gto99 Privacy Policy

This Privacy Policy ("Policy") describes how gto99 ("the Platform", "we", "us", "our") collects, uses, stores, shares, and protects personal information about players and visitors ("you", "your") who use the gto99 website and associated mobile interface located at gto99.pro. This Policy should be read alongside our Terms and Conditions, which govern your use of the gto99 platform, and our Responsible Gaming Policy, both of which are available on this website.

By registering an account on gto99, accessing the platform, or otherwise providing your personal information to us, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the gto99 platform.

gto99 is committed to handling your personal data responsibly and transparently. We collect only the data that is necessary to deliver a secure, fair, and compliant gaming experience to players in Bangladesh. We do not sell your personal data to third parties, and we do not use your data for purposes unrelated to the delivery of gto99 platform services.

gto99 collects personal information from players and visitors through several channels. The type of information collected depends on the nature of your interaction with the platform. The four primary categories of data we collect are set out below.

gto99 uses the personal information it collects exclusively for the purposes necessary to deliver and improve the platform's services. The specific purposes for which your data is used are as follows:

• Account creation, authentication, and ongoing account management — including password reset, session security, and account recovery.
• Processing deposits and withdrawals to and from your registered payment methods (bKash, Nagad, Rocket, Upay, Visa, Mastercard).
• Identity verification and KYC compliance — verifying that players meet the 21+ age requirement and that financial transactions comply with anti-money-laundering obligations.
• Delivering customer support — responding to account inquiries, deposit or withdrawal queries, technical support requests, and responsible gaming assistance.
• Fraud detection, platform abuse prevention, and account security — monitoring account and transaction activity for patterns consistent with fraudulent conduct, account sharing, or Terms violations.
• Responsible gaming compliance — monitoring gaming activity to identify patterns that may indicate problem gambling, and making responsible gaming tools available in accordance with our Responsible Gaming Policy.
• Platform improvement — analysing aggregated, anonymised usage data to understand how players use gto99, identify technical issues, and improve the platform's design and performance.

gto99 does not use your personal data for behavioural advertising targeting, does not build algorithmic profiles to influence your in-platform spending, and does not share your data with advertisers. Promotional communications from gto99 itself (for example, bonus offer notifications sent to your registered mobile number) are based solely on your account status and are subject to your communication preferences, which you may update by contacting support.

gto99 processes personal data only where there is a lawful basis to do so. The legal bases on which gto99 relies for the processing activities described in this Policy are:

• Contractual necessity — processing required to deliver the services you have contracted for by accepting our Terms and Conditions, including account management, transaction processing, and customer support.
• Legal obligation — processing required to comply with applicable legal and regulatory obligations, including anti-money-laundering (AML) requirements, fraud prevention obligations, and responsible gaming compliance duties.
• Legitimate interests — processing conducted for the purposes of platform security, fraud detection, platform abuse prevention, and technical improvement, where these interests are not overridden by your rights as a data subject.
• Consent — where gto99 relies on your consent as the basis for processing (for example, sending promotional communications to your registered mobile number), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

gto99 does not sell, rent, or trade your personal data. We share personal information with third parties only where it is necessary to deliver our services, comply with our legal obligations, or protect the integrity of the platform.

The third parties with whom gto99 may share your personal data, and the basis for each sharing arrangement, are limited to the following categories:

• Payment processors — bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. Each payment processor operates under its own privacy policy and data security standards.
• Game providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Habanero, Ezugi, and other third-party game studios whose games are accessible via gto99 receive the minimum player session data necessary to deliver their games (such as a session token). They do not receive your personal contact information, payment method details, or KYC documents.
• Identity verification services — where gto99 uses a third-party KYC verification service to process identity documents, that service provider receives only the documents submitted for verification and is bound by a data processing agreement with gto99.
• Regulatory and law enforcement authorities — gto99 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, by a valid court order, or where gto99 reasonably believes disclosure is necessary to prevent imminent harm, fraud, or financial crime.

In all cases where gto99 shares personal data with third-party service providers, those providers are required to process your data only for the specific purpose for which it was shared, to maintain appropriate security standards, and to delete the data once their services have been completed. gto99 does not permit third-party service providers to use your data for their own marketing or commercial purposes.

gto99 treats payment data with the highest level of security applied anywhere on the platform. When you make a deposit via bKash, Nagad, Rocket, or Upay, your transaction is initiated directly through the payment provider's own interface — gto99 receives a transaction confirmation and reference number from the provider, but does not have access to your full mobile banking PIN or password at any point in the transaction flow.

For deposits made via Visa or Mastercard, card details entered on the gto99 deposit interface are transmitted directly to our payment processor using SSL encryption. gto99 does not store full card numbers or CVV codes on its own servers. Partial card information (such as the last four digits and card type) may be stored to assist with withdrawal processing and to satisfy anti-fraud and KYC requirements.

gto99 uses cookies and similar tracking technologies to operate core platform functionality, maintain your login session, detect fraudulent or abusive access patterns, and collect aggregated analytics data that helps us understand how players use the platform. This section explains the types of cookies used by gto99 and your options regarding their use.

gto99 does not use third-party advertising cookies or tracking pixels that share your browsing data with advertisers. All cookies set by gto99 serve either a functional purpose (keeping you logged in, remembering your preferences) or an analytical purpose (understanding aggregate usage patterns) — they are never used to build individual advertising profiles or to share your data with ad networks.

gto99 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law or regulatory obligation. The following retention periods apply: active account data is retained for the duration of the account's active status; KYC verification documents are retained for five years from the date of verification; financial transaction records are retained for five years from the date of the transaction; support correspondence is retained for two years from the date of the interaction; technical access logs are retained for 90 days from the date of collection.

When a player requests account closure or when an account is closed by gto99 following a Terms violation, personal data that is not subject to a mandatory retention period under applicable law will be deleted or irreversibly anonymised within 90 days of the closure date. Data subject to mandatory retention will be held in restricted storage for the required retention period and then deleted.

gto99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include SSL encryption for all data transmitted between your device and the gto99 platform; encryption at rest for sensitive stored data including KYC documents and payment reference data; access controls that restrict access to personal data to authorised personnel only; regular security reviews and vulnerability assessments of the platform's infrastructure; and monitoring of platform activity for patterns consistent with data security threats.

While gto99 takes all reasonable steps to secure your personal data, no internet-based platform can guarantee absolute security against all possible threats. In the event of a data security incident that materially affects your personal data, gto99 will notify affected players via their registered mobile number or via an in-platform notification as soon as practicable following discovery of the incident, and will take all reasonable steps to contain and remediate the incident.

As a player registered on the gto99 platform, you have the following rights with respect to your personal data. To exercise any of these rights, contact gto99 support at [email protected] with the subject line "Data Rights Request" and a description of the right you wish to exercise. gto99 will respond to all data rights requests within 48 hours of receipt and will aim to fulfil all valid requests within 14 days.

• Right of access — you may request a copy of all personal data gto99 holds about you, together with information about how that data is used and with whom it has been shared.
• Right to rectification — if any personal data gto99 holds about you is inaccurate or incomplete, you may request that it be corrected or completed.
• Right to erasure — you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to gto99's obligations to retain certain data under applicable law.
• Right to restrict processing — you may request that gto99 restrict the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of the data is being resolved.
• Right to withdraw consent — where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to the withdrawal.

gto99 will not charge a fee for responding to data rights requests submitted in good faith. If a request is manifestly unfounded or excessive, gto99 may decline to respond or may charge a reasonable administrative fee, in which case gto99 will explain its reasons in writing before any fee is applied.

The gto99 platform is strictly for adults aged 21 years and above. gto99 does not knowingly collect personal data from any person under the age of 21. The platform's registration process includes a declaration that the registering player meets the 21+ age requirement. If gto99 discovers that it has collected personal data from a person under the age of 21 — whether through a misrepresentation made at registration or through any other means — it will immediately suspend the associated account, delete the personal data of the underage individual, and void any transactions conducted under the account.

The gto99 platform may contain links to third-party websites or embed content from third-party game providers (such as game preview videos or game launchers). gto99 is not responsible for the privacy practices of any third-party website or service. When you follow a link from gto99 to a third-party website, or when you interact with third-party embedded content, you are subject to that third party's own privacy policy and terms of service. gto99 recommends that you review the privacy policy of any third-party website or service before providing personal information to it. This Privacy Policy applies only to data collected by gto99 directly through the gto99 platform.

gto99 reserves the right to update or modify this Privacy Policy at any time. When changes are made, the "Last updated" date at the top of this page will be revised to reflect the date of the most recent amendment. Material changes to this Policy — for example, changes that expand the categories of personal data collected, changes to data sharing arrangements, or changes to data retention periods — will be communicated to registered players via an in-platform notification or via a message to their registered mobile number where practicable.

Your continued use of gto99 following publication of a revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop using gto99. We encourage you to review this Policy periodically to stay informed about how gto99 handles your personal data.

All privacy-related enquiries, data access requests, data correction requests, data deletion requests, and consent withdrawal notifications should be directed to the gto99 data team at [email protected]. Please use the subject line "Privacy" or "Data Rights Request" to ensure your message is routed to the correct team. gto99 will acknowledge all privacy-related correspondence within 48 hours of receipt during Bangladesh Standard Time (BST, UTC+6) business hours, and will aim to provide a substantive response within 14 days.

If you are contacting gto99 regarding a data rights request, please include in your message: your registered mobile number (so we can locate your account), a clear description of the right you wish to exercise, and any supporting information that may help us process your request. gto99 will not process data rights requests submitted anonymously, as we must be able to verify your identity before disclosing, amending, or deleting any personal data associated with your account.