Privacy Policy — Your Data Rights at sd99

1 Information We Collect

sd99 collects personal data in order to provide a safe, compliant, and personalised gaming experience to players across Bangladesh. We collect only the data that is necessary for the specific purpose for which it is processed. The categories of personal data we collect are as follows:

Data Category	Specific Data Points	Collection Method
Identity Data	Full name, date of birth, gender, nationality, National ID number, passport number	Registration form, KYC verification upload
Contact Data	Email address, mobile phone number, city of residence (e.g., Dhaka, Chittagong, Sylhet)	Registration form, account settings
Financial Data	bKash/Nagad/Rocket/Upay mobile wallet numbers, transaction amounts in ৳ BDT, transaction timestamps	Payment processing system
Technical Data	IP address, browser type and version, device type and OS, screen resolution, time zone (BST UTC+6)	Automatic collection via server logs and analytics
Usage Data	Pages visited, games played, bet amounts and outcomes, session duration, login timestamps	Platform activity logging
Communication Data	Support chat transcripts, email correspondence, feedback submissions	Customer support channels

sd99 does not knowingly collect personal data from individuals under 18 years of age. If we become aware that a minor has provided personal data to us, that data will be deleted promptly and the associated account will be permanently closed. If you believe a minor may have registered on sd99, please contact us immediately at [email protected].

          Sensitive Data: sd99 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. In circumstances where such data is incidentally submitted (for example, a government ID document that records religion), that information is used solely for identity verification and is not processed for any other purpose.
        

2 How We Use Your Data

sd99 processes your personal data only where a lawful basis for doing so exists. The primary bases on which we rely are: (a) the performance of a contract between you and sd99 (your player account agreement), (b) compliance with legal obligations, (c) your explicit consent, and (d) our legitimate business interests where these do not override your fundamental rights and freedoms.

The specific purposes for which we use your data include:

Account Creation and Management: To register your account, verify your identity, maintain your player profile, and manage your login credentials securely.
Payment Processing: To facilitate deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain accurate financial records of all transactions.
Age and Identity Verification: To confirm that all players are at least 18 years of age and that the identity information provided during registration is accurate and genuine.
Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, and other unlawful conduct on the sd99 platform, including the use of automated tools and multi-accounting.
Regulatory Compliance: To meet our obligations under applicable anti-money laundering (AML) regulations, including record-keeping and reporting requirements.
Customer Support: To respond to your queries, resolve disputes, investigate complaints, and provide assistance through our support channels.
Platform Improvement: To analyse usage patterns, identify technical issues, and improve the functionality, performance, and content of the sd99 platform.
Responsible Gaming: To monitor betting behaviour, identify indicators of problem gambling, and reach out proactively where our responsible gaming tools may be of benefit to you.
Marketing Communications (with consent): To send you promotional offers, bonus notifications, and event updates via email or SMS where you have consented to receive such communications. You may opt out at any time.

Automated Decision-Making: sd99 uses automated systems to flag accounts for fraud review, bonus abuse detection, and responsible gaming interventions. Where an automated process results in an action that significantly affects your account (such as a suspension), you have the right to request human review of that decision by contacting our support team.

3 Data Sharing & Third Parties

sd99 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data with third parties only in the following limited circumstances, and only to the extent strictly necessary:

Payment Processors: Financial data is shared with our payment partners — including bKash, Nagad, Rocket, Upay, Visa, and Mastercard — solely to process transactions you have initiated. Each payment partner operates under its own privacy policy and data security standards.
Game Content Providers: Technical and usage data (such as player ID and bet history) may be shared with licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi for the purpose of game delivery, fair play auditing, and technical support.
Identity Verification Services: Identity data and document uploads may be shared with third-party KYC (Know Your Customer) verification providers during account verification processes. These providers are contractually obligated to process data solely for verification purposes.
Analytics Providers: Anonymised and aggregated technical and usage data may be shared with analytics platforms to help us understand platform performance. No personally identifiable information is shared in this context.
Legal and Regulatory Authorities: Where required by applicable law, court order, or regulatory instruction, sd99 may disclose personal data to law enforcement agencies, government bodies, or regulatory authorities in Bangladesh or other applicable jurisdictions. sd99 will notify you of such disclosures where legally permitted to do so.
Business Transfers: In the event of a merger, acquisition, or sale of all or part of sd99's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and the privacy implications before it takes effect.

All third-party service providers that process personal data on sd99's behalf are required to enter into data processing agreements that bind them to handle your data securely, in confidence, and strictly in accordance with sd99's instructions and applicable data protection standards.

4 Cookies & Tracking Technologies

sd99 uses cookies and similar tracking technologies (including local storage and session tokens) to operate the platform, remember your preferences, and analyse how you interact with the site. A cookie is a small text file placed on your device by a web server; it does not give us access to your device and cannot execute programmes.

The categories of cookies used by sd99 are as follows:

Strictly Necessary Cookies: These cookies are essential for the sd99 platform to function correctly. They include session authentication tokens, security cookies, and load-balancing cookies. Without these, core features such as account login and fund deposits cannot operate. These cookies cannot be disabled.
Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and previously used payment method — to provide a more personalised experience. Disabling these cookies may reduce the convenience of using the platform.
Analytical Cookies: These cookies collect anonymised information about how visitors use the sd99 platform, including which pages are most visited, how long sessions last, and where errors occur. This data helps us improve the platform and fix issues faster.
Marketing and Retargeting Cookies: Where you have provided consent, these cookies track your activity to help us deliver relevant promotional content and measure the effectiveness of marketing campaigns. You may withdraw consent for marketing cookies at any time.

          Cookie Management: Most browsers allow you to control cookies through their settings. You can configure your browser to refuse all cookies, accept only certain types, or delete cookies after each session. Note that disabling strictly necessary cookies will prevent the sd99 platform from functioning correctly. For detailed guidance on managing cookies in your specific browser, consult the help documentation provided by your browser's developer.
        

sd99 does not use cookies to collect sensitive personal data, and no cookie data is sold to third parties. Analytical and marketing cookies use anonymised or pseudonymised identifiers wherever possible to minimise privacy impact.

5 Data Retention & Storage

sd99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply as a general guide:

Active Account Data: Retained for the full duration of your account's active status and for a period of five (5) years following voluntary account closure, in compliance with AML record-keeping obligations.
Transaction Records: Financial transaction logs, including deposit and withdrawal records in BDT, are retained for a minimum of five (5) years from the date of the transaction.
Identity Verification Documents: Copies of National ID cards, passports, and proof of address documents are retained for five (5) years following account closure or the completion of the verification process, whichever is later.
Support Communications: Customer support chat logs and email correspondence are retained for three (3) years from the date of the last communication in a given support thread.
Marketing Preferences: Records of your marketing consent or opt-out are retained for as long as necessary to demonstrate compliance with consent obligations, and for a minimum of three (3) years after your most recent interaction with sd99.
Technical and Usage Logs: Server logs and anonymised usage analytics are retained for up to twelve (12) months before being aggregated or deleted.

Where data is no longer required for any lawful purpose, sd99 will securely delete or anonymise it so that it can no longer be associated with any individual player. Data held on third-party infrastructure (such as payment processor records) is subject to those providers' own retention policies, which may differ from sd99's.

Data Storage Location: Player data is stored on servers operated by or on behalf of sd99. Wherever practicable, data relating to Bangladeshi players is stored within the Asia-Pacific region. Where data is transferred outside this region for processing purposes, sd99 ensures that appropriate safeguards are in place — including contractual data protection clauses — to maintain the same standard of protection that applies to data stored locally.

6 Your Privacy Rights

As a player on the sd99 platform, you hold a number of rights in relation to your personal data. sd99 is committed to honouring these rights promptly and without undue obstruction. The following rights are available to you:

Right of Access Request a copy of all personal data sd99 holds about you, along with information about how it is used.

Right of Rectification Request correction of any inaccurate or incomplete personal data held in your sd99 account.

Right of Erasure Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.

Right to Restrict Processing Request that sd99 limit how your data is used in certain circumstances, such as while a rectification request is under review.

Right to Data Portability Request a copy of your data in a structured, machine-readable format suitable for transfer to another service provider.

Right to Object Object to processing of your data for direct marketing or where processing is based on sd99's legitimate interests.

To exercise any of the above rights, please contact sd99 in writing at [email protected]. We will acknowledge your request within five (5) business days and provide a full response within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, of which you will be notified with reasons.

Please note that some rights are subject to limitations. For example, the right of erasure does not apply where sd99 is required to retain data to comply with a legal obligation, such as AML record-keeping requirements. Where a right cannot be fully satisfied, sd99 will explain the reason and the extent to which the request can be accommodated.

          Identity Verification for Requests: To protect your privacy and prevent unauthorised access to your data, sd99 will require you to verify your identity before processing any data rights request. This typically involves confirming account details and may require submission of a valid government-issued ID.
        

7 Data Security Measures

sd99 takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or alteration. These measures include:

Transport Layer Security: All data transmitted between your device and sd99's servers is encrypted using TLS (Transport Layer Security) protocols. This protects your login credentials, personal information, and financial data from interception during transit.
Data Encryption at Rest: Sensitive data stored on sd99's servers — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
Access Controls: Access to personal data within sd99's systems is restricted to authorised personnel only, on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
Payment Tokenisation: Card payment data is tokenised by our payment processing partners, meaning that full card numbers are never stored on sd99's own systems.
Intrusion Detection and Monitoring: sd99's infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and potential security incidents. Alerts are reviewed by our security team on an ongoing basis.
Penetration Testing: sd99 commissions regular third-party security assessments and penetration tests to identify and remediate vulnerabilities in the platform before they can be exploited.

Despite these measures, no data transmission over the internet and no storage system can be guaranteed to be 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, sd99 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

Reporting a Security Concern: If you believe your sd99 account has been compromised, or if you discover a potential security vulnerability on the sd99 platform, please contact us immediately at . Do not attempt to exploit any vulnerability you discover — responsible disclosure allows us to fix the issue promptly and protect all players.

8 Policy Updates & Contact

sd99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered players directly via email.

Your continued use of the sd99 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. We encourage you to review this page periodically to stay informed about how we protect your personal data.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which sd99 handles your personal data, you are welcome to contact us using the details below. We take all privacy inquiries seriously and will respond within the timeframes described in the Your Privacy Rights section above.

Data Controller: sd99 | Platform: sd99.club | Privacy Enquiries: | Response Time: Within 30 calendar days of a verified request.

For matters relating to responsible gaming — including self-exclusion requests, deposit limit adjustments, and time-out activations — please visit our dedicated Responsible Gaming page or contact support directly. sd99 is committed to providing a safe, fair, and enjoyable entertainment environment for all players in Bangladesh, and your trust in how we handle your data is central to that commitment.

Privacy Policy for sd99