bw99 Privacy Policy — Your Data, Your Rights

1 Introduction & Scope

This Privacy Policy (the "Policy") sets out how bw99 (the "Company", "we", "us", or "our"), operating the online gaming and betting platform at bw99.io (the "Platform"), collects, processes, stores, shares, and protects the personal data of individuals who visit, register on, or otherwise interact with the Platform.

This Policy applies to all players registered on bw99, prospective players who browse the Platform without registering, and any individual who contacts bw99 through our support channels. It covers all personal data processed in connection with bw99 services, including account registration, identity verification (KYC), financial transactions, gameplay activity, marketing communications, and customer support interactions.

By accessing the Platform, creating an account, or making a deposit, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

This Policy should be read alongside bw99's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference.

2 Data Controller Information

bw99 is the data controller responsible for the personal data collected and processed through the Platform at bw99.io. As data controller, bw99 determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable data protection principles.

For all data protection enquiries, subject access requests, erasure requests, and complaints relating to this Privacy Policy, please contact:

• Data Protection Contact: [email protected]
• Subject line for data requests: "Data Privacy Request — [Your Registered Username]"
• Response commitment: All data-related enquiries are acknowledged within 48 hours and substantively responded to within 10 business days.
• Operating hours: 24 hours a day, 7 days a week, including Bangladesh public holidays.

bw99 has designated a data protection point of contact within the compliance function who oversees adherence to this Privacy Policy and manages all data subject requests. This individual reviews the Policy at least annually and following any material changes to bw99's data processing activities.

3 Data We Collect

bw99 collects personal data across several categories depending on your level of interaction with the Platform. The table below summarises the main data categories and examples within each:

bw99 does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (other than facial recognition used in document verification), health data, or data concerning sexual orientation, unless expressly required by applicable law or provided voluntarily by the player for responsible gaming purposes (e.g., self-declaration of a gambling problem).

4 How We Collect Your Data

bw99 collects personal data through the following channels and mechanisms:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or update your account profile, you directly provide the personal data we hold about you.
• Automated technical collection: When you browse or use the Platform, certain technical and behavioural data is collected automatically through server logs, session tracking technologies, and analytics tools. This includes your IP address, device identifiers, browser characteristics, and on-site navigation patterns.
• Cookies and similar technologies: bw99 uses cookies, pixel tags, and local storage objects to support Platform functionality, remember your session preferences, and analyse aggregate usage patterns. Please refer to Section 7 (Cookies & Tracking Technologies) for full details.
• Third-party game providers: When you play games provided by studios such as Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, or Spribe, gameplay outcome data and session information may be shared with bw99 by the game provider for account integrity and audit purposes.
• Payment processing partners: When you transact via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, transaction confirmation data (including wallet references and transaction IDs) is shared with bw99 by the payment processor to confirm deposits and process withdrawals.
• Fraud and risk screening tools: bw99 may receive data from third-party fraud detection and AML screening services to assist in validating player identity and detecting suspicious activity patterns. Any data received through these channels is used exclusively for platform security and compliance purposes.

5 Why We Use Your Data

bw99 uses personal data for the following specific and clearly defined purposes:

• Account creation and management: To register your bw99 account, authenticate your identity at login, maintain your account profile, and provide access to all Platform features.
• Identity verification (KYC): To verify that you meet bw99's eligibility requirements — including the minimum age of 21 years — in accordance with our AML compliance framework and internal policies.
• Transaction processing: To receive and allocate your deposits to your account balance, process withdrawal requests to your verified payment method, and maintain an accurate financial transaction record.
• Bonus and promotion administration: To determine your eligibility for promotional offers, credit bonus funds to your account, track wagering progress against rollover requirements, and detect and prevent bonus abuse.
• Customer support: To respond to your enquiries, resolve complaints, process responsible gaming requests (including self-exclusion and deposit limit adjustments), and maintain records of support interactions for quality assurance and dispute resolution.
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming compliance: To monitor gameplay patterns for indicators of problem gambling, administer self-exclusion and cooling-off requests, enforce deposit limits, and fulfil our duty of care obligations to players.
• Legal and regulatory compliance: To maintain records required by applicable AML, financial, and data protection laws; to respond to lawful requests from law enforcement or regulatory bodies; and to defend bw99's legal interests in the event of a dispute.
• Platform analytics and improvement: To analyse aggregate and anonymised usage data to understand how players interact with the Platform, identify technical issues, and develop new features and improvements.
• Marketing communications (with consent): To send you promotional emails, in-platform notifications, and personalised offers where you have opted in to receive marketing communications. You may withdraw this consent at any time by updating your account preferences or contacting [email protected].

6 Legal Basis for Processing

bw99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and bw99 — including account registration, transaction processing, bonus administration, and customer support — is carried out on the basis of contractual necessity.
• Legal obligation: Processing required to comply with applicable legal obligations — including KYC/AML identity verification, transaction record-keeping, and responding to lawful regulatory requests — is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, aggregate analytics, and product improvement is carried out on the basis of bw99's legitimate interests in operating a safe, secure, and legally compliant platform. bw99 has assessed these interests against your data protection rights and considers them proportionate.
• Consent: Processing for direct marketing communications is carried out solely on the basis of your freely given, specific, and informed consent. You have the right to withdraw this consent at any time without affecting the legality of processing carried out before withdrawal.

7 Cookies & Tracking Technologies

bw99 uses cookies and similar browser-based technologies to support the operation of the Platform and to enhance your experience. The following categories of cookies are used:

• Essential / Strictly Necessary Cookies: These cookies are required for the Platform to function. They enable core features such as user session authentication, navigation between pages, and security controls. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language setting, last-used payment method display, and responsible gaming reminder intervals — so that your experience is consistent across sessions.
• Analytics Cookies: bw99 uses anonymised analytics cookies to understand how players navigate the Platform in aggregate. This data is used internally to identify popular features, diagnose technical issues, and prioritise Platform improvements. Analytics data is not linked to individual account profiles.
• Security Cookies: Short-duration session cookies that help detect and prevent fraudulent login attempts, cross-site request forgery, and other security threats. These are essential and cannot be disabled.

bw99 does not use third-party advertising or behavioural profiling cookies that track your activity across websites other than bw99.io. All cookies set by bw99 are first-party cookies scoped exclusively to the bw99.io domain.

You may manage cookie preferences through your browser settings at any time. Most modern browsers allow you to view, delete, and block cookies. Note that disabling essential cookies will prevent you from logging in and using core Platform features. For guidance on managing cookies in your specific browser, please consult your browser's help documentation.

8 Data Sharing & Third Parties

bw99 does not sell, rent, or trade your personal data to any unaffiliated third party for their own commercial purposes. We share your personal data only in the following limited and necessary circumstances:

• Payment processing partners: Your financial transaction data (wallet references, transaction amounts, timestamps) is shared with payment service providers — including bKash, Nagad, Rocket, Upay, and card processing partners — solely to facilitate your deposits and withdrawals. These partners are bound by contractual obligations to use your data only for the specified transaction purpose.
• Identity verification providers: KYC document data may be processed by authorised identity verification service providers engaged by bw99. These providers operate under strict data processing agreements and are permitted to use your data only for the purposes of document authentication and AML screening on bw99's behalf.
• Game technology providers: Gameplay session data is shared with game studios (Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, Spribe, and others) to facilitate game delivery, ensure fair play, and support audit trails. Game providers are prohibited from using your personal data for their own marketing or profiling purposes.
• Law enforcement and regulatory authorities: bw99 will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by applicable law, court order, or lawful regulatory request. Where legally permitted, bw99 will notify you of any such disclosure.
• Professional advisers: bw99 may share limited personal data with external legal counsel, auditors, or financial advisers under strict confidentiality obligations where necessary to obtain professional advice or to defend legal claims.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of bw99 assets, personal data held by bw99 may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and any change in data controller identity via the Platform or by email before the transfer takes effect.

9 International Data Transfers

bw99 is a platform that serves players in Bangladesh (Bangladesh Standard Time, UTC+6). Some of bw99's technology partners, game providers, and infrastructure providers may be located in countries outside Bangladesh. Where personal data is transferred to a country that does not provide an equivalent level of data protection, bw99 ensures that appropriate safeguards are in place before the transfer occurs.

Safeguards used by bw99 for international data transfers include:

• Contractual data protection clauses included in all agreements with third-party data processors, requiring them to maintain confidentiality, implement security measures, and process data only on bw99's documented instructions.
• Data minimisation during transfers — only the minimum data necessary for the third party to perform their specific function is shared. Full account profiles are not shared with international service providers where only transaction reference data is required.
• Encryption in transit — all data transfers to third-party processors are conducted over encrypted connections using TLS 1.2 or higher.

For specific information about the countries to which bw99 may transfer your data and the safeguards applied, please contact [email protected] with the subject line "International Transfer Enquiry".

10 Data Retention

bw99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data must be retained for legal compliance purposes beyond your account closure date, it is archived with access restricted to authorised compliance personnel only.

11 Your Data Rights

As a bw99 account holder, you hold the following rights with respect to your personal data. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request — [Right Type] — [Your Username]":

• Right of Access: You have the right to request a copy of all personal data that bw99 holds about you. We will provide this in a structured, commonly used format within 10 business days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction. Account profile data (name, contact details, address) can also be updated directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing has been unlawful. Note that bw99 may be required to retain certain data categories for legal compliance purposes even after an erasure request — these exceptions are explained in Section 10.
• Right to Restrict Processing: You may request that bw99 suspend processing of your personal data in certain circumstances — for example, while the accuracy of data is being disputed, or while an objection to processing is being assessed.
• Right to Data Portability: For data processed on the basis of your consent or contractual necessity, you have the right to receive your personal data in a machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing based on legitimate interests, subject to bw99 demonstrating compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where bw99 processes your data on the basis of consent (primarily for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

All data rights requests are processed within 10 business days of receipt of a verified request. In complex cases, we may extend this period by a further 10 business days, in which case we will notify you of the extension and the reason for it. bw99 does not charge a fee for processing routine data rights requests.

12 Children & Minors

The bw99 Platform is strictly for adults aged 21 years and above. bw99 does not knowingly collect, process, or store personal data from any individual under the age of 21. The Platform employs age verification measures during the registration and KYC process specifically to prevent minors from accessing gambling services.

If bw99 becomes aware that personal data has been collected from an individual who is under the age of 21, we will immediately suspend the relevant account, delete all associated personal data to the extent permitted by law, and return any funds held in the account to the originating payment method.

If you are a parent or guardian and believe that your child (under 21) has registered on bw99 or provided personal data to the Platform, please contact [email protected] immediately with the subject line "Minor Account Report". Our compliance team will investigate and act on your report within 24 hours.

13 Data Security Measures

bw99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls in place include:

• 256-bit SSL/TLS encryption on all data transmitted between your browser or device and bw99 servers, ensuring that your login credentials, personal details, and payment information cannot be intercepted in transit.
• Encrypted data storage — personal data and KYC documents stored on bw99 servers are encrypted at rest using AES-256 encryption. Decryption keys are managed through a separate, access-controlled key management system.
• Role-based access control (RBAC) — bw99 employees and contractors are granted access only to the personal data categories required for their specific job function. Access is reviewed regularly and revoked immediately upon a change in role or employment status.
• Multi-factor authentication (MFA) — internal bw99 systems that process player personal data require multi-factor authentication for all staff logins, significantly reducing the risk of unauthorised internal access.
• Regular security audits — bw99 conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses in our infrastructure before they can be exploited.
• Automated intrusion detection — bw99's infrastructure is monitored 24 hours a day by automated systems that detect and alert on anomalous access patterns, brute-force login attempts, and other indicators of malicious activity.
• Data breach response plan — in the event of a confirmed personal data breach, bw99 has a documented incident response procedure that includes containment, impact assessment, regulatory notification (where required), and direct notification to affected players within 72 hours of becoming aware of the breach.

While bw99 takes all reasonable technical and organisational precautions to protect your personal data, no internet-based platform can guarantee absolute security. You also play an important role in keeping your account secure — use a strong, unique password, do not share your login credentials with anyone, and contact [email protected] immediately if you suspect unauthorised access to your account.

14 Changes to This Policy

bw99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, applicable laws, or regulatory requirements. All changes to this Policy will be published on this page at bw99.io/privacy-policy.

Where a proposed change is material — meaning it significantly affects how we collect, use, or share your personal data, or materially reduces your rights — bw99 will provide at least 14 days' advance notice before the change takes effect. Notice will be provided via:

• Email notification to your registered email address, clearly identifying the nature of the change and its effective date.
• In-platform notification displayed prominently upon your next login, requiring acknowledgement before you can continue using the Platform.
• Policy version history — the "Last Updated" date at the top of this page is updated with every revision. Previous versions of this Policy are available on request from [email protected].

Your continued use of the bw99 Platform after any changes to this Privacy Policy take effect constitutes your acceptance of the revised Policy. If you do not agree with any material changes, you have the right to close your account and request deletion of your personal data in accordance with Section 11 of this Policy.

15 Contact & Data Requests

For all matters relating to this Privacy Policy, your personal data, or your data protection rights, please contact bw99's data protection point of contact using the details below. All enquiries are handled confidentially by bw99's compliance team.

• Email: [email protected] (plain text — not a clickable link)
• Subject line format: "Privacy Policy — [Enquiry Type] — [Your Registered Username]"
• Acknowledgement: Within 48 hours of receiving your request
• Full response: Within 10 business days of identity verification
• Availability: 24/7 including Bangladesh public holidays
• Language: English (all formal correspondence is conducted in English)

When submitting a data rights request, please include your registered username, the email address associated with your bw99 account, and a clear description of your request. To protect your privacy, bw99 will verify your identity before processing any data access, rectification, or erasure request. Identity verification typically requires you to confirm details that match your account registration data.

bw99 is committed to resolving all data protection concerns fairly and promptly. If you are not satisfied with our response to your enquiry, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.