Your Data Rights

As a gl99 player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: You may request a copy of the personal data gl99 holds about you, along with information about how it is used.
• Right to rectification: If personal data held by gl99 is inaccurate or incomplete, you have the right to request correction or completion.
• Right to erasure ("right to be forgotten"): In certain circumstances, you may request the deletion of your personal data. This right is subject to our legal obligation to retain certain data (e.g., AML records). Where deletion is not possible, gl99 will explain the reason.
• Right to restrict processing: You may request that gl99 limits the way it uses your personal data in specific circumstances, such as while a rectification request is being assessed.
• Right to data portability: Where processing is based on your consent or on contract performance, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes. gl99 will assess and respond to objections within 30 days.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting prior processing.

gl99 will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case you will be notified of the extension and the reason for it.

12. Minors & Age Policy

The gl99 platform is strictly for adults aged 21 years and above. gl99 does not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory step in the account activation and withdrawal process.

If gl99 becomes aware that personal data has been collected from a person under 21, that account will be immediately closed, all data will be securely deleted to the extent permitted by law, and any funds deposited will be refunded to the originating payment method after identity verification of the true account holder.

Parents and guardians who believe their child may have accessed the gl99 platform should contact us immediately at [email protected]. We will investigate and act without delay.

13. Third-Party Links & Integrations

The gl99 platform may contain references to third-party game providers, payment services, or informational resources. Where you interact directly with a third-party service (for example, completing a bKash payment through the bKash interface), that interaction is governed by the third party's own privacy policy, not by this Policy.

gl99 is not responsible for the privacy practices of any third-party service provider. We recommend that you review the privacy policies of any third-party services you use in connection with your gl99 account, particularly your MFS provider (bKash, Nagad, Rocket, Upay) and your bank.

14. Changes to This Privacy Policy

gl99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made, registered players will be notified via the email address or mobile number held on file, at least seven (7) days before the new policy takes effect.

The most current version of this Privacy Policy will always be accessible at gl99.io/privacy-policy. The effective date at the top of the page indicates when the current version was last revised. We encourage you to review this page periodically, particularly after receiving a notification of changes.

Continued use of the gl99 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.

15. Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the way gl99 handles your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the gl99 platform — ask to be connected to the Data Protection team
• WhatsApp: +880-XXX-XXXXXXX
• Response Time: Privacy enquiries are handled within 5 business days; data rights requests within 30 calendar days

This Privacy Policy was last reviewed and updated on 1 January 2026. The version published on this page supersedes all prior versions. The governing language for this Policy is English.