by99 Privacy Policy

About This Policy

This Privacy Policy applies to all personal data processed by by99 in connection with the operation of the by99 Platform at https://by99.io, including the casino gaming section, sportsbook, cashier, account management area, and all associated customer support communications. It applies to all registered players and to visitors who browse the by99 Platform without registering.

by99 is committed to handling your personal data with integrity, transparency, and security. We collect only the data we need, use it only for the purposes described in this Policy, and protect it using industry-standard technical and organisational security measures. We do not sell your personal data to third parties under any circumstances.

This Privacy Policy should be read alongside the by99 Terms & Conditions and the by99 Responsible Gaming Policy. By registering a by99 account or continuing to use the by99 Platform, you acknowledge that you have read this Privacy Policy and consent to the data practices described herein.

Data Controller Information

For the purposes of applicable data protection law, by99 is the data controller responsible for the personal data collected and processed through the by99 Platform. by99 is the entity operating the website at https://by99.io and providing online casino and sports betting services to players in Bangladesh.

All data protection enquiries, access requests, and complaints should be directed to the by99 data support team. Contact details are provided in Section 14 of this Policy. by99 will respond to all legitimate data enquiries within a reasonable period, typically within 30 days of receipt.

Personal Data We Collect

The following categories of personal data may be collected and processed by by99 in the course of providing the Platform and its services:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where health-related information is voluntarily provided in the context of a responsible gaming self-exclusion or problem gambling support request.

How We Collect Your Data

by99 collects personal data through the following channels:

• Direct Registration: When you create a by99 account, you provide your name, date of birth, email address, and Bangladeshi mobile number directly through the registration form on the by99 Login page.
• KYC Verification Submissions: When you submit identity documents (National ID, passport, or driving licence) to complete the by99 Know Your Customer process, we collect and store the data contained in those documents.
• Deposits and Withdrawals: When you transact through the by99 cashier using bKash, Nagad, Rocket, Upay, or bank transfer, financial reference data associated with those transactions is recorded.
• Platform Activity: As you navigate the by99 Platform — browsing the casino lobby, placing cricket bets, spinning slots, or accessing your account settings — usage and technical data is automatically recorded by our Platform systems.
• Customer Support: When you contact the by99 support team by email or live chat, the content of your communications is stored as part of your account record.
• Cookies and Similar Technologies: When you visit the by99 Platform, cookies and tracking pixels automatically collect technical and usage data. See Section 8 for full details on our cookie practices.

How We Use Your Data

by99 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose incompatible with those listed below without first seeking your consent:

• Account Creation and Management: To register your by99 account, verify your identity (including the mandatory 21+ age check), manage your account settings, and maintain accurate account records.
• Processing Transactions: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other accepted payment methods, and to maintain a complete and accurate transaction history for your account.
• Platform Delivery: To provide access to the by99 casino game library, live dealer tables, cricket and sports betting markets, and all other Platform features you are eligible to use.
• Security and Fraud Prevention: To monitor account activity for signs of fraud, money laundering, multi-accounting, bot usage, or other prohibited conduct as defined in the by99 Terms & Conditions.
• Responsible Gaming Compliance: To enforce deposit limits, cooling-off periods, and self-exclusion instructions, and to monitor player behaviour patterns that may indicate problem gambling requiring intervention.
• Legal and Regulatory Compliance: To meet our obligations under applicable anti-money laundering (AML), Know Your Customer (KYC), and data retention requirements.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and deliver a consistent standard of English-language support across all channels.
• Marketing Communications (with consent): To send you promotional offers, bonus notifications, and platform updates where you have provided explicit opt-in consent. You may withdraw consent at any time through your account settings or by contacting [email protected].
• Platform Improvement: To analyse aggregated, anonymised usage data in order to improve Platform performance, game selection, and the overall player experience across Bangladesh.

Legal Basis for Processing

by99 processes your personal data under the following legal bases:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered by99 player — including account management, transaction processing, and Platform access.
• Legal Obligation: Processing required to comply with applicable AML, KYC, and data retention laws. This includes identity verification, transaction record-keeping, and cooperation with lawful regulatory requests.
• Legitimate Interests: Processing carried out for by99's legitimate business interests, including security monitoring, fraud detection, Platform analytics, and product development — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for direct marketing communications and for certain non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing and Disclosure

by99 does not sell, rent, or trade your personal data to any third party. We share your data only in the following limited and controlled circumstances:

• Game Software Providers: Certified game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe, and Play'n GO may receive limited technical data (such as session tokens or game round identifiers) necessary to deliver their games within the by99 Platform. These providers are contractually prohibited from using this data for any other purpose.
• Payment Processing Partners: When you transact via bKash, Nagad, Rocket, Upay, Visa, Mastercard, or our banking partners (including Dutch-Bangla Bank, BRAC Bank, City Bank), the minimum financial data necessary to process your transaction is shared with the relevant payment provider. Payment providers handle this data under their own privacy frameworks.
• Identity Verification Services: Third-party KYC verification providers may receive identity document images and biographical data solely for the purpose of completing the by99 identity verification process. These providers are bound by strict data processing agreements.
• Fraud Prevention and Security Services: Specialist third-party fraud detection and cybersecurity providers may receive technical and usage data to support by99's security monitoring obligations.
• Legal and Regulatory Authorities: by99 will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by law or by a lawful order issued by a competent authority. by99 will notify affected players of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or transfer of all or part of by99's business, player data may be transferred to the acquiring entity, subject to that entity assuming equivalent data protection obligations.

All third parties with whom by99 shares personal data are required to implement appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose beyond that for which it was shared.

Cookies and Tracking Technologies

The by99 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to protect account security, and to improve the player experience. A cookie is a small text file stored on your device by your browser when you visit a website.

by99 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to operate. These include session authentication cookies that keep you logged in to your by99 account, security cookies that protect against cross-site request forgery (CSRF), and load-balancing cookies. These cookies cannot be disabled without preventing the Platform from functioning correctly.
• Functional Cookies: Remember your Platform preferences such as language settings, preferred game view, and cashier display options. Disabling these cookies will not prevent Platform access but will reset your preferences on each visit.
• Analytics Cookies: Collect anonymised data about how players interact with the by99 Platform — pages visited, session duration, error events, and feature usage — to help by99 identify and fix issues and improve the user experience. This data is aggregated and does not identify individual players.
• Marketing and Retargeting Cookies: Used only with your explicit consent to help by99 deliver relevant promotional content. You may opt out of marketing cookies at any time through your account settings.

You can manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in to and using the by99 Platform.

Data Retention

by99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods generally apply:

• Active Account Data: Retained for the duration of your active by99 account plus a minimum of 5 years following account closure, in compliance with AML and KYC record-keeping requirements.
• Transaction Records: Financial transaction data, including deposit and withdrawal history, is retained for a minimum of 5 years from the date of each transaction.
• KYC and Identity Documents: Identity verification documents are retained for a minimum of 5 years following the completion of the verification process or account closure, whichever is later.
• Support Communications: Customer support records are retained for a minimum of 3 years from the date of the last communication.
• Responsible Gaming Records: Self-exclusion records, deposit limit settings, and cooling-off period records are retained for a minimum of 6 years to ensure compliance with responsible gaming obligations and to prevent re-registration during active exclusion periods.
• Marketing Consent Records: Records of your marketing opt-in or opt-out choices are retained for as long as your account is active and for 2 years following account closure.

When retention periods expire, by99 securely deletes or anonymises the relevant personal data in accordance with our internal data disposal procedures.

Your Data Rights

As a by99 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at the details provided in Section 14. by99 will respond to all legitimate rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of all personal data that by99 holds about you, along with information about how that data is used and stored.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held in your by99 account. Some data corrections may require KYC re-verification.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. Note that this right is limited where by99 has a legal obligation to retain data (for example, AML and KYC retention requirements). Erasure requests will be assessed on a case-by-case basis.
• Right to Restriction of Processing: You have the right to request that by99 restrict processing of your personal data in certain circumstances — for example, while a data accuracy dispute is being resolved.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to by99 in a structured, commonly used, machine-readable format where processing is based on your consent or on a contract.
• Right to Object: You have the right to object to processing based on by99's legitimate interests at any time. You also have an unconditional right to object to direct marketing, which by99 will honour immediately upon receiving your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Data Security

by99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-Bit SSL Encryption: All data transmitted between your device and the by99 Platform is protected by 256-bit SSL/TLS encryption, ensuring that your login credentials, financial information, and personal data cannot be intercepted in transit.
• Two-Factor Authentication (2FA): by99 supports 2FA via your registered Bangladeshi mobile number. We strongly recommend enabling 2FA on your by99 account to provide an additional layer of protection against unauthorised access.
• Access Controls: Access to personal data within by99's internal systems is strictly limited to authorised personnel on a need-to-know basis. All staff with access to player data are subject to confidentiality obligations and regular data protection training.
• Intrusion Detection and Monitoring: by99's security infrastructure includes continuous intrusion detection, real-time anomaly monitoring, and automated alerts for suspicious account activity patterns.
• Secure Data Storage: Player data is stored on secure, access-controlled servers. Financial data, identity documents, and KYC records are stored in encrypted form with restricted access.
• Regular Security Audits: by99 conducts regular internal and third-party security reviews to identify and address potential vulnerabilities in our Platform and data systems.

While by99 takes all reasonable and practical steps to secure your personal data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, by99 will notify affected players promptly and take all available remedial action.

Children's Privacy

The by99 Platform is strictly intended for adults aged 21 and over. by99 does not knowingly collect, process, or store personal data relating to any individual under the age of 21. Age verification is a mandatory step in the by99 account registration and KYC process, and all accounts are subject to age verification review.

If by99 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, the data will be securely deleted, and any deposited funds will be returned to the originating payment method to the extent that verification permits. If you believe that a minor may have registered a by99 account, please notify us immediately at [email protected].

Changes to This Policy

by99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes to this Policy, we will:

• Update the "Effective Date" at the top of this Policy.
• Send a notification email to all registered players at the email address on file.
• Display a prominent notice on the by99 Platform for a period of at least 14 days following the change.

Your continued use of the by99 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material change to this Policy, you should cease using the Platform and may request account closure by contacting [email protected].

Contact and Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data by99 holds about you — including data access requests, rectification requests, erasure requests, and marketing opt-out requests — please contact the by99 data support team using the details below.

Support and Data Enquiries Email: [email protected]

Please include your registered account username, your full name as registered, and a clear description of your request in all data-related communications. by99 will acknowledge receipt of your request within 5 business days (Bangladesh Standard Time) and will provide a substantive response within 30 days of receipt. In cases of particular complexity, this period may be extended by a further 30 days, with prior written notice to you.