Privacy Policy for gy99

1Overview

gy99 ("we", "us", "our") operates the online casino and sports betting platform accessible at gy99.io. As a platform serving players across Bangladesh, we are fully committed to handling your personal information with the highest standards of care, transparency, and security.

This Privacy Policy describes the personal data we collect from you when you register and use gy99, the purposes for which that data is processed, the parties with whom it may be shared, the security measures we employ to keep it safe, and the rights you hold as a data subject. We believe you have the right to know exactly how your information is used, and we have written this policy in plain English to ensure that understanding is accessible to every player.

This policy applies to all personal data collected through the gy99 website, mobile browser interface, live chat support system, email communications, and any other channel through which you interact with gy99. It covers data collected from registered players, visitors who have not yet registered, and individuals who contact our support team.

2Data We Collect

We collect only the personal data that is necessary to provide you with a safe, functional, and compliant online gaming experience. The categories of personal data we collect are described below:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data unless legally required to do so in specific circumstances (for example, if responsible gaming safeguards require a medical certificate to support a self-exclusion request).

3How We Collect Data

gy99 collects personal data through the following primary channels:

• Direct Submission: Information you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, filling out a support form, or corresponding with our support team via live chat or email.
• Automated Collection: Technical and usage data collected automatically when you access the platform, including via browser cookies, session tokens, server-side logs, and analytics tools. This data is collected whether or not you have a registered account.
• Payment Processors: Confirmation data received from payment partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, Mastercard) following a deposit or withdrawal transaction. This typically includes a transaction reference number, timestamp, and amount — not your full payment credentials.
• Identity Verification Services: Data received from third-party KYC verification providers who assist us in confirming the authenticity of identity documents submitted by players during the verification process.
• Fraud Detection Systems: Behavioural and technical signals collected through our internal and third-party anti-fraud monitoring systems to detect account takeover attempts, multi-accounting, and suspicious wagering activity.

4Purpose of Processing

gy99 processes your personal data only for specific, legitimate purposes. We do not process data in a manner that is incompatible with those purposes. The table below maps each processing purpose to the type of data involved:

5Legal Basis for Processing

Every data processing activity carried out by gy99 rests on at least one of the following recognised legal grounds:

• Contractual Necessity: Processing that is required to fulfil our obligations to you under the Terms & Conditions you agreed to at registration — for example, processing your deposits, verifying your identity to enable withdrawals, and maintaining your account balance records.
• Legal Obligation: Processing required to comply with applicable laws — for example, Know Your Customer (KYC) obligations, anti-money laundering (AML) requirements, and record-keeping obligations that require us to retain transaction data for defined periods.
• Legitimate Interests: Processing carried out in pursuit of gy99's legitimate business interests where those interests are not overridden by your rights — for example, fraud detection, platform security monitoring, responsible gaming surveillance, and internal analytics used to improve our services.
• Consent: Processing based on your freely given, specific, and informed consent — principally the sending of marketing communications and the placement of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

6Data Sharing

gy99 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your data only in the following limited circumstances and only to the extent strictly necessary:

• Payment Processors: We share the minimum necessary payment and identity data with our payment partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, Mastercard) to initiate and confirm deposit and withdrawal transactions. These parties process your data under their own privacy policies and are not permitted to use it for any other purpose.
• KYC & Identity Verification Providers: We share identity documents and related data with third-party verification services engaged to confirm the authenticity of documents submitted by players during the KYC process. These providers operate under strict confidentiality obligations.
• Game Studios: When you launch a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, Spribe, or NetEnt), a session token and your account identifier may be passed to the studio's game server to initiate the game session. We do not share your full personal profile with game studios.
• Fraud & AML Service Providers: We may share technical and account activity data with specialist fraud detection and anti-money laundering service providers who assist us in identifying and preventing financial crime on the platform.
• Legal Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or other governmental authorities when required to do so by applicable law, a valid court order, or in response to a lawful investigative request. We will notify you of any such disclosure where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of gy99's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance if such a transfer is to occur and if it materially affects the processing of your data.

7Data Retention

gy99 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

After the applicable retention period expires, your data is either securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

8Security Measures

gy99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our current security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the gy99 platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This ensures that your login credentials, payment details, and personal information cannot be intercepted during transmission.
• Password Hashing: Passwords stored in our system are never retained in plain text. They are processed using a salted one-way cryptographic hashing algorithm, meaning that even gy99 staff cannot retrieve your original password from our systems.
• Two-Step SMS Verification: All sensitive account actions — including login from a new device, withdrawal requests, and password changes — are protected by two-step verification via SMS to your registered mobile number.
• Login Anomaly Detection: Our security systems monitor login activity for anomalous patterns, including logins from unusual locations, rapid successive login attempts, and simultaneous session attempts from different IP addresses. Suspicious activity triggers automatic alerts and may result in temporary account restriction pending your confirmation.
• Access Controls: Access to personal data within gy99's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access necessary to perform their specific job functions. All internal data access is logged and subject to periodic audit.
• Secure Data Storage: All personal data is stored on servers with physical and logical access controls, regular security patching, and encrypted backups stored in geographically separate locations.

9Cookies & Tracking Technologies

gy99 uses cookies and similar tracking technologies to operate the platform, maintain session state, measure performance, and (where you have consented) deliver personalised content. The types of cookies we use are described below:

• Strictly Necessary Cookies: These cookies are essential to the operation of the platform and cannot be disabled. They include session authentication cookies that keep you logged in, CSRF protection tokens, and cookies that maintain your language and currency settings. No consent is required for these cookies as they are necessary for the service to function.
• Performance & Analytics Cookies: These cookies collect aggregated, anonymised data about how visitors interact with the platform — such as which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used solely to improve the platform experience and does not identify you individually. These cookies require your consent.
• Functional Cookies: These cookies remember your preferences and settings (such as your preferred game lobby view, notification preferences, and deposit method) to provide a more personalised experience on return visits. These cookies require your consent.
• Session Tokens: Short-lived tokens used to maintain your authenticated session while you are actively using the platform. These expire automatically when you log out or after a defined period of inactivity.

You may manage your cookie preferences at any time through the cookie settings available within your account dashboard. Please note that disabling certain categories of cookies may affect the functionality of some platform features. Your browser settings may also allow you to block or delete cookies independently, though doing so may prevent you from logging in or maintaining an active session.

10Your Rights

As a data subject, you hold a number of rights in relation to your personal data held by gy99. These rights are described below, along with guidance on how to exercise each one:

• Right of Access: You have the right to request a copy of the personal data gy99 holds about you. Upon a valid request, we will provide a summary of your data within 30 days. Requests may be made by contacting [email protected] with the subject line "Data Access Request".
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For basic contact details, you may update your own information via your account settings. For identity data and KYC records, please contact our support team.
• Right to Erasure: You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for continued processing. Please note that this right is subject to our legal retention obligations — we cannot erase data that we are required by law to retain (such as transaction records).
• Right to Restriction: You have the right to request that we restrict the processing of your data in certain circumstances — for example, while the accuracy of data is being contested, or pending the resolution of an objection.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent (principally marketing communications and non-essential cookies), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights listed above, please contact our support team at [email protected]. We will respond to all valid requests within 30 calendar days. We may request proof of identity before processing any data rights request to ensure we do not disclose or modify data belonging to a third party.

11Protection of Minors

gy99 strictly prohibits the use of its platform by anyone under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. Our registration process includes mandatory age declaration, and our KYC verification process is specifically designed to confirm that all registered users meet the minimum age requirement.

If gy99 becomes aware that an account has been registered by or on behalf of an individual under 21, the account will be immediately and permanently suspended. Any personal data collected in connection with that account will be securely deleted as quickly as is consistent with our legal obligations, and any deposits made will be returned to the originating payment method following verification.

If you are a parent or guardian and believe that a person under 21 in your care has registered on gy99, please contact our support team immediately at [email protected]. We take all such reports seriously and will investigate and act on them promptly.

12Third-Party Services

The gy99 platform integrates with a number of third-party services to deliver its full functionality. These include game studios (Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, Microgaming, Play'n GO), payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, Mastercard), and identity verification providers.

Each of these third parties operates its own systems and is governed by its own privacy policy. gy99 is not responsible for the data practices of these third parties. When your data is shared with them for the purposes described in this policy, it is shared under contractual data processing terms that restrict their use of the data to the specific purpose for which it was shared. However, we encourage you to review the privacy policies of any third-party provider whose services you use in connection with your gy99 account.

The gy99 website may contain links to our own informational pages. We do not link to external third-party websites, and this Privacy Policy does not extend to any external site.

13International Data Transfers

gy99 primarily stores and processes personal data within secure data centre infrastructure. In some cases, the use of third-party service providers (such as game studios or identity verification services) may result in your personal data being processed outside Bangladesh. Where such transfers occur, gy99 takes appropriate measures to ensure that your data is afforded a level of protection equivalent to that provided under this Privacy Policy.

These measures include entering into written data processing agreements with service providers that incorporate standard contractual clauses requiring them to apply appropriate technical and organisational security measures to your data, to process it only for specified purposes, and to return or delete it once the processing purpose has been fulfilled.

14Policy Amendments

gy99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made to this policy, we will notify registered users via the email address associated with their account and/or by displaying a prominent notice on the platform prior to the changes taking effect.

The effective date displayed at the top of this document will be updated with each revision. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the gy99 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to a revised policy, you should discontinue use of the platform and contact our support team to arrange account closure.

Minor clarifications or formatting corrections that do not materially affect your rights or our data practices will be made without specific notification, though the effective date will be updated accordingly.

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which gy99 handles your personal data, please contact our data support team using the details below. All privacy-related communications are handled in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Rights Requests: Please use "Privacy Request — [Your Request Type]" (e.g., "Privacy Request — Data Access", "Privacy Request — Erasure") to ensure prompt routing to the correct team.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 calendar days, in line with our policy commitments.
• Identity Verification: To protect your data, we may require you to verify your identity before we process any data rights request. This is to ensure we do not disclose or modify data relating to a third party acting without your knowledge.

gy99 is committed to resolving all privacy concerns fairly and transparently. If you believe your privacy rights have been violated and you are not satisfied with the outcome of your support interaction, you may escalate your complaint by replying to the original support thread and requesting a senior privacy review.