gc99 Privacy Policy

1.1 This Privacy Policy ("Policy") describes how gc99 ("we ", "our", "us") collects, uses, stores, and protects the personal data of individuals ("you", "your", "Player") who access or use the gc99 online gaming platform at gc99.ws, including all associated pages, services, and features.

1.2 gc99 is committed to handling your personal data with the highest standards of care, transparency, and security. This Policy is intended to give you a clear and complete picture of our data practices so that you can make informed decisions about your use of the gc99 platform.

1.3 This Policy applies to all personal data collected through the gc99 website, mobile-optimised platform, customer support channels, and any other interface through which you interact with gc99. It should be read alongside the gc99 Terms & Conditions, which govern your overall use of the platform.

1.4 By registering an Account or otherwise using the gc99 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the gc99 platform.

2.1 gc99 collects the following categories of personal data from Players:

2.2 We do not collect sensitive special-category data such as racial or ethnic origin, religious beliefs, health data, or political opinions unless such information is voluntarily submitted by the Player in the context of a responsible gaming assessment or a support request, and is strictly necessary for the purpose at hand.

2.3 Providing accurate and complete data during registration and KYC verification is a contractual requirement. Failure to do so may result in Account restrictions or closure, and may prevent the processing of withdrawal requests.

3.1 gc99 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when registering an Account, completing the KYC process, making deposits or withdrawal requests, contacting customer support, or participating in any promotional activity.
• Automated technical collection: Data gathered automatically when you access the gc99 platform, including IP address, browser fingerprint, device identifiers, and session activity logs. This collection occurs on every visit, whether or not you are logged in.
• Payment processors: Transaction confirmation data relayed by payment networks including bKash, Nagad, Rocket, Upay, SureCash, Visa, and Mastercard when you initiate deposits or withdrawals through those systems.
• Third-party game providers: Game session outcomes, bet records, and timestamps relayed by certified game studios such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe as part of the integrated gaming API.
• Cookies and similar technologies: Data collected via browser cookies, local storage, and web beacons as described in Section 7 of this Policy.
• Identity verification services: Where gc99 uses a third-party KYC partner to cross-reference the identity documents you submit, that partner may return data points confirming or querying the validity of the documents provided.

4.1 gc99 processes your personal data only where a clear legal basis exists. The following table sets out the primary purposes for which we process data and the corresponding legal basis in each case:

4.2 Where we rely on your consent as the legal basis for processing — in particular for marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. You can manage your marketing preferences directly from your Account Settings or by contacting our support team.

5.1 gc99 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the lifetime of the Account and for a minimum of five years following permanent Account closure, in order to fulfil financial record-keeping and anti-money-laundering obligations.
• Transaction and financial records: Retained for a minimum of five years from the date of the transaction, in line with financial compliance requirements.
• KYC documents: Retained for a minimum of five years following Account closure. Documents submitted during an investigation that did not result in Account approval may be retained for up to two years from the date of submission.
• Customer support communications: Retained for three years from the date of the interaction, unless the communication is related to an ongoing dispute, in which case it is retained until the dispute is fully resolved plus one year.
• Technical and usage logs: Retained for up to thirteen months from the date of collection for performance monitoring and fraud detection purposes.
• Marketing consent records: Retained for as long as you hold an active Account plus three years, to demonstrate compliance with consent obligations.

5.2 When personal data is no longer required under any applicable retention obligation, gc99 will securely delete or anonymise it in a manner that prevents reconstruction of the original data.

6.1 gc99 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following limited and controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, SureCash, Visa, Mastercard, and other integrated payment networks receive the transaction data necessary to process your deposits and withdrawals. Each processor operates under its own privacy policy and applicable financial regulations.
• Game providers: Studios such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe receive session identifiers and bet data as part of the API integration required to deliver games on the gc99 platform. They do not receive your full identity or financial data.
• KYC and identity verification partners: Where gc99 uses a third-party service to assist with document verification, your submitted identity documents may be shared with that partner under a data processing agreement that restricts their use strictly to the verification purpose.
• IT and infrastructure providers: Cloud hosting, database management, and security monitoring services that process data on our behalf under binding data processor agreements. These providers are not permitted to use your data for any purpose other than delivering the contracted service to gc99.
• Legal and regulatory authorities: Where gc99 is required by law, court order, or regulatory instruction to disclose personal data, we will comply with that obligation. We will notify you of such disclosure wherever legally permissible to do so.
• Fraud prevention and anti-money-laundering networks: gc99 may share data with industry-wide fraud prevention databases or anti-money-laundering monitoring services where there is a legitimate legal basis for doing so. Information shared for these purposes may be used by other participating organisations to identify and prevent financial crime.

7.1 gc99 uses cookies and similar tracking technologies to operate the platform effectively, enhance the user experience, and gather aggregated analytics about platform usage. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without breaking core platform functionality. No consent is required for these cookies.
• Functional cookies: Remember your preferences such as language settings, display options, and previously entered Account details to reduce repetitive data entry. These improve the usability of the platform but are not strictly required for its operation.
• Analytics cookies: Collect aggregated, anonymised data about how Players navigate the gc99 platform — which pages are visited most, where sessions typically begin and end, and how long Players spend on different sections. This data is used solely to improve the platform and is not linked to individual identities.
• Security and fraud detection cookies: Used to identify unusual patterns of behaviour that may indicate fraudulent access attempts, bot activity, or account takeover attempts. These cookies are a component of gc99's overall security infrastructure.

7.2 You may manage your cookie preferences through your browser settings at any time. Please note that disabling functional or analytics cookies will not affect your access to core platform features, but may result in a less personalised experience. Disabling strictly necessary cookies will prevent you from logging in or using the platform.

7.3 gc99 does not use third-party advertising cookies or retargeting pixels that track you across other websites. Our analytics tools are used exclusively for internal platform improvement purposes.

8.1 gc99 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport layer encryption: All data transmitted between your device and the gc99 platform is encrypted using TLS 1.3 with 256-bit AES encryption, ensuring that data cannot be intercepted in transit.
• Data-at-rest encryption: Personal data stored on gc99 servers is encrypted at rest, meaning that even in the unlikely event of a physical security breach, stored data cannot be read without the corresponding decryption keys.
• Access controls: Access to personal data within gc99's internal systems is granted on a strict need-to-know basis. All internal access is logged, and privileged access is subject to multi-factor authentication requirements.
• Regular security audits: gc99's platform and infrastructure undergo regular penetration testing and security audits by qualified third-party security professionals to identify and remediate vulnerabilities before they can be exploited.
• Payment data tokenisation: Full payment card details are never stored on gc99's servers. Card payments are processed through certified payment gateways that tokenise sensitive financial data, meaning gc99 retains only a non-sensitive token reference.
• Incident response procedures: gc99 maintains a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, we will notify affected Players and take all necessary steps to contain the breach, assess its impact, and prevent recurrence.

8.2 While gc99 employs industry-standard security practices, no digital system can be guaranteed to be completely impenetrable. You are encouraged to protect your own Account by using a strong, unique password, enabling two-factor authentication, and promptly reporting any suspicious activity to our support team.

9.1 As a Player on the gc99 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team via live chat or by emailing [email protected]. We will respond to all valid requests within 30 calendar days.

• Right of access: You have the right to request a copy of all personal data that gc99 holds about you. We will provide this in a structured, commonly used format.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Basic information such as your email address and mobile number can be updated directly from your Account Settings.
• Right to erasure: You may request that gc99 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Please note that this right is subject to gc99's legal retention obligations — we may not be able to delete data that we are required by law to retain.
• Right to restriction of processing: You have the right to request that gc99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on a contractual obligation, and is carried out by automated means, you have the right to receive your data in a portable format that you can transfer to another service provider.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring. gc99 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent — in particular, the receipt of promotional communications — you may withdraw that consent at any time through your Account Settings or by contacting support. Withdrawal does not affect the lawfulness of prior processing.

9.2 gc99 will not charge a fee for handling standard data subject requests. However, we reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded, excessive, or repetitive in nature.

10.1 The gc99 platform is strictly prohibited to individuals under the age of 21. gc99 does not knowingly collect or process personal data from individuals below this age threshold.

10.2 If gc99 becomes aware that personal data has been collected from an individual under the age of 21, the relevant Account will be permanently closed immediately, any funds in the Account will be handled in accordance with our Terms & Conditions, and all personal data associated with the Account will be deleted from our systems as soon as is reasonably practicable, subject only to any legal retention obligations that may apply.

10.3 If you are a parent or guardian and believe that a minor in your care has registered an Account on gc99, please contact our support team immediately at [email protected]. We take all such reports seriously and will investigate and act on them promptly.

11.1 The gc99 platform integrates third-party game provider software and payment processing services as described in Section 6. Each of these third-party services operates under its own privacy policy and data protection practices, for which gc99 is not responsible.

11.2 gc99 does not embed third-party social media plugins, advertising networks, or external tracking scripts on the platform that would allow third parties to collect your data without your knowledge. All integrations on the gc99 platform are operational in nature and are governed by formal data processing agreements.

11.3 gc99 does not provide links to external websites that are not part of the gc99 platform. If you navigate away from gc99.ws to any external website, the privacy practices of that external site are entirely outside gc99's control and responsibility.

12.1 gc99 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or our data processing practices. The date of the most recent revision is displayed at the top of this document.

12.2 Where amendments are material — meaning they significantly change how we collect, use, or share your personal data — gc99 will provide advance notice by publishing a prominent notice on the platform and, where possible, notifying registered Players by email at least seven calendar days before the changes take effect.

12.3 Your continued use of the gc99 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you disagree with any amendment, you should close your Account and cease using the platform before the amendment takes effect.

13.1 If you have any questions about this Privacy Policy, wish to exercise any of the rights set out in Section 9, or want to raise a concern about how your personal data has been handled, please contact the gc99 Data Protection team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the gc99 platform. Responses typically within five minutes.
• Email: [email protected] — Please include "Privacy Request" in the subject line so your message is directed to the appropriate team. Average email response time is 2–5 hours.

13.2 All formal privacy requests must be submitted in writing and must include your registered username, the email address associated with your Account, and a clear description of your request or concern. We may need to verify your identity before processing a data access or deletion request to ensure we are responding to the legitimate Account holder.

13.3 gc99 aims to acknowledge all privacy requests within 48 hours and to provide a full response within 30 calendar days. Complex requests that require input from third-party processors or legal review may require additional time, in which case we will notify you of the extended timeline.