bu99 Privacy Policy — How We Handle & Protect Your Personal Information

bu99 ("we", "us", "our") is committed to protecting the privacy and personal data of all users ("you", "your", "the Player") who access and use the bu99 platform at bu99.io and all associated subdomains and mobile applications (collectively, "the Platform"). This Privacy Policy sets out in clear and formal terms how bu99 collects, processes, stores, shares, and protects your personal information in connection with your use of the Platform.

This Privacy Policy forms part of the legal framework governing your relationship with bu99, together with our Terms & Conditions and Responsible Gaming Policy. By registering an account on bu99 or by continuing to use the Platform after this policy has been updated, you acknowledge that you have read, understood, and agreed to the data practices described herein.

bu99 serves players across Bangladesh, including in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. All data handling described in this policy applies equally to all players regardless of their location within Bangladesh.

bu99 collects personal data through several channels: directly from you during registration and account management, automatically through your use of the Platform, and in limited cases from third-party identity verification and payment service providers. The categories of personal data we collect are described below.

bu99 does not collect sensitive special-category data (such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond that required for identity verification) unless expressly required by law or provided voluntarily by the player in a support context.

bu99 uses your personal data for the following specific purposes, each of which is tied to a legitimate legal basis as described in Section 4 below:

• Account creation and management: To register, verify, and administer your player account, including processing deposits and withdrawals via bKash, Nagad, Rocket, and Upay.
• Identity verification (KYC): To confirm your identity, age (21+ requirement), and payment method ownership in compliance with anti-money laundering obligations and responsible gaming standards.
• Service delivery: To provide access to sports betting markets (including BPL, IPL, T20 World Cup, and other cricket events), casino games, live dealer tables, virtual games, and all other Platform features.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multiple account registrations, and other prohibited conduct.
• Responsible gaming: To monitor gaming patterns, implement player-requested deposit limits, self-exclusion arrangements, and session time limits, and to identify players who may be exhibiting signs of problem gambling.
• Customer support: To respond to your queries, process complaints, manage disputes, and deliver 24/7 live chat and email support.
• Legal compliance: To comply with applicable legal, regulatory, and law enforcement obligations, including responding to lawful requests from Bangladeshi authorities.
• Platform improvement: To analyse anonymous usage patterns and technical performance data in order to improve Platform stability, user experience, and game offerings.
• Promotional communications: To send you relevant bonus offers, VIP tier updates, tournament announcements, and seasonal promotions — but only where you have not opted out of marketing communications.

bu99 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing that is necessary to perform our contract with you — i.e., to operate your account, process bets and payments, and deliver Platform services as described in our Terms & Conditions.
• Legal obligation: Processing that is required to comply with applicable laws, including anti-money laundering regulations, age verification mandates, and lawful requests from government or law enforcement authorities.
• Legitimate interests: Processing for our legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and improving our service — provided these interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications, where we rely on your consent given at registration. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

bu99 does not sell or rent your personal data. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment service providers: We share transaction data with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank solely to process your deposits and withdrawals.
• Identity verification partners: We share identity documents with accredited KYC service providers to verify your identity, age, and payment method ownership as required by our responsible gaming and anti-fraud obligations.
• Game technology providers: Game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive limited session and game-round data as necessary to deliver their games and maintain RNG certification.
• Fraud and security services: We may share technical data (IP addresses, device fingerprints, behavioural patterns) with anti-fraud and security platforms to detect and prevent prohibited activities.
• Legal and regulatory authorities: We will disclose personal data to law enforcement, regulatory bodies, or other government authorities in Bangladesh where required to do so by applicable law, court order, or lawful regulatory instruction.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the bu99 business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom bu99 shares personal data are contractually required to handle that data securely, use it only for the specified purpose, and comply with applicable data protection standards.

bu99 uses cookies and similar technologies (including local storage, session storage, and pixel tags) to operate the Platform and to understand how it is used. The types of cookies we use are:

• Strictly necessary cookies: These are essential for the Platform to function. They enable you to log in, navigate between pages, and complete transactions. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: These remember your preferences such as language settings, display preferences, and responsible gaming limits, so that you do not need to re-enter them on each visit.
• Analytics cookies: These collect anonymised data about how players use the Platform — which pages are visited most frequently, how long sessions last, and where technical errors occur. This data is used solely to improve Platform performance and does not identify you personally.
• Security cookies: These support our fraud detection systems by tracking technical indicators such as device consistency and login patterns.

You can manage cookie preferences through your browser settings. Please note that disabling cookies other than strictly necessary ones may affect Platform functionality. For more information on managing cookies, visit your browser's official support documentation.

bu99 retains personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your account's active status plus five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of account closure or the last transaction, whichever is later.
• Transaction records: All deposit and withdrawal records are retained for a minimum of five (5) years in accordance with financial record-keeping obligations.
• Support communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction.
• Technical and log data: Server logs and security event logs are retained for twelve (12) months and then automatically deleted.
• Marketing consent records: Records of your marketing opt-in or opt-out preference are retained for the lifetime of your account plus one (1) year.

At the end of the applicable retention period, personal data is either securely and permanently deleted from our systems or irreversibly anonymised so that it can no longer be associated with you as an individual.

bu99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records.
• Two-factor authentication (2FA) options for player accounts to prevent unauthorised login.
• Access controls: Personal data is accessible only to bu99 personnel and authorised third-party partners who have a legitimate need to process it, and only to the extent required for their specific role.
• Regular security audits and penetration testing by independent security professionals to identify and address vulnerabilities.
• Intrusion detection systems that monitor platform traffic for signs of unauthorised access or suspicious activity in real time.
• Secure data centres with physical access controls, redundant infrastructure, and disaster recovery protocols.

While bu99 takes all reasonable steps to protect your personal data, no digital platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

As a bu99 player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond to all legitimate requests within 30 days.

• Right of Access: You have the right to request a copy of all personal data bu99 holds about you, along with information about how it is being processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn your consent. This right is subject to our legal retention obligations — we cannot delete data we are required by law to retain.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, for example while a correction request is being assessed.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format and to request that it be transferred directly to another service provider where technically feasible.
• Right to Object: You may object to the processing of your personal data where it is based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

bu99 operates a strict minimum age policy of 21 years. We do not knowingly collect, store, or process personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration process, and all players are required to complete KYC verification confirming their date of birth before being permitted to deposit funds or place bets.

If bu99 discovers or has reasonable grounds to suspect that a player is under the age of 21, we will immediately suspend the account, freeze any balance, and conduct a full identity review. If the suspicion is confirmed, the account will be permanently closed, all gameplay records will be voided, and — where funds were deposited by a minor or on a minor's behalf — those funds will be returned to the identified payment source pending investigation.

Parents and guardians are encouraged to use available parental control tools on shared devices and to ensure that minors in their household do not have access to their bu99 login credentials. If you suspect that a minor has accessed the bu99 platform using your credentials or those of another adult, please contact us immediately at [email protected].

bu99 primarily stores and processes personal data within secure data centres serving the South and Southeast Asia region, with the primary operational timezone being Bangladesh Standard Time (BST, UTC+6). However, some of our third-party service partners — including game technology providers such as Pragmatic Play, Evolution Gaming, and NetEnt — may process certain technical and gameplay data on servers located outside Bangladesh.

Where personal data is transferred internationally, bu99 takes all reasonable steps to ensure that the recipient provides an adequate level of protection for your personal data, including through the use of data processing agreements that impose contractual obligations consistent with applicable data protection standards.

By registering a bu99 account and agreeing to this Privacy Policy, you acknowledge and consent to the potential transfer of your personal data to third-party game technology partners in connection with the delivery of gaming services, subject to the protections described above.

bu99 reserves the right to update or revise this Privacy Policy at any time. When we make material changes — that is, changes that significantly affect how we collect, use, or share your personal data — we will notify registered players by:

• Displaying a prominent notice on the bu99 platform at the time of login for a period of at least 14 days following the update.
• Sending a notification to your registered email address summarising the key changes.
• Updating the "Last Updated" date at the top of this page and incrementing the version number.

Minor changes — such as clarifications of existing language, corrections of typographical errors, or updates to contact information — may be made without prior notice. We encourage you to review this Privacy Policy periodically to stay informed about how bu99 handles your personal data.

Continued use of the bu99 platform following notification of changes to this Privacy Policy constitutes your acceptance of those changes. If you do not agree with any revision to this policy, you must cease using the platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or requests in relation to this Privacy Policy or the way bu99 handles your personal data, please contact us using the following channels:

• Live Chat: Available 24/7 within the platform after login. Average response time 2–5 minutes (BST, UTC+6).
• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" so that your message is routed to the appropriate team. (Non-clickable address — please copy and paste into your email client.)
• WhatsApp: Available to verified VIP members after account login.

Our support and data protection team operates on Bangladesh Standard Time (BST, UTC+6), seven days a week including public holidays such as Eid, Pohela Boishakh, Independence Day (March 26), and Victory Day (December 16). We aim to acknowledge all written privacy enquiries within 48 hours and to provide a substantive response within 30 calendar days.