gf99 Privacy Policy — How We Protect and Handle Your Personal Data
At gf99, protecting the personal data of every player across Bangladesh is a responsibility we take seriously. This Privacy Policy explains precisely what data we collect, why we collect it, how it is used and stored, who it may be shared with, and what rights you hold as a data subject.
Our Privacy Commitments at a Glance
gf99 is built on transparency. Here are the six core privacy commitments that underpin everything described in this policy.
gf99 collects personal data on a minimal, purpose-limited basis. We do not gather information beyond what is required to operate your account, process transactions, verify your identity, and keep the platform safe. No unnecessary data collection takes place.
gf99 does not sell, rent, or trade your personal data to third-party advertisers, data brokers, or marketing networks under any circumstances. When data is shared with service partners, it is done under strict data processing agreements and only to the extent necessary for platform operations.
All data transmitted between your device and the gf99 platform is protected by TLS/SSL encryption. Stored personal and financial data is held on secured servers with access controls, firewalls, and regular security audits to safeguard against unauthorised access or disclosure.
Every category of personal data we collect has a clearly stated purpose and legal basis set out in this policy. You will not encounter vague or ambiguous explanations of how your information is used. If gf99's data practices change in a material way, you will be notified before those changes take effect.
gf99 respects your right to access, correct, restrict, and delete your personal data. You may exercise any of your data rights at any time by contacting [email protected]. Requests are handled within 30 days in accordance with applicable data protection standards.
Personal data is not kept indefinitely. gf99 applies defined retention schedules to each category of data. Account data is held for the duration of the player relationship plus a post-closure period required for legal and compliance purposes. After that period, data is securely deleted or anonymised.
Full Privacy Policy
Please read the following sections carefully. This Privacy Policy applies to all players who register an account on, access, or interact with the gf99 platform at https://gf99.io. By using the platform you acknowledge that you have read and understood this policy.
- 1. Who We Are
- 2. Scope of This Policy
- 3. Data We Collect
- 4. How We Collect Your Data
- 5. Legal Bases for Processing
- 6. How We Use Your Data
- 7. Cookies and Tracking
- 8. Data Sharing and Disclosure
- 9. International Data Transfers
- 10. Data Retention
- 11. Your Data Rights
- 12. Children and Minors
- 13. Marketing Communications
- 14. Security Measures
- 15. Third-Party Links
- 16. Changes to This Policy
- 17. Contact Us
Who We Are
gf99 is an online sports betting and casino entertainment platform operating at https://gf99.io and serving players based in Bangladesh. References in this Privacy Policy to "gf99", "we", "us", or "our" refer to the operator of the gf99 platform in its capacity as data controller.
As data controller, gf99 determines the purposes and means by which personal data collected through the platform is processed. We are committed to handling that data responsibly, transparently, and in accordance with recognised data protection principles.
If you have any questions about this Privacy Policy or the way your data is handled, please contact our Data Protection team at [email protected]. We aim to acknowledge all privacy-related enquiries within 24 hours (Bangladesh Standard Time, UTC+6) and provide a substantive response within 30 calendar days.
Scope of This Policy
This Privacy Policy applies to all personal data collected and processed by gf99 in connection with:
- The registration and ongoing management of a player account on the gf99 platform.
- The use of any game, betting market, or service offered on the platform, including cricket betting (BPL, IPL, T20 World Cup), slot games, live casino, Blocky Block, Crash Bonus, and any other feature available at https://gf99.io.
- Deposits and withdrawals processed via bKash, Nagad, Rocket, Upay, Visa, Mastercard, or any other accepted payment method.
- Communications between a player and gf99 support via live chat, email, or any other support channel.
- Visits to the gf99 website, including interactions with cookies and analytics tools as described in Section 7.
- Promotional and marketing communications where a player has opted in to receiving such communications.
This policy does not apply to the practices of third-party services that may be linked to or integrated within the gf99 platform (for example, game software providers or payment processors operating their own platforms). Such third parties operate under their own privacy policies, which are independent of gf99's privacy practices.
Data We Collect
The following table sets out the categories of personal data that gf99 may collect from or about you, together with specific examples of the data points within each category:
| Data Category | Specific Data Points | Mandatory / Optional |
|---|---|---|
| Identity Data | Full legal name, date of birth, national identity card (NID) number, passport number, gender | Mandatory (KYC) |
| Contact Data | Email address, mobile phone number, residential address, city (e.g., Dhaka, Chittagong, Sylhet) | Mandatory (registration) |
| Account Data | Username, hashed password, account balance, account status, login history, session timestamps | Mandatory (platform operation) |
| Financial Data | Deposit and withdrawal history, transaction amounts in BDT (৳), payment method identifiers (e.g., bKash number, last 4 digits of card) | Mandatory (transactions) |
| Betting and Gaming Data | Bet history, game sessions, stakes placed, winnings and losses, bonus usage, wagering progress | Mandatory (service delivery) |
| Technical Data | IP address, device type, operating system, browser type and version, screen resolution, time zone setting | Automatic (platform access) |
| Usage Data | Pages visited, features used, click paths, session duration, referral source, search queries on platform | Automatic (analytics) |
| Communication Data | Content of live chat transcripts, support email correspondence, complaint submissions | When support is contacted |
| Responsible Gaming Data | Deposit limits set, self-exclusion requests, cooling-off period requests, reality check settings | When tools are used |
| KYC Documentation | Scanned copies of NID / passport / utility bills submitted for identity and address verification | Mandatory (withdrawal) |
How We Collect Your Data
gf99 collects personal data through the following channels:
- Direct provision by you: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion. This is the primary source of identity, contact, and financial data.
- Automated technical collection: When you access the gf99 platform, our servers automatically record technical data including your IP address, device identifiers, browser type, and session timestamps. This data is collected through server logs and platform infrastructure.
- Cookies and similar technologies: gf99 uses cookies, local storage, and similar browser-based tracking technologies to collect usage data as described in Section 7. This data helps us understand how players navigate the platform and allows us to maintain session state (e.g., keeping you logged in).
- Payment providers: When you make a deposit or withdrawal, our payment processing partners (bKash, Nagad, Rocket, Upay, Visa/Mastercard processors) share transaction confirmation data with gf99, including transaction reference numbers and payment method identifiers.
- KYC verification services: Where gf99 uses a third-party identity verification service to cross-check KYC documents, that service may return verification outcomes and risk signals to gf99. The full KYC documentation itself is handled in accordance with that provider's data processing agreement.
Legal Bases for Processing
gf99 processes your personal data only where a valid legal basis exists for doing so. The following legal bases apply to gf99's processing activities:
- Contractual necessity: Processing that is necessary to deliver the services you have registered for — including account management, transaction processing, bet settlement, and customer support — is carried out on the basis of contractual necessity. Without this processing, gf99 cannot provide its platform services to you.
- Legal obligation: Certain processing activities are required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and fraud prevention obligations. gf99 must retain certain transaction and identity records to satisfy these obligations regardless of your preferences.
- Legitimate interests: Some processing is carried out on the basis of gf99's legitimate interests as a platform operator, where those interests are not overridden by your rights and interests. This includes security monitoring, fraud detection, platform analytics, and responsible gaming monitoring.
- Consent: Where gf99 relies on your consent as a legal basis (for example, for the sending of promotional marketing communications), you have the right to withdraw that consent at any time by contacting [email protected] or adjusting your account communication preferences. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.
How We Use Your Data
The personal data gf99 collects is used for the following specific purposes:
- Account creation and management: To register your account, verify your identity and age (21+ requirement), manage your account settings, and maintain accurate records of your account activity.
- Service delivery: To provide access to betting markets, casino games, slot titles, and all other platform features; to process your bets and game rounds; and to credit winnings and process withdrawals to your nominated payment method.
- Payment processing: To process deposits received via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; to reconcile transaction records; and to investigate and resolve failed or disputed transactions.
- Identity and age verification (KYC): To verify that you are who you say you are, that you meet the minimum age requirement of 21 years, and that funds deposited into your account are from a legitimate source.
- Fraud and crime prevention: To detect, investigate, and prevent fraudulent activity, money laundering, and any other illegal or prohibited conduct on the platform. This includes monitoring for unusual betting patterns, multiple account usage, and suspicious financial activity.
- Responsible gaming: To monitor account activity for indicators of problem gambling behaviour and to administer responsible gaming tools including deposit limits, self-exclusion, and cooling-off periods that you request.
- Customer support: To respond to your queries, complaints, and requests submitted via live chat, email, or other support channels; to maintain records of support interactions for quality assurance purposes.
- Platform improvement: To analyse usage data and identify patterns that help us improve platform performance, fix technical issues, and enhance the player experience.
- Marketing communications (with consent): To send you promotional offers, bonus notifications, and news about new games or features, where you have consented to receive such communications. See Section 13 for full details on marketing preferences.
- Legal compliance: To comply with applicable legal obligations, to cooperate with regulatory or law enforcement bodies where required, and to establish, exercise, or defend legal claims.
Cookies and Tracking Technologies
gf99 uses cookies and similar browser-based technologies to operate the platform effectively and to understand how players use it. The following categories of cookies are in use on the gf99 platform:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Session | Maintain your login session, remember your language/display preferences, and enable core platform functionality. The platform cannot operate without these cookies. | Session (cleared on logout or browser close) |
| Functional | Remember your account preferences such as notification settings, display options, and responsible gaming tool configurations. | Up to 12 months |
| Analytics | Collect aggregated, anonymised data about how players navigate the platform — which pages are visited most, where players spend time, and where technical issues occur. This data is used solely for platform improvement purposes. | Up to 24 months |
| Security | Help detect and prevent fraudulent logins, bot activity, and automated abuse of the platform. These cookies are part of gf99's fraud prevention infrastructure. | Up to 6 months |
You may manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling essential cookies will impair or entirely prevent your ability to use the gf99 platform, including logging into your account.
gf99 does not use third-party advertising cookies or retargeting pixels that track your activity across external websites.
Data Sharing and Disclosure
gf99 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:
- Payment service providers: bKash, Nagad, Rocket, Upay, Visa/Mastercard processing partners — to process deposit and withdrawal transactions. These providers receive only the data necessary to execute and confirm each transaction.
- Identity verification (KYC) providers: Third-party services used to verify player identity, age, and document authenticity. These providers process KYC data under contractual obligations that mirror gf99's data protection standards.
- Game software suppliers: Providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Play'n GO, and Ezugi may receive anonymised session identifiers to facilitate game round tracking and dispute resolution. These providers do not receive your full identity or financial data.
- IT infrastructure and hosting providers: Secure cloud hosting and infrastructure providers that store and process gf99 platform data on our behalf under strict contractual data security obligations.
- Fraud prevention and AML services: Specialist third-party services used to monitor for fraudulent activity, money laundering signals, and sanctions screening. These services process data under legally mandated anti-money laundering frameworks.
- Legal and regulatory authorities: gf99 may disclose personal data to law enforcement agencies, regulatory bodies, tax authorities, or courts where required to do so by applicable law, or where such disclosure is necessary to protect the rights, property, or safety of gf99, its players, or the public.
- Professional advisers: Lawyers, auditors, and accountants acting in their professional capacity, subject to professional secrecy obligations.
International Data Transfers
gf99 operates as a platform serving players in Bangladesh. Some of our service providers and game software suppliers operate infrastructure in jurisdictions outside Bangladesh, which means your personal data may be processed or stored in countries other than Bangladesh.
Where personal data is transferred internationally, gf99 takes steps to ensure that such transfers are carried out with appropriate safeguards in place, including:
- Contractual clauses requiring the receiving party to apply data protection standards equivalent to those applied by gf99.
- Verification that the receiving service provider maintains appropriate technical and organisational security measures.
- Ensuring that international transfers are limited to what is strictly necessary for the delivery of platform services.
By using the gf99 platform, you acknowledge that your data may be transferred to and processed in countries outside Bangladesh for the purposes described in this policy.
Data Retention
gf99 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply:
| Data Category | Retention Period | Basis for Retention |
|---|---|---|
| Account and identity data | Duration of account + 5 years post-closure | Legal / AML compliance obligation |
| Financial transaction records | Duration of account + 7 years post-closure | Financial regulatory requirement |
| KYC documentation | Duration of account + 5 years post-closure | AML / identity verification legal obligation |
| Betting and gaming history | Duration of account + 3 years post-closure | Dispute resolution and regulatory audit |
| Customer support communications | 3 years from date of last interaction | Quality assurance and legal claims |
| Marketing consent records | Until consent withdrawn + 3 years | Evidence of consent / legal compliance |
| Technical / server log data | 12 months from collection | Security monitoring and fraud detection |
| Analytics / usage data | 24 months from collection (anonymised) | Platform improvement (anonymised — no personal link) |
| Self-exclusion records | Permanent (for the period of exclusion + 5 years) | Responsible gaming legal obligation |
Upon expiry of the applicable retention period, personal data is either securely deleted, anonymised, or pseudonymised so that it can no longer be linked to any identifiable individual. If you request deletion of your data before the end of a legally mandated retention period, gf99 will retain the minimum data necessary to satisfy that legal obligation and delete all remaining data promptly.
Your Data Rights
As a data subject, you hold the following rights in relation to the personal data gf99 holds about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered account username. All requests are responded to within 30 calendar days.
You have the right to request a copy of all personal data gf99 holds about you, along with information about how it is being used. This is sometimes called a Subject Access Request (SAR).
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For account data you can manage directly, this may be done via your account settings.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right is subject to legal retention obligations.
You may request that gf99 restricts the processing of your data in certain circumstances — for example, while the accuracy of data is contested, or while an objection to processing is being assessed.
Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
You have the right to object to processing of your personal data where gf99 relies on legitimate interests as the legal basis. You also have an unconditional right to object to processing for direct marketing purposes at any time.
Children and Minors
The gf99 platform is strictly intended for adults aged 21 years and above. gf99 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and gf99 reserves the right to request documentary proof of age at any stage.
If gf99 becomes aware that personal data has been collected from a person under the age of 21 without verified parental or guardian consent, that account will be immediately suspended, all associated data will be deleted, and any funds held in the account will be returned to the source payment method after deduction of any amounts owed for fraudulently played rounds.
If you have reason to believe that a person under the age of 21 has registered an account on the gf99 platform, please notify us immediately at [email protected] so that we can investigate and take appropriate action without delay.
Marketing Communications
gf99 may, with your explicit consent, send you promotional communications about bonuses, new game releases, seasonal offers (such as Eid, Pohela Boishakh, or BPL season promotions), and other platform news. Marketing communications are sent via email to your registered email address.
You may withdraw your consent to receive marketing communications at any time by:
- Clicking the "Unsubscribe" link included in every marketing email we send.
- Updating your communication preferences within your gf99 account settings.
- Contacting our support team at [email protected] with the subject line "Marketing Opt-Out".
Once you opt out, gf99 will cease sending marketing communications within 5 business days. Please note that opting out of marketing does not affect transactional communications — we will continue to send you account-related notifications such as deposit confirmations, withdrawal updates, KYC requests, and security alerts, as these are necessary for the operation of your account.
gf99 does not engage in SMS marketing, push notification marketing, or third-party retargeting advertising. All marketing communications are sent directly by gf99 from official gf99.io domain addresses only.
Security Measures
gf99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- TLS/SSL encryption: All data transmitted between your browser or app and the gf99 servers is encrypted in transit using Transport Layer Security (TLS), ensuring that data cannot be intercepted by third parties during transmission.
- Encrypted data storage: Sensitive data fields — including passwords (stored as salted hashes), payment method identifiers, and KYC document references — are encrypted at rest using industry-standard encryption algorithms.
- Access controls: Access to production systems containing personal data is restricted to authorised gf99 personnel on a strict need-to-know basis. Multi-factor authentication (MFA) is required for all administrative access to data systems.
- Regular security testing: gf99 conducts periodic penetration testing and vulnerability assessments of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
- Intrusion detection: Automated monitoring systems are in place to detect and alert on suspicious access patterns, brute-force login attempts, and other indicators of potential security incidents.
- Incident response procedures: gf99 maintains documented data breach response procedures. In the event of a security incident that affects your personal data, gf99 will notify affected players without undue delay and take all necessary steps to contain and remediate the breach.
- Vendor security assessments: All third-party service providers with access to personal data are required to demonstrate appropriate data security standards before onboarding and on an ongoing basis.
While gf99 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You also play a role in keeping your account secure — use a strong, unique password, do not share your login credentials with anyone, and contact support immediately if you suspect unauthorised access to your gf99 account.
Third-Party Links
The gf99 platform may, from time to time, contain references to or integrations with third-party services such as game software providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others). While gf99 takes care to partner with reputable providers, each of these third parties operates under its own privacy policy and data handling practices, which are entirely independent of gf99's Privacy Policy.
gf99 does not control the privacy practices of third-party game providers, payment processors, or any other external service and cannot be held responsible for their data handling. We recommend reviewing the privacy policies of any third-party service you interact with through or alongside the gf99 platform.
This Privacy Policy applies exclusively to data processed by gf99 as data controller. It does not extend to any data processed by third parties in their capacity as independent data controllers.
Changes to This Policy
gf99 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in our data processing practices, changes to applicable law, or improvements to our platform operations.
When a material change is made to this Privacy Policy, gf99 will notify registered players by:
- Displaying a prominent notice on the gf99 homepage and login area for a period of at least 14 days prior to the change taking effect.
- Sending an email notification to your registered email address (for players who have not opted out of transactional communications).
- Updating the "Effective Date" stated at the top of this Privacy Policy document.
Your continued use of the gf99 platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with the changes, you should cease using the platform and may request account closure by contacting our support team.
We encourage you to review this Privacy Policy periodically to stay informed about how gf99 protects your personal data. The most current version of this policy is always available at https://gf99.io/privacy-policy.
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way gf99 handles your personal data, please contact our Data Protection team using the details below. We are committed to responding to all privacy-related enquiries promptly and thoroughly.
- Email: [email protected] — use subject line "Privacy Enquiry" for general questions or "Data Rights Request" for formal rights requests.
- Live Chat: Available 24/7 via the gf99 platform. Our support agents can handle general privacy questions and escalate formal requests to the Data Protection team.
- Response Time: General privacy enquiries are acknowledged within 24 hours (Bangladesh Standard Time, UTC+6). Formal data rights requests receive a substantive response within 30 calendar days.
- Supported Language: All privacy correspondence is handled in English.
Ready to Explore Everything gf99 Has to Offer?
Now that you are familiar with how gf99 protects your data, dive into the full platform — cricket betting on BPL and IPL, 500+ slots, live casino tables, and instant games. All in English, all in BDT, available to players across Dhaka, Chittagong, Sylhet, and beyond.