fd99 Privacy Policy — How We Protect Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how fd99 ("fd99", "we", "us", "our") collects, uses, processes, stores, and discloses personal data obtained from players, registered account holders, and visitors to the fd99 online betting and casino platform accessible at https://fd99.io ("the Platform"). This Policy is intended to be read alongside the fd99 Terms & Conditions and the fd99 Responsible Gaming Policy, all of which together govern your relationship with the Platform.

By registering an account on the Platform, making a deposit, or otherwise interacting with any service offered by fd99, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the Platform immediately.

fd99 is committed to handling personal data responsibly, maintaining its confidentiality, and protecting it against unauthorised access, disclosure, alteration, or destruction. We apply appropriate technical and organisational measures proportionate to the sensitivity of the data we hold.

2. Data Controller

For the purposes of this Policy, fd99 is the data controller responsible for the personal data you provide or that is generated through your use of the Platform. As data controller, fd99 determines the purposes and means by which personal data is processed, and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

All data protection queries, access requests, and deletion requests should be directed to the fd99 Data Protection contact point via email at [email protected]. Please include the subject line "Data Protection Request — [your account username]" so your request is routed to the correct team without delay.

3. Data We Collect

fd99 collects the following categories of personal data in connection with your use of the Platform:

3.1 Identity and Registration Data

• Full legal name as it appears on your official identification document
• Date of birth (used for age verification — players must be 21 or older)
• Residential address in Bangladesh (city, district, full postal address)
• Gender (optional, collected for demographic analytics only)
• Nationality and country of residence

3.2 Contact Data

• Email address (primary communication channel)
• Mobile phone number (used for OTP verification, account alerts, and optional SMS promotions)

3.3 Identity Verification (KYC) Data

• Scanned or photographed copy of National Identity Card (NID), passport, or birth certificate
• Selfie photograph, with or without the accompanying identity document
• Proof of residential address document (utility bill, bank statement, or equivalent)
• Proof of payment method ownership (screenshot or screenshot extract from mobile wallet)

3.4 Financial and Transaction Data

• Deposit and withdrawal transaction references, amounts, dates, and methods
• Mobile wallet account identifiers associated with bKash, Nagad, Rocket, or Upay accounts
• Bank account details where bank transfers are used (account number, bank name, branch)
• Account balance history and betting turnover data for responsible gaming monitoring

3.5 Gameplay and Behavioural Data

• Betting history including market selections, stake amounts, odds accepted, and settlement outcomes
• Casino and slot game session data including game titles, session duration, wager amounts, and RTP performance
• Login timestamps, session lengths, and navigation patterns within the Platform
• Bonus usage, wagering progress, and promotional eligibility status

3.6 Technical and Device Data

• IP address at the time of registration and each subsequent login
• Device type, operating system version, and browser type
• Geolocation data derived from IP address (country and city level only — no GPS data)
• Cookie identifiers and session tokens (see Section 8 for full cookie information)

3.7 Communications Data

• Content of live chat support conversations
• Email correspondence with the fd99 support team
• Records of any formal dispute submissions
• Records of responsible gaming tool activations (deposit limits, self-exclusion, cooling-off periods)

4. How We Collect Your Data

fd99 collects personal data through the following means:

• Direct collection: Data you provide directly when completing the registration form, submitting KYC documents, making deposits, contacting support, or using responsible gaming tools.
• Automated collection: Data collected automatically via cookies, web beacons, server logs, and session tracking technologies when you browse or interact with the Platform.
• Payment provider data: Transaction confirmation data shared by bKash, Nagad, Rocket, Upay, and banking partners when you initiate a deposit or withdrawal.
• Identity verification partners: Where fd99 uses a third-party KYC verification provider, that provider may process your identity documents and return a verification result to fd99. The provider does not retain your documents beyond what is required for the verification process.
• Fraud prevention services: fd99 may receive risk signals and device fingerprint data from third-party fraud detection services to protect the Platform against fraudulent account activity.

5. How We Use Your Data

fd99 uses the personal data it collects for the following specific purposes:

Purpose	Data Categories Used
Account registration and management	Identity, contact, device data
Age and identity verification (KYC)	Identity, KYC documents, selfie
Processing deposits and withdrawals	Financial, identity, KYC data
Providing sports betting and casino services	Gameplay, financial, account data
Administering bonuses and promotions	Gameplay, financial, contact data
Fraud detection and prevention	Device, IP, financial, behavioural data
Responsible gaming monitoring and tool activation	Gameplay, behavioural, communications data
Customer support and dispute resolution	Identity, communications, transaction data
Sending service notifications and account alerts	Contact, account data
Sending promotional communications (opted-in players only)	Contact, gameplay, behavioural data
Regulatory compliance and legal obligations	Identity, KYC, financial, transaction data
Platform analytics and improvement	Behavioural, device, technical data (anonymised)

fd99 will not use your personal data for any purpose not listed above without first obtaining your explicit consent or being required to do so by applicable law.

6. Legal Basis for Processing

fd99 processes your personal data on the following legal grounds:

• Contractual necessity: Processing is required to perform the contract between you and fd99 — specifically, to register your account, process your transactions, settle your bets, and deliver casino services.
• Legal obligation: Processing is required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) rules, age verification obligations, and financial record-keeping duties.
• Legitimate interests: Processing is carried out in fd99's legitimate interests where those interests are not overridden by your data protection rights — specifically, fraud detection, platform security, responsible gaming monitoring, and analytics to improve service quality.
• Consent: Processing based on your specific, freely given consent — specifically, the sending of marketing communications via email and SMS. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

fd99 may share your personal data with the following categories of third parties, strictly for the purposes outlined in this Policy:

7.1 Payment Processors

To process your deposits and withdrawals, fd99 shares relevant transaction and identity data with licensed mobile financial services providers (bKash, Nagad, Rocket, Upay) and banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank) as required to execute the transaction. These providers are bound by their own privacy and security policies and are independently regulated.

7.2 Identity Verification (KYC) Providers

fd99 may engage third-party identity verification services to assist with KYC checks. Such providers process identity documents and biometric selfie data solely for the purpose of returning a verification result. fd99 selects providers that maintain data security standards equivalent to or exceeding those applied by fd99 itself.

7.3 Fraud Prevention and Security Services

fd99 uses third-party fraud detection platforms to assess login risk, detect multi-accounting, and identify patterns associated with money laundering or bonus abuse. These services may process device fingerprints, IP addresses, and behavioural signals. No document images or sensitive identity data are shared with fraud prevention providers.

7.4 Game Technology Providers

Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive your account identifier, session tokens, and wager data as required to deliver their game interfaces within the fd99 Platform. These providers do not receive your full name, contact details, or payment information.

7.5 Legal and Regulatory Authorities

fd99 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required by applicable law, court order, or official government request. fd99 will notify the affected player of any such disclosure where legally permitted to do so.

7.6 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial part of fd99's business assets, player data may be transferred to the acquiring entity as part of that transaction. Affected players will be notified via email prior to any such transfer, and the acquiring entity will be bound by obligations no less protective than those set out in this Policy.

fd99 does not sell, lease, or trade personal data to any third party for commercial or marketing purposes. All data sharing is governed by data processing agreements where applicable, which require third parties to implement appropriate security measures and restrict use of the data to the specified purpose.

8. Cookies and Tracking Technologies

fd99 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help the Platform function correctly, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, security cookies, and load-balancing cookies. No personal data is transmitted to third parties via these cookies.
• Functional cookies: These cookies remember your preferences such as language settings, preferred sports or game categories, and display preferences. They improve your experience but are not essential to core functionality.
• Analytics cookies: fd99 uses anonymised analytics data to understand how players navigate the Platform, which pages generate the most engagement, and where technical errors occur. Analytics data is aggregated and does not identify individual players.
• Marketing and retargeting cookies: Where you have opted in to marketing communications, fd99 may use cookies to measure the effectiveness of promotional campaigns. These cookies are not placed if you have not consented to marketing.

You can control cookie settings through your browser preferences. Note that disabling strictly necessary cookies may impair the functionality of the Platform, including your ability to log in and place bets. For a full list of cookies in use, contact [email protected].

9. Data Retention

fd99 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any applicable legal retention requirements. The following general retention guidelines apply:

• Active account data: Retained for the full duration of your account's active status plus five years following account closure, to satisfy financial record-keeping and anti-money-laundering requirements.
• KYC and identity documents: Retained for five years following account closure, in accordance with standard financial compliance obligations.
• Transaction records: Retained for five years following the date of each transaction.
• Support communications: Retained for two years from the date of the communication, unless the communication relates to a formal dispute, in which case it is retained for five years.
• Marketing data and consent records: Marketing preference data is deleted within 30 days of receiving a valid consent withdrawal request. Consent records (as evidence of prior opt-in) are retained for three years.
• Anonymised analytics data: May be retained indefinitely as it contains no personally identifiable information.

When personal data reaches the end of its retention period, fd99 will securely delete or anonymise it so that it can no longer be associated with an individual player.

10. Data Security

fd99 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the fd99 Platform.
• Encrypted database storage for all sensitive personal data fields including identity information, KYC documents, and financial records.
• Role-based access controls ensuring that fd99 personnel can only access the personal data categories required for their specific job function.
• Multi-factor authentication required for all staff accessing systems that process player personal data.
• Regular penetration testing and security audits conducted by independent third-party security specialists.
• Intrusion detection systems and real-time monitoring to identify and respond to unusual access patterns or potential data breach events promptly.
• Secure data destruction protocols applied when physical or digital storage media containing personal data is decommissioned.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights, fd99 will notify affected players without undue delay and take immediate steps to contain and remediate the breach.

11. Your Data Rights

As a player whose personal data is processed by fd99, you hold the following rights. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [your account username]". fd99 will acknowledge your request within 5 business days and respond substantively within 30 calendar days.

• Right of Access: You may request a copy of all personal data fd99 holds about you, along with information about the purposes for which it is processed, the categories of data held, and any third parties with whom it has been shared.
• Right to Rectification: You may request that fd99 correct any personal data that is inaccurate or incomplete. For data that can be updated directly within your account settings, you may make changes without contacting support.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data. This right is subject to fd99's legal retention obligations — data that fd99 is required to retain by applicable law (such as transaction records) cannot be deleted prior to the expiry of the mandatory retention period.
• Right to Restriction of Processing: You may request that fd99 temporarily suspend the processing of your personal data — for example, while a rectification request is being assessed — without requiring its deletion.
• Right to Data Portability: You may request that fd99 provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another data controller where technically feasible.
• Right to Object: You may object to the processing of your personal data where fd99 relies on legitimate interests as the legal basis. fd99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or processing is required for legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

12. Children and Minors

The fd99 Platform is strictly intended for adults aged 21 and above. fd99 does not knowingly collect or process personal data from individuals under the age of 21. If fd99 discovers or is notified that an account has been registered by a person under 21, the account will be closed immediately, any deposited funds will be returned to the payment source, and all data associated with the account will be deleted in accordance with the retention policy applicable to underage account closures.

Parents and guardians who believe that a minor may have registered on the fd99 Platform should contact [email protected] immediately. fd99 takes underage gambling prevention seriously and actively employs age verification systems to prevent minors from accessing the Platform.

13. Third-Party Links and Embedded Content

The fd99 Platform may contain links to third-party websites or embedded content from game providers, payment gateways, or promotional partners. This Privacy Policy applies only to data collected directly by fd99 on the Platform. fd99 is not responsible for the privacy practices of any third-party website or service that you access via a link or integration on the Platform.

We encourage you to review the privacy policies of any third-party services you interact with when using the Platform — including the privacy policies of bKash, Nagad, and your banking institution when initiating payment transactions.

14. Changes to This Privacy Policy

fd99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made — meaning changes that affect how your personal data is processed or your rights as a data subject — fd99 will notify registered players via email at least 14 days before the changes take effect.

For minor updates such as typographical corrections or clarifications that do not alter the substance of the Policy, the "Last Updated" date at the top of this document will be revised without individual notification. Continued use of the Platform following any update to this Policy constitutes acceptance of the revised terms. You are encouraged to review this page periodically.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a concern about how fd99 has handled your personal data, please contact us using the details below. All contact details are displayed as plain text only.

• Data Protection Email: [email protected]
• WhatsApp: +880 1700 000000
• Live Chat: Available 24/7 on the fd99 Platform
• Response Time: Acknowledgement within 5 business days; substantive response within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)