Your Privacy, Protected by gtc99

1 Introduction

This Privacy Policy ("Policy") describes how gtc99 ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "the Player") who access or use the gtc99 website and services available at gtc99.io, including all casino games, sports betting markets, payment facilities, customer support channels, and promotional communications.

gtc99 is an online casino and sports betting platform serving players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and other cities and districts. This Policy applies to all personal data collected from Bangladesh-based players through any channel, including web browser interactions, mobile access, account registration, payment transactions, and direct communications with our support team.

By registering an account on gtc99, making a deposit, or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data in accordance with the practices described herein. If you do not consent, you must not use the gtc99 platform.

This Policy should be read alongside the gtc99 Terms & Conditions and Responsible Gaming policy, both of which contain additional provisions relevant to your use of the platform.

2 Data We Collect

gtc99 collects the following categories of personal data from players. The specific data points collected may vary depending on the services you use and the verification requirements applicable to your account.

3 How We Collect Data

gtc99 collects personal data through several distinct channels, each serving a specific operational function:

• Direct submission: Data you provide voluntarily when creating an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical data collected automatically as you browse and interact with the gtc99 platform, including IP address logging, session recording, browser fingerprinting, and cookie-based tracking.
• Payment processors: Transaction confirmation data and payment method identifiers received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, and Mastercard when you initiate a deposit or withdrawal.
• Identity verification partners: Confirmation and risk-score data returned by third-party KYC providers when we submit your identity documents for verification as part of our compliance process.
• Fraud detection systems: Behavioural and device-level signals generated by automated fraud monitoring tools that analyse your interactions with the platform for unusual or high-risk patterns.
• Game providers: Session and outcome data received from third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, etc.) that power the games on the gtc99 platform.

4 Purpose of Processing

Every category of personal data collected by gtc99 is collected for one or more specific, documented purposes. We do not process personal data for purposes beyond those listed below without first obtaining your explicit consent or being required to do so by applicable law.

• Account administration: Creating, maintaining, and managing your player account, including verifying your identity, processing login requests, and managing account settings.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported methods; verifying payment ownership; processing refunds where applicable.
• KYC and AML compliance: Verifying your age (21+), identity, and the source of funds to satisfy Know Your Customer and Anti-Money Laundering obligations.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling; enforcing deposit limits, cooling-off periods, and self-exclusion settings.
• Fraud prevention and security: Detecting and investigating suspicious account activity, bonus abuse, multi-accounting, unauthorised access attempts, and money laundering.
• Customer support: Responding to queries, processing complaints, and delivering account assistance via email and live chat.
• Legal compliance: Retaining records required by financial regulations, responding to lawful requests from competent authorities, and enforcing our Terms & Conditions.
• Marketing communications: Sending promotional emails, bonus notifications, and tournament updates to players who have opted in. You may opt out at any time.
• Platform improvement: Analysing aggregated usage data to improve game selection, interface design, payment flow, and overall platform performance.

5 Legal Basis for Processing

gtc99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to when registering your account, including payment processing, account management, and KYC verification.
• Legitimate interests: Processing that serves gtc99's legitimate business interests — such as fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your rights and freedoms.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, financial record-keeping requirements, and responses to lawful authority requests.
• Consent: Processing for which you have given us specific, informed, and freely given consent — such as receiving marketing communications. Where consent is the legal basis, you retain the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing

gtc99 does not sell or rent your personal data. Data may be shared with third parties only in the following strictly defined circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, and Mastercard receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are bound by financial data protection standards.
• KYC and identity verification providers: Third-party identity verification services receive copies of your submitted identity documents and return a verification status to gtc99. These providers are contractually prohibited from using your data for any purpose other than identity verification on our behalf.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other platform game providers receive session identifiers and wager data necessary to deliver game content. They do not receive your full identity or payment details.
• Fraud prevention and security services: Automated fraud detection providers may receive technical signals (IP address, device fingerprint, behavioural data) to generate risk assessments. These providers act as data processors under instructions from gtc99.
• Legal and regulatory authorities: gtc99 will disclose personal data to competent authorities, law enforcement agencies, or courts when required to do so by a valid legal obligation, court order, or lawful request.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of gtc99's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer by email at your registered address.

7 Cookies & Tracking Technologies

gtc99 uses cookies and similar tracking technologies to operate the platform, personalise your experience, maintain session security, and analyse platform performance. The following categories of cookies are used:

• Essential cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. They cannot be disabled without preventing you from using core platform features such as login and deposit.
• Functional cookies: Used to remember your preferences such as language settings, preferred deposit method, and responsible gaming configuration. Disabling these cookies will result in your preferences not being saved between sessions.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate the platform — which pages are visited most, where sessions end, and how features are used. This data helps us improve platform design and performance. No individual player is identified through analytics data.
• Fraud detection cookies: Device fingerprinting identifiers used by our security systems to detect multi-accounting, bot activity, and other prohibited behaviours. These are essential for platform integrity.

Most web browsers allow you to control cookie acceptance through browser settings. However, disabling essential cookies will prevent you from logging into or using the gtc99 platform. Clearing cookies may also terminate your active session and require you to log in again.

8 Data Security

gtc99 employs a multi-layered security architecture to protect your personal data from unauthorised access, loss, alteration, or disclosure. Our security measures include the following:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and our servers.
• Encryption at rest for all personally identifiable information stored in our databases.
• Role-based access controls ensuring that only staff members whose job functions require data access can retrieve player records, and that all such access is logged.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Multi-factor authentication required for all internal staff systems that handle player data.
• Real-time intrusion detection systems that alert our security team to unusual access patterns.
• Separate, isolated storage environments for financial data and identity documents, with additional access restrictions beyond those applied to general account data.

Despite these measures, no digital system can be guaranteed to be completely secure. In the event of a data breach that is likely to result in a risk to your rights or freedoms, gtc99 will notify affected players at their registered email address without undue delay.

9 Data Retention

gtc99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:

Once the applicable retention period has expired and there is no overriding legal requirement to retain the data, gtc99 will securely delete or anonymise the relevant records. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for analytical purposes.

10 Your Rights

As a player whose personal data is processed by gtc99, you hold the following rights with respect to your data. To exercise any of these rights, contact [email protected] with your registered account email address and a description of your request.

• Right of access: You may request a copy of all personal data gtc99 holds about you. We will provide this within 10 business days of receiving a valid request.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected. For identity data, correction may require submission of updated verification documents.
• Right to erasure: You may request deletion of your personal data. We will comply where no legal retention obligation applies. Note that financial transaction records must be retained for at least 5 years regardless of any deletion request.
• Right to restriction: You may request that we restrict processing of your data while a rectification or objection request is being assessed.
• Right to object: You may object to processing carried out on the basis of legitimate interests. We will assess your objection and cease or continue processing based on whether compelling legitimate grounds exist.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time by updating your account preferences or contacting [email protected]. Withdrawal does not affect the lawfulness of prior processing.
• Right to data portability: You may request that we provide your personal data in a structured, machine-readable format for transfer to another provider, where technically feasible.

11 Minors

gtc99 strictly enforces a minimum age requirement of 21 years for all registered players. The platform does not knowingly collect personal data from individuals under the age of 21. Registration by minors is prohibited, and gtc99 applies age verification checks during the KYC process to enforce this requirement.

If gtc99 becomes aware that personal data has been collected from an individual under 21 years of age, the relevant account will be immediately suspended, all balances and bonuses will be forfeited, and the personal data will be securely deleted in accordance with our data retention policy. If you believe a minor has created an account on gtc99, please contact [email protected] immediately so that we can investigate and act without delay.

12 International Data Transfers

Some of the third-party service providers used by gtc99 — including game providers such as Pragmatic Play, Evolution Gaming, and Microgaming, as well as cloud infrastructure and fraud detection partners — may be based outside Bangladesh and may process your data in jurisdictions with different data protection frameworks.

Where personal data is transferred internationally, gtc99 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that described in this Policy. These safeguards include contractual data processing agreements with all third-party processors that incorporate data protection obligations consistent with recognised international standards.

By using the gtc99 platform, you acknowledge and consent to the transfer of your personal data to third-party processors located outside Bangladesh, subject to the safeguards described above.

13 Policy Amendments

gtc99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform operations. When material changes are made to this Policy, we will notify registered players by email at their registered address and display a prominent notice on the platform for a minimum of 14 days following the change.

The effective date displayed at the top of this document will be updated each time the Policy is revised. Your continued use of the gtc99 platform after a revised Policy has taken effect constitutes your acceptance of the updated terms. If you do not accept the updated Policy, you must cease using the platform and may request account closure by contacting [email protected].

We encourage you to review this Policy periodically to stay informed about how gtc99 protects your personal data.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way gtc99 handles your personal data, please contact our Data Protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week
• Language: English
• Response Time: Data rights requests responded to within 10 business days

When submitting a data rights request, please include your full registered name, your registered email address, the specific right you wish to exercise, and any relevant details that will help us locate and process your request efficiently.