99ox Privacy Policy

1 Introduction

99ox ("99ox", "we", "us", "our") operates an internationally licensed online sports betting and casino platform accessible at https://99ox.io. This Privacy Policy ("Policy") sets out the basis on which personal data collected from users of the 99ox platform ("you", "Player", "User") will be processed by us. This Policy applies to all personal data collected via the website, mobile interface, customer support channels, and any other means through which you interact with 99ox.

99ox is committed to handling your personal information with integrity, transparency, and in strict accordance with applicable data protection law. We recognise that players in Bangladesh trust us with sensitive financial and identity information, and we take that responsibility seriously. This Policy is designed to give you a clear, honest, and comprehensive account of our data practices so that you can make informed decisions about your use of the platform.

This Privacy Policy should be read together with the 99ox Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and 99ox. In the event of any conflict between this Policy and those documents, this Privacy Policy shall prevail with respect to matters of data protection.

2 Data We Collect

99ox collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises the categories of data we collect and the specific data points within each category:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data unless you voluntarily disclose such information in the context of a responsible gaming self-assessment or a support interaction. Any such data disclosed in that context is treated with the highest level of confidentiality.

3 How We Collect Your Data

99ox collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing the KYC verification process, making a deposit or withdrawal, filling in support forms, or communicating with the 99ox team.
• Automated technical collection: Data collected automatically when you access the platform, including IP address, browser fingerprint, session data, and cookies. See Section 9 (Cookies & Tracking) for full details.
• Payment processors: Limited transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when processing your deposits and withdrawals.
• Identity verification partners: Where 99ox uses a third-party KYC provider to assist in verifying National ID documents, that provider may return a verification status and a confidence score to 99ox. The raw document image is not retained by the third-party provider beyond the verification window.
• Third-party game providers: Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, Ezugi, and other integrated providers may pass session identifiers and game-outcome data to 99ox via secure API connections for the purpose of game history recording and dispute resolution.
• Fraud prevention services: 99ox may receive risk-scoring signals from third-party fraud detection services. These signals are used to protect the platform and its players and are not used for marketing profiling.

4 Legal Basis for Processing

99ox processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is required to fulfil the agreement between you and 99ox, including account creation, identity verification, payment processing, bet settlement, and customer support.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, financial crime prevention obligations, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing carried out for 99ox's legitimate business interests where those interests are not overridden by your data protection rights. This includes fraud detection, platform security monitoring, responsible gaming analytics, and internal business analytics.
• Consent: Where we send you optional marketing communications (such as promotional offers, bonus notifications, and event announcements), we will first obtain your explicit consent. You may withdraw your consent to marketing communications at any time by contacting [email protected].

5 How We Use Your Data

The personal data 99ox collects is used for the following specific purposes:

• Account management: Creating, maintaining, and securing your 99ox account; processing password resets and two-factor authentication (2FA) via SMS OTP.
• Identity and age verification: Confirming that you are a real person, that you are at least 21 years of age, and that the account belongs to you — a legal requirement of the 99ox gaming licence.
• Payment processing: Facilitating BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other supported methods; reconciling transaction records; processing refunds where applicable.
• Sports betting and casino operations: Recording and settling your bets on cricket (BPL, IPL, T20 World Cup, Bangladesh Tigers), football, kabaddi, and other markets; recording your slot, live casino, and crash game history.
• Regulatory compliance and AML: Monitoring for suspicious transaction patterns; filing statutory reports where required; cooperating with law enforcement or regulatory requests; maintaining audit trails for the required retention period.
• Responsible gaming: Tracking your play patterns to identify signs of problem gambling; applying deposit limits, cooling-off periods, and self-exclusion restrictions that you have set; conducting mandatory affordability checks where required.
• Customer support: Responding to queries, resolving disputes, and escalating complaints to third-party game providers where necessary.
• Security and fraud prevention: Detecting and preventing account takeover, bonus abuse, multi-accounting, money laundering, and other fraudulent activity.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the user experience, optimise page load times, and prioritise new features.
• Marketing (consent-based): Sending you promotional offers, bonus notifications, tournament announcements, and seasonal promotions (e.g., Eid offers, Pohela Boishakh promotions, BPL season campaigns) where you have given your consent to receive such communications.

6 Data Sharing & Disclosure

99ox does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. Data is shared with third parties only in the following limited and controlled circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, SureCash, Tap, Visa, and Mastercard receive the minimum data necessary to process your transactions. These providers are independently regulated financial institutions bound by their own data protection obligations.
• Game content providers: Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, Ezugi, and other integrated studios receive a pseudonymous player session token to authenticate your game sessions. They do not receive your full name, contact details, or financial data.
• KYC and fraud prevention services: Third-party identity verification and fraud scoring providers receive identity document data and device fingerprint data solely for the purpose of account verification and fraud risk assessment.
• Regulatory and law enforcement authorities: Where required by law, court order, or regulatory instruction, 99ox may disclose personal data to competent authorities. We will notify you of such disclosures wherever legally permitted to do so.
• Professional advisers: Legal, accounting, and auditing firms engaged by 99ox may access personal data in connection with specific engagements. All such advisers are bound by strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of the 99ox business, personal data may be transferred to the acquiring entity. You will be notified in advance of any such transfer, and the acquiring entity will be bound by the terms of this Privacy Policy.

7 International Data Transfers

99ox is an internationally licensed platform and some of the third-party service providers described in Section 6 may be located outside Bangladesh. Where personal data is transferred to a country that does not provide an equivalent level of data protection, 99ox will ensure that appropriate safeguards are in place before making the transfer. These safeguards include:

• Standard contractual clauses approved by recognised data protection authorities, incorporated into agreements with the receiving party.
• Binding corporate rules where the recipient is part of the same corporate group as 99ox.
• Verified certification by the recipient under an internationally recognised data protection framework.

You may request further information about the safeguards applicable to a specific international transfer by contacting [email protected]. We will respond to such requests within 30 days.

8 Data Retention

99ox retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with you as an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical analysis purposes without restriction.

9 Cookies & Tracking Technologies

99ox uses cookies and similar tracking technologies to operate the platform, maintain your session, and understand how users navigate the site. The cookies we use fall into the following categories:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, store your authentication token, remember your language preference (English), and support the security features of the platform including CSRF protection. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how visitors use the 99ox platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used exclusively to improve the platform. No personally identifiable information is collected via analytics cookies.
• Functional cookies: These cookies remember your preferences such as display settings, responsible gaming reminders, and deposit limit notifications so that you do not need to reconfigure them on each visit.

99ox does not use advertising or third-party retargeting cookies. You will not find Facebook Pixel, Google Ads tags, or affiliate tracking scripts embedded in the 99ox platform. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the platform.

10 Security Measures

99ox implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your browser or device and the 99ox servers.
• AES-256 encryption at rest for all stored personal and financial data.
• Two-factor authentication (2FA) via SMS OTP, strongly recommended and available to all registered players.
• Role-based access controls ensuring that 99ox staff can only access personal data where it is necessary for their specific job function.
• Automated intrusion detection systems that monitor the platform in real time for suspicious access patterns.
• Regular penetration testing by independent third-party security specialists.
• Automatic account lockout after a defined number of consecutive failed login attempts, with mandatory re-verification before access is restored.

While 99ox employs industry-leading security measures, no online platform can guarantee absolute security against all threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, 99ox will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

11 Your Data Protection Rights

As a player registered with 99ox, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact [email protected] with the subject line "Data Rights Request". We will respond to all verified requests within 30 calendar days.