gu99 Privacy Policy

This Privacy Policy ("Policy") describes how gu99 ("gu99", "we", "us", "our") collects, uses, stores, and protects the personal information of players ("you", "your", "Player") who access or use the gu99 platform at gu99.io. By registering an account or continuing to use any gu99 service, you acknowledge that you have read and understood this Policy. This Policy forms part of and should be read alongside the gu99 Terms & Conditions.

1. About This Policy

gu99 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy applies to all personal data collected through the gu99 website, mobile-optimised platform, customer support channels, and any other touchpoint through which you interact with gu99.

This Policy does not apply to third-party websites or services that may be referenced on the gu99 platform. We strongly encourage you to review the privacy policies of any third-party service before providing your personal information to them.

2. Data We Collect

The categories of personal data gu99 may collect about you include the following:

2.1 Registration Data

When you create a gu99 account, we collect the information you provide during the registration process, including:

• Full legal name
• Date of birth
• Mobile phone number (used for account authentication and support contact)
• Email address
• Preferred username and password (stored in hashed form)
• Residential address (city and district within Bangladesh)

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and to verify your age as required by our 21+ policy, we may request copies of:

• Government-issued photo identification (National Identity Card, passport, or driving licence)
• Proof of address documentation
• Payment method ownership verification (e.g., screenshot of bKash, Nagad, or Rocket account registered in your name)

2.3 Financial Transaction Data

Every deposit and withdrawal you make through gu99 generates a transaction record. This includes the transaction amount in Bangladeshi Taka (৳), the payment method used, the timestamp, and the transaction reference number provided by the payment provider. gu99 does not store full card numbers or full mobile banking credentials.

2.4 Gameplay and Betting Data

We record data related to your activity on the platform, including bets placed, games played, bet amounts, outcomes, session durations, and game provider interactions. This data is used for account management, dispute resolution, responsible gaming monitoring, and fraud detection.

2.5 Technical and Device Data

When you access gu99, our servers automatically collect certain technical information including:

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Referring URL and pages visited within the gu99 platform
• Session start and end times
• Cookie identifiers and similar tracking data (see Section 6)

2.6 Communications Data

If you contact gu99 via email or live chat, we retain the content of those communications for quality assurance, dispute resolution, and training purposes. This includes any attachments or supporting documentation you submit to our support team.

3. How We Use Your Data

gu99 uses your personal data only for the purposes listed below. We do not use your data for any purpose that is incompatible with the reason it was originally collected.

Purpose	Data Used
Account creation and management	Registration data, device data
Age and identity verification (KYC)	Registration data, KYC documents
Processing deposits and withdrawals	Financial transaction data, KYC data
Fraud prevention and anti-money laundering	All categories
Responsible gaming monitoring	Gameplay data, registration data
Customer support and dispute resolution	Communications data, gameplay data
Platform security and abuse prevention	Technical data, gameplay data
Promotional communications (where opted in)	Registration data, gameplay data
Legal and regulatory compliance	All categories as required

4. Legal Basis for Processing

gu99 processes your personal data under one or more of the following legal bases depending on the specific activity:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions, such as operating your account and processing transactions.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and record-keeping obligations.
• Legitimate interests: Processing conducted for purposes such as fraud prevention, platform security, and improving our services, where such interests are not overridden by your rights.
• Consent: Processing for optional activities such as marketing communications, where you have provided explicit consent. You may withdraw consent at any time by contacting support or updating your Account preferences.

5. Sharing Your Data

gu99 does not sell, rent, or trade your personal data. We may share your data with carefully selected third parties only in the following circumstances:

5.1 Payment Processors

To process your deposits and withdrawals, we share necessary transaction data with local payment providers including bKash, Nagad, Rocket, and Upay. These providers act as independent data controllers for their own transaction records and are subject to their own privacy policies.

5.2 Game Providers

Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive a session token and limited account identifier to authenticate your game session. They do not receive your full name, payment details, or identity documents.

5.3 Fraud Prevention and Security Services

gu99 may use third-party fraud detection and cybersecurity services that process technical and gameplay data on our behalf. These providers are bound by strict data processing agreements and may not use your data for any purpose other than delivering their contracted services to gu99.

5.4 Legal and Regulatory Authorities

We may disclose your personal data to law enforcement agencies, regulatory bodies, or other government authorities where required to do so by applicable law, court order, or where disclosure is necessary to protect the rights, property, or safety of gu99, its players, or the public.

5.5 Business Transfers

In the event that gu99 undergoes a merger, acquisition, or sale of all or part of its assets, your personal data may be transferred to the successor entity. We will notify registered players via their registered email address prior to any such transfer, and this Policy will continue to govern your data.

6. Cookies & Tracking Technologies

gu99 uses cookies and similar technologies (including local storage and session tokens) to operate the platform and deliver a secure, personalised experience. The categories of cookies we use are described below:

Cookie Type	Purpose	Retention
Strictly Necessary	Maintain your login session, protect against CSRF attacks, and enable core platform functions.	Session / up to 24 hours
Functional	Remember your language preference, odds format, and interface settings.	Up to 12 months
Analytics	Understand how players navigate the platform so we can improve the user experience. Data is aggregated and anonymised.	Up to 24 months
Fraud Detection	Identify suspicious login patterns, unusual betting behaviour, and potential account compromise.	Up to 12 months

You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your gu99 account. gu99 does not currently use third-party advertising or retargeting cookies.

7. Data Security

gu99 applies a layered security approach to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and gu99 servers.
• Bcrypt password hashing with unique per-account salting. gu99 staff cannot view your plaintext password under any circumstances.
• Access controls: Personal data is accessible only to gu99 staff who require it to perform their specific job function. All staff access is logged and audited.
• Regular security reviews of our infrastructure, including penetration testing and vulnerability assessments.
• Anomaly detection systems that flag and investigate unusual account activity in real time.
• Secure data centres with physical access controls and redundant backup systems.

Despite our extensive precautions, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights or freedoms, gu99 will notify affected players without undue delay and will take all reasonable steps to mitigate harm.

8. Data Retention

gu99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years after closure	Legal and regulatory obligation
KYC identity documents	Duration of account + 5 years after closure	Anti-money laundering compliance
Financial transaction records	7 years from transaction date	Financial record-keeping requirements
Gameplay and betting history	Duration of account + 2 years after closure	Dispute resolution, responsible gaming
Support communications	3 years from last interaction	Quality assurance, dispute resolution
Technical / device logs	Up to 12 months	Security monitoring
Marketing preference records	Until consent is withdrawn	Consent management

Once the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual.

9. Your Rights

As a gu99 player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request".

• Right of Access: You may request a copy of the personal data gu99 holds about you. We will respond within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected.
• Right to Erasure: In certain circumstances, you may request that gu99 delete your personal data. Note that this right may be limited where retention is required for legal compliance (see Section 8).
• Right to Restrict Processing: You may request that gu99 limit the processing of your data in circumstances where its accuracy is contested or its processing is objected to.
• Right to Data Portability: Where technically feasible, you may request that your account data be provided to you in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to Object: You may object to processing carried out under gu99's legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

10. Children & Minors

gu99 services are strictly intended for adults aged 21 years and above. gu99 does not knowingly collect personal data from any person under the age of 21. If we become aware that a minor has registered an Account, that Account will be immediately suspended, all bets will be voided, and any deposited funds will be returned to the originating payment method following a mandatory review. If you believe a minor has created an account on gu99, please contact us immediately at [email protected].

11. Third-Party Links

The gu99 platform may contain references to third-party services such as game providers, payment processors, or responsible gaming organisations. These references do not constitute endorsements, and gu99 is not responsible for the privacy practices or content of any third-party service. We encourage you to read the privacy policy of any third-party service before sharing your personal information with them.

12. International Data Transfers

gu99's primary infrastructure is located in secure data centres serving the South and Southeast Asia region. In some cases, data may be processed by third-party service providers whose servers are located outside Bangladesh. Where such transfers occur, gu99 ensures that appropriate safeguards are in place — including contractual data processing agreements with standard data protection clauses — to maintain a level of protection equivalent to the standards described in this Policy.

13. Updates to This Policy

gu99 reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or operational needs. When material changes are made, we will notify registered players via their account email address at least 7 days before the changes take effect. The updated Policy will always be accessible at gu99.io/privacy-policy, and the "Last Updated" date at the top of this page will be revised accordingly. Your continued use of the gu99 platform after the effective date of any update constitutes acceptance of the revised Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way gu99 handles your personal data, please reach out to our dedicated support team:

• Email: [email protected]
• Subject Line for Data Requests: "Data Rights Request"
• Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)
• Response Time: We aim to acknowledge all privacy-related enquiries within 2 business days and to resolve them fully within 30 days.

For urgent account security matters — such as suspected unauthorised access or a potential data breach — please mark your message as "URGENT – SECURITY" in the subject line for priority handling by our security team.