cd99 Privacy Policy
How We Protect Your Data

1 Introduction

cd99 is Bangladesh's premier online casino and sports betting platform, accessible at https://cd99.win. We are committed to protecting the privacy and personal data of every player who chooses to engage with our platform. This Policy sets out our practices in relation to the collection, processing, storage, and disclosure of personal data, in a manner that is transparent, fair, and consistent with internationally recognised data protection principles.

This Policy applies to all personal data collected through your use of the cd99 website, including account registration, deposits and withdrawals, game play activity, customer support interactions, and any communications you initiate with cd99 staff. It applies equally to data collected through desktop browsers and mobile-optimised views of the platform.

cd99 primarily serves players located in Bangladesh, including those accessing the platform from Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. Where relevant, this Policy takes into account the data protection expectations of Bangladeshi users and international best practices applicable to online gaming platforms.

2 Data We Collect

cd99 collects only the personal data that is necessary to provide a safe, fair, and functional gaming experience. The categories of personal data we collect are described in the table below.

2.1 Sensitive Data

cd99 does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless specifically required by applicable law or directly provided by the player in the context of a support interaction. Any sensitive data received incidentally will be handled with the highest level of care and deleted as soon as it is no longer required for its stated purpose.

2.2 Data You Choose Not to Provide

Where provision of certain personal data is optional, you may choose not to provide it. However, failure to supply data that is required for account registration, KYC verification, or payment processing may result in cd99 being unable to fulfil its obligations to you — including the processing of withdrawal requests or the provision of certain gaming features.

3 How We Collect Your Data

cd99 collects personal data through the following channels:

• Direct Interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or responding to promotions.
• Automated Technologies: Data collected automatically as you interact with the platform, including cookies, server logs, IP address tracking, and device fingerprinting used for security and fraud prevention purposes.
• Third-Party Payment Providers: Confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when processing financial transactions. cd99 does not receive or store your full payment credentials — only the minimum data necessary to reconcile and verify transactions.
• Game Providers: Summary gameplay and session data from our game studio partners including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe, used solely for account management and responsible gaming monitoring.
• Identity Verification Partners: Where third-party identity verification services are used to assist with KYC processes, the results of those verification checks (pass/fail status and associated reference data) are shared with cd99.

4 How We Use Your Data

cd99 processes your personal data for the following specific purposes:

1. Account Management: To create, maintain, and manage your cd99 player account, including processing registration, updating your profile, and handling account closure requests.
2. Identity and Age Verification: To verify that you are who you say you are, and to confirm that you are 18 years of age or older before permitting real-money gaming activity.
3. Payment Processing: To process deposits and withdrawals accurately, securely, and within stated timeframes, using your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, or Mastercard).
4. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, multiple-account abuse, bonus abuse, and any other conduct that violates our Terms & Conditions or applicable law.
5. Responsible Gaming: To monitor gaming patterns for indicators of problem gambling and to action self-exclusion, deposit limit, and session timer requests submitted by players.
6. Customer Support: To respond to your enquiries, complaints, and support requests promptly and effectively.
7. Platform Improvement: To analyse aggregated, anonymised usage data to identify technical issues, improve game performance, and enhance the overall player experience.
8. Marketing Communications: To send promotional offers, bonus notifications, and seasonal campaign information — but only where you have provided explicit opt-in consent to receive such communications. You may withdraw consent at any time.
9. Legal Compliance: To meet obligations under applicable laws and regulations, including responding to valid requests from law enforcement or regulatory authorities.

5 Legal Basis for Processing

cd99 processes your personal data on the following legal bases, depending on the purpose of processing:

• Contractual Necessity: Processing required to fulfil our obligations to you under the player account agreement — including account creation, payment processing, and gameplay facilitation.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering (AML) requirements, age verification obligations, and responses to lawful requests from authorities.
• Legitimate Interests: Processing carried out for cd99's legitimate business interests where those interests are not overridden by your rights — including fraud detection, platform security, and aggregate analytics for service improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for optional marketing communications. You may withdraw consent at any time by contacting support or updating your account preferences.

6 Data Sharing and Disclosure

cd99 does not sell or rent your personal data. We share your personal data only in the following limited circumstances:

6.1 Service Providers

cd99 works with carefully selected third-party service providers who process personal data on our behalf, strictly under our instruction and under contractual data processing agreements that require them to protect your data to the same standard as cd99. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard gateway partners), identity verification services, cloud hosting providers, and customer support platform providers.

6.2 Game Studio Partners

To facilitate gameplay, limited technical data (such as player session tokens and account identifiers) is shared with our game studio partners including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe. These studios are contractually prohibited from using this data for any purpose other than delivering the requested game session.

6.3 Legal and Regulatory Disclosure

cd99 may disclose personal data to governmental authorities, law enforcement agencies, or regulatory bodies where required by law, court order, or regulatory direction. We will disclose only the minimum data necessary to satisfy the lawful request and will notify the affected player where legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of cd99's business assets, personal data held by cd99 may be transferred to the acquiring entity, subject to the acquiring entity agreeing to uphold the standards set out in this Privacy Policy.

7 Data Retention

cd99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised in a manner that renders it irrecoverable and no longer attributable to you as an individual.

8 Data Security

cd99 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the cd99 platform is encrypted in transit using industry-standard SSL/TLS protocols.
• Encryption at Rest: Sensitive personal data stored in cd99's systems — including KYC documents and financial records — is encrypted at rest using strong encryption algorithms.
• Access Controls: Access to personal data within cd99 is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Firewall and Intrusion Detection: cd99's infrastructure is protected by enterprise-grade firewalls and automated intrusion detection and prevention systems that monitor for suspicious activity 24/7.
• Penetration Testing: cd99 conducts regular independent security assessments and penetration tests to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response Plan: cd99 maintains a documented data breach incident response plan. In the event of a security incident, our response team will act swiftly to contain the breach, assess its scope, and notify affected players without undue delay.

9 Cookies and Tracking Technologies

cd99 uses cookies and similar technologies (such as local storage and session tokens) to operate the platform, maintain your login session, and gather anonymised analytics that help us improve the user experience. The following categories of cookies are used on the cd99 platform:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They enable core features such as secure login session management, fraud detection, and load balancing. The platform cannot function properly without these cookies and they cannot be disabled.

9.2 Analytics Cookies

cd99 uses anonymised analytics cookies to understand how players interact with the platform — for example, which games are most popular, how players navigate between sections, and where technical errors occur. This data is aggregated and does not identify individual players.

9.3 Preference Cookies

These cookies remember your platform preferences — such as your language setting, responsible gaming tool configurations, and display preferences — so that you do not need to reconfigure them each time you visit.

9.4 What We Do NOT Use

cd99 does not deploy third-party advertising cookies, social media tracking pixels, or any cookie technology that tracks your browsing behaviour across websites other than cd99.win. We do not participate in cross-site behavioural advertising networks.

9.5 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the cd99 platform and may prevent you from accessing certain features, including secure login.

10 Your Privacy Rights

As a cd99 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request".

• Right of Access: You may request a copy of all personal data cd99 holds about you. We will provide this within 30 days of receiving your verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations as outlined in Section 7.
• Right to Restriction of Processing: You may request that cd99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object to processing of your personal data where that processing is based on our legitimate interests. cd99 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11 Minors and the 18+ Policy

The cd99 platform is strictly intended for adults aged 18 years and above. cd99 does not knowingly collect personal data from individuals under the age of 18. If we discover that personal data has been provided by or on behalf of a person under 18, we will immediately close the associated account, delete all personal data connected to it, and return any deposited funds.

cd99 strongly recommends that parents and guardians employ parental control software to prevent underage individuals from accessing online gaming platforms. We take our responsibility to protect minors extremely seriously.

12 Third-Party Services and Links

The cd99 platform integrates third-party game content from studios including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe. While cd99 maintains data processing agreements with these studios, we do not control their independent privacy practices. Players who interact directly with third-party game interfaces should be aware that those studios may collect minimal technical data as part of delivering the game session.

cd99 also integrates third-party payment gateways to process bKash, Nagad, Rocket, Upay, Visa, and Mastercard transactions. When you initiate a payment, you will interact with the respective payment provider's interface. cd99 does not store your full payment credentials. The payment provider's own privacy policy governs data collected during the payment process.

The cd99 platform does not contain hyperlinks to external third-party websites. Any content provided within this platform is hosted by cd99 or our contracted service providers. cd99 accepts no liability for the privacy practices of any third party whose services you access independently of the cd99 platform.

13 International Data Transfers

cd99 primarily processes and stores player data on servers located in secure data centres. In certain circumstances, personal data may be processed by our third-party service providers in jurisdictions outside Bangladesh. Where such transfers occur, cd99 ensures that appropriate safeguards are in place to protect your personal data, including:

• Contractual clauses requiring the recipient to maintain data protection standards equivalent to those applied by cd99.
• Transfer only to jurisdictions or organisations that provide an adequate level of data protection as assessed by cd99 in good faith.
• Limiting the scope of transferred data to the minimum necessary for the specific service being provided.

If you have questions about the specific safeguards in place for any international transfer of your personal data, please contact us at [email protected].

14 Changes to This Privacy Policy

cd99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. When material changes are made, we will notify registered players by posting a prominent notice on the platform and, where possible, by email to the address associated with your account.

The updated Policy will take effect from the date stated in the "Effective Date" notice at the top of this page. Your continued use of the cd99 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should discontinue use of the platform and may request account closure in accordance with the Terms & Conditions.

We recommend reviewing this Policy periodically to stay informed about how cd99 protects your personal data. The current version will always be accessible at https://cd99.win/privacy-policy.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way cd99 handles your personal data, please reach out to our dedicated support team through any of the following channels:

For matters specifically relating to responsible gaming, self-exclusion, or deposit limits, please visit our Responsible Gaming page. For questions about your account agreement and our platform rules, please refer to our Terms & Conditions.

cd99 treats all privacy-related enquiries with strict confidentiality. Your request will be handled by a trained team member and will not be shared with parties outside cd99 except as required to fulfil the request.