Your Privacy Matters
at cr99
This Privacy Policy explains how cr99 collects, processes, stores, and protects the personal data of all players on our platform. We are committed to maintaining the highest standards of data privacy for every user in Bangladesh and beyond.
Our Core Privacy Commitments
cr99 treats the privacy of every Bangladesh player with the same seriousness as we treat the security of their funds. The following principles shape how we handle your personal information from the moment you register your cr99 account.
Data Minimisation
cr99 collects only the personal data that is strictly necessary to operate your account, verify your identity, process transactions, and comply with applicable legal requirements. We do not collect data for the sake of it.
End-to-End Encryption
All data transmitted between your device and cr99's servers is protected using 256-bit SSL/TLS encryption. Sensitive information such as payment details and identity documents is never stored or transmitted in plain text.
No Sale of Personal Data
cr99 does not sell, rent, or trade your personal data to third-party marketers or data brokers. Your information is shared only with the trusted partners necessary to operate our platform — and only on a need-to-know basis.
Access Control
Access to player personal data within cr99's internal systems is restricted to authorised personnel with a legitimate operational need. All staff with data access are bound by strict confidentiality obligations.
Your Right to Access
Every cr99 player has the right to request a copy of the personal data we hold about them, correct inaccurate information, and request deletion of their data subject to legal retention requirements. Submit requests to [email protected].
Breach Notification
In the unlikely event of a data breach that affects your personal information, cr99 will notify impacted players promptly and take immediate steps to contain and remediate the incident. We maintain a formal incident response procedure at all times.
Information We Collect
cr99 collects personal data from players through several channels: directly when you register or update your account, automatically as you use the platform, and occasionally from third parties such as payment processors and identity verification services. Below is a detailed breakdown of the categories of personal data we collect.
Account Registration Data
When you create a cr99 account, we collect your full legal name, date of birth, residential address in Bangladesh, email address, and mobile phone number. This data is required to establish your identity, comply with our Know Your Customer (KYC) obligations, and enable communication with you regarding your account.
Identity Verification Data
As part of our KYC process, cr99 may collect copies of government-issued identification documents such as your National Identity Card (NID) or passport, proof of residential address (utility bill or bank statement), and proof of ownership of the payment method you use for deposits. These documents are processed securely and retained only for the period required by our compliance obligations.
Financial and Transaction Data
cr99 records all financial transactions associated with your account, including deposits, withdrawals, bonus credits, and wagers. This includes the amount, date, time, payment method identifier (such as your registered bKash or Nagad mobile number), and transaction reference number. cr99 does not store full card numbers or mobile banking PINs — payment credentials are processed directly by our payment partners.
Device and Technical Data
When you access cr99, our servers automatically log certain technical information from your device. This includes your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, and session duration. This data is used for fraud prevention, platform optimisation, and security monitoring.
Behavioural and Usage Data
cr99 tracks how you interact with the platform — including which games you play, how long you play, your betting patterns, the sports markets you browse, and any responsible gaming tools you activate. This behavioural data helps us personalise your experience, identify signs of problem gambling, and improve our product. It is never sold to third parties.
Communication Data
Any communications you have with the cr99 support team — whether by email, live chat, or on-platform messaging — are recorded and retained. This enables our team to handle follow-up queries efficiently and maintain a consistent service record for your account.
Data Categories Summary
- Name, date of birth, address
- Email address and phone number
- Identity documents (NID, passport)
- Payment method identifiers
- Transaction history in BDT
- Device and IP address logs
- Platform usage and gameplay data
- Support communication records
Sensitive Data
Identity documents and financial records are classified as sensitive data within cr99's systems. They are stored in encrypted form, accessed only by authorised compliance staff, and never shared with third parties beyond those necessary for KYC and payment processing.
How We Use Your Data
cr99 uses the personal data we collect for clearly defined, lawful purposes. We do not use your data in any manner inconsistent with the purposes described at the time of collection. The primary purposes for which cr99 processes your personal data are as follows.
| Purpose | Legal Basis |
|---|---|
| Creating and managing your cr99 player account | Contractual necessity |
| Processing deposits and withdrawals in BDT | Contractual necessity |
| Verifying your identity and age (18+ compliance) | Legal obligation |
| Detecting and preventing fraud, money laundering, and abuse | Legal obligation / Legitimate interest |
| Sending transactional account notifications by email or SMS | Contractual necessity |
| Sending promotional offers and bonus communications (opt-in) | Consent |
| Monitoring gameplay for responsible gaming indicators | Legal obligation / Legitimate interest |
| Improving platform performance and user experience | Legitimate interest |
| Responding to support queries and resolving disputes | Contractual necessity |
Marketing Communications
cr99 will only send you promotional emails or SMS messages regarding bonuses, new games, cricket betting offers, and seasonal campaigns (such as BPL or Eid promotions) if you have explicitly opted in to marketing communications during registration or through your account settings. You may withdraw your marketing consent at any time by updating your notification preferences in your cr99 account dashboard or by contacting [email protected].
Note: Even if you opt out of marketing communications, cr99 will continue to send you essential transactional notifications — such as deposit confirmations, withdrawal updates, password reset emails, and security alerts — as these are necessary for the operation of your account.
Automated Decision-Making
cr99 uses automated systems to assist with fraud detection, bonus eligibility assessment, and responsible gaming monitoring. Where an automated decision has a significant effect on your account (such as a withdrawal hold or a bonus restriction), you have the right to request human review of that decision by contacting our support team.
Marketing Opt-Out
To stop receiving promotional messages from cr99, log in to your account, navigate to Notification Settings, and toggle off marketing communications. Alternatively, email [email protected] with the subject line "Marketing Opt-Out" and your registered account email address.
Automated Systems
cr99's fraud detection and responsible gaming monitoring systems use automated analysis of transaction and gameplay patterns. These systems are designed to protect players, not to penalise them. Contact support if you believe an automated decision has been applied to your account incorrectly.
Data Sharing and Disclosure
cr99 does not sell or rent your personal data to any third party. We share your data only with the categories of recipients described below, and only to the extent necessary for the stated purpose.
Payment Processing Partners
To process deposits and withdrawals in Bangladeshi Taka, cr99 shares relevant transaction data with our authorised payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and Visa/Mastercard. These partners receive only the data necessary to execute the transaction and are bound by their own data protection obligations.
Identity Verification Services
cr99 may engage accredited third-party KYC and identity verification providers to assist in verifying the authenticity of identity documents submitted by players. These providers process your data under strict confidentiality agreements and are prohibited from using your data for any purpose other than verification.
Game Content Providers
Games on cr99 are delivered by licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive technical session data (such as a session token and game round ID) necessary to run the game. They do not receive your full personal profile or financial history.
Legal and Regulatory Disclosure
cr99 may disclose your personal data to law enforcement agencies, financial intelligence units, or regulatory authorities where we are legally required to do so — for example, in connection with an investigation into suspected money laundering or fraud. We will only make such disclosures to the minimum extent required by applicable law.
Business Transfers
In the event that cr99 undergoes a merger, acquisition, or sale of business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to how your data is processed as a result.
No Third-Party Marketing: cr99 strictly prohibits its data-sharing partners from using your personal information for their own marketing purposes. All data-sharing arrangements are governed by contractual data processing agreements that restrict use of your data to the specific purpose for which it was shared.
Authorised Partners
- bKash, Nagad, Rocket, Upay
- Dutch-Bangla Bank, BRAC Bank
- Visa / Mastercard
- KYC verification providers
- Pragmatic Play, Evolution Gaming
- NetEnt, Microgaming, Spribe, Ezugi
- Law enforcement (where legally required)
Data Processing Agreements
Every third party that receives cr99 player data signs a data processing agreement that restricts their use of that data, mandates appropriate security standards, and requires prompt notification to cr99 in the event of any data incident on their end.
Data Retention and Storage
Retention Periods
cr99 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:
- Account registration data: Retained for the duration of your active account, plus a minimum of 5 years following account closure, to meet anti-money laundering record-keeping requirements.
- Identity verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
- Transaction records: Retained for a minimum of 5 years from the date of the transaction.
- Support communication records: Retained for 3 years from the date of the communication.
- Device and technical logs: Retained for up to 24 months for fraud prevention and security monitoring purposes.
- Marketing consent records: Retained for the duration of your consent plus 2 years to enable cr99 to demonstrate compliance.
Data Storage Location
cr99's player data is stored on secure servers. Where data is processed or stored outside Bangladesh, cr99 ensures that appropriate safeguards are in place to protect your information to a standard equivalent to that applied within Bangladesh.
Secure Deletion
When personal data is no longer required and retention periods have expired, cr99 ensures it is securely deleted or anonymised in a manner that prevents recovery. Physical documents (if any) are destroyed using certified secure shredding processes.
Regulatory Note: Some data retention obligations are imposed on cr99 by external legal requirements — including anti-money laundering regulations and financial record-keeping rules — and cannot be overridden by an individual player's deletion request during the applicable retention period. Once the mandatory retention period has elapsed, cr99 will honour deletion requests promptly.
Your Privacy Rights
cr99 respects your rights in relation to the personal data we hold about you. The following rights are available to all cr99 players in Bangladesh. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and your registered account email address.
Right to Access
You have the right to request a copy of all personal data cr99 holds about you. We will provide this information within a reasonable period following verification of your identity. The data will be delivered in a structured, commonly used format.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For account details such as your email address or phone number, you may update these directly in your cr99 account settings.
Right to Erasure
You may request that cr99 delete your personal data in certain circumstances — for example, if you have closed your account and the legal retention period has expired. Please note that erasure requests cannot be fulfilled where data retention is required by law (see the Data Retention section above).
Right to Restrict Processing
In certain circumstances — for example, while a dispute regarding data accuracy is being resolved — you may request that cr99 restrict the processing of your personal data to storage only.
Right to Object
You have the right to object to cr99's processing of your personal data where that processing is based on our legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where cr99 processes your data based on your consent (such as for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Submit a Rights Request
To exercise any of your privacy rights, email cr99 support with:
- Your full name as registered on cr99
- Your registered email address
- The specific right you wish to exercise
- Any relevant details or context
Response Times
cr99 will acknowledge all privacy rights requests within 48 hours and aim to resolve them fully within 30 calendar days. Complex requests may require additional time, in which case we will inform you of the extended timeframe and the reason.
Data Security Measures
Technical Safeguards
cr99 implements a range of technical measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include 256-bit SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest, multi-factor authentication on all internal administrative systems, and regular automated vulnerability scanning of our platform infrastructure.
Organisational Safeguards
Access to player personal data is granted on a strict need-to-know basis. All cr99 staff who handle personal data undergo data protection training and are bound by confidentiality obligations. Our internal data handling policies are reviewed and updated at least annually.
Incident Response
cr99 maintains a formal data breach incident response procedure. In the event of a confirmed breach that poses a risk to your personal data, we will notify affected players without undue delay and take immediate steps to contain the breach, assess its scope, and implement remediation measures. cr99 will also notify relevant authorities where legally required to do so.
Your Role in Security
While cr99 takes extensive measures to protect your data on our end, the security of your account also depends on the steps you take personally. cr99 recommends that you use a strong, unique password for your account, enable two-factor authentication, never share your login credentials with anyone, and log out of your cr99 session when using a shared or public device.
Phishing Warning: cr99 will never send you an email asking for your password, full payment card details, or mobile banking PIN. If you receive a communication claiming to be from cr99 that requests such information, do not respond — report it immediately to [email protected].
Updates to This Policy
How We Notify You of Changes
cr99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When we make material changes to this policy, we will notify registered players by email to the address on file with their account and display a prominent notice on the cr99 platform for a period of at least 14 days following the update.
Effective Date
The effective date at the top of this Privacy Policy indicates when the current version came into force. We recommend reviewing this policy periodically to stay informed about how cr99 protects your data. The most current version of this Privacy Policy is always available at cr99.bet/privacy-policy.
Continued Use as Acceptance
Your continued use of the cr99 platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change to this policy, you should cease using the platform and contact [email protected] to request account closure and data deletion.
Contact Us About This Policy
If you have any questions, concerns, or requests regarding this Privacy Policy or the way cr99 handles your personal data, please contact our support team at any time. Our English-speaking team is available 24 hours a day, 7 days a week, across all Bangladesh Standard Time (UTC+6) hours.
Ready to Play at cr99? Your Data Is Safe With Us
Now that you have reviewed cr99's Privacy Policy, you can explore Bangladesh's most trusted online casino and cricket betting platform with full confidence. All transactions in BDT — instant deposits via bKash and Nagad. 18+ only. Play responsibly.