to99 Privacy Policy

1. Data We Collect

When you interact with to99 — whether by browsing the website, creating an account, making a deposit, or contacting customer support — to99 may collect the following categories of personal data:

Identity and Contact Data

This includes your full legal name, date of birth, residential address (including city and district within Bangladesh, such as Dhaka, Chittagong, Sylhet, or Khulna), email address, and mobile phone number. This data is collected during account registration and is used to verify your identity as required by our KYC (Know Your Customer) obligations.

Identity Verification Documents

To comply with age verification and anti-money laundering requirements, to99 may request copies of government-issued identity documents including your Bangladesh National Identity Card (NID), passport, or driving licence. These documents are stored securely and used solely for verification purposes.

Financial Data

to99 collects data relating to your deposit and withdrawal transactions, including mobile wallet identifiers associated with bKash, Nagad, Rocket, and Upay accounts, bank account details where bank transfer is used, transaction amounts in Bangladeshi Taka (BDT), and transaction timestamps. to99 does not store full payment credentials — payment processing is handled by certified third-party processors.

Usage and Gameplay Data

to99 automatically collects data about how you use the platform, including pages visited, games played, bet amounts and outcomes, session duration, login and logout timestamps, and device and browser information. This data is used to personalise your experience, detect fraudulent behaviour, and improve platform performance.

Communication Data

If you contact to99 via live chat, email, or any other support channel, to99 retains records of those communications, including the content of messages and any attachments provided. This data is used to resolve your query and to improve our customer service quality.

2. How We Use Your Data

to99 processes personal data only where a lawful basis for doing so exists. The following sets out the primary purposes for which to99 uses the data described in Section 1, along with the corresponding lawful basis for each purpose.

Account Management and Service Delivery

to99 uses your identity, contact, and financial data to create and maintain your player account, process deposits and withdrawals in BDT, award bonuses and process related wagering activity, and provide customer support. The lawful basis for this processing is the performance of a contract — specifically, the agreement between you and to99 formed when you accept these Terms & Conditions.

Identity Verification and Fraud Prevention

to99 is obligated to verify the identity and age of all account holders and to monitor transactions for signs of money laundering, fraud, or other financial crime. The lawful basis for this processing is compliance with legal obligations applicable to platforms operating in the online gaming sector. to99 may use automated systems to flag unusual account or transaction patterns for manual review.

Responsible Gaming Monitoring

to99 analyses gameplay and account data to identify patterns that may indicate problem gambling behaviour — such as rapidly escalating deposit amounts, extended session durations, or frequent self-exclusion requests followed by re-registration attempts. Where such patterns are identified, to99 may proactively reach out to the affected player with responsible gaming information or apply account restrictions in accordance with to99's Responsible Gaming policy.

Platform Improvement and Analytics

Aggregated and anonymised usage data is used by to99 to understand how players interact with the platform, which game categories are most popular, and where technical or user-experience improvements are needed. This analytics processing does not involve identifying individual players and is carried out on the basis of to99's legitimate interest in maintaining and improving its services.

Marketing Communications

Where you have provided explicit consent during registration or at a later date, to99 may send you marketing communications about new games, promotions, and seasonal offers relevant to the Bangladesh market. You may withdraw consent to marketing communications at any time by updating your communication preferences within your account settings or by contacting support at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

3. Cookies & Tracking

to99 uses cookies and similar tracking technologies on to99.bet to enable core platform functionality, remember your preferences, and gather anonymised analytics data. A cookie is a small text file placed on your device by the to99 website when you visit. Cookies do not contain executable code and cannot access other files stored on your device.

Essential Cookies

Essential cookies are strictly necessary for the operation of to99.bet. They maintain your login session, remember your language and currency preferences, and protect the platform against cross-site request forgery (CSRF) attacks. Essential cookies cannot be disabled without significantly impairing your ability to use the platform. No consent is required for essential cookies as their use is based on the legitimate interest of operating the service.

Analytics Cookies

to99 uses analytics cookies to collect aggregated, anonymised data about how visitors use to99.bet — including which pages are visited most frequently, how long sessions last, and which device types are in use. This data helps to99 identify performance issues and improve the player experience. Analytics cookies are deployed only where you have provided consent or where applicable law permits their use on the basis of legitimate interests.

Preference Cookies

Preference cookies remember choices you make on to99 — such as your preferred game category, notification settings, or display preferences — so that you do not need to re-enter them on each visit. These cookies are functional in nature and do not track your activity across other websites.

Managing Your Cookie Preferences

You may manage non-essential cookie preferences at any time via your account settings panel on to99. You may also configure your browser to block or delete cookies; however, please note that blocking essential cookies will prevent you from logging in and using core platform features. to99 does not use third-party advertising cookies or cross-site tracking pixels of any kind.

4. Data Sharing & Third Parties

to99 does not sell or rent your personal data to any third party. However, to deliver the services you use on to99, it is necessary to share certain data with trusted third-party service providers operating under strict contractual data protection obligations. The categories of third parties with whom to99 may share your data are set out below.

Payment Processing Partners

to99 shares transaction data — including your mobile wallet identifier and transaction amounts — with payment processors such as bKash, Nagad, Rocket, and Upay to facilitate deposits and withdrawals. These processors are independent data controllers and their own privacy policies govern how they handle data received in the course of processing your transactions.

Game Content Providers

Certain game providers — including Pragmatic Play, Evolution Gaming, Ezugi, Spribe, Microgaming, and NetEnt — may receive a player session token and anonymised account identifier when you launch their games on to99. This is technically necessary to load the game and record the outcome of your bets. Game providers do not receive your full name, contact details, or payment information.

Identity Verification Services

to99 may use third-party KYC and identity verification services to authenticate the documents you submit during verification. These providers process your identity data on to99's behalf under a data processing agreement and are not permitted to use your data for any purpose other than verification on to99's instruction.

Legal and Regulatory Disclosure

to99 may disclose personal data to law enforcement authorities, regulatory bodies, or other competent authorities where required to do so by applicable law or by a valid legal order. to99 will, where legally permitted, notify you of any such disclosure request before complying with it.

5. Data Retention

to99 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply to the principal categories of data held by to99:

• Active account data — retained for the duration of your account's active status plus a minimum of 5 years following account closure, to meet anti-money laundering record-keeping requirements.
• Identity verification documents — retained for a minimum of 5 years following account closure, in line with financial crime prevention obligations.
• Transaction records — retained for a minimum of 5 years from the date of each transaction.
• Customer support communications — retained for 3 years from the date of the most recent interaction, unless the communication relates to a dispute or legal claim, in which case it is retained for the duration of that matter plus 2 years.
• Analytics and usage data — aggregated and anonymised after 13 months; anonymised data may be retained indefinitely as it no longer constitutes personal data.
• Marketing consent records — retained for as long as you hold an active account, and for 3 years following account closure or withdrawal of consent.

Once the applicable retention period has expired, to99 will securely delete or irreversibly anonymise the relevant data. In cases where deletion is not technically possible in the short term (for example, because the data exists in backup archives), to99 will isolate the data from active processing and ensure it is deleted at the next scheduled backup cycle.

6. Your Privacy Rights

As a user of to99, you hold a number of rights with respect to your personal data. to99 is committed to honouring these rights in a timely and transparent manner. The following rights are available to all to99 account holders:

Right of Access

You may request a copy of the personal data that to99 holds about you at any time. to99 will provide this information in a structured, commonly used, machine-readable format within 30 days of receiving a valid request. There is no charge for a first access request in any 12-month period.

Right to Rectification

If you believe that any personal data held by to99 is inaccurate or incomplete, you may request that it be corrected. Certain data — such as your verified name and date of birth — cannot be amended unilaterally and may require submission of updated documentation.

Right to Erasure

You may request the deletion of your personal data in circumstances where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the data has been unlawfully processed. Please note that to99's legal obligations — particularly anti-money laundering record-keeping requirements — may require to99 to retain certain data for a defined period even following an erasure request.

Right to Restrict Processing

You may request that to99 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being verified, or while an objection to processing is being assessed. During a restriction period, to99 will continue to store your data but will not actively process it for purposes beyond storage.

Right to Object to Marketing

You have an unconditional right to object to the processing of your personal data for direct marketing purposes. You may exercise this right at any time by updating your communication preferences in your account settings or by contacting support at [email protected]. to99 will action all marketing opt-out requests within 5 business days.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to to99 at [email protected] from the email address registered to your account. to99 will acknowledge your request within 5 business days and provide a substantive response within 30 days. to99 reserves the right to verify your identity before processing a data rights request.

7. Data Security

to99 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• TLS 1.2 or higher encryption for all data transmitted between your device and to99.bet.
• Encryption at rest for all stored personal data and financial records using AES-256 or equivalent standards.
• Role-based access controls ensuring that only authorised to99 personnel can access personal data, and only to the extent necessary for their specific role.
• Regular security assessments and vulnerability testing of to99's platform infrastructure.
• Two-factor authentication options for player accounts to reduce the risk of unauthorised account access.
• Monitoring systems that detect and alert to99's security team of unusual access patterns or potential data breach events in real time.

Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, to99 will notify affected users without undue delay, and in any event within 72 hours of becoming aware of the breach, where technically and legally practicable. The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences of the breach, and the measures taken or proposed to address it.

8. Changes to This Policy

to99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. The "last updated" date at the top of this page will be revised whenever a material change is made.

Where changes are material — meaning they affect your rights, the types of data collected, or the purposes for which data is used — to99 will notify registered users via the email address associated with their account at least 7 days before the revised policy takes effect. For non-material clarifications or corrections, changes may be made without prior notice.

Your continued use of to99.bet after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes to this policy, you should cease using to99 and contact support to request account closure.

Questions, concerns, or requests relating to this Privacy Policy should be directed in writing to the to99 Data Support team at [email protected]. Our team is available 24/7 and will respond to all privacy-related enquiries within 2 business hours during Bangladesh Standard Time (BST, UTC+6) operating hours.