gz99 Privacy Policy — How We Protect Your Data

1About This Policy

This Privacy Policy ("Policy") sets out how gz99 ("we", "us", "our", "the Company"), operator of the online casino and sports betting platform available at gz99.io (the "Platform"), collects, processes, stores, and protects the personal data of individuals who access or use the Platform ("you", "your", "the User").

This Policy applies to all gz99 products and services, including but not limited to casino games, live dealer games, sports betting markets, the gz99 mobile experience, customer support interactions, marketing communications, and all other services offered through gz99.io. It should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy.

By registering an account with gz99, accessing the Platform, or by accepting these terms during the registration process, you confirm that you have read, understood, and agreed to the collection and use of your personal data as described in this Policy. If you do not agree, you must discontinue use of the Platform immediately.

2Data Controller Information

gz99 is the data controller in respect of personal data collected through the gz99 Platform. As data controller, gz99 determines the purposes for which and the means by which your personal data is processed. All data-related enquiries, access requests, rectification requests, and erasure requests should be directed to the gz99 Data Protection contact provided in Section 15 of this Policy.

3Personal Data We Collect

gz99 collects personal data that is necessary to provide a safe, secure, and regulatory-compliant gambling service to our Bangladeshi player community. The categories of personal data we collect include the following:

gz99 does not collect special categories of sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, health data, or data concerning sexual orientation, unless expressly required by applicable law or regulation.

4How We Collect Your Data

gz99 collects personal data through a variety of direct and automated means during your interaction with the Platform:

• Registration: When you create a gz99 account, you provide Identity Data, Contact Data, and Account Data directly via the registration form.
• KYC Verification: When you submit identity documents (NID, passport, or other approved documents) to complete the Know Your Customer verification process, gz99 collects and stores copies of those documents.
• Deposits and Withdrawals: When you initiate a financial transaction using bKash, Nagad, Rocket, Upay, or a bank account, Financial Data and Transaction Data are collected automatically by our payment processing systems.
• Platform Usage: As you browse and interact with gz99.io, Technical Data is collected automatically via server logs, cookies, and similar tracking technologies. This includes your IP address, device type, and navigation patterns.
• Customer Support: When you contact gz99 support via live chat or email, Communications Data is collected and stored as part of the support record for that interaction.
• Promotions and Surveys: If you participate in a gz99 promotion, enter a tournament, or respond to a player survey, additional data relevant to that activity may be collected.
• Third-Party Sources: gz99 may receive data about you from third-party identity verification partners, fraud prevention databases, and payment processors to supplement the information you have provided directly.

5How We Use Your Personal Data

gz99 uses the personal data we collect exclusively for the purposes described below. We do not use your data for purposes incompatible with those for which it was originally collected without obtaining your separate consent.

• Account management: To create, maintain, and administer your gz99 player account, including processing your gz99 login credentials securely.
• Service delivery: To provide access to casino games, live dealer tables, sports betting markets (including BPL, IPL, ICC T20 tournaments, and Bangladesh Tigers fixtures), and all other Platform features.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard in Bangladeshi Taka (BDT).
• Identity and age verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with Know Your Customer requirements. The 21+ age restriction is strictly enforced.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited conduct as described in our Terms & Conditions.
• Responsible gaming: To monitor player activity for signs of problem gambling behaviour and to enable responsible gaming tools including deposit limits, session alerts, cool-off periods, and self-exclusion, in accordance with our Responsible Gaming Policy.
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and provide technical assistance via live chat and email.
• Marketing communications: To send you promotional offers, bonus notifications, and news about gz99, where you have given explicit consent to receive such communications. You may opt out at any time.
• Platform improvement: To analyse usage patterns, diagnose technical issues, and improve the performance, content, and user experience of the gz99 Platform.
• Legal compliance: To comply with applicable laws and regulations, respond to lawful requests from authorities, and enforce our contractual rights.

6Legal Basis for Processing

gz99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing is necessary to perform the contract between you and gz99 — that is, to operate your player account, process transactions, and deliver the services you have registered to use.
• Legal obligation: Processing is required to comply with legal and regulatory obligations, including age verification, identity verification, anti-money laundering record-keeping, and tax reporting requirements.
• Legitimate interests: Processing is carried out in pursuit of gz99's legitimate business interests, including fraud prevention, platform security, and improving the quality of our services, where those interests are not overridden by your data protection rights.
• Consent: Where processing is based on consent — most notably for marketing communications and for non-essential cookies — gz99 will only process your data with your explicit, freely given, and withdrawable consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

7Data Sharing and Third Parties

gz99 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the following limited circumstances, and only to the extent strictly necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive Financial Data and Transaction Data necessary to process your deposits and withdrawals in BDT.
• KYC and identity verification partners: Third-party identity verification service providers receive copies of your Identity Data documents (NID, passport) to complete the required Know Your Customer process.
• Fraud prevention services: gz99 shares Technical Data and Transaction Data with fraud detection platforms to identify suspicious activity, prevent account takeovers, and protect the integrity of the Platform.
• Game studios: Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session data necessary to run their games within the gz99 environment. These studios operate under their own data protection policies and are contractually bound to protect player data.
• Legal and regulatory authorities: gz99 may disclose personal data to law enforcement agencies, regulatory bodies, or judicial authorities in Bangladesh or other applicable jurisdictions where required by law, court order, or in connection with the investigation of prohibited conduct.
• Professional advisers: gz99 may share data with legal advisers, auditors, and IT security consultants under strict confidentiality obligations where necessary to obtain professional services.

8Cookies and Tracking Technologies

gz99 uses cookies, web beacons, pixel tags, and similar tracking technologies on the Platform to ensure the site functions correctly, to remember your preferences, and to gather analytics data that helps us improve our services for Bangladeshi players.

Types of cookies used by gz99:

• Strictly necessary cookies: These cookies are essential for the gz99 Platform to function. They manage your session state, gz99 login authentication, and security tokens. These cookies cannot be disabled without preventing you from using the Platform.
• Functional cookies: These cookies remember your preferences, such as language settings, display preferences, and previously entered form data, to improve your experience across sessions.
• Analytics cookies: gz99 uses anonymised analytics tools to understand how players navigate the Platform — including which games are most popular, how long sessions last, and where users encounter difficulties. This data is used exclusively to improve Platform quality.
• Marketing cookies: Where you have given consent, gz99 may use marketing cookies to deliver relevant promotional content about gz99 offers, seasonal bonuses (such as Eid promotions and Pohela Boishakh specials), and new game releases.

You can manage cookie preferences at any time through your browser settings. Please note that disabling functional or analytics cookies may affect the quality of your gz99 experience. Strictly necessary cookies cannot be deactivated via browser settings without disrupting Platform functionality.

9Data Retention

gz99 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as outlined in this Policy, or as required by applicable law and regulation.

• Active account data: Personal data associated with an active gz99 account is retained for the full duration that your account remains open and for a defined period after account closure.
• Transaction and financial records: All financial transaction records, including deposit and withdrawal history in BDT, are retained for a minimum of 5 years following the transaction date in order to comply with anti-money laundering record-keeping obligations.
• KYC documents: Identity documents submitted for age and identity verification are retained for a minimum of 5 years following account closure or the date of the last transaction, whichever is later.
• Support communications: Live chat transcripts and email correspondence with gz99 support are retained for a minimum of 2 years to allow for complaint resolution and audit purposes.
• Marketing data: If you withdraw consent for marketing communications, your marketing preference record (including the opt-out) is retained indefinitely to ensure gz99 does not contact you in the future.
• Inactive accounts: Data associated with accounts that have been inactive for 12 consecutive months may be archived and retained in accordance with our legal obligations, even if the account itself is closed.

Upon expiry of the applicable retention period, gz99 will securely delete or anonymise your personal data in accordance with our internal data destruction procedures.

10Data Security

gz99 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational security measures to protect it against unauthorised access, loss, alteration, disclosure, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and gz99 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to your gz99 login session, all game sessions, and all payment transactions.
• Password hashing: gz99 account passwords are never stored in plain text. Passwords are processed through a one-way cryptographic hashing algorithm, meaning gz99 staff cannot access your password under any circumstances.
• Two-factor authentication (2FA): gz99 strongly recommends enabling 2FA via SMS on your account. This provides an additional layer of security for your gz99 login.
• Access controls: Access to personal data within gz99's internal systems is restricted on a strict need-to-know basis. Staff members are only granted access to the data required to perform their specific role.
• Penetration testing and security audits: gz99 conducts regular security assessments to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident response: In the event of a data security incident that affects your personal data, gz99 will notify affected players via the email address on file within a reasonable timeframe, consistent with applicable notification obligations.

11Your Rights as a Data Subject

As a registered gz99 player, you hold a number of rights in relation to the personal data gz99 holds about you. gz99 is committed to honouring these rights in a timely and transparent manner. Your rights include:

• Right of access: You have the right to request a copy of all personal data that gz99 holds about you. gz99 will provide this information within 14 business days of receiving a verified request.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data that gz99 holds about you. You can update basic account information directly from your account settings, or contact support for assistance with document-level corrections.
• Right to erasure: You have the right to request deletion of your personal data ("right to be forgotten"), subject to gz99's legal retention obligations. Requests will be assessed on a case-by-case basis; data that must be retained for legal compliance cannot be erased until the relevant retention period has expired.
• Right to restrict processing: You have the right to request that gz99 restricts the processing of your personal data in certain circumstances — for example, if you contest the accuracy of data while correction is pending.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that gz99 transmit this data to another service provider where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where it is based on gz99's legitimate interests. gz99 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the rights listed above, please contact gz99 Data Protection at [email protected] (plain text — not a clickable link). gz99 may request proof of identity before processing a data rights request to ensure that data is not disclosed to an unauthorised party.

12Children and Minors

The gz99 Platform is strictly for adults aged 21 years and above. gz99 does not knowingly collect personal data from individuals under the age of 21. The 21+ age restriction is enforced through our KYC verification process, which requires all registered players to provide valid proof of age before they may deposit funds or access gambling features.

If gz99 discovers or reasonably suspects that a registered account belongs to a person under the age of 21, gz99 will immediately suspend the account, void any wagers placed, and request return of deposited funds to the originating payment method. All personal data associated with that account will be deleted, except for data that must be retained to record and investigate the underage access incident.

13International Data Transfers

gz99 primarily serves Bangladeshi players and stores personal data in secure data centres. In some cases, personal data may be transferred to and processed by third-party service providers (such as game studios, KYC partners, or payment processors) whose infrastructure is located outside Bangladesh.

Where such transfers occur, gz99 ensures that appropriate safeguards are in place to protect your personal data. These safeguards may include contractual data protection clauses requiring the recipient to treat your data with an equivalent level of protection to that applied by gz99, or reliance on the third party's independently verified security certifications.

By registering with gz99 and accepting this Privacy Policy, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Bangladesh. gz99 will always take reasonable steps to ensure that any cross-border transfer of your data is carried out securely and with appropriate protections in place.

14Changes to This Privacy Policy

gz99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulation, new services introduced on the Platform, or feedback received from players and advisers. All updates will be posted to this page at gz99.io/privacy-policy with a revised "Last Updated" date at the top of the document.

Where a change to this Policy is material — meaning it significantly affects how we collect, use, or share your personal data — gz99 will notify registered players by sending an alert to the email address associated with their account at least 14 days before the revised Policy takes effect. Minor clarifications and editorial corrections may be updated without advance notice.

Your continued use of the gz99 Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and may request closure of your account by contacting [email protected]. Account closure requests will be processed in accordance with the Terms & Conditions.

gz99 recommends that you review this Privacy Policy periodically to remain informed about how we protect your personal data. Previous versions of this Policy are available on request by contacting gz99 Data Protection at [email protected].

15Contact and Data Requests

If you have any questions, concerns, or complaints about this Privacy Policy or about the way gz99 handles your personal data, or if you wish to exercise any of the data subject rights described in Section 11, please contact gz99 Data Protection using the details below. All communications must be in English.

When submitting a data subject request, please include your full name as registered with gz99, your registered email address, the nature of your request (access, rectification, erasure, portability, objection, or consent withdrawal), and any relevant details that will help gz99 locate and process your data accurately. gz99 may request a copy of a valid identity document to verify your identity before processing the request.

gz99 is committed to resolving all data-related concerns fairly and promptly. If you are not satisfied with gz99's response to your request or complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.