gold99 Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") sets out the basis on which gold99 collects, uses, stores, and discloses personal data obtained from individuals who register for and use the gold99 online casino and sports betting platform, accessible at gold99.biz ("Platform"). This Policy applies to all gold99 account holders, prospective registrants, and visitors to the Platform, wherever located, who interact with gold99 services in Bangladesh or from Bangladesh.

gold99 is the data controller responsible for your personal data. This means gold99 determines the purposes and means by which your personal data is processed. This Policy is incorporated by reference into the gold99 Terms & Conditions, and both documents together form the complete agreement governing your relationship with gold99 in respect of data privacy.

This Policy should be read carefully in its entirety. Capitalised terms used but not defined in this Policy carry the meanings assigned to them in the gold99 Terms & Conditions. This Policy was last revised on 1 July 2026. The current version supersedes all previous versions.

2 Data We Collect

gold99 collects and processes the following categories of personal data in connection with the operation of the Platform and the provision of its services:

2.1 Identity Data

This includes your full legal name, date of birth, gender (where provided), and national identity card (NID) number or passport number submitted during the Know Your Customer (KYC) verification process.

2.2 Contact Data

This includes your registered mobile phone number, email address, and residential address in Bangladesh (including division, district, and thana/upazila).

2.3 Financial Data

This includes details of the payment methods you use to deposit funds and receive withdrawals, such as your bKash, Nagad, Rocket, or Upay account number (last four digits only), Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank account reference, and records of all deposit and withdrawal transactions associated with your gold99 account. gold99 does not store full bank account numbers or mobile banking PINs.

2.4 Account & Gameplay Data

This includes your username, encrypted account password, account balance history, betting and wagering records (including all sports bets placed, casino games played, and outcomes), bonus and promotion history, session timestamps, and any responsible gaming settings or self-exclusion elections you have activated.

2.5 Technical Data

This includes your IP address, device type and model, operating system, browser type and version, unique device identifiers, mobile network information, time zone (Bangladesh Standard Time, UTC+6), and Platform access logs.

2.6 Communications Data

This includes records of any communications you have with the gold99 customer support team, including live chat transcripts, email correspondence, and support ticket history.

2.7 Verification Documents

This includes copies of identity documents, address confirmation documents (such as utility bills or bank statements), and payment method confirmation screenshots submitted as part of the KYC or withdrawal verification process.

3 How We Collect Your Data

gold99 collects personal data through the following methods:

3.1 Direct Submission

Data you provide directly when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, participating in a promotion, or submitting any form or communication through the Platform.

3.2 Automated Technical Collection

Data collected automatically when you access the Platform, including via cookies, web beacons, session tracking technologies, and server-side access logs. This data is collected regardless of whether you are logged into your account.

3.3 Third-Party Sources

Data received from third-party service providers engaged by gold99 for the purpose of identity verification, fraud detection, or payment processing. This may include confirmation data from bKash, Nagad, Rocket, Upay, or banking partners, as well as results from third-party KYC verification services. gold99 uses such data only for the purposes described in this Policy and does not combine it with data obtained from unrelated sources.

4 Purposes & Legal Bases for Processing

The following table summarises the purposes for which gold99 processes your personal data and the corresponding legal basis for each processing activity:

4.1 Marketing Communications

Where you have provided explicit consent during registration or at a later point, gold99 may send you information about promotions, new games, and seasonal offers by email or SMS. You may withdraw this consent at any time by contacting the gold99 support team or by following the unsubscribe instructions included in any marketing communication. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

5 Sharing Your Personal Data

gold99 does not sell, rent, or trade personal data. We share personal data with third parties only in the following limited and controlled circumstances:

5.1 Payment Service Providers

Deposit and withdrawal transactions require the sharing of relevant account and financial data with your selected payment service provider — for example, bKash, Nagad, Rocket, Upay, or the relevant bank. Only the data strictly necessary to execute the transaction is shared. These providers are bound by their own privacy and data security obligations.

5.2 Identity Verification Services

To fulfil our KYC and age verification obligations, gold99 may share identity data and document copies with reputable third-party verification service providers. These providers process data solely on gold99's instructions and are contractually prohibited from using the data for any other purpose.

5.3 Game Technology Providers

Third-party game providers — including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe — may receive your account session token and anonymised player identifier to facilitate gameplay. These providers do not receive your full identity data, contact details, or financial data.

5.4 Legal and Regulatory Authorities

gold99 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or where gold99 determines in good faith that disclosure is necessary to protect the rights, property, or safety of gold99, its users, or the public.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a portion of gold99's business assets, personal data held by gold99 may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations being assumed by the acquirer. Affected account holders will be notified in advance of any such transfer where practicable.

6 International Data Transfers

The gold99 Platform primarily serves users in Bangladesh, and personal data is stored on servers located within secure data centre facilities. Certain third-party service providers engaged by gold99 — particularly game technology providers and KYC verification services — may process data on servers located outside Bangladesh.

Where personal data is transferred internationally, gold99 takes appropriate steps to ensure that such transfers are subject to adequate safeguards, including contractual protections equivalent to applicable data protection standards. gold99 will not transfer personal data to any jurisdiction that it determines to offer inadequate data protection without implementing appropriate compensating controls.

If you have questions about the specific locations where your personal data may be processed, please contact the gold99 support team using the details provided in Section 13 of this Policy.

7 Data Retention

gold99 retains personal data for the periods set out below, or for such longer period as may be required by applicable law:

• Active account data: Retained for the duration of your account's active status and for a minimum of five years following permanent account closure, in compliance with applicable anti-money laundering and regulatory record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later.
• Transaction records (deposits and withdrawals): Retained for a minimum of five years from the date of the transaction.
• Customer support communications: Retained for three years from the date of the last communication in a support thread.
• Technical and access log data: Retained for 12 months from the date of collection, unless required to be retained longer in connection with an active investigation or legal proceeding.
• Marketing consent records: Retained for the duration of your consent and for two years following withdrawal of consent, as evidence of the consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual. Anonymised aggregate data may be retained indefinitely for analytical and statistical purposes.

8 Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function efficiently, to maintain session state, and to provide usage information to the site operator. gold99 uses cookies and similar technologies (such as local storage and session storage) on the Platform for the purposes described below.

8.2 Types of Cookies Used by gold99

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be switched off. They include session authentication tokens that keep you securely logged in during your visit, CSRF protection tokens, and load-balancing cookies. Without these cookies, core Platform services cannot be delivered.
• Functional Cookies: These cookies remember your preferences — such as your selected language, display preferences, and responsible gaming settings — so that you do not need to re-enter them on each visit.
• Analytics Cookies: gold99 uses anonymised first-party analytics cookies to understand how users navigate the Platform in aggregate. This data helps gold99 improve page layouts, game discovery, and support workflows. No personally identifiable information is included in analytics data.

8.3 Third-Party Cookies

gold99 does not permit third-party advertising networks to place tracking cookies on the Platform. Game providers integrated into the Platform may set functional cookies necessary for game delivery within the game frame; these cookies are governed by the respective provider's privacy policy.

8.4 Managing Cookies

You can manage or delete cookies at any time through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to and using the Platform. Disabling functional or analytics cookies will not affect your ability to use core Platform features but may reduce the quality of your experience. Please consult your browser's help documentation for instructions on managing cookies.

9 Your Privacy Rights

As a data subject, you have the following rights in relation to your personal data held by gold99. These rights may be subject to certain conditions and limitations under applicable law:

• Right of Access: You have the right to request a copy of all personal data that gold99 holds about you. gold99 will provide this information within 30 days of receiving a valid request.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data that gold99 holds about you. You may update certain account details directly within your gold99 account settings; for other corrections, please contact the support team.
• Right to Erasure: In certain circumstances, you have the right to request that gold99 delete your personal data. This right is not absolute — gold99 may be required to retain certain data for legal, regulatory, or fraud-prevention purposes even where an erasure request is made.
• Right to Restriction of Processing: You have the right to request that gold99 restrict the processing of your personal data in certain defined circumstances, such as where you contest the accuracy of data or where processing is unlawful but you prefer restriction to deletion.
• Right to Data Portability: Where processing is based on consent or the performance of a contract and is carried out by automated means, you have the right to receive a structured, machine-readable copy of your personal data for transfer to another controller.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Object: You have the right to object to the processing of your personal data where gold99 relies on legitimate interests as its legal basis, including profiling based on legitimate interests. gold99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, please submit a written request to the gold99 support team via live chat or by email at [email protected]. gold99 will acknowledge your request within five business days and provide a substantive response within 30 calendar days. If your request is complex or you have made multiple requests, the response period may be extended by a further 30 days, in which case you will be notified.

10 Children's Privacy

The gold99 Platform is strictly for adults aged 18 years and above. gold99 does not knowingly collect personal data from any person under the age of 18. If gold99 becomes aware that personal data has been collected from a person under 18, it will take immediate steps to delete that data and permanently close any associated account in accordance with the underage account closure policy set out in the gold99 Terms & Conditions.

If you are a parent or guardian and you believe that a minor has registered an account on the gold99 Platform or has provided personal data to gold99 without your knowledge or consent, please contact the support team immediately at [email protected]. gold99 will investigate the report and take appropriate action within two business days.

11 Security Measures

gold99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the gold99 Platform;
• Encryption at rest for all stored personal data, including identity documents and financial records;
• Role-based access controls ensuring that only authorised gold99 personnel whose job functions require access to specific data categories can view that data;
• Multi-factor authentication requirements for all gold99 administrative systems;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Automated intrusion detection and anomaly monitoring systems operating 24 hours a day, 7 days a week;
• Documented incident response procedures, including mandatory breach notification protocols where applicable law requires notification to affected individuals or authorities.

While gold99 takes all reasonable measures to protect your data, no security system is impenetrable. gold99 cannot guarantee absolute security of data transmitted over the internet. You also play an important role in keeping your account secure: use a strong, unique password for your gold99 account, do not share your credentials with anyone, and contact support immediately if you suspect your account has been compromised.

12 Changes to This Policy

gold99 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, or applicable legal requirements. The date of the most recent revision is displayed at the top of this document.

Where changes to this Policy are material — meaning they significantly affect how gold99 uses your personal data or the rights available to you — gold99 will provide advance notice to registered account holders via email or a prominent in-Platform notification before the revised Policy takes effect. For minor or clarificatory amendments, the updated Policy will be published on this page without separate individual notification.

Your continued use of the gold99 Platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Policy, you must stop using the Platform and may request account closure in accordance with the gold99 Terms & Conditions.

gold99 recommends that you review this Privacy Policy periodically — particularly before making deposits, initiating withdrawals, or submitting new personal data to the Platform — to ensure you remain informed of how your data is handled.

13 Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data gold99 holds about you, please contact the gold99 Data Support team using the following methods:

• Live Chat: Available 24/7 within the gold99 Platform — the fastest way to reach the support team.
• Email: [email protected] — please include "Privacy Request" in the subject line of your email so that your enquiry is routed to the correct team member.

gold99 support operates around the clock, every day of the year, Bangladesh Standard Time (BST, UTC+6). gold99 commits to acknowledging all privacy-related enquiries within five business days and to providing a substantive response within 30 calendar days of receipt of a complete and valid request.