aa99 Privacy Policy

aa99 collects personal data in the following categories in connection with account registration, ongoing use of the platform, and compliance with applicable legal obligations:

• Identity data: full legal name, date of birth, gender, and (where required for KYC verification) a copy of a government-issued identity document such as a National Identity Card (NID) or passport.
• Contact data: Bangladeshi mobile number (used as the primary account identifier and for transaction notifications), and optionally an email address for account communications.
• Financial data: mobile wallet account numbers (bKash, Nagad, Rocket, Upay), transaction amounts, deposit and withdrawal history, and account balance records. This data is stored in encrypted form and is used solely for processing transactions, AML compliance, and resolving payment disputes.
• Technical and usage data: IP address, device type and operating system, browser type, session timestamps, pages visited, games played, bet history, and platform interaction logs. This data is used for security monitoring, fraud prevention, platform performance analysis, and to personalise the user experience.

aa99 processes personal data only for the following lawful purposes:

• Account registration and management: creating and maintaining your aa99 account, verifying your identity, processing KYC documentation, and communicating account-related information to you.
• Payment processing: executing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment channels; detecting and preventing payment fraud; complying with anti-money laundering regulations.
• Platform security and fraud prevention: monitoring platform activity to detect fraud, collusion, bonus abuse, and other prohibited behaviour; protecting the integrity of all games and sports betting markets; protecting the accounts of all registered players.
• Responsible gaming: monitoring play patterns to identify players who may be showing signs of problem gambling; delivering responsible gaming messages, session reminders, and self-exclusion notifications; complying with our responsible gaming commitments set out in the aa99 Terms and Conditions.

aa99 does not use your personal data for any purpose beyond those listed above without first obtaining your explicit consent or being required to do so by applicable law. We do not use personal data to make automated decisions that have a legal or similarly significant effect on your account or your rights, except for fraud-prevention checks and responsible gaming tools which operate automatically to protect you and other players.

aa99 takes the security of your personal data seriously. The following technical and organisational measures are in place to protect your data:

• All personal data is stored on secure servers using AES-256 encryption at rest. All data transmitted between your device and aa99.lol is protected by TLS 1.2 or higher (SSL). aa99's platform infrastructure is hosted in data centres with physical access controls, 24/7 monitoring, and redundant backup systems.
• Access to personal data within aa99 is restricted to employees and contractors who require it to perform their job functions. All staff with access to personal data are subject to confidentiality obligations. aa99 conducts regular internal security reviews and takes prompt action to address any identified vulnerability.
• aa99 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Transaction records and KYC documentation may be retained for a minimum of five years following account closure to comply with anti-money laundering legal obligations. After the applicable retention period, personal data is securely deleted or anonymised.

In the event of a data breach that is likely to result in a risk to the rights and freedoms of players, aa99 will notify affected players as promptly as practicable and will take immediate steps to contain the breach and minimise its impact. aa99 will also report significant data breaches to relevant authorities as required by applicable law.

aa99 does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

• Service providers: aa99 engages third-party service providers to assist with payment processing (bKash, Nagad, Rocket, Upay), identity and age verification (KYC), fraud detection, customer support systems, and platform analytics. These providers process personal data only on aa99's behalf and under strict data processing agreements that prohibit them from using personal data for their own purposes.
• Game providers: aa99's casino games are supplied by certified third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. To facilitate gameplay, technical session data (such as session tokens and game-round identifiers) is exchanged with these providers. No financial or identity data beyond what is technically required to authenticate a gaming session is shared with game providers.
• Legal and regulatory obligations: aa99 may be required to disclose personal data to law enforcement agencies, regulatory bodies, or other government authorities in response to a lawful request, court order, or other legal process. In such cases, aa99 will disclose only the minimum personal data necessary to comply with the legal obligation and will, where permitted by law, notify the affected player.

All third-party service providers engaged by aa99 are contractually required to maintain the confidentiality of personal data, implement appropriate security measures, and use personal data only for the specific purposes for which it was shared. aa99 conducts due diligence on all third-party providers before engagement and reviews their practices periodically.

aa99 uses cookies and similar tracking technologies on aa99.lol to operate and improve the platform. The following types of cookies are used:

• Strictly necessary cookies: These cookies are required for the platform to function. They maintain your login session, remember your language preference, and enable core security features. These cookies cannot be disabled without breaking the platform's basic functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how players use aa99.lol — such as which pages are visited most frequently, how long sessions last, and which games are most popular. This data helps aa99 identify areas for improvement and optimise the platform experience.
• Functional cookies: These cookies remember your platform preferences — such as your chosen language, your preferred deposit method, and any responsible gaming settings you have configured — so that you do not need to re-enter them on every visit.
• You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into your aa99 account and using the platform. aa99 does not use third-party advertising or retargeting cookies.

aa99 may send you promotional communications about bonuses, new games, sporting events, and seasonal promotions where you have given your consent to receive such communications. The following rules apply to all aa99 marketing activity:

• aa99 will only send marketing communications to players who have explicitly opted in to receive them. Opt-in is presented as a clear, affirmative choice during registration and is never pre-ticked or assumed by default.
• You may withdraw your consent to receive marketing communications at any time by updating your preferences in account settings, or by contacting [email protected] with the subject line 'Unsubscribe'. Once an unsubscribe request is received, aa99 will process it within 5 business days. You may continue to receive non-marketing communications (such as transaction confirmations and security alerts) even after unsubscribing from promotional content.
• aa99 will never send marketing communications to players who have activated self-exclusion, or to players whose accounts have been suspended or closed. aa99 uses reasonable technical measures to suppress marketing to self-excluded players across all communication channels.

aa99 does not share personal data with third-party advertisers or ad networks for the purpose of targeted advertising. Any personalisation of promotions shown to you within the aa99 platform is based solely on your own play history and account preferences, and is handled internally by aa99 without sharing data externally for advertising purposes.

aa99 operates primarily in Bangladesh and processes the personal data of Bangladeshi players. In some cases, personal data may be transferred to or accessed by service providers or game providers located outside Bangladesh. When such transfers occur, aa99 ensures appropriate safeguards are in place:

• All third-party processors that receive personal data from aa99 are contractually required to protect that data to a standard equivalent to or higher than the protections described in this Privacy Policy.
• Where personal data is transferred to game providers outside Bangladesh, such transfers are limited to the technical session data strictly required to authenticate and run a gaming session. No KYC identity documents, financial account numbers, or sensitive personal data are transferred to game providers.
• aa99 does not transfer personal data to any country or territory that does not provide an adequate level of data protection without first implementing appropriate additional safeguards such as contractual data protection clauses.

Players with questions about international data transfers or who wish to obtain a copy of the contractual safeguards in place for a specific transfer may contact aa99 at [email protected].

aa99 operates a strict 21+ policy. The aa99 platform is intended solely for adults aged 21 and above. aa99 takes the following measures to prevent minors from accessing or using the platform:

• Age declaration at registration: all players are required to confirm at registration that they are aged 21 or above. This declaration forms part of the registration contract between the player and aa99.
• KYC age verification: aa99 may request government-issued identity documentation at any time to verify a player's date of birth. Where a player cannot provide satisfactory documentation confirming they are aged 21 or above, their account will be suspended and any funds in the account permanently forfeited.
• aa99 does not knowingly collect personal data from individuals under the age of 21. If aa99 discovers that personal data has been collected from a minor, it will immediately suspend the relevant account, delete the minor's personal data (except where required by law to retain it), and report the matter to the appropriate authorities where required.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account with aa99, please contact us immediately at [email protected]. We will investigate and take appropriate action within 2 business days of receiving your report.

aa99 takes privacy complaints seriously. If you have any question, concern, or complaint about how aa99 handles your personal data, please contact us using the following details:

• Email (privacy enquiries): [email protected] — please use the subject line 'Privacy Enquiry' so that your message is directed to the correct team. aa99 commits to acknowledging all privacy enquiries within 2 business days and providing a substantive response within 10 business days.
• Data deletion requests: if you wish to request deletion of your personal data, please email [email protected] with the subject line 'Data Deletion Request'. Please note that aa99 is required by law to retain certain categories of data (including KYC documentation and transaction records) for a minimum of five years following account closure, regardless of a deletion request.
• Data access requests: you have the right to request a copy of the personal data aa99 holds about you. To make an access request, please email [email protected] with the subject line 'Data Access Request'. aa99 will respond within 30 calendar days. Identity verification may be required before personal data is disclosed.

If you are not satisfied with aa99's response to your privacy complaint, you may seek further recourse through applicable consumer protection or data protection channels available in Bangladesh. aa99 will cooperate fully with any such process.