hg99 Privacy Policy — How We Protect Your Personal Data

Introduction

hg99 ("we", "us", "our") operates the online casino and sports betting platform accessible at hg99.io (the "Platform"). This Privacy Policy describes how hg99 collects, uses, stores, shares, and protects the personal data of players and visitors who interact with the Platform, with particular reference to players based in Bangladesh.

This Privacy Policy applies to all personal data processed by hg99 in connection with your registration, account management, gaming activity, financial transactions, customer support interactions, and any other use of the Platform. It should be read alongside the hg99 Terms & Conditions, which govern your contractual relationship with us.

We are committed to handling your personal data with integrity, transparency, and in accordance with recognised data protection standards. Our practices are designed to give you confidence that your information is safe with hg99 at all times.

Data We Collect

hg99 collects personal data across several categories, each of which is necessary to provide specific aspects of our service. The following table summarises the categories of data we collect, along with examples of specific data points within each category:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information unless specifically required for a regulatory purpose and with your explicit consent.

How We Collect Your Data

hg99 collects your personal data through the following methods:

3.1 Direct Collection

You provide data directly to hg99 when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, participate in a promotion, or submit feedback. This is the primary source of your personal data on the Platform.

3.2 Automated Collection

When you access the Platform, our servers automatically collect technical data including your IP address, device identifiers, browser characteristics, and session information. This data is collected through server logs, cookies, and similar tracking technologies (see Section 8 for full details on cookies).

3.3 Third-Party Sources

In certain circumstances, hg99 may receive data about you from third parties. These sources include:

• Identity verification service providers used during the KYC process.
• Payment processors and mobile financial service providers (bKash, Nagad, Rocket, Upay) who may share transaction confirmation data.
• Fraud prevention and anti-money laundering (AML) screening services.
• Game studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) who may share game session logs relevant to dispute resolution.

Legal Basis for Processing

hg99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is required to fulfil our obligations under the Terms & Conditions — for example, operating your account, processing deposits and withdrawals, and delivering gaming services.
• Legal Obligation: Processing is necessary to comply with applicable legal requirements, including identity verification (KYC), anti-money laundering (AML) obligations, and financial record-keeping.
• Legitimate Interests: Processing serves hg99's legitimate business interests — such as fraud detection, platform security, abuse prevention, and service analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: For non-essential processing activities such as direct marketing communications and non-functional cookies, we rely on your explicit consent. You may withdraw consent at any time by contacting [email protected] or updating your account preferences.

How We Use Your Data

hg99 uses your personal data for the following defined purposes:

• Account Management: Creating, maintaining, and operating your hg99 account, including processing login sessions, password resets, and account settings updates.
• Identity & Age Verification: Confirming that you are at least 21 years of age and that your identity matches the details provided at registration, in compliance with our 21+ age restriction policy.
• Payment Processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, all denominated in BDT.
• Fraud & AML Compliance: Monitoring transaction patterns and gaming behaviour to detect and prevent fraud, money laundering, underage gambling, and other prohibited activities.
• Customer Support: Responding to your queries, complaints, and requests submitted via [email protected] or live chat; maintaining records of support interactions for quality and dispute purposes.
• Responsible Gaming: Monitoring account activity for signs of problem gambling; enforcing self-exclusion requests, deposit limits, and cooling-off periods requested through the responsible gaming tools.
• Marketing & Promotions: Where you have provided consent, sending personalised promotional communications about hg99 bonuses, tournaments, and seasonal offers relevant to the Bangladesh market.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the Platform's performance, user experience, game selection, and payment flow.
• Legal & Regulatory Compliance: Maintaining financial records, responding to formal legal requests, and fulfilling any reporting obligations required of the Platform.

Sharing Your Data

hg99 does not sell or rent your personal data. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

6.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under strict data processing agreements. These include KYC/identity verification providers, payment processing partners, cloud hosting and infrastructure providers, fraud and AML screening tools, and customer support platform providers. All service providers are required to process your data solely on hg99's instructions and to maintain appropriate security standards.

6.2 Game Studio Partners

Game studios whose titles are hosted on hg99 — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive limited gaming session data (such as player identifiers, bet amounts, and game outcomes) for the purpose of game delivery, fairness certification, and dispute resolution. These studios are bound by their own data protection obligations and do not receive your identity or contact data.

6.3 Legal & Regulatory Authorities

hg99 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, court order, or where disclosure is necessary to protect the rights, property, or safety of hg99, its players, or the public. In such cases, hg99 will share only the minimum data necessary to fulfil the legal obligation.

6.4 Business Transfers

In the event that hg99 undergoes a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via your registered email address before your data is subject to a different privacy policy.

Payment Data

All financial transactions on hg99 are processed in Bangladeshi Taka (BDT). Payment data — including bKash account numbers, Nagad wallet identifiers, Rocket numbers, bank account details, and card numbers — is treated with the highest level of security on our Platform.

hg99 does not store full payment card numbers on its own servers. Card payment data is tokenised and processed directly by our PCI-compliant payment processing partners. Mobile financial service data (bKash, Nagad, Rocket, Upay) is processed through encrypted API integrations with the respective service providers and is retained only in the form of masked references required for withdrawal routing and audit purposes.

Transaction records — including deposit amounts, withdrawal amounts, dates, and payment method references — are retained for a minimum of five years from the date of the transaction to comply with financial record-keeping obligations. This retention is necessary even after your account is closed.

Cookies & Tracking Technologies

hg99 uses cookies and similar tracking technologies to operate, secure, and improve the Platform. A cookie is a small text file placed on your device by a website; it is used to remember information about your visit and to distinguish you from other users.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in to your hg99 account during your visit. These cookies cannot be disabled without preventing core Platform functionality.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised account access, and bot traffic. These cookies assign a unique session identifier used to verify the authenticity of requests made to our servers.
• Performance & Analytics Cookies: Used to collect anonymised data about how players navigate the Platform — which pages they visit, how long they spend on each section, and what errors they encounter. This data helps us improve the Platform experience for Bangladesh players.
• Preference Cookies: Remember your account preferences such as language settings, notification preferences, and responsible gaming settings so these do not need to be re-entered each visit.

8.2 Managing Cookies

You can control or delete cookies through your browser settings at any time. Please be aware that disabling strictly necessary or security cookies will significantly impair your ability to use the Platform — in particular, your ability to log in and maintain a secure session. Preference and analytics cookies can be disabled without affecting core Platform functionality.

hg99 does not use third-party advertising cookies or cross-site tracking cookies for the purpose of serving targeted advertisements on external websites.

Data Retention

hg99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to minimum retention periods required by applicable law. The following retention principles apply:

• Active Account Data: Retained for the full duration of your account relationship with hg99, plus a post-closure period as described below.
• Post-Closure Retention: Following account closure — whether voluntary or by hg99 — identity, contact, and gaming activity data is retained for a minimum period of five years. This retention is required for AML compliance, fraud investigation, and dispute resolution purposes.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping obligations.
• Support Communications: Retained for a period of three years from the date of the interaction, to support the resolution of future disputes and quality assurance reviews.
• Marketing Consent Records: Retained for the duration of your consent plus two years post-withdrawal, for compliance demonstration purposes.
• Technical & Log Data: Server logs and IP data are retained for up to 12 months, after which they are automatically purged or anonymised.

At the end of each applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

Your Rights Over Your Data

As a player on the hg99 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

Security Measures

hg99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our current security infrastructure includes:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and hg99 servers is encrypted using industry-standard TLS protocols. Look for the padlock icon in your browser's address bar when using the Platform.
• Password Hashing: Account passwords are never stored in plain text. hg99 uses strong, one-way cryptographic hashing with salting to ensure that passwords cannot be recovered even in the unlikely event of a data breach.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their hg99 accounts. 2FA adds a second layer of security by requiring a one-time code in addition to your password at login.
• Access Controls: Access to personal data within hg99's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged and audited.
• Fraud & Anomaly Detection: Automated systems monitor login activity and transaction patterns for anomalies that may indicate unauthorised access or account compromise. Suspicious activity triggers account review and, where necessary, temporary suspension pending investigation.
• Secure Data Storage: Personal data is stored in secure, access-controlled environments with encryption at rest for sensitive data categories including KYC documents and financial records.

Despite these measures, no internet transmission or electronic storage system is completely secure. hg99 cannot provide an absolute guarantee of data security but commits to taking all reasonable and industry-standard steps to protect your information and to respond transparently and promptly in the event of any confirmed security incident affecting your data.

Third-Party Services

The hg99 Platform integrates with a number of third-party services to deliver its full range of features. While hg99 carefully selects and vets its third-party partners, please be aware that these services operate under their own privacy policies. hg99 is not responsible for the data practices of third-party services beyond the data processing agreement obligations we impose on them as processors acting on our behalf.

Categories of third-party services integrated into hg99 include:

• Game content delivery networks operated by studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi).
• Mobile financial service APIs for bKash, Nagad, Rocket, and Upay payment processing.
• Card payment gateways for Visa and Mastercard processing.
• Identity verification and KYC document review services.
• Cloud infrastructure and content delivery network (CDN) providers.
• Customer support chat platform providers.

hg99 does not integrate third-party social media tracking pixels, advertising networks, or retargeting services on the Platform. Our Platform does not load Facebook Pixel, Google Ads tags, or any equivalent tracking scripts that would transmit your browsing behaviour to external advertising platforms.

Children & Minors

The hg99 Platform is strictly intended for adults aged 21 and above. hg99 does not knowingly collect personal data from any individual under the age of 21. The Platform employs mandatory age verification procedures to prevent underage access, and all accounts are subject to KYC age confirmation before withdrawal privileges are granted.

hg99 supports responsible gaming at both the individual and societal level. We actively cooperate with responsible gaming organisations and take all reasonable steps to prevent underage gambling on our Platform.

Policy Updates

hg99 reviews this Privacy Policy periodically to ensure it remains accurate, complete, and reflective of our current data practices. We may update this Policy from time to time in response to changes in applicable law, changes in our services, or improvements to our data handling practices.

14.1 Material Changes

Where an update constitutes a material change to how we collect, use, or share your personal data, hg99 will provide at least 14 days' advance notice via email to your registered account address before the updated Policy takes effect. The notification will clearly describe what has changed and why. If you do not agree with the updated Policy, you must stop using the Platform and may request account closure by contacting [email protected] prior to the effective date.

14.2 Non-Material Changes

Minor updates — such as clarifications of existing language, corrections of typographical errors, or formatting improvements that do not alter the substantive meaning of any provision — take effect immediately upon publication. The effective date shown at the top of this page is updated whenever any change is made, material or otherwise.

14.3 Version History

hg99 maintains an internal version history of this Privacy Policy. Players who wish to review a previous version of the Policy may request it by contacting [email protected] with the subject line "Privacy Policy Version Request".

Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how hg99 has handled your personal data, please contact our support team using the details below:

• Email: [email protected]
• Subject Line for Rights Requests: Data Rights Request
• Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)
• Response Time: We aim to acknowledge all requests within 3 business days and resolve them within 30 days.

When submitting a data rights request, please include your registered username and the email address associated with your hg99 account so we can verify your identity before processing the request. We may ask for additional verification if the nature of the request requires a higher level of identity confirmation.

hg99 is committed to resolving all privacy concerns promptly and fairly. If you are unsatisfied with our response to your data rights request, you retain the right to escalate your concern through any applicable legal channels available to you in Bangladesh.