gh99 Privacy Policy

1 Who We Are

gh99 is an internationally operated online gaming and sports betting platform accessible at gh99.io. For the purposes of this Privacy Policy, gh99 acts as the data controller in respect of all personal data collected from players who access the platform from Bangladesh and other supported regions.

As data controller, gh99 determines the purposes and means of processing your personal data. We are responsible for ensuring that your data is handled lawfully, fairly, and transparently in accordance with applicable data protection standards. All data-related enquiries and requests should be directed to our support team using the contact details provided in Section 15 of this Policy.

References to "gh99", "we", "us", or "our" throughout this Privacy Policy refer to the gh99 platform operator. References to "you" or "your" refer to any individual who accesses, registers for, or uses the gh99 platform in any capacity.

2 What Data We Collect

gh99 collects personal data in the categories described in the table above. The specific data points collected in each category are set out below for completeness:

2.1 Identity Data includes your full legal name, date of birth, gender (where provided), nationality, and the reference number of any government-issued identity document you submit during KYC verification — such as your Bangladesh National ID card (NID), passport, or driving licence.

2.2 Contact Data includes the email address and mobile phone number you register with, as well as any residential address information you provide. For players in Bangladesh, this typically includes district, division, and city information.

2.3 Financial Data includes the mobile financial service account references (bKash, Nagad, Rocket, Upay) or bank account details you use to make deposits and withdrawals, as well as your full transaction history on the gh99 platform including deposit amounts, withdrawal requests, and balance movements.

2.4 Technical Data includes your IP address at the time of each session, your device identifier, browser and operating system information, and session timestamps. This data is collected automatically when you access the platform.

2.5 Usage Data includes records of all gaming and betting activity on your account — games played, stakes placed, winnings received, game session durations, and navigation patterns within the platform interface.

2.6 Communications Data includes the content of any messages exchanged with gh99's support team, complaint submissions, and any other correspondence you initiate with us via email or the platform's messaging features.

2.7 Marketing Preference Data includes your opted-in or opted-out status for promotional communications, and any game category or sport preferences you have indicated.

3 How We Collect Your Data

gh99 collects personal data through the following channels:

• Direct submission: Information you provide when creating an account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automated collection: Technical and usage data collected automatically via server logs, cookies, and similar tracking technologies when you access and interact with the gh99 platform. See Section 6 for full details on cookies.
• Payment processors: Transaction reference data received from bKash, Nagad, Rocket, Upay, and other payment partners when you initiate a deposit or withdrawal.
• Identity verification partners: Confirmation data returned by KYC verification service providers when we submit identity documents for validation as part of the account verification process.
• Fraud and risk systems: Device fingerprinting data and behavioural signals collected by gh99's fraud-detection infrastructure to identify suspicious activity patterns.

gh99 does not purchase personal data from data brokers, marketing list providers, or any other third-party data resellers.

4 Legal Basis for Processing

gh99 processes your personal data on one or more of the following legal bases, depending on the type of data and the purpose of processing:

• Contract performance: Processing that is necessary to operate your gh99 account, process your deposits and withdrawals, and provide you with access to games and betting markets. Without this processing, gh99 cannot deliver its services to you.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML) requirements, age verification obligations, fraud reporting duties, and data retention mandates imposed by applicable law.
• Legitimate interests: Processing carried out for gh99's legitimate business interests — including platform security, fraud prevention, abuse detection, and service quality improvement — where these interests are not overridden by your rights and interests.
• Consent: Processing carried out on the basis of your freely given, specific, informed consent — primarily in the context of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5 How We Use Your Data

gh99 uses the personal data we collect for the following purposes:

• Account creation and management: To register your account, verify your identity and age (21+), maintain your account profile, and communicate account-related information to you.
• Transaction processing: To process deposits via bKash, Nagad, Rocket, Upay, and other supported payment methods, and to process withdrawal requests to your registered payment method.
• Responsible gaming: To monitor your gaming patterns, identify indicators of problem gambling, apply deposit limits or session restrictions where appropriate, and action self-exclusion requests.
• Fraud and security: To detect, investigate, and prevent fraudulent activity, money laundering, identity theft, account takeover attempts, and other security threats to the platform and its players.
• Customer support: To respond to your enquiries, process complaints, and maintain records of support interactions for quality assurance and dispute resolution purposes.
• Legal compliance: To meet anti-money-laundering reporting requirements, respond to lawful requests from competent authorities, and maintain records required by applicable law.
• Platform improvement: To analyse usage patterns and player behaviour in aggregate (anonymised where possible) to improve the gh99 platform's performance, layout, and game selection.
• Marketing (consent-based only): To send you personalised promotional offers, bonus notifications, and platform news — but only where you have given your explicit consent to receive such communications. See Section 12 for how to manage your marketing preferences.

gh99 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing a separate legal basis for the new processing activity.

6 Cookies and Tracking Technologies

The gh99 platform uses cookies and similar tracking technologies to support platform functionality, maintain session state, and collect technical and usage data. The categories of cookies used by gh99 are as follows:

• Strictly necessary cookies: Essential to the operation of the platform. These cookies enable you to log in, maintain your session, access your account balance, and navigate between game categories. The platform cannot function without them and no consent is required for their use.
• Functional cookies: Used to remember your preferences — such as your preferred language, display settings, and recent game history — to provide a more personalised experience on return visits.
• Analytics cookies: Used to collect anonymised data about how players navigate the platform, which game categories attract the most engagement, and where technical errors occur. This data is used solely to improve the gh99 platform and is not shared with advertising networks.
• Security cookies: Used to detect suspicious login behaviour, enforce session timeouts, and identify device changes that may indicate an account takeover attempt.

gh99 does not use third-party advertising or retargeting cookies. We do not allow external advertising networks to place cookies on the gh99 platform. You may manage your browser's cookie settings at any time, but please note that disabling strictly necessary cookies will impair your ability to use the platform.

7 Sharing Your Data with Third Parties

gh99 shares personal data with third parties only in the following circumstances, and always under appropriate contractual and technical safeguards:

• Payment service providers: bKash, Nagad, Rocket, Upay, SureCash, Tap, Visa, Mastercard, and partner banks receive the transaction reference data necessary to process your deposits and withdrawals. These providers are data processors acting under gh99's instructions and are contractually prohibited from using your data for any independent purpose.
• KYC and identity verification providers: gh99 uses trusted third-party identity verification services to validate the identity documents submitted during account verification. These providers process identity data solely for the purpose of returning a verification result to gh99.
• Fraud prevention and AML screening services: Transaction and identity data may be passed to specialist fraud-prevention and anti-money-laundering screening providers to identify high-risk patterns and comply with applicable compliance obligations.
• Game content providers: Live casino and slot game providers — including Ezugi, Evolution Gaming, Pragmatic Play, Spribe, NetEnt, and Microgaming — may receive your player identifier and session data in order to serve game content and record game outcomes within their systems. These providers operate under their own data security standards and are bound by contractual data protection clauses with gh99.
• Legal and regulatory authorities: gh99 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by applicable law, a valid court order, or a legitimate regulatory request.
• Professional advisers: Legal counsel, auditors, and other professional advisers engaged by gh99 may access personal data on a strictly need-to-know basis and are bound by confidentiality obligations.

gh99 does not sell, rent, or trade your personal data to any third party for commercial purposes, marketing campaigns, or data enrichment activities.

8 Data Retention

gh99 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and in any case for no longer than is required by applicable legal, regulatory, or contractual obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of your account's active status, plus a minimum of five (5) years after account closure, to meet anti-money-laundering record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial crime prevention standards.
• KYC verification documents: Retained for the duration of your account, plus five (5) years after account closure.
• Technical and usage data: Retained for up to twenty-four (24) months from the date of collection, after which it is deleted or permanently anonymised.
• Communications and support data: Retained for three (3) years from the date of the last interaction, or longer where the communication relates to an open dispute or legal matter.
• Marketing preference data: Retained until you withdraw consent or close your account. Consent withdrawal records are retained indefinitely to evidence compliance.

At the end of the applicable retention period, personal data is securely deleted from gh99's systems using methods appropriate to the sensitivity of the data. Where full deletion is not immediately practicable — for example, where data exists in backup archives — the data will be quarantined and deleted at the next scheduled backup purge cycle.

9 Data Security

gh99 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls in place include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the gh99 platform.
• Encryption at rest for all databases storing personal and financial data.
• One-way cryptographic hashing (bcrypt) for all stored account passwords — plain-text passwords are never stored or transmitted by gh99.
• Access controls — internal access to personal data is restricted on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and regular security training.
• Intrusion detection systems monitoring the gh99 infrastructure for anomalous access patterns and potential breaches in real time.
• Regular security assessments including penetration testing and vulnerability scanning of the gh99 platform and supporting infrastructure.

Despite these measures, no internet-based platform can guarantee absolute security. If gh99 becomes aware of a personal data breach that poses a risk to affected players, we will notify impacted players and take all reasonable remediation steps as promptly as circumstances permit.

You are responsible for maintaining the security of your own account credentials. gh99 support staff will never ask you to share your password or one-time passcode (OTP) under any circumstances. If you receive a communication purportedly from gh99 requesting such information, treat it as a phishing attempt and notify us immediately at the contact address in Section 15.

10 Your Rights Over Your Data

gh99 respects your right to control how your personal data is used. The following rights are available to all gh99 players, and requests should be submitted using the contact details in Section 15:

To exercise any of the rights listed above, submit a written request to the gh99 support team at the email address provided in Section 15. gh99 will verify your identity before actioning any data rights request to prevent unauthorised access to another player's information. gh99 will respond within 30 calendar days of receiving a valid, verified request. Where a request is complex or numerous, this period may be extended by up to a further 60 days, and you will be notified of the extension.

Please note that certain rights are subject to limitations. For example, gh99 cannot delete financial transaction records that are required to be retained under applicable anti-money-laundering law, regardless of a deletion request. Where a right cannot be fully actioned, gh99 will explain the reason in writing.

11 Children and Minors

The gh99 platform is strictly available to individuals who are 21 years of age or older. gh99 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the gh99 account registration and KYC process.

If gh99 becomes aware that personal data has been submitted by or on behalf of a person under the age of 21, that account will be immediately closed, all data associated with it will be securely deleted (subject to any mandatory legal reporting obligations), and any balance held in the account will be returned to the depositing payment method.

Parents and guardians who believe that a minor may have registered on the gh99 platform should contact our support team immediately using the contact details in Section 15. gh99 will investigate and respond to all such reports as a matter of priority.

12 Marketing Communications

gh99 may send you marketing communications about promotions, bonuses, seasonal offers (such as Eid specials, Pohela Boishakh offers, or BPL season promotions), and new game launches — but only where you have given your explicit consent to receive such communications at the time of registration or through your account preferences.

Marketing communications from gh99 are sent via email and/or SMS to the contact details registered on your account. gh99 does not use push notification advertising, in-app advertising networks, or social media retargeting for individual player marketing.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your gh99 account settings dashboard;
• Clicking the unsubscribe link included in any marketing email sent by gh99; or
• Contacting gh99 support directly at the address in Section 15 with a written opt-out request.

Withdrawing marketing consent does not affect your ability to use the gh99 platform or receive transactional communications (such as deposit confirmations, withdrawal updates, and account security alerts), which are sent on a contract and security basis regardless of your marketing preferences.

13 International Data Transfers

gh99 operates as an offshore platform and its server infrastructure, data processing systems, and third-party service providers may be located in jurisdictions outside Bangladesh. As a result, your personal data may be transferred to, stored in, and processed in countries other than Bangladesh.

gh99 takes appropriate steps to ensure that any international transfer of personal data is carried out with adequate safeguards in place. These safeguards include:

• Contractual protections: gh99 requires all third-party data processors and sub-processors located outside Bangladesh to sign data processing agreements that impose data protection standards consistent with this Privacy Policy.
• Technical security measures: All personal data transferred internationally is transmitted using 256-bit SSL/TLS encryption. Data at rest on overseas servers is encrypted using industry-standard encryption protocols.
• Vendor due diligence: gh99 conducts privacy and security due diligence on all third-party providers that process personal data on our behalf before engaging their services, and reviews this on a periodic basis.

By using the gh99 platform, you acknowledge that your personal data may be processed in jurisdictions whose data protection laws may differ from those of your home country. gh99 will always endeavour to ensure your data receives an equivalent standard of protection regardless of where it is processed.

14 Changes to This Privacy Policy

gh99 reserves the right to update, amend, or replace this Privacy Policy at any time. The most current version of this Policy will always be available at gh99.io/privacy-policy, and the effective date at the top of the document will be updated accordingly.

Where changes are material — meaning they significantly affect how gh99 collects, uses, or shares your personal data — gh99 will provide advance notice via a prominent notice on the platform and/or by email to your registered address, no less than fourteen (14) days before the changes take effect.

For non-material changes (such as clarifications to existing language, corrections of typographical errors, or additions of new examples that do not change the substance of the Policy), gh99 may update the Policy without prior notice beyond updating the effective date.

Your continued use of the gh99 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should cease using the platform and may request account closure and data deletion in accordance with Section 10 of this Policy.

15 Contact and Data Requests

For all privacy-related enquiries, data rights requests, or concerns about how gh99 handles your personal data, please contact the gh99 support team using the details below. All communications must be in English.

• Email: [email protected] (plain text only — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week, including public holidays in Bangladesh.
• Response Time: gh99 aims to respond to all data rights requests within 30 calendar days of receipt. Complex requests may take up to 60 additional calendar days, in which case gh99 will notify you in writing of the extension and the reason for it.
• Verification Requirement: To protect your data, gh99 will verify your identity before actioning any data rights request. You may be asked to confirm your registered email address, mobile number, and account username. In some cases, additional verification steps may be required.

When submitting a data rights request, please include: your full name as registered on your gh99 account, your registered email address, a clear description of the right you wish to exercise, and any relevant details that will help our team locate and process your request efficiently.