Privacy Policy

01Introduction

bag99 ("we", "us", "our") operates the online casino and sports betting platform at bag99.bet, serving players across Bangladesh. We are committed to protecting the privacy of every individual who interacts with our platform, whether as a registered player, a visitor browsing the site, or a person contacting us for support.

This Privacy Policy explains what personal data bag99 collects about you, the purposes for which we use that data, the legal bases on which we rely, how long we retain it, with whom we may share it, what rights you have over your data, and how to exercise those rights. This policy should be read alongside our Terms and Conditions, which are available on this site.

02Personal Data We Collect

bag99 collects personal data from you directly (when you register, deposit, place a bet, or contact support) and automatically (through your device and browser as you use the platform). The categories of personal data we collect are set out below:

bag99 does not collect special category data (such as health data, political opinions, or biometric data beyond what is strictly required for age and identity verification). We do not knowingly collect data from individuals under the age of 21.

03How We Use Your Personal Data

bag99 uses the personal data we collect for the following purposes, each of which is tied to a specific legal basis described in Section 4:

• Account creation, verification, and ongoing account management — including identity verification (KYC), age verification, and maintaining your account profile and preferences.
• Processing deposits and withdrawals — using your financial data and payment method details to complete transactions securely and efficiently, and to apply bag99's same-source withdrawal policy.
• Providing gaming and betting services — recording your bets, game sessions, and results; applying bonus terms; delivering game titles from third-party providers; and enforcing betting limits.
• Fraud prevention, AML compliance, and security — using device data, transaction patterns, and behavioural analytics to detect and prevent fraud, money laundering, account takeover, and other prohibited activities.
• Customer support — using your contact data and account history to respond to enquiries, resolve complaints, and manage responsible gaming requests such as self-exclusion.
• Marketing and promotions — sending you information about bag99 bonuses, seasonal promotions (for example Eid, Pohela Boishakh, or BPL season offers), and platform updates, where you have consented to receive such communications or where we have a legitimate interest in doing so.

We do not use your personal data to make automated decisions that produce legal or similarly significant effects on you without a human review step. Automated fraud detection may flag accounts for human investigation, but account closure decisions are reviewed by a member of the bag99 team.

04Legal Basis for Processing

bag99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing required to register your account, fulfil your deposits and withdrawals, provide gaming and betting services, and enforce our Terms and Conditions — we cannot provide the bag99 service without this processing.
• Legal obligation: processing required to comply with applicable law, including anti-money laundering (AML) obligations, KYC requirements, age verification requirements, and responding to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: processing carried out for bag99's legitimate business interests, including fraud prevention, platform security, improving our services based on usage data, and direct marketing to existing players — where these interests are not overridden by your rights and interests.
• Consent: where we rely on your explicit consent, for example when sending you marketing communications outside of the legitimate interests basis. You may withdraw your consent at any time by contacting bag99 support or using the unsubscribe mechanism in any marketing message.

05Sharing Your Personal Data

bag99 does not sell, rent, or trade your personal data. We share personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

Categories of Third-Party Recipients

• Payment processing partners (bKash, Nagad, Rocket, Upay, and banking partners): we share the minimum financial data necessary to process your deposits and withdrawals and to verify that payment methods belong to you.
• KYC and identity verification providers: we share identity data with trusted third-party verification services to fulfil our age verification and KYC obligations. These providers process data strictly for verification purposes and are contractually bound to confidentiality.
• Game content providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and other licensed studios): limited technical and session data is shared to deliver game content, maintain game integrity, and resolve game-related disputes.
• Fraud prevention and security services: anonymised or pseudonymised behavioural and device data may be shared with third-party security and fraud analytics providers to protect bag99 and its players from fraudulent activity, account takeovers, and abuse.

06Cookies and Tracking Technologies

bag99 uses cookies and similar tracking technologies on bag99.bet to make the platform function correctly, to remember your preferences, and to understand how players use the site so we can improve it. The types of cookies we use are explained below:

Most modern browsers allow you to control cookies through your browser settings — you can block or delete cookies at any time. Please note that blocking strictly necessary cookies will impair or prevent the bag99 platform from functioning. To adjust your cookie preferences, consult your browser's help documentation.

07Data Retention

bag99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce our agreements. Our retention periods are guided by the following principles:

• Active account data is retained for the duration of your account's active status, plus an additional period after account closure as required by AML and financial record-keeping regulations applicable to online payment services in Bangladesh.
• KYC and identity verification documents are retained for the period required by applicable AML legislation. After this period, verification documents are securely deleted or anonymised.
• Marketing opt-in records are retained until you withdraw your consent to marketing, plus a reasonable additional period to demonstrate compliance with your opt-out request.

When personal data is no longer required for any retention purpose, bag99 will either securely delete it or irreversibly anonymise it so that it can no longer be associated with any individual.

08Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by bag99. To exercise any of these rights, please contact bag99 support using the details in Section 14.

bag99 will respond to all valid data rights requests within a reasonable timeframe. We may need to verify your identity before processing a request to ensure that we do not disclose personal data to an unauthorised person. We will not charge a fee for handling most requests, but may charge a reasonable administrative fee for manifestly unfounded or excessive requests.

09Data Security

bag99 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and bag99.bet, ensuring that your login credentials, financial data, and personal information cannot be intercepted in transit.
• Access controls ensuring that only authorised bag99 personnel can access personal data, and only to the extent necessary for their role. We apply the principle of least privilege — staff see only the data they need to do their job.
• Regular security reviews, vulnerability assessments, and penetration testing to identify and remediate potential weaknesses in our platform's security posture.
• Secure, encrypted storage of personal data on access-controlled servers. Sensitive data such as payment credentials is tokenised — bag99 stores a reference token, not the raw credential itself.

Despite these measures, no internet transmission or electronic storage system is completely secure. In the event of a data security incident that is likely to result in a high risk to your rights and freedoms, bag99 will notify you without undue delay using the contact details associated with your account.

10Children's Privacy

bag99 operates a strict 21+ only policy. The platform is not intended for, and does not knowingly collect personal data from, individuals under the age of 21. Age verification is a mandatory step in the account registration process, and bag99 conducts further verification checks where it has reason to suspect that a user may be under the minimum age.

11Third-Party Links

The bag99 platform may, from time to time, contain references to or integrations with third-party services — for example, game content delivered by licensed studios, or payment processing interfaces operated by bKash, Nagad, and other mobile financial service providers. These third parties operate under their own privacy policies, which govern how they collect and use your data when you interact with their services.

bag99 is not responsible for the privacy practices of third-party services, and this Privacy Policy does not apply to any third-party websites, applications, or services that you access through or in connection with the bag99 platform. We encourage you to review the privacy policies of any third-party services you use.

12Marketing Communications

Where you have provided consent or where bag99 has a legitimate interest in doing so, we may contact you with information about promotions, bonuses, new game launches, seasonal offers (for example BPL season, Eid, or Pohela Boishakh campaigns), and platform updates. We will contact you via the mobile number and/or email address registered on your account.

• You may opt out of marketing communications at any time by contacting bag99 support with your opt-out request. Following a valid opt-out, we will stop sending marketing messages within a reasonable processing period — typically within 5 business days.
• Opting out of marketing communications does not affect transactional messages — we will continue to send you account-related messages such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts, as these are necessary for the provision of the bag99 service.
• bag99 will never send unsolicited messages asking for your password, full payment credentials, or one-time passcodes (OTPs). If you receive a message claiming to be from bag99 that requests such information, do not respond and contact bag99 support immediately.

13Changes to This Privacy Policy

bag99 reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where practicable, will notify registered players via the mobile number or email address associated with their account.

Your continued use of the bag99 platform after the effective date of any update to this policy constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated policy, you must stop using the platform and may request account closure by contacting bag99 support.

14Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact bag99's support team. Email is displayed as plain text only — it is not a clickable link:

bag99 support is available 24 hours a day, 7 days a week. We aim to acknowledge all privacy-related requests within 48 hours (Bangladesh Standard Time, UTC+6) and to resolve them within a reasonable period. If your concern relates to a suspected data breach or unauthorised access to your account, please mark it as urgent and we will prioritise it accordingly.