cc99 Privacy Policy

Who We Are and How to Contact Us

cc99 (referred to throughout this document as "cc99", "we", "us", or "our") operates the online betting and casino platform accessible at https://cc99.io. cc99 is a platform built specifically for the Bangladesh market, offering cricket betting, live casino games, slots, card games, and other gaming products to eligible adult members in Bangladesh. All monetary balances on the cc99 platform are denominated in Bangladeshi Taka (৳).

cc99 is the data controller responsible for the personal information you provide when using the cc99 platform. If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact us at:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through the cc99 platform. Peak staffing: 8 AM to Midnight Bangladesh Standard Time (BST, UTC+6).

Scope of This Privacy Policy

This Privacy Policy applies to all personal data collected, stored, processed, and used by cc99 in connection with:

• The cc99 website at https://cc99.io and all pages, subdomains, and associated web applications operated by cc99.
• All account registration, login, verification, and profile management interactions on the cc99 platform.
• All deposit, withdrawal, and payment transactions processed through the cc99 platform using bKash, Nagad, Rocket, Upay, or any other authorised payment method.
• All betting, wagering, and gaming activity conducted by registered members on the cc99 platform.
• All interactions with cc99's customer support team, including live chat sessions and email correspondence sent to [email protected].
• Any marketing or promotional communications sent by cc99 to members who have opted in to receive such communications.

This Privacy Policy does not apply to third-party websites, payment provider platforms, or game studio interfaces that may be accessible through or linked from the cc99 platform. Those third parties operate under their own independent privacy policies, and cc99 encourages members to review those policies before providing personal data to any third-party service.

What Personal Data We Collect

cc99 collects the following categories of personal data from members and prospective members:

cc99 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health and medical records, except where a member voluntarily discloses information relating to a gambling-related health concern through the responsible gaming or self-exclusion process, in which case such data is used solely for the purpose of administering the requested player protection measure.

How We Collect Your Data

cc99 collects your personal data through the following mechanisms:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your profile settings.
• Automated collection: Technical and usage data collected automatically when you access the cc99 platform, via server logs, cookies, local storage, and session tracking technologies embedded in the platform interface.
• Payment provider data: Transaction confirmation data passed to cc99 by bKash, Nagad, Rocket, or Upay upon successful completion of a deposit or withdrawal, including transaction reference numbers and timestamps.
• Identity verification partners: Confirmation data from third-party KYC service providers who verify the authenticity of identity documents you submit as part of the account verification process.
• Fraud prevention partners: Risk signals and device fingerprint data from fraud detection services used to protect cc99 members and the integrity of the platform.

Legal Basis for Processing

cc99 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual necessity: Processing required to register your account, execute deposits and withdrawals, verify your identity, administer your bonuses, and deliver the gaming and betting services you have requested from cc99.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, fraud prevention duties, and any reporting obligations imposed on cc99 as a platform operator.
• Legitimate interests: Processing that serves cc99's legitimate business interests, such as platform security, fraud detection, product improvement, responsible gaming monitoring, and direct marketing to existing members — provided these interests are not overridden by your individual rights and freedoms.
• Consent: For optional processing activities — such as sending promotional emails, third-party marketing communications, or placing non-essential cookies — cc99 relies on your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

How We Use Your Personal Data

cc99 uses collected personal data for the following specific purposes:

• Account management: Creating, maintaining, verifying, and securing your cc99 member account, including password resets, OTP delivery, and account recovery procedures.
• Service delivery: Processing deposits and withdrawals in BDT via bKash, Nagad, Rocket, and Upay; crediting winnings; administering bonuses; and providing access to all games and betting markets available on cc99.
• Identity verification: Conducting KYC checks to confirm your age (21+ requirement), identity, and payment method ownership in accordance with cc99's anti-fraud and AML obligations.
• Customer support: Investigating and resolving account queries, payment disputes, bonus complaints, and technical issues reported by members through live chat or email.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour, administering deposit limits and self-exclusion requests, and proactively reaching out to members who may be at risk.
• Platform security and fraud prevention: Detecting and preventing unauthorised account access, multi-accounting, bonus abuse, money laundering, and other prohibited activities as defined in cc99's Terms and Conditions.
• Analytics and product improvement: Analysing aggregated, anonymised usage data to understand how members interact with cc99, identify usability issues, and improve the platform experience for Bangladeshi players.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to members who have opted in — and only for as long as consent remains active. Members may opt out at any time.

Data Sharing and Third-Party Disclosure

cc99 does not sell, rent, or commercially transfer your personal data to any third party. Personal data may be shared with carefully vetted third-party service providers only where strictly necessary for the purposes described in this Privacy Policy, and only subject to binding data processing agreements that require those parties to protect your data to the same standard applied by cc99.

Categories of third parties with whom cc99 may share personal data include:

• Payment processors: bKash, Nagad, Rocket (Dutch-Bangla Mobile Banking), and Upay — to process deposit and withdrawal transactions on your behalf.
• KYC and identity verification providers: Third-party services that verify the authenticity of identity documents submitted during the account verification process. These providers receive only the minimum data required for the verification task.
• Fraud detection and AML compliance partners: Services that help cc99 detect and prevent financial crime, account takeover, and bonus abuse. These services may process device fingerprints, IP addresses, and transaction patterns.
• Game software providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session identifiers to deliver game content. They do not receive your full identity details.
• Analytics providers: Aggregated, anonymised or pseudonymised data may be shared with web analytics platforms to help cc99 understand platform usage trends. No personally identifiable information is shared for this purpose.
• Legal and regulatory authorities: cc99 may disclose personal data to law enforcement agencies, government authorities, or courts where required to do so by law, legal process, or to protect the rights, property, or safety of cc99, its members, or the public.

cc99 does not share your personal data with social media platforms, advertising networks, data brokers, or any other unrelated commercial entity under any circumstances.

Cookies and Tracking Technologies

cc99 uses cookies and similar tracking technologies (including local storage and session storage) to operate core platform functions and to improve your experience. The following categories of cookies are used on the cc99 platform:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without disrupting platform functionality.
• Functional cookies: Remember your language preference, display settings, and platform layout choices to personalise your experience across sessions.
• Analytics cookies: Collect anonymised data on how members navigate the platform, which pages are most visited, and where users encounter friction. This data is used solely to improve cc99's platform and is never used for advertising profiling.
• Responsible gaming cookies: Track session duration and gaming frequency to support the delivery of session time reminders and responsible gaming interventions configured by the member.

cc99 does not use third-party advertising cookies, behavioural tracking cookies, or retargeting pixels on its platform. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the cc99 platform.

Data Retention

cc99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal, regulatory, and compliance obligations. The following general retention periods apply:

• Active account data (identity, contact, financial, gaming history): Retained for the lifetime of the account and for a minimum of 5 years following permanent account closure, in accordance with AML record-keeping requirements.
• KYC documentation (ID scans, proof of address): Retained for a minimum of 5 years following account closure or the date of the last verified transaction, whichever is later.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of 5 years from the date of each transaction.
• Customer support communications (live chat transcripts, email correspondence): Retained for 3 years following the closure of the relevant support ticket or account, whichever is later.
• Analytics and usage data (anonymised): Retained in aggregated, anonymised form indefinitely, as it cannot be traced back to any individual member.
• Self-exclusion records: Retained permanently to ensure that a previously self-excluded member cannot re-register in violation of the exclusion period they selected.

Following the expiry of the applicable retention period, cc99 will securely delete or irreversibly anonymise your personal data in a manner that prevents reconstruction or re-identification.

Data Security

cc99 implements a layered, defence-in-depth approach to personal data security. The following technical and organisational measures are maintained at all times:

• Transport security: 256-bit SSL/TLS encryption on all data in transit between member devices and cc99 servers.
• Storage security: Personal data stored on cc99 infrastructure is encrypted at rest using AES-256 encryption.
• Access controls: Personal data access within cc99 is restricted on a strict need-to-know basis. Staff members are granted only the minimum data access permissions required for their specific role.
• Two-factor authentication (2FA): All cc99 staff accounts with access to member data are protected by mandatory 2FA. Members are strongly encouraged to enable 2FA on their player accounts as well.
• Security monitoring: cc99 maintains 24/7 automated monitoring for suspicious access patterns, brute-force login attempts, and anomalous data access events.
• Penetration testing: cc99 conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in platform infrastructure.
• Incident response: In the event of a data breach that poses a material risk to member rights, cc99 will notify affected members without undue delay and take all reasonable steps to contain and remediate the breach.

Your Data Rights

As a cc99 member, you have the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address registered on your cc99 account. cc99 will acknowledge your request within two business days and aim to resolve it within 30 calendar days, or sooner where required.

• Right of Access: You have the right to request a copy of all personal data cc99 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by cc99. For account details, many corrections can be made directly through your account settings panel.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to cc99's legal retention obligations — for example, transaction and KYC records required by AML regulations cannot be deleted on request.
• Right to Restriction: You have the right to request that cc99 restrict processing of your personal data while a complaint or rectification request is under review.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to cc99 in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to cc99 demonstrating compelling grounds for continued processing.
• Right to Withdraw Consent: Where cc99 processes your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Children and Minors

The cc99 platform is strictly for adults aged 21 and above. cc99 does not knowingly collect, process, or retain personal data from any person under the age of 21. Our registration process includes mandatory age verification steps, and all accounts are subject to KYC verification that confirms the account holder meets the minimum age requirement.

If cc99 discovers or is notified that personal data has been collected from a person under the age of 21, the following steps will be taken immediately:

• The affected account will be suspended and permanently closed without delay.
• All gaming activity conducted on the account will be reviewed, and any winnings generated during the period of underage access may be forfeited.
• Verified deposits will be returned to the original payment source (bKash, Nagad, Rocket, or Upay account from which they were made).
• All personal data associated with the underage account will be permanently deleted from cc99 systems as soon as legally permissible.

If you are a parent or guardian and believe your child has registered an account on cc99, please contact [email protected] immediately with the relevant account details so we can act without delay.

International Data Transfers

cc99 operates infrastructure and engages service providers across multiple jurisdictions. As a result, personal data collected from members in Bangladesh may be transferred to, stored on, or processed by systems located outside Bangladesh. Where such transfers occur, cc99 takes the following steps to ensure your data remains protected to the standard described in this Privacy Policy:

• Contractual safeguards: All third-party processors receiving personal data outside Bangladesh are bound by written data processing agreements that impose privacy and security obligations equivalent to those applied by cc99.
• Minimum transfer principle: Only the minimum personal data necessary to perform the contracted service is transferred. Full identity records are not routinely transferred to overseas processors unless strictly required for KYC or AML compliance.
• Encryption in transit: All cross-border data transfers are conducted over encrypted channels. Unencrypted transmission of personal data to any third party in any jurisdiction is strictly prohibited by cc99's internal data governance policy.

By registering an account and using the cc99 platform, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this section.

Changes to This Privacy Policy

cc99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, platform features, applicable laws, or regulatory requirements. The effective date displayed at the top of this page will be updated on every revision.

For material changes — those that significantly affect how your data is collected, used, or shared — cc99 will provide advance notice to registered members through one or more of the following methods:

• A prominent notice banner displayed when you next log in to your cc99 account, requiring acknowledgement before continued platform access.
• An email notification sent to the email address registered on your cc99 account, providing a summary of the key changes and a link to the updated Privacy Policy.
• A platform notification visible in your cc99 account notification centre.

Continued use of the cc99 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, you have the right to close your cc99 account before the effective date of the change. Please contact [email protected] to initiate account closure and to exercise any applicable data rights before closing.

Non-material updates — such as corrections of typographical errors, clarifications of existing practices, or formatting changes that do not alter the substance of the policy — will be applied without advance notice, though the effective date will still be updated to reflect the revision.

Contact and Data Requests

For all privacy-related enquiries, data subject access requests, correction requests, deletion requests, or complaints regarding cc99's data handling practices, please use the following contact channels. All communication related to this Privacy Policy must be in English.

• Email: [email protected] — Please include your registered username and the nature of your request in the subject line (e.g., "Data Access Request", "Data Deletion Request", "Privacy Complaint").
• Live Chat: Available 24/7 directly on the cc99 platform. Peak staffing hours: 8 AM to Midnight Bangladesh Standard Time (BST, UTC+6). Live chat is suitable for general privacy questions; formal data requests should be submitted by email for a documented record.

cc99 is committed to resolving all privacy-related requests and complaints fairly and efficiently. If you are not satisfied with cc99's response to a complaint, you retain the right to escalate the matter through applicable dispute resolution mechanisms available to you as a consumer in Bangladesh.