Privacy Policy — How al99 Handles Your Data

1. Introduction

This Privacy Policy ("Policy") describes how al99 ("we", "us", or "our") collects, uses, stores, and discloses personal information in connection with the al99 online gaming platform accessible at al99.io (the "Platform"). It applies to all registered players, visitors, and any individual who interacts with the Platform in any capacity.

By creating an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

This Policy should be read in conjunction with al99's Terms & Conditions, which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a privacy matter, this Policy shall prevail.

al99 is committed to protecting the personal data of players across Bangladesh, including those in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. We apply internationally recognised data protection standards to ensure your information is handled with the highest level of care.

2. Personal Data We Collect

al99 collects personal data in the following categories:

Category	Examples	Purpose
Identity Data	Full name, date of birth, national ID number, photograph	Account registration, age verification, identity verification
Contact Data	Mobile number, email address, residential address	Account communications, support, promotional messages (with consent)
Financial Data	bKash/Nagad/Rocket mobile wallet numbers, Visa/Mastercard last four digits, transaction history	Processing deposits and withdrawals, fraud prevention
Technical Data	IP address, device type, browser type, operating system, session timestamps	Security monitoring, fraud detection, platform optimisation
Usage Data	Pages visited, games played, bets placed, session duration, click paths	Platform improvement, personalisation, responsible gaming monitoring
Communications Data	Live chat transcripts, email correspondence, support ticket content	Dispute resolution, quality assurance, regulatory compliance
Verification Documents	Copies of national identity card, selfie photographs, utility bills	Know Your Customer (KYC) compliance, withdrawal authorisation

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes, or health information beyond what is voluntarily disclosed in a responsible gaming context.

3. How We Collect Your Data

al99 collects personal data through the following channels:

• Direct Provision: Information you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting support, or responding to a survey or promotion.
• Automated Technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies (see Section 7 for details).
• Payment Service Providers: Transaction confirmation data shared by bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a financial transaction via the Platform's cashier.
• Third-Party Game Providers: Game session data shared by certified providers including Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, and Microgaming for the purpose of game history maintenance and dispute resolution.
• Identity Verification Services: Confirmation data from document verification partners used to validate the authenticity of identification documents submitted during the KYC process.

4. Legal Basis for Processing

al99 processes your personal data on one or more of the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and al99 — including operating your account, processing bets, and handling deposits and withdrawals.
• Legitimate Interests: Processing that serves al99's legitimate business interests, such as fraud prevention, platform security, improving user experience, and responsible gaming monitoring, provided these interests are not overridden by your fundamental rights.
• Legal Obligation: Processing required to comply with applicable legal requirements, including financial record-keeping, anti-money-laundering (AML) obligations, and cooperation with lawful regulatory or law-enforcement requests.
• Consent: Processing for optional activities such as sending you promotional communications, depositing marketing cookies, or profiling for personalised game recommendations — where we rely on your freely given, informed, and specific consent. You may withdraw consent at any time without penalty.

5. How We Use Your Personal Data

al99 uses the personal data it collects for the following specific purposes:

• Creating, verifying, and maintaining your player account on the Platform.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard.
• Conducting identity and age verification to ensure compliance with the 21+ eligibility requirement.
• Detecting, investigating, and preventing fraud, money laundering, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Monitoring gaming behaviour to identify indicators of problem gambling and to offer responsible gaming tools where appropriate.
• Providing customer support through live chat and email communications.
• Sending account-related notifications such as deposit confirmations, withdrawal status updates, and security alerts.
• Sending promotional communications, bonus offers, and platform news — only where you have provided explicit consent and subject to your right to opt out at any time.
• Improving the performance, usability, and game catalogue of the Platform based on aggregate usage analytics.
• Maintaining accurate financial records and complying with applicable legal and regulatory obligations.

al99 does not use automated decision-making processes (including profiling) that produce legal or similarly significant effects on your account without human review being available upon request.

6. Data Sharing and Disclosure

al99 does not sell, rent, or exchange your personal data with third parties for commercial purposes. We disclose your data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the minimum data required to process your financial transaction. These providers operate under their own privacy frameworks and are contractually bound to process data only for the purpose of facilitating your payment.
• Game Content Providers: Certified game studios (including Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, and Microgaming) receive session identifiers and bet data necessary to run the game in question and maintain certified game history records.
• Identity Verification Partners: Where required for KYC purposes, identity document data may be shared with accredited verification service providers operating under strict confidentiality obligations.
• Technology Infrastructure Providers: Cloud hosting, database management, and platform security providers may process data on our behalf as data processors under written agreements that impose data protection obligations equivalent to our own.
• Legal and Regulatory Authorities: al99 will disclose personal data to competent authorities where required to do so by applicable law, valid court order, or a lawful request from a regulatory or law-enforcement body. We will notify you of any such disclosure where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of al99's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments being maintained. You will be notified of any such transfer in advance.

Any third party receiving your personal data is contractually prohibited from using it for any purpose beyond the specific function for which it was shared.

7. Cookies and Tracking Technologies

al99 uses cookies and similar tracking technologies to operate core platform functions, remember your preferences, and analyse how players interact with the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. These cookies cannot be disabled without rendering the Platform unusable.
• Functional Cookies: Used to remember your preferences such as language settings, preferred deposit method, and display configurations. Disabling these cookies may reduce your comfort of use but will not prevent core functions.
• Analytics Cookies: Used to collect aggregated data about how players navigate the Platform, which pages are most visited, and how long sessions last. This data helps us improve the Platform. These cookies are activated only with your consent.
• Marketing Cookies: Used to track the effectiveness of promotional campaigns and to serve relevant offers based on your interaction history with the Platform. These are activated only with your explicit consent and you may withdraw that consent at any time via your account settings.

Most web browsers allow you to manage cookie preferences directly through their settings panels. Blocking all cookies may affect the functionality of the al99 Platform. For more information on managing cookies, refer to your browser's help documentation.

8. Data Security

al99 implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform.
• Encrypted storage of sensitive data fields including passwords (stored as salted cryptographic hashes, never in plain text) and financial identifiers.
• Access controls limiting internal data access to authorised personnel on a strict need-to-know basis, with role-based permissions and audit logging.
• Two-factor authentication (2FA) available for player accounts and enforced for all internal administrative access.
• Regular security assessments including penetration testing and vulnerability scanning conducted by qualified information security professionals.
• Incident response procedures that define how al99 identifies, contains, and notifies affected parties in the event of a data breach.

While al99 takes all reasonable technical and organisational measures to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for notifying al99 immediately if you suspect unauthorised access to your account.

In the event of a personal data breach that is likely to result in a significant risk to your rights, al99 will notify affected players without undue delay and will take all practicable steps to mitigate the impact of the breach.

9. Data Retention

al99 retains personal data for only as long as necessary to fulfil the purpose for which it was collected, subject to applicable legal requirements. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, to meet financial compliance and potential dispute resolution obligations.
• Transaction records: Retained for a minimum of five (5) years following the transaction date, in accordance with financial record-keeping obligations.
• Communications and support records: Retained for three (3) years from the date of the most recent communication, or longer where a dispute is unresolved.
• Technical and usage data: Retained in identifiable form for up to twelve (12) months, after which it is aggregated and anonymised for analytical purposes with no retention limit.
• Verification documents (KYC): Retained for five (5) years post account closure. Physical or digital copies are securely destroyed at the end of the retention period.
• Marketing consent records: Retained for the duration of the consent and for three (3) years after withdrawal to demonstrate compliance history.

Where data is retained beyond the primary purpose of collection solely due to a legal obligation, it is held in a restricted access state and not used for any further operational activity.

10. Your Privacy Rights

As a player on the al99 Platform, you have the following rights in respect of your personal data. To exercise any of these rights, please contact our support team at [email protected] or via live chat. We aim to respond to all privacy rights requests within 30 days.

• Right of Access: You may request a copy of all personal data al99 holds about you, together with an explanation of the purposes for which it is processed.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request its correction or completion without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding legal retention obligations.
• Right to Restriction: You may request that al99 restrict processing of your personal data in certain circumstances, such as while the accuracy of data is being contested or a legitimate interests objection is under assessment.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that al99 provide your personal data to you in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Upon receiving such an objection, al99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

al99 will not discriminate against any player for exercising their privacy rights. Exercising a privacy right will not result in any change to your account status, withdrawal capabilities, or bonus eligibility, except where the specific request itself (e.g., account erasure) logically entails a change in service.

11. Children's Privacy

The al99 Platform is strictly intended for adults aged 21 years and above. al99 does not knowingly collect or process personal data from any person under the age of 21. Age verification is a mandatory step in the account registration process, and additional documentary verification may be requested at any time.

If al99 discovers that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all associated data will be deleted, and any Balance in the account will be returned to the originating payment method after verification. If you believe a person under 21 has registered on the Platform, please notify us immediately at [email protected].

Parents and guardians in Bangladesh who are concerned about underage access to online gaming platforms are encouraged to use parental control tools available through mobile network operators and device manufacturers to restrict access to age-restricted content.

12. Third-Party Links and Integrations

The al99 Platform may contain references to third-party services such as payment gateways (bKash, Nagad, Rocket), live game streams hosted by Evolution Gaming or Ezugi, and sports data feeds from external providers. When you interact with these third-party services, you may leave the al99 Platform environment and your activity will then be subject to the privacy policy of that third party.

al99 is not responsible for the privacy practices or content of third-party services. We strongly encourage you to read the privacy policies of any third-party service you access in connection with your use of the al99 Platform. The presence of a third-party integration on the Platform does not constitute al99's endorsement of that party's data practices.

13. Changes to This Privacy Policy

al99 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will post the revised policy on the Platform with an updated effective date and, where reasonably practicable, notify registered players via their account email address or through an in-platform notification.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must stop using the Platform and may request account closure by contacting our support team.

The version of this Policy in effect at the time of any data processing activity governs the handling of the data collected at that time. We maintain an archive of prior policy versions which is available upon request.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data al99 holds about you, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the al99 website. Average response time under 3 minutes.
• Email: [email protected] (plain text — not a clickable link)

We are committed to resolving all privacy-related enquiries fairly and promptly. Formal privacy rights requests (access, erasure, portability, etc.) will receive a substantive response within 30 calendar days. Where a request is complex or high in volume, we may extend this period by a further 30 days and will notify you accordingly.