cc99 Privacy Policy
Your privacy matters to us. This document explains exactly what personal data cc99 collects from players in Bangladesh, how we use it, how we protect it, and what rights you have over your information.
Privacy at a Glance
What This Policy Covers
Before diving into the full detail, here is a plain-English summary of the six core privacy commitments cc99 makes to every player registered on the platform.
Minimal Data Collection
cc99 collects only the personal data that is strictly necessary to operate your account, process your payments, verify your identity, and comply with applicable legal obligations. We do not collect data speculatively or sell player profiles to marketers.
Bank-Grade Encryption
All personal data transmitted between your browser or app and cc99 servers is protected by TLS 1.3 encryption. Sensitive fields such as payment account references are tokenised and never stored in raw form. Data at rest is encrypted using AES-256.
Your Data, Your Rights
You have the right to access, correct, export, and request deletion of your personal data at any time. cc99 provides a dedicated data request process via our support team, reachable 24 hours a day, 7 days a week.
No Data Sales
cc99 does not sell, rent, or commercially exploit your personal data to third parties for advertising, profiling, or any other purpose unrelated to the legitimate operation of your cc99 account and our legal compliance obligations.
Secure Payment Handling
Payments via bKash, Nagad, Rocket, Upay, and Bangladeshi bank transfers are processed through PCI-DSS compliant channels. cc99 never stores full bKash or Nagad PINs, and our staff will never ask for your payment credentials.
Breach Notification
In the unlikely event of a data breach that poses a risk to your rights and freedoms, cc99 will notify affected players by email within 72 hours of becoming aware of the incident, in line with responsible data governance practices.
Section 01
Information We Collect
cc99 collects personal data from players through a number of channels — primarily during account registration, during the ongoing use of platform features, and through automated technical means such as server logs and browser cookies. The categories of personal data we collect are set out below.
Registration Data
When you create a cc99 account, we collect the following information: your full legal name (as it appears on your National Identity Card or passport), date of birth, email address, Bangladeshi mobile number, and the details of the payment method you register with your account (for example, your bKash or Nagad account number, or the name and account number associated with your Bangladeshi bank account). This data is required to create and operate your account and to verify your identity and age in compliance with our 18+ policy.
Identity Verification (KYC) Data
Where cc99 initiates a Know Your Customer (KYC) verification — for example, when you make your first withdrawal, when a transaction exceeds ৳50,000, or as part of a routine compliance review — we may collect copies of identity documents including your National Identity Card (NID), passport, or driving licence, as well as proof-of-address documents such as a recent bank statement or utility bill. We may also collect a selfie or live photograph for biometric identity matching purposes. KYC documents are stored securely and processed only for the purpose of verifying your identity.
Transaction and Financial Data
cc99 maintains a complete record of all financial transactions associated with your account, including deposits, withdrawals, wagering activity, bonus credits and debits, and balance adjustments. Transaction records include timestamps (in Bangladesh Standard Time, UTC+6), amounts in BDT, the payment method used, and a transaction reference identifier. This data is retained for a minimum of five years to satisfy our financial record-keeping obligations.
Usage and Behavioural Data
When you use the cc99 platform, we automatically collect data about your session activity including the games you play, bet amounts, session duration, in-play betting patterns, and responsible gaming tool usage. This data helps us personalise your experience, identify problem gambling indicators, detect fraud, and improve the platform.
Technical and Device Data
Our servers automatically log technical information each time your device connects to cc99, including your IP address, browser type and version, operating system, device type (mobile, tablet, desktop), screen resolution, and referral URL. This data is used for security monitoring, fraud detection, and platform analytics.
Communications Data
If you contact cc99 support via live chat, email, or any other channel, we retain a record of that communication including the content of your messages and any attachments you share. This data is used to resolve your query, to improve our support service, and for quality assurance purposes.
Section 02
How We Use Your Data
cc99 uses the personal data we collect for clearly defined purposes. We do not use your data in ways that go beyond what is described in this Privacy Policy without first seeking your consent or being required to do so by law.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and operation | Registration data, device data | Contract performance |
| Age and identity verification (KYC) | KYC documents, registration data | Legal obligation / contract |
| Processing deposits and withdrawals | Transaction data, payment method details | Contract performance |
| Fraud prevention and security monitoring | Technical data, transaction data, usage data | Legitimate interests |
| Responsible gaming monitoring | Usage data, behavioural data, transaction data | Legal obligation / legitimate interests |
| Anti-money laundering (AML) compliance | Transaction data, KYC data | Legal obligation |
| Customer support | Communications data, account data | Contract performance |
| Platform analytics and improvement | Usage data, technical data | Legitimate interests |
| Promotional communications (opt-in only) | Email address, mobile number, usage data | Consent |
| Legal and regulatory reporting | All categories as required | Legal obligation |
Marketing Communications
cc99 will only send you promotional emails or SMS messages if you have explicitly opted in to receive them during account registration or through your account settings. You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your cc99 account settings, or by contacting cc99 support. Withdrawing marketing consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect cc99's right to send you transactional communications relating to your account (such as deposit confirmations and withdrawal notifications).
Automated Decision-Making
cc99 uses automated systems to monitor account activity for fraud indicators, AML red flags, and responsible gaming triggers. In some cases, automated monitoring may result in a temporary account restriction being applied while the flagged activity is reviewed by a human member of the cc99 compliance team. If your account is restricted as a result of automated monitoring, you have the right to request human review of the decision by contacting cc99 support.
Section 03
Legal Basis for Processing
cc99 processes your personal data on the basis of one or more of the following lawful grounds. The applicable basis for each processing activity is indicated in the table in Section 02 above.
Contract Performance
The majority of the data processing cc99 carries out is necessary for the performance of the contract between you and cc99 — that is, the Terms & Conditions you agree to when you register your account. Without this processing, cc99 could not create or maintain your account, accept deposits, process withdrawals, or provide the gaming services you have signed up for.
Legal Obligation
Certain processing activities are required in order for cc99 to comply with applicable legal obligations, including age verification requirements, anti-money laundering (AML) record-keeping obligations, and the duty to report suspicious transactions to relevant authorities. Processing carried out on this basis cannot be opted out of, as it is mandated by law.
Legitimate Interests
cc99 processes some categories of data on the basis of its legitimate business interests, including fraud prevention, IT security, platform analytics, and responsible gaming monitoring. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental privacy rights and freedoms. You have the right to object to processing based on legitimate interests — see the Your Data Rights section for more information.
Consent
Where cc99 relies on your consent as the legal basis for processing — for example, for sending you marketing communications or for setting non-essential cookies — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
Section 04
Data Sharing & Disclosure
cc99 does not sell your personal data. We share your personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.
Game Providers
To enable you to play games on cc99, certain technical identifiers (such as a pseudonymous player ID and session token) are passed to our third-party game providers, including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi. These providers operate under contractual data processing agreements with cc99 and are prohibited from using player data for any purpose other than delivering the game service.
Payment Processors
To process your deposits and withdrawals, cc99 shares the minimum necessary transaction data with your chosen payment provider — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, or another Bangladeshi bank. This sharing is necessary for the performance of your contract with cc99. Payment providers are independent data controllers and their own privacy policies govern their handling of your payment data.
Identity Verification Services
Where cc99 uses a third-party KYC or identity verification service to verify your identity documents, your document images and extracted data will be shared with that provider solely for the purpose of verification. Verification providers are bound by strict contractual data processing terms and are prohibited from retaining your documents beyond the period required for verification.
Fraud Prevention and AML
cc99 may share account and transaction data with fraud prevention agencies and industry-wide fraud detection databases to identify and prevent fraudulent activity. Where required by applicable law, cc99 will report suspicious transaction activity to relevant authorities without prior notification to the account holder.
Legal and Regulatory Authorities
cc99 will disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required to do so by law, court order, or binding regulatory directive. cc99 will comply with such requests promptly and will, where legally permitted to do so, inform affected players of any disclosure.
Section 06
Data Retention
cc99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable law or legitimate business need. The key retention periods applied by cc99 are summarised below.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account plus 5 years after closure | Legal obligation (AML / financial records) |
| KYC identity documents | Duration of account plus 5 years after closure | Legal obligation (identity verification records) |
| Transaction records | 5 years from transaction date | Financial record-keeping requirement |
| Wagering and game history | 3 years from session date | Responsible gaming monitoring / dispute resolution |
| Support communications | 3 years from last communication | Quality assurance / dispute evidence |
| Server and access logs | 12 months | Security monitoring / fraud investigation |
| Marketing consent records | Until consent withdrawn plus 3 years | Proof of consent / compliance record |
| Self-exclusion records | Duration of exclusion plus 7 years | Responsible gaming obligations |
At the expiry of the applicable retention period, cc99 will securely delete or anonymise your personal data so that it can no longer be associated with you as an identifiable individual. Where anonymisation is not technically feasible, data will be securely destroyed using industry-standard data deletion methods.
If you request deletion of your account before the end of the relevant retention period, cc99 will close your account and cease active processing of your data for marketing and operational purposes, but will retain the minimum data required to satisfy legal obligations for the periods specified above.
Section 07
Your Data Rights
As a cc99 player, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact cc99 support via live chat or at [email protected]. cc99 will respond to all verified data rights requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 30 days, in which case we will notify you promptly.
cc99 will not charge a fee for handling data rights requests unless a request is manifestly unfounded, excessive, or repetitive — in which case a reasonable administrative fee may be applied or the request may be refused, with an explanation provided to you.
Contact cc99 support via live chat (available 24/7) or email us at [email protected] with the subject line "Data Rights Request". Please include your registered email address and a description of your request. We may ask you to verify your identity before processing the request.
- Right of Access: You have the right to request a copy of the personal data cc99 holds about you, along with information about how it is being used. This is sometimes called a Subject Access Request (SAR).
- Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor account data corrections (such as updating your email address or mobile number) can be made directly through your account settings.
- Right to Erasure: You have the right to request that cc99 delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis applies. Note that erasure requests cannot override cc99's legal obligations to retain certain data for specified periods.
- Right to Restriction: You have the right to request that cc99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
- Right to Data Portability: Where cc99 processes your data on the basis of consent or contract performance, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request that it be transmitted directly to another data controller where technically feasible.
- Right to Object: You have the right to object to cc99 processing your personal data where that processing is based on legitimate interests. cc99 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
- Right to Human Review of Automated Decisions: Where cc99 makes a decision about you based solely on automated processing that produces a significant effect on you — such as an automated account restriction — you have the right to request that the decision be reviewed by a human member of the cc99 compliance team.
- Right to Withdraw Consent: Where cc99 relies on your consent as the legal basis for processing (for example, for marketing communications), you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Section 08
Data Security
cc99 takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. The security controls we apply include but are not limited to the following.
Technical Security Controls
All data in transit between your browser or mobile device and cc99 infrastructure is encrypted using TLS 1.3. Data at rest on cc99 servers is encrypted using AES-256. Access to production databases is restricted to authorised cc99 personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication. Our infrastructure is hosted in data centres with physical access controls, 24-hour on-site security, and environmental monitoring.
Organisational Security Controls
cc99 employees who have access to player personal data receive mandatory data protection and security training. All staff with access to sensitive data are bound by confidentiality obligations as a condition of their employment or engagement. cc99 maintains internal data handling policies and procedures that are reviewed and updated regularly. Access permissions are reviewed periodically, and access is revoked promptly upon termination of employment or engagement.
Penetration Testing and Vulnerability Management
cc99 conducts regular security assessments of its platform infrastructure, including periodic penetration testing by qualified third-party security professionals. Identified vulnerabilities are prioritised and remediated in accordance with their severity level. cc99 maintains a vulnerability disclosure process — if you believe you have discovered a security vulnerability in the cc99 platform, please report it responsibly to [email protected].
Incident Response
cc99 maintains a documented data breach incident response procedure. In the event of a confirmed personal data breach, our security and compliance teams will act immediately to contain the incident, assess the scope and risk, and notify affected players and relevant authorities as required. Players affected by a high-risk breach will be notified by email within 72 hours of cc99 becoming aware of the incident, along with guidance on protective steps they can take.
Payment Security
cc99 does not store raw payment credentials such as bKash or Nagad PINs, card numbers, or bank account passwords on its servers. Payment transactions are processed through PCI-DSS compliant channels. cc99 staff will never ask for your full payment PIN or password — if you receive a communication purportedly from cc99 asking for such information, treat it as fraudulent and report it to cc99 support immediately.
Continue Exploring cc99
Your Data Is Safe — Now Let's Play
Now that you understand how cc99 protects your personal data, explore Bangladesh's premier online casino and sports betting platform. Live casino games, cricket betting, slots, fishing games — all secured and all accessible via bKash, Nagad, and Rocket. 18+ only. Please play responsibly.