tb99 Privacy Policy — How We Protect Your Personal Data

1 Introduction

tb99 is committed to handling your personal data responsibly, transparently, and in strict accordance with the data protection requirements imposed under our international gaming licence. This Privacy Policy sets out a comprehensive account of how personal data relating to tb99 players in Bangladesh is collected, stored, used, shared, and protected.

The term "personal data" in this policy refers to any information that identifies you as an individual or that could reasonably be used to identify you — either on its own or in combination with other data held by tb99. This includes, but is not limited to, your name, date of birth, email address, mobile number, residential address, National Identity Card number, device identifiers, and financial account references such as bKash or Nagad wallet numbers.

This policy should be read alongside the tb99 Terms & Conditions and the Responsible Gaming Policy. Those documents form part of the overall agreement between tb99 and each registered player and contain additional provisions relevant to the lawful use of your account and personal data.

2 Personal Data We Collect

The categories of personal data tb99 collects from players are described in the table below. The scope of data collected at any given time depends on the nature of your interaction with the platform.

3 How We Collect Your Data

3.1 Directly From You

The majority of personal data we hold is provided directly by you at the time of account registration, during the KYC verification process, when you contact our support team, or when you update your account profile. You are under no obligation to provide data beyond what is required for the specific purpose, but declining to provide mandatory data may prevent you from accessing certain platform features.

3.2 Automatically Through Platform Use

When you access the tb99 website or mobile platform, we automatically collect certain technical data about your device and browsing behaviour. This includes your IP address, device fingerprint, browser configuration, operating system, session duration, pages visited, and interaction patterns. This data is collected through server logs, cookies, and similar tracking technologies described in Section 7 of this policy.

3.3 From Third-Party Service Providers

In certain circumstances, tb99 may receive data about you from third-party service providers engaged to support platform operations. These include payment processors (such as mobile banking aggregators handling bKash and Nagad transactions), identity verification services, fraud detection providers, and game platform operators. Data received from these sources is treated with the same level of protection as data you provide directly.

4 How and Why We Use Your Data

tb99 uses personal data for the following specific purposes. In each case, we have identified the corresponding legal basis, which is set out in full in Section 5.

• Account creation and management: To register your account, verify your identity, and maintain your player profile throughout your relationship with tb99.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladeshi bank channels. All payment transactions are processed in Bangladeshi Taka (BDT).
• KYC and regulatory compliance: To verify your age (21+ only), identity, and the legitimate source of funds deposited on the platform, as required under our gaming licence obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, multiple-account abuse, bonus fraud, money laundering, and other prohibited conduct described in the tb99 Terms & Conditions.
• Responsible gaming: To monitor gaming patterns for indicators of problem gambling and to enforce deposit limits, self-exclusion orders, and cooling-off periods.
• Customer support: To respond to your queries, complaints, and account requests, and to maintain records of those interactions for quality assurance and dispute resolution purposes.
• Platform improvement: To analyse aggregated, anonymised usage data that helps us improve the reliability, performance, and design of the tb99 platform.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS — but only where you have provided your explicit consent to receive such communications and have not subsequently withdrawn that consent.

5 Legal Basis for Processing

tb99 processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which we rely are as follows:

• Contractual necessity: Processing required to perform the contract between tb99 and the player — including account management, payment processing, and customer support.
• Legal obligation: Processing required to comply with our gaming licence conditions, anti-money laundering obligations, and other applicable regulatory requirements.
• Legitimate interests: Processing that serves tb99's legitimate business interests — such as fraud prevention, platform security, and anonymised analytics — where those interests are not overridden by the player's right to privacy.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. Consent may be withdrawn at any time by contacting support or using the unsubscribe option in marketing emails.

6 Data Sharing and Disclosure

tb99 does not sell, rent, or trade your personal data with any third party. We share data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

6.1 Payment Service Providers

To process deposits and withdrawals, tb99 shares relevant financial and identity data with licensed payment processors and mobile banking partners, including bKash, Nagad, Rocket, Upay, and our partner banking institutions. These parties are contractually bound to process data solely for the purposes of completing the relevant transaction and to maintain appropriate security standards.

6.2 Identity and Fraud Verification Partners

tb99 engages specialist third-party providers to assist with KYC verification and fraud detection. These providers may access identity documents and device data for the sole purpose of confirming a player's identity or flagging suspicious activity. They are not permitted to use this data for any other purpose.

6.3 Game Software Providers

To deliver casino games and sports betting markets on the tb99 platform, we work with licensed game studios and data feed providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive the minimum technical data required to deliver game content — such as session tokens — but are not provided with full player identity records.

6.4 Legal and Regulatory Authorities

tb99 will disclose personal data to government bodies, law enforcement agencies, or regulatory authorities where we are legally required to do so — for example, in response to a valid court order, anti-money laundering investigation, or regulatory audit. In all such cases, disclosure is limited to what is legally mandated.

7 Cookies and Tracking Technologies

tb99 uses cookies and similar technologies to support platform functionality, maintain session security, and gather anonymised analytics data. A cookie is a small text file placed on your device when you visit the tb99 website. It does not execute code or install software.

7.1 Types of Cookies Used

• Strictly necessary cookies: These cookies are essential for you to navigate the tb99 platform and use its core features, such as maintaining your login session and remembering your language preference. They cannot be disabled without disrupting platform functionality.
• Functional cookies: These cookies remember your preferences and customisations across sessions — for example, your preferred currency display (BDT) or game lobby sort order.
• Analytics cookies: These cookies collect anonymised data about how players use the platform, which pages are visited most frequently, and where technical errors occur. This data is used solely to improve the tb99 platform and is never linked back to individual player profiles.
• Security cookies: These cookies help tb99 detect and prevent fraudulent login attempts, bot activity, and other security threats by analysing device and session characteristics.

7.2 Managing Cookies

Most web browsers allow you to control cookie settings through their privacy preferences. You can configure your browser to refuse all cookies or to alert you when a cookie is being set. Please note that disabling strictly necessary cookies will impair your ability to use the tb99 platform. Browser-based cookie controls do not apply to server-side session data maintained for security purposes.

8 Data Retention

tb99 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for as long as required by our gaming licence conditions and applicable law. The general retention principles are as follows:

• Active account data: Retained for the duration of your account relationship with tb99, plus a minimum period of five years from the date of account closure to satisfy anti-money laundering record-keeping requirements.
• KYC verification documents: Retained for a minimum of five years from the date of verification, or longer if required by a specific regulatory obligation or ongoing investigation.
• Transaction records: Deposit, withdrawal, and betting transaction records are retained for a minimum of five years from the date of the transaction.
• Support correspondence: Customer support records are retained for three years from the date of the last interaction in a given thread, unless the content is relevant to an open dispute or regulatory matter.
• Marketing consent records: Consent records are retained for as long as the consent is active and for two years after it is withdrawn, to demonstrate compliance with consent management obligations.
• Technical logs: Server logs and analytics data are retained for up to 12 months in identifiable form, after which they are aggregated and anonymised.

When personal data reaches the end of its applicable retention period and there is no other legal basis for continued storage, it is securely deleted or permanently anonymised.

9 Your Data Rights

As a registered tb99 player, you have the following rights with respect to your personal data. These rights may be subject to limitations where their exercise would conflict with tb99's legal obligations or the rights of third parties.

• Right of access: You have the right to request a copy of the personal data tb99 holds about you and to receive information about how it is being used.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: In certain circumstances, you may request that we delete personal data we hold about you. This right is subject to overriding retention obligations, particularly those arising from our gaming licence and anti-money laundering requirements.
• Right to restriction: You have the right to request that we restrict the processing of your personal data in circumstances where the accuracy of the data is contested, or where processing is unlawful but you prefer restriction over deletion.
• Right to object: You have the right to object to processing based on tb99's legitimate interests, and to processing for direct marketing purposes. Objections to direct marketing will always be honoured without exception.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

10 Data Security

tb99 implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include, but are not limited to:

• TLS 1.3 encryption for all data transmitted between your device and the tb99 platform
• AES-256 encryption for sensitive data stored at rest in tb99's databases and document storage systems
• Multi-factor authentication requirements for all tb99 staff who access systems containing personal data
• Role-based access controls that restrict data access to personnel whose specific job functions require it
• Regular third-party security audits and penetration testing of the tb99 platform infrastructure
• Automated intrusion detection and anomaly-monitoring systems operating 24 hours a day
• Secure document destruction procedures for any physical materials containing personal data

Despite these measures, no system is completely immune to security threats. In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected players, tb99 will notify affected individuals within 72 hours of becoming aware of the breach, in accordance with our licensing obligations.

Players are also responsible for maintaining the security of their own account. You must keep your login credentials confidential, use a strong and unique password, and notify tb99 support immediately if you suspect any unauthorised access to your account.

11 Third-Party Links

The tb99 platform may from time to time reference or display content connected with third-party game providers, payment services, or promotional partners. This Privacy Policy applies exclusively to data processed by tb99 in connection with the tb99 platform and its directly operated services.

tb99 is not responsible for the privacy practices of third-party platforms, even where those platforms are referenced in the context of tb99 services. Players who interact with third-party services — including mobile banking apps, bank portals, or game provider environments — should review the applicable privacy policies for those services independently.

12 Minors and Age Restrictions

The tb99 platform is strictly restricted to individuals who are 21 years of age or older. tb99 does not knowingly collect or process personal data relating to individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, that account will be closed immediately and all associated data will be deleted from our active systems, subject to any minimum regulatory retention obligations.

If you believe that a person under the age of 21 has registered an account on the tb99 platform, please notify us immediately at [email protected] (plain text — not a clickable link). We take underage gambling prevention very seriously and will investigate and act on all reports promptly.

13 Changes to This Privacy Policy

tb99 reserves the right to update or replace this Privacy Policy at any time. When material changes are made — that is, changes that substantially affect how we collect, use, or share your personal data — we will notify all registered players by email to the address on file no less than 14 days before the changes come into effect. A notice will also be displayed prominently on the tb99 website during the notice period.

Minor or administrative changes, such as clarifications of existing language or updates to contact details, may be made without advance notice but will always be reflected by an updated effective date at the top of this document.

Continued use of the tb99 platform after the effective date of any revision to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree to the revised policy, you should stop using the platform and request account closure before the revision takes effect.

14 Contact and Data Enquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which tb99 processes your personal data, please contact our support team using the details below. All communications should be submitted in English.