ca99 Privacy Policy — Your Data, Your Rights
At ca99, protecting the personal information of every player in Bangladesh and beyond is a core responsibility, not an afterthought. This Privacy Policy explains precisely what data we collect, why we collect it, how it is used and stored, and the rights you hold over your own information at every stage of your relationship with us.
- 1.Introduction
- 2.Data We Collect
- 3.How We Collect Data
- 4.Purpose & Legal Basis
- 5.Data Sharing
- 6.Cookies & Tracking
- 7.Data Retention
- 8.Data Security
- 9.International Transfers
- 10.Your Rights
- 11.Children's Privacy
- 12.Marketing & Communications
- 13.Third-Party Links
- 14.Changes to This Policy
- 15.Contact Us
Introduction
This Privacy Policy is published by ca99 ("ca99", "we", "us", "our"), the operator of the online betting and gaming platform accessible at ca99.io. This policy applies to all users of the ca99 platform, including visitors who browse without registering, registered Players with active accounts, and former Players whose accounts have been closed.
ca99 is committed to handling your personal data responsibly, transparently, and in compliance with applicable data protection principles. This Privacy Policy explains what personal information we collect from you, the lawful basis on which we process it, how long we retain it, who we share it with, and what rights you have in relation to your own data.
By accessing or using the ca99 platform — including registering an account, making a deposit, placing a wager, or contacting support — you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the platform.
This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference and together govern your relationship with ca99.
Data We Collect
ca99 collects personal data in several categories depending on how you interact with the platform. The following table summarises the categories of personal data we may collect and process:
| Category | Examples of Data Collected | Collected At |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, NID / passport / driving licence number | Registration & KYC |
| Contact Data | Email address, phone number, residential address (including district and division within Bangladesh) | Registration & KYC |
| Financial Data | bKash / Nagad / Rocket / Upay mobile wallet identifiers, bank account details (for bank transfer), transaction history, deposit and withdrawal amounts in BDT | Deposits & Withdrawals |
| Account Data | Username, account ID, encrypted password hash, account balance, bonus balance, wagering history, session history | Registration & Ongoing Use |
| Technical Data | IP address, device type, operating system, browser type and version, screen resolution, device fingerprint, geolocation data (country / city level) | Every Platform Visit |
| Usage Data | Pages visited, games played, bet types selected, session duration, click paths, search queries within the platform | Every Platform Visit |
| Communications Data | Content of live chat conversations with support, emails sent to and received from ca99, voluntary feedback and survey responses | Support Interactions |
| Responsible Gaming Data | Self-imposed deposit limits, loss limits, session limits, cooling-off periods, self-exclusion status and duration | Account Dashboard Actions |
How We Collect Your Data
ca99 collects personal data through the following channels and methods:
Direct Interactions
The majority of personal data we hold is provided directly by you. This includes data you submit when creating your account, completing KYC verification, making deposits or withdrawals, contacting customer support, participating in promotions, or responding to surveys. You are in control of what you provide during these interactions.
Automated Technologies
When you visit and interact with the ca99 platform, certain technical and usage data is collected automatically via server logs, cookies, session tokens, device fingerprinting software, and analytics tools. This automated collection begins the moment you land on any ca99 page — including before you register or log in — and continues throughout each authenticated session. See Section 6 (Cookies & Tracking) for full details.
Third-Party Sources
In limited circumstances, ca99 may receive personal data about you from trusted third-party sources, including:
- Identity verification and KYC service providers, who cross-reference the documents you submit against official government databases;
- Payment processing partners (bKash, Nagad, Rocket, Upay, and banking partners), who share transaction confirmation data with ca99 for the purpose of crediting your account;
- Fraud detection and anti-money laundering (AML) screening services, which may flag accounts associated with known fraudulent activity;
- Responsible gaming databases (where applicable), to identify Players who have self-excluded from other platforms.
Purpose & Legal Basis for Processing
ca99 processes your personal data only where a legitimate purpose and lawful basis exists. The following table sets out the primary purposes for which we process personal data and the corresponding lawful basis for each:
| Processing Purpose | Data Categories Used | Lawful Basis |
|---|---|---|
| Creating and managing your player account | Identity, Contact, Account | Contractual necessity |
| Processing deposits and withdrawals in BDT | Financial, Identity, Account | Contractual necessity |
| KYC identity verification | Identity, Contact, Financial | Legal obligation |
| Anti-money laundering (AML) compliance | Identity, Financial, Technical | Legal obligation |
| Fraud detection and platform security | Technical, Usage, Financial | Legitimate interest |
| Responsible gaming monitoring | Account, Usage, Responsible Gaming | Legal obligation / Legitimate interest |
| Delivering personalised promotions | Account, Usage | Consent (where obtained) |
| Customer support and dispute resolution | Identity, Contact, Communications | Contractual necessity |
| Platform analytics and product improvement | Technical, Usage | Legitimate interest |
| Legal proceedings and regulatory requests | All categories (as required) | Legal obligation |
Data Sharing & Disclosure
ca99 does not sell, rent, or trade your personal data to any third party. We share personal data with external parties only where strictly necessary and only in the circumstances described below:
Service Providers
ca99 engages carefully vetted third-party service providers to support platform operations. These providers act as data processors on ca99's behalf and are contractually prohibited from using your data for any purpose other than the specific service they perform. Categories of service providers include:
- KYC / identity verification providers;
- Payment processing partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank);
- AML and fraud screening services;
- Cloud hosting and data storage providers;
- Analytics and platform performance monitoring tools;
- Customer support software providers;
- Game studio partners (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi) — limited to game session data necessary to run the game and settle results.
Regulatory & Law Enforcement Authorities
ca99 may disclose personal data to governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or lawful regulatory directive. ca99 will, where legally permitted, notify you of any such disclosure request before complying.
Business Transfers
In the event that ca99 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to the data controller's identity via platform notification or email.
Aggregate & Anonymised Data
ca99 may share aggregated, anonymised statistical data (for example, overall player retention rates, game popularity metrics, or deposit volume trends) with business partners and research organisations. Such data cannot be used to identify any individual player and does not constitute a disclosure of personal data.
Cookies & Tracking Technologies
ca99 uses cookies and similar tracking technologies to operate the platform efficiently, maintain your authenticated session, remember your preferences, and gather anonymised analytics about how the platform is used. The following categories of cookies are deployed on ca99.io:
Strictly Necessary Cookies
These cookies are essential for the platform to function and cannot be disabled without breaking core functionality. They include session authentication tokens, CSRF protection tokens, load-balancing identifiers, and cookies that remember your language and currency preference. No consent is required to set these cookies, and they cannot be opted out of while you continue to use the platform.
Functional Cookies
Functional cookies allow the platform to remember choices you make — such as your preferred deposit method, last-viewed game category, or notification preferences — so that you do not need to reconfigure these settings on every visit. These cookies do not track your activity across other websites.
Analytics Cookies
ca99 uses analytics cookies to collect aggregated, anonymised data about how players navigate the platform — including which pages are most visited, how long sessions last, and which features are most used. This data is used solely to improve platform performance and user experience. Individual player activity reports are not shared externally.
Fraud Prevention & Security Cookies
These cookies collect device fingerprint data and behavioural signals used to detect and prevent fraudulent account activity, multi-accounting, bot traffic, and bonus abuse. They are classed as strictly necessary for security purposes.
Data Retention
ca99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account & Identity Data | Duration of active account + 5 years post-closure | AML / KYC regulatory obligation |
| Financial Transaction Records | 7 years from transaction date | Financial record-keeping obligation |
| Betting & Gaming History | 5 years from account closure | Dispute resolution & regulatory audit |
| Customer Support Communications | 3 years from last interaction | Dispute resolution & quality assurance |
| Technical & Usage Logs | 13 months on a rolling basis | Security monitoring & fraud detection |
| Marketing Preferences & Consent Records | Until consent is withdrawn + 3 years | Evidence of lawful marketing processing |
| Responsible Gaming Records | Self-exclusion duration + 5 years | Regulatory duty of care obligation |
Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible due to technical constraints (for example, data held in backup archives), the data is isolated from further processing until deletion is technically feasible.
Data Security
ca99 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:
- 256-bit SSL/TLS 1.3 encryption on all data transmitted between your device and the ca99 servers, including all login, deposit, withdrawal, and account management operations;
- One-way cryptographic password hashing using industry-standard algorithms — your account password is never stored in plain text and is inaccessible to ca99 staff;
- Encrypted at-rest storage for all sensitive personal data and financial records held in ca99 databases;
- Role-based access controls (RBAC) restricting internal staff access to personal data on a strict need-to-know basis;
- Multi-factor authentication (MFA) required for all ca99 internal systems and staff accounts with access to personal data;
- Continuous intrusion detection and monitoring with automated alerting for anomalous access patterns;
- Regular third-party security audits and penetration testing of the ca99 platform infrastructure;
- Incident response procedures that include mandatory data breach notification protocols consistent with applicable regulatory requirements.
International Data Transfers
ca99 operates as an offshore platform and its infrastructure, including server hosting, KYC processing, and analytics services, may be located outside Bangladesh. This means that your personal data may be transferred to and processed in countries other than Bangladesh, including countries that may have different data protection standards.
Where personal data is transferred internationally, ca99 takes appropriate measures to ensure that your data receives a level of protection consistent with the principles outlined in this Privacy Policy. These measures include:
- Entering into data processing agreements with all third-party processors that include standard contractual clauses or equivalent data protection provisions;
- Conducting due diligence assessments of the data protection frameworks in place in destination countries before transferring data;
- Applying technical security measures (including encryption and pseudonymisation) to data in transit to minimise the risk of interception or unauthorised access.
By using the ca99 platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards described above.
Your Data Rights
ca99 respects your rights over your own personal data. Depending on applicable data protection law and the specific circumstances, you may have the following rights in relation to your personal data held by ca99:
Right of Access
You have the right to request a copy of all personal data ca99 holds about you. We will provide this within 30 days of a verified request at no charge.
Right of Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Update basic details directly via your account dashboard.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Right to Restrict Processing
In certain circumstances you may ask ca99 to restrict how your data is processed — for example while the accuracy of data you have disputed is being verified.
Right to Data Portability
Where processing is based on your consent or contractual necessity, you may request your data in a structured, machine-readable format suitable for transfer to another service.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we have compelling grounds to continue.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time via your account notification settings or by contacting support. Withdrawal does not affect prior processing.
Rights Re: Automated Decisions
ca99 does not make solely automated decisions that produce significant legal or similarly significant effects on Players. Human review is available for any account action you dispute.
Right to Lodge a Complaint
If you believe ca99 has mishandled your personal data, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.
Children's Privacy
ca99 does not knowingly solicit, collect, or process personal data from any individual under the age of 21. Registration by underage individuals is strictly prohibited under our Terms & Conditions, and all account applicants are subject to age verification checks during the KYC process.
If ca99 discovers or is notified that personal data belonging to an individual under the age of 21 has been collected — whether through registration, payment processing, or any other means — that account will be immediately suspended, all associated data will be securely deleted, and any funds deposited will be returned via the original payment method after identity verification of the account holder's parent or guardian.
If you are a parent or guardian and have reason to believe that your child has accessed or registered on the ca99 platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.
Marketing & Communications
ca99 may send you promotional communications — including information about bonuses, seasonal promotions tied to events such as the BPL, IPL, and T20 World Cup, new game launches, and platform updates — where you have provided your consent to receive such communications during the registration process or via your account notification settings.
Types of Marketing Communications
- Email marketing: Promotional newsletters, bonus alerts, and event-based offers sent to your registered email address;
- SMS notifications: Short promotional messages sent to your registered phone number (where enabled);
- On-platform notifications: In-platform banners, pop-up notifications, and dashboard alerts visible when you are logged into your ca99 account.
Opting Out
You may opt out of marketing communications at any time by:
- Clicking the "Unsubscribe" link at the bottom of any ca99 marketing email;
- Updating your notification preferences in your ca99 account dashboard under "Communication Settings";
- Contacting the ca99 support team at [email protected] and requesting removal from all marketing lists.
Please note that opting out of marketing communications does not affect transactional communications necessary to operate your account — such as deposit confirmation messages, withdrawal status updates, KYC request notifications, and mandatory platform notices.
Third-Party Links
The ca99 platform may, from time to time, contain references or links to third-party websites, payment portals, or partner services. This Privacy Policy applies solely to personal data collected and processed by ca99 on the ca99.io platform. It does not extend to any third-party websites or services that you may access via links on the platform.
ca99 is not responsible for the privacy practices, data handling policies, or content of any third-party website or service. We strongly encourage you to review the privacy policy of any external website you visit before providing any personal information. ca99 has no control over and assumes no responsibility for the content, privacy policies, or practices of third-party sites.
Where the ca99 platform integrates with payment partners such as bKash, Nagad, Rocket, or Upay for the purpose of processing deposits and withdrawals, any data you submit directly to those payment providers via their own interfaces is governed by the respective payment provider's own privacy policy — not this policy.
Changes to This Privacy Policy
ca99 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. The most current version of this Privacy Policy will always be accessible at ca99.io/privacy-policy.
Where changes are material — meaning they substantially affect how we collect, use, or share your personal data — ca99 will provide advance notice via one or more of the following channels:
- A prominent notice displayed on the ca99 platform homepage and account dashboard for a minimum of 14 days prior to the updated policy taking effect;
- An email notification sent to your registered email address summarising the key changes and the effective date;
- An in-platform notification visible upon your next login after the policy update has been published.
Your continued use of the ca99 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you should cease using the platform and may request account closure by contacting [email protected].
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way ca99 handles your personal data, please contact us using the details below. Our data support team responds to all privacy-related enquiries in English within 3 business days (Bangladesh Standard Time, UTC+6).
Email Support
For all privacy-related enquiries, data rights requests, and policy questions:
[email protected]
Live Chat
Our English-language support team is available 24/7 via the live chat feature accessible from any page on the ca99 platform.
Response Times
Email privacy requests: within 3 business days (BST, UTC+6).
Data rights requests (access, erasure, portability): within 30 days.
Coverage Area
Serving players across Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh & Cox's Bazar.
Six Pillars of Our Data Protection Commitment
Privacy is not a compliance checkbox at ca99 — it is an active, ongoing commitment backed by technical infrastructure, internal governance, and transparent communication with every player in Bangladesh and beyond.
End-to-End Encryption
Every byte of data transmitted between your device and ca99's servers is protected with 256-bit SSL/TLS 1.3 encryption — the same standard used by international financial institutions.
Strict Access Controls
Your personal data is accessible only to ca99 staff members who genuinely need it to perform their role. Role-based access controls and full audit logging are enforced across all internal systems.
Zero Data Selling
ca99 has never sold, rented, or traded player data to third-party advertisers or data brokers — and never will. Your personal information is not a commercial asset; it is a trust responsibility.
Transparent Processing Records
ca99 maintains detailed records of all data processing activities, lawful bases applied, and third-party data sharing arrangements. These records are available to supervisory authorities on request.
Incident Response Readiness
In the unlikely event of a data breach, ca99's incident response procedures ensure rapid containment, root-cause investigation, and timely notification to affected players and relevant authorities.
Regular Policy Reviews
This Privacy Policy is reviewed at least annually, and immediately following any significant change in applicable law, platform architecture, or data processing practices — keeping it accurate and current at all times.
Your Privacy is Protected. Now Explore ca99 with Confidence.
Every player on ca99 is backed by robust data protection practices, 24/7 English support, and a platform built for the Bangladesh market. Browse our games, read our FAQ, or log in to your account.