Privacy Policy — How td99 Collects, Uses, and Protects Your Data

1. Information We Collect

td99 collects personal information from you in several ways: directly when you register an account or interact with our services, automatically as you browse and play on the platform, and occasionally from trusted third parties such as payment processors and identity verification providers. We only collect information that serves a clear and legitimate purpose.

1.1 Information You Provide Directly

When you register for a td99 account or update your profile, we collect the following categories of information:

• Identity data: Full legal name, date of birth, gender, and nationality
• Contact data: Email address, Bangladesh mobile phone number, and residential address
• Account credentials: Username and encrypted password (we never store passwords in plain text)
• Identity verification documents: Copies of your National Identity Card (NID), passport, or other government-issued identification submitted during KYC verification
• Financial data: Payment method details such as your bKash or Nagad mobile number, bank account reference, or card details (card numbers are handled by our PCI-DSS compliant payment partners and are never stored in full on td99 servers)
• Responsible gaming data: Deposit limits, session limits, self-exclusion requests, and cooling-off preferences you configure within your account settings
• Support communications: Records of any messages, emails, or live chat interactions you have with the td99 customer support team

1.2 Information We Collect Automatically

When you access td99 through a web browser or mobile device, we automatically collect certain technical and behavioural data to ensure the platform functions correctly and to protect the security of all players:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and time zone setting
• Usage data: Pages visited, features used, games played, bets placed, session duration, click patterns, and navigation paths within the td99 platform
• Transaction data: Records of all deposits, withdrawals, bonus claims, wagers, game round results, and balance movements associated with your account
• Location data: General geographic location derived from your IP address (we do not collect precise GPS location data)
• Cookie and tracking data: Information collected via cookies and similar technologies as described in Section 4 of this Policy

1.3 Information from Third Parties

In certain circumstances td99 may receive personal information about you from trusted third-party sources, including: identity verification service providers who assist with KYC checks; payment processors including bKash, Nagad, Rocket, and Upay who confirm the status of transactions; fraud detection and anti-money laundering screening services; and publicly available sources such as sanctions lists and politically exposed persons (PEP) databases. Information received from third parties is handled with the same standard of care as information you provide directly.

2. How We Use Your Information

td99 uses the personal information we collect for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected.

Purpose	Data Used	Legal Basis
Account registration and management	Identity data, contact data, account credentials	Performance of contract
Processing deposits and withdrawals	Financial data, identity data, transaction data	Performance of contract
Identity verification (KYC)	Identity documents, financial data	Legal obligation (AML compliance)
Fraud prevention and security	Device data, usage data, transaction data, IP address	Legitimate interest
Responsible gaming monitoring	Usage data, transaction data, responsible gaming data	Legal obligation / legitimate interest
Customer support	Contact data, support communications, account data	Performance of contract
Platform improvement and analytics	Usage data, device data, cookie data (anonymised)	Legitimate interest
Promotional communications	Contact data, usage data, game preferences	Consent (opt-in)

Where td99 relies on your consent as the legal basis for processing (for example, sending you promotional emails about bonuses and new game releases), you have the right to withdraw that consent at any time by updating your notification preferences within your td99 account settings or by contacting our support team at [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

3. Data Sharing and Third Parties

td99 does not sell your personal data to any third party under any circumstances. We may, however, share your information with carefully selected third-party organisations where it is necessary to deliver or protect our services, or where we are required to do so by law.

3.1 Service Providers

We work with third-party service providers who process personal data on our behalf in order to support the operation of the td99 platform. These providers are bound by strict data processing agreements and are permitted to use your data only for the specific purpose for which it was shared. Categories of service providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, SureCash, Visa, and Mastercard processing partners who handle the technical execution of deposits and withdrawals
• Identity verification providers: Third-party KYC and AML screening services that assist with verifying player identities and checking against sanctions and PEP lists
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studios whose game software is integrated into the td99 platform
• Cloud infrastructure and hosting providers: Secure, enterprise-grade cloud services that store platform data with industry-standard physical and logical security controls
• Analytics providers: Aggregated and anonymised usage analytics tools that help us understand how players interact with td99 and where we can improve the experience
• Fraud detection and cybersecurity services: Specialist providers that monitor for suspicious account activity, bot traffic, and potential security threats

3.2 Legal and Regulatory Disclosure

td99 may be required to disclose your personal information to regulatory authorities, law enforcement agencies, or other government bodies where we are under a legal obligation to do so. This includes, but is not limited to, disclosures required under anti-money laundering (AML) legislation and responses to valid legal process such as court orders or official investigations. In such cases td99 will disclose only the minimum information necessary to satisfy the legal requirement.

3.3 Business Transfers

In the event that td99 undergoes a merger, acquisition, restructuring, or sale of all or a substantial part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via your registered email address if such a transfer results in a material change to how your data is processed, and you will have the opportunity to close your account if you do not wish your data to be transferred.

4. Cookies and Tracking Technologies

td99 uses cookies and similar tracking technologies on our website and mobile platform to ensure the site functions correctly, to remember your preferences, to keep your session secure, and to understand how players use our services so we can continue to improve them.

4.1 Types of Cookies We Use

• Strictly necessary cookies: These cookies are essential for the td99 platform to function. They enable core functionality such as session management, authentication, and security. Without these cookies, services you have requested — such as maintaining your login session — cannot be provided. These cookies cannot be disabled.
• Functional cookies: These cookies remember your preferences and settings — for example, your chosen display language, responsible gaming reminder intervals, and lobby layout preferences — so you do not need to reconfigure them each time you visit td99.
• Analytics cookies: These cookies collect anonymised, aggregated information about how visitors navigate the td99 platform, which pages are most visited, and where users encounter difficulties. This data helps us improve the platform experience. No personally identifiable information is contained in analytics cookie data.
• Marketing and preference cookies: With your consent, td99 may use cookies to deliver more relevant promotional communications and to measure the effectiveness of our marketing campaigns. You can withdraw consent for marketing cookies at any time through your account settings.

4.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can configure your browser to refuse all cookies, to alert you when a cookie is being set, or to delete cookies that have already been stored on your device. Please note that disabling strictly necessary cookies may prevent certain parts of the td99 platform from functioning correctly and may affect your ability to log in or complete transactions. Instructions for managing cookies in common browsers are available via the browser's own help documentation.

5. Data Security and Storage

Protecting your personal data is a core operational priority for td99. We maintain a comprehensive information security programme that includes both technical controls and organisational policies designed to prevent unauthorised access to, disclosure of, or destruction of your personal information.

5.1 Technical Security Measures

• 256-bit SSL/TLS encryption: All data in transit between your device and td99 servers is encrypted using industry-standard TLS protocols
• Encrypted data at rest: Sensitive personal data stored on td99 servers, including identity documents and financial records, is encrypted at rest using AES-256 encryption
• Password hashing: Account passwords are never stored in plain text; they are hashed using a strong, salted one-way hashing algorithm
• Access controls: Access to personal data within td99's internal systems is restricted on a strict need-to-know basis, with role-based access controls and multi-factor authentication required for all staff with data access privileges
• Intrusion detection: td99 employs automated intrusion detection and prevention systems that monitor for unusual access patterns and potential security threats around the clock
• Regular security audits: Our platform and infrastructure undergo periodic independent security assessments to identify and remediate vulnerabilities before they can be exploited

5.2 Data Breach Response

In the unlikely event of a data breach that poses a risk to your rights and freedoms, td99 will take immediate steps to contain and investigate the incident. Affected players will be notified without undue delay, and we will provide clear guidance on any protective steps you should take. td99 maintains a documented incident response procedure specifically for data security events.

6. Your Privacy Rights

As a player on the td99 platform, you have a number of rights in relation to the personal data we hold about you. td99 is committed to honouring these rights promptly and without undue bureaucratic obstruction. To exercise any of the rights listed below, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and specify which right you wish to exercise.

• Right of access: You have the right to request a copy of all personal data td99 holds about you, together with information about how it is being used. We will provide this information within a reasonable timeframe of receiving your verified request.
• Right to rectification: If any personal information we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay. Many basic corrections can be made directly within your td99 account profile.
• Right to erasure: In certain circumstances, you have the right to request that td99 permanently delete your personal data — for example, where you withdraw your consent and no other legal basis exists for continued processing, or where the data is no longer necessary for its original purpose. Please note that we may be required to retain certain data for regulatory compliance reasons even after an erasure request.
• Right to restrict processing: You have the right to request that we limit how we use your data in certain circumstances — for instance, while you dispute the accuracy of the data we hold or while a complaint about our processing is under investigation.
• Right to data portability: Where processing is based on your consent or on a contractual basis, you may request that we provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider if you choose.
• Right to object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You can also object to processing based on our legitimate interests, though in such cases we may continue processing if we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where td99 relies on your consent to process your data (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

td99 will respond to all privacy rights requests within a reasonable period. We will not charge a fee for handling reasonable requests. In cases where a request is manifestly unfounded or excessive, we reserve the right to either charge a reasonable administrative fee or decline the request, with written explanation.

7. Data Retention

td99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulations. The following general retention periods apply to the main categories of data we hold:

Data Category	Retention Period	Reason
Account registration data	Duration of account plus 5 years post-closure	AML compliance and dispute resolution
Identity verification documents	Duration of account plus 5 years post-closure	Regulatory KYC obligations
Transaction records	7 years from date of transaction	Financial recordkeeping requirements
Customer support communications	3 years from date of interaction	Dispute resolution and service quality
Marketing consent records	Until consent is withdrawn, plus 1 year	Proof of consent for compliance purposes
Anonymised analytics data	Indefinitely (no personal identifiers retained)	Platform improvement and trend analysis

Once data reaches the end of its applicable retention period and there is no outstanding legal, regulatory, or contractual requirement to retain it, td99 will securely delete or irreversibly anonymise the data. Deletion processes are audited periodically to ensure compliance with our stated retention schedules.

8. Updates to This Policy

td99 reviews this Privacy Policy on a regular basis to ensure it accurately reflects our current data practices and remains compliant with applicable privacy standards. We reserve the right to update or amend this Policy at any time.

When we make material changes to this Privacy Policy — changes that significantly affect how we collect, use, or share your personal data — we will notify you in advance by sending a notification to your registered email address and by displaying a prominent notice on the td99 platform. The updated Policy will include a revised "Last Updated" date at the top of the page.

We encourage you to review this Privacy Policy periodically to stay informed about how td99 is protecting your information. Your continued use of the td99 platform after a notified change to this Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way td99 handles your personal data, please contact our privacy support team at [email protected]. We take all privacy queries seriously and will aim to respond within 2 business days during Bangladesh Standard Time (BST, UTC+6) working hours.