Privacy Policy
of gtc99

Information We Collect

gtc99 collects personal data through several channels: information you provide directly during registration and KYC verification, data generated automatically by your use of the platform, and in limited circumstances, data received from trusted third-party service providers. The categories of data we collect are described below.

Information You Provide to Us

• Registration data: Your full legal name, date of birth, email address, mobile phone number, and a self-selected password when you create a gtc99 account.
• Identity verification documents: Copies of your National ID card (NID), passport, or driving licence submitted as part of the Know Your Customer (KYC) process.
• Payment method details: Your registered bKash, Nagad, Rocket, or Upay mobile number, or your bank account name and number if you choose to transact via Dutch-Bangla Bank, BRAC Bank, or City Bank.
• Source-of-funds documentation: In certain high-volume deposit scenarios, we may request payslips, bank statements, or other documents confirming the legitimate origin of your deposited funds.
• Communications: The content of any email, live-chat message, or support ticket you send to the gtc99 team at [email protected].
• Preference and profile data: Your chosen display name, preferred language, favourite game categories, and any marketing communication preferences you set within your account.

Data Collected Automatically

• Device and browser identifiers: IP address, device type, operating system, browser version, and screen resolution collected each time you access the gtc99 platform.
• Session and activity logs: Pages visited, game sessions initiated, bets placed, deposit and withdrawal timestamps, login and logout times, and in-game event records — all logged to our secure servers in Bangladesh Standard Time (BST, UTC+6).
• Geolocation data: Your approximate geographic location derived from your IP address, used to ensure compliance with access and responsible-gaming requirements.
• Cookie and tracking data: Information captured by first-party and third-party cookies and similar technologies as described in the Cookies and Tracking Technologies section below.

Data Received from Third Parties

• Payment processor confirmations: Transaction reference numbers and confirmation statuses returned by bKash, Nagad, Rocket, Upay, and our banking partners when a deposit or withdrawal is processed.
• Game provider data: Round IDs, bet amounts, game outcomes, and RTP audit records supplied by our certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi.
• Fraud and AML screening: Risk scores or flagging information returned by third-party identity verification and anti-money-laundering screening tools used by gtc99 to protect the integrity of the platform.

How We Use Your Data

gtc99 processes your personal data only for clearly defined, legitimate purposes. We do not use your data for purposes that are incompatible with those stated below without first obtaining your explicit consent or being required to do so by applicable law.

Where we rely on your consent as the legal basis for processing — most commonly for marketing communications — you may withdraw that consent at any time with no effect on the lawfulness of any processing carried out before withdrawal. To withdraw marketing consent, log in to your account and update your notification preferences, or email [email protected] with the subject line "Marketing Opt-Out".

Cookies and Tracking Technologies

The gtc99 platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience for players in Bangladesh. This section explains the types of cookies we use, their purposes, and how you can manage your cookie preferences.

Types of Cookies We Use

• Strictly necessary cookies: These cookies are essential for the platform to function correctly. They enable core features such as user authentication, session management, and secure access to your account balance and game history. These cookies cannot be disabled without severely impairing platform functionality.
• Performance and analytics cookies: We use first-party analytics cookies to measure how players navigate the gtc99 platform — which pages are visited most, where sessions begin and end, and which game categories attract the most engagement. This data is aggregated and anonymised before analysis.
• Functional cookies: These cookies remember your preferences — such as your preferred notification settings — so that you do not have to reconfigure them on every visit.
• Targeting and marketing cookies: With your consent, we may use cookies to identify which promotions you have already viewed and to deliver relevant bonus offers based on your play history. These cookies do not track your activity across unrelated third-party websites.

Managing Your Cookie Preferences

You can control non-essential cookies through your browser settings. Most modern browsers — including Chrome, Firefox, Safari, and Samsung Internet (commonly used on Android devices in Bangladesh) — allow you to block or delete cookies via the browser's privacy or settings menu. Note that disabling certain cookies may affect the functionality of the gtc99 platform, including the ability to maintain your login session across pages.

Data Sharing and Disclosure

gtc99 does not sell, rent, or trade your personal information. We share data only where it is strictly necessary to operate the platform, to comply with legal obligations, or where you have given your explicit consent. The categories of recipients with whom we may share data are described below.

• Payment service providers: We share the minimum necessary payment details (such as your registered mobile number or bank account number) with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank solely for the purpose of processing your deposit or withdrawal transaction.
• Game content providers: Certified game suppliers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised session identifiers and bet records necessary to deliver game content and resolve any technical disputes over game outcomes.
• Identity verification and AML service providers: Third-party KYC and anti-money-laundering screening tools may process your identity documents and transaction data as part of our compliance programme. All such providers are bound by contractual data-processing agreements requiring the same level of protection as gtc99 itself.
• IT infrastructure and cloud service providers: Hosting, database, and security infrastructure providers who process data on gtc99's behalf under strict data-processor agreements, with no independent right to use your data for their own purposes.
• Legal and regulatory authorities: gtc99 will disclose personal data to Bangladeshi law-enforcement agencies, courts, or regulatory bodies when legally required to do so, or when we have a good-faith belief that disclosure is necessary to protect the safety of our players or the public, or to prevent fraud or serious crime.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of gtc99's assets, player data may be transferred to the acquiring entity as part of the transaction. You will be notified via email before your data becomes subject to a materially different privacy policy.

Data Retention

gtc99 retains your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law or regulation.

The following retention guidelines apply to the principal categories of data we hold:

• Account and registration data: Retained for the duration of your active account relationship with gtc99, plus a minimum of five years after account closure to satisfy anti-money-laundering record-keeping obligations.
• KYC identity documents: Retained for the duration of the account relationship and for a minimum of five years from the date of the last transaction on the account, in line with standard financial services record-keeping practice.
• Transaction records (deposits and withdrawals): Retained for a minimum of seven years from the date of the transaction to support financial audit, AML compliance, and dispute resolution requirements.
• Game session logs and bet history: Retained for a minimum of three years from the date of the relevant game session, for dispute resolution and regulatory compliance purposes.
• Customer support communications: Retained for three years from the date of the last interaction in a given support thread, unless the communication relates to an ongoing dispute, in which case it is retained until the dispute is fully resolved.
• Marketing preference records: Retained for the duration of the account relationship. Consent withdrawal records are retained for five years as evidence of your preference at each point in time.
• Analytics and session data: Aggregated and anonymised within 12 months of collection. Raw session logs containing IP addresses are deleted within 90 days unless retained for an active fraud or AML investigation.

When the retention period for a given category of data expires and there is no legal basis to retain it further, gtc99 securely deletes or anonymises the data in a manner that makes re-identification impossible.

Data Security

gtc99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes the following core controls:

• Transport encryption: All data transmitted between your browser or app and gtc99 servers is encrypted using TLS 1.2 or higher (effectively 256-bit SSL), providing a secure channel for all login, payment, and account-management activity.
• At-rest encryption: Sensitive data fields — including identity document references, payment account numbers, and password hashes — are encrypted at the database level using AES-256, ensuring that raw data is unreadable even in the unlikely event of a database breach.
• Access controls: Access to systems containing identifiable player data is restricted on a strict need-to-know basis. Staff access is controlled by role-based permissions, multi-factor authentication, and comprehensive audit logging of all access events.
• Penetration testing and vulnerability management: The gtc99 platform is subject to regular vulnerability assessments and periodic penetration testing by qualified security professionals to identify and remediate weaknesses before they can be exploited.
• Incident response: gtc99 maintains a documented data-breach response procedure. In the event of a confirmed breach affecting your personal data, we will notify affected players and take all reasonable steps to contain and remediate the incident as quickly as possible.
• Staff training: All gtc99 personnel who handle personal data receive regular data-protection training and are bound by confidentiality obligations as a condition of their engagement.

Your Rights Over Your Data

As a gtc99 player based in Bangladesh, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, send a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and respond substantively within 30 calendar days.

Please note that certain rights are subject to exceptions. For example, gtc99 cannot delete transaction records that must be retained for anti-money-laundering compliance, and cannot provide data portability for data that was not directly provided by you. Where we are unable to fulfil a request in full, we will explain the applicable exception clearly in our response.

gtc99 does not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive in scope. In such cases, we will notify you of any applicable fee before proceeding.

Contact and Complaints

If you have any question about this Privacy Policy, wish to exercise a data right, or believe that gtc99 has not handled your personal data in accordance with this Policy, please contact our dedicated data-protection team using the details below. All privacy-related queries are handled in English and are responded to within Bangladesh Standard Time (BST, UTC+6) business hours.

• Email: [email protected] (subject line: "Privacy Query" or "Data Rights Request")
• Response time: Acknowledgement within 3 business days; substantive response within 30 calendar days of receiving a complete request.
• Postal correspondence: Where a written postal response is required for formal legal purposes, please include your full name, registered account email, and a clear description of your request in your initial email so that we can provide the appropriate mailing details.

If you are not satisfied with gtc99's response to your privacy complaint, you have the right to escalate the matter to the relevant data-protection authority or consumer-protection body in Bangladesh. gtc99 will cooperate fully with any such investigation and provide all information reasonably requested by the relevant authority.

This Privacy Policy was last reviewed and published on 1 January 2026. The version on this page supersedes all prior versions of the gtc99 Privacy Policy.