ao99 Privacy Policy

This Privacy Policy is published by ao99, the operator of the online casino and sports betting platform accessible at ao99.club (the "Platform" ). ao99 operates the Platform for the benefit of players based primarily in Bangladesh and English-speaking markets in South Asia.

In this Privacy Policy, references to "ao99", "we", "us", or "our" mean the ao99 platform operator. References to "you" or "Player" mean any individual who accesses, browses, registers on, or otherwise uses the ao99 Platform.

ao99 acts as the data controller in respect of all personal data collected through the Platform. This means ao99 determines the purposes for which your personal data is collected and the manner in which it is processed. If you have any questions about this Privacy Policy or about how your data is handled, you may contact us at any time at [email protected].

ao99 collects the following categories of personal data in connection with your use of the Platform:

ao99 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where a player voluntarily discloses health information in the context of a responsible gaming self-exclusion request, in which case the disclosure is made by the player's own initiative and is used solely to administer the responsible gaming measure requested.

ao99 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, submitting a support request, or updating your profile.
• Automated technical collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, and server log files. See Section 6 (Cookies & Tracking) for full details.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a deposit or withdrawal. ao99 does not receive or store your full card number or mobile banking PIN — only the reference data required to match and confirm a transaction.
• Identity verification partners: Where ao99 uses a third-party KYC service to cross-reference identity documents against official databases, that partner may return a verification result and associated metadata to ao99. The third-party partner is contractually bound to process your data only for the purpose of KYC verification on behalf of ao99.
• Publicly available sources: ao99 may, in connection with fraud prevention or responsible gaming obligations, cross-reference information you have provided against publicly available records (such as public self-exclusion registers) where lawfully permitted.

ao99 processes your personal data only where a lawful basis for doing so exists. The following table sets out the primary purposes for which ao99 processes personal data and the corresponding legal basis for each purpose:

ao99 does not sell your personal data. We share personal data with third parties only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data required to execute your deposit or withdrawal. Each payment partner is subject to their own privacy and security obligations under applicable financial services regulation.
• Game studio providers: Third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Habanero, Jili, Ezugi, and Play'n GO may receive a session token and anonymised player identifier to launch game sessions. They do not receive your full name, contact details, or financial data.
• KYC and identity verification partners: Where ao99 uses a third-party service to verify your identity documents, that partner receives only the information required to complete the verification and is contractually prohibited from using it for any other purpose.
• IT infrastructure and cloud service providers: ao99 uses third-party hosting and infrastructure services to operate the Platform. These providers process data on ao99's behalf under strict data processing agreements and may not use the data for their own purposes.
• Legal and regulatory authorities: ao99 may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a legally binding order, warrant, or other lawful obligation.
• Fraud prevention networks: ao99 may share data with industry fraud-prevention services to identify and prevent fraudulent activity, bonus abuse, and money laundering, where this sharing is proportionate and lawful.

In all cases where ao99 shares data with a third-party processor, ao99 maintains a written data processing agreement with that party requiring them to process personal data only on ao99's documented instructions and to maintain appropriate technical and organisational security measures.

ao99 uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the Platform, remember your session, measure usage patterns, and improve your experience. The following categories of cookies are used on the ao99 Platform:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery (CSRF), and load-balancing cookies. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: These cookies remember your preferences, such as your preferred language setting (English) and display settings, so you do not need to re-enter them on each visit.
• Analytics Cookies: ao99 uses anonymised analytics tools to understand aggregated usage patterns — for example, which game categories are most popular among Bangladeshi players, and which pages experience high exit rates. This data is used only in aggregate form to improve the Platform and is not linked to individually identifiable profiles.
• Responsible Gaming Cookies: ao99 uses session cookies to enforce responsible gaming measures such as session time limits and cooling-off periods. These cookies are strictly necessary for player protection and cannot be disabled by players who have active responsible gaming restrictions in place.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. ao99 does not use third-party advertising or behavioural tracking cookies for the purpose of serving targeted advertisements on other websites.

ao99 retains personal data for as long as is necessary for the purpose for which it was collected, or as required by applicable legal obligations. The following standard retention periods apply:

• Active account data: Retained for the full duration that your ao99 account remains active, plus a period of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements and to resolve any post-closure disputes.
• KYC and identity verification documents: Retained for five (5) years from the date of verification or the date of account closure, whichever is later, in compliance with applicable anti-money laundering and counter-terrorism financing obligations.
• Financial transaction records: Retained for five (5) years from the date of the transaction, in accordance with financial record-keeping requirements applicable to online gaming platforms.
• Support communications: Retained for three (3) years from the date of the communication, to provide a record for dispute resolution and service quality review.
• Technical and usage logs: Retained for thirteen (13) months on a rolling basis, after which they are aggregated and anonymised or deleted.
• Marketing consent records: Retained for the duration of the consent period plus three (3) years after withdrawal of consent, to demonstrate compliance with marketing consent obligations.

Upon expiry of the applicable retention period, ao99 will securely delete or irreversibly anonymise the relevant personal data, unless a longer retention period is required or permitted by law.

ao99 implements a multi-layered security architecture to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• Encryption in transit: All data exchanged between your device and the ao99 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). This includes all login sessions, game sessions, and payment transactions.
• Encryption at rest: Sensitive personal data stored on ao99 servers — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. ao99 operational staff access is governed by role-based access controls, and all access events are logged and auditable.
• Password security: Account passwords are stored in a salted, hashed format using a modern cryptographic hashing algorithm. ao99 does not store plaintext passwords and cannot retrieve your password — only reset it.
• Two-factor authentication: ao99 may require one-time password (OTP) verification via your registered mobile number for high-value withdrawals or logins from unrecognised devices, as an additional layer of account protection.
• Penetration testing and vulnerability management: ao99 conducts regular security assessments of the Platform infrastructure to identify and remediate vulnerabilities on a proactive basis.
• Incident response: In the event of a data security incident that affects your personal data, ao99 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.

While ao99 maintains robust security measures, no digital platform can guarantee absolute security against all possible threats. You are also responsible for maintaining the confidentiality of your account credentials and for notifying ao99 immediately if you suspect that your account has been compromised.

As an ao99 player, you hold the following rights in relation to the personal data ao99 holds about you. You may exercise any of these rights at any time by contacting [email protected]:

• Right of Access: You have the right to request a copy of the personal data ao99 holds about you. ao99 will provide this information within 30 days of receiving a valid access request, in a legible electronic format.
• Right of Rectification: If any personal data ao99 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. ao99 will act on rectification requests promptly.
• Right of Erasure ("Right to be Forgotten"): You may request that ao99 delete your personal data. ao99 will comply with such requests where it is not legally required to retain the data and where deletion does not conflict with other legitimate interests, such as fraud prevention or compliance with financial record-keeping obligations.
• Right to Restrict Processing: In certain circumstances — for example, while a dispute about data accuracy is being resolved — you may request that ao99 restrict the processing of your personal data to storage only.
• Right to Data Portability: Where ao99 processes your personal data on the basis of consent or contract, you have the right to receive that data in a structured, commonly used, machine-readable format, and to request that ao99 transmit it to another controller where technically feasible.
• Right to Object: You have the right to object to ao99 processing your personal data on the basis of legitimate interest, including profiling for responsible gaming purposes. ao99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where ao99 processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before the withdrawal.

ao99 will respond to all data rights requests within 30 days. In complex cases, this period may be extended by a further 60 days, in which case ao99 will notify you of the extension and the reason for it within the initial 30-day period. ao99 does not charge a fee for exercising your data rights unless a request is manifestly unfounded or excessive.

The ao99 Platform is strictly intended for adults aged 18 and above. ao99 does not knowingly collect, store, or process personal data from any individual under the age of 18. If ao99 becomes aware that personal data has been collected from a person under 18, that data will be deleted immediately and the associated account will be permanently closed.

ao99 applies age verification checks at the point of registration and during the KYC process to minimise the risk of underage access. Any player suspected of being under 18 years of age will have their account suspended pending satisfactory age verification. If age verification cannot be completed, the account will be permanently closed and any funds returned to the source payment method, subject to fraud and legal hold checks.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on the ao99 Platform, please contact ao99 immediately at [email protected]. ao99 will investigate and take appropriate action without undue delay.

The ao99 Platform may contain references to third-party game studios and payment service providers. While the Platform itself does not contain outbound links to third-party websites in its general navigation, game launch interfaces may open within iframes or separate windows governed by the respective game provider's own terms and privacy policies.

ao99 is not responsible for the privacy practices or content of any third-party provider's own interfaces. Players who interact with game providers' embedded interfaces should review the relevant provider's privacy documentation. ao99 screens all game and payment partners for their security and compliance standards as part of the provider onboarding process, but cannot guarantee the ongoing practices of independent third parties.

ao99 may send you promotional communications — including information about new games, seasonal bonuses (such as Eid promotions, Pohela Boishakh offers, and BPL cricket betting specials), Loyalty Program updates, and exclusive deposit match offers — where you have provided your consent to receive such communications at the time of registration or through your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your ao99 account settings.
• Clicking the "Unsubscribe" link included in any promotional email sent by ao99.
• Contacting ao99 support at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent will not affect the delivery of transactional communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, KYC requests, responsible gaming alerts, and security notifications. These operational communications are sent on the basis of contract or legal obligation, not consent, and cannot be opted out of while your account remains active.

ao99 does not share your contact details with third-party marketers for the purpose of sending you marketing communications from other brands. All ao99 marketing is sent directly by ao99 or by a data processor acting strictly on ao99's behalf.

ao99 operates a platform that serves Bangladeshi players. In providing the Platform, ao99 may use infrastructure, cloud services, and third-party processors whose servers are located outside Bangladesh. Where personal data is transferred to a jurisdiction that does not provide the same level of data protection as Bangladesh, ao99 ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses that require the recipient to maintain equivalent security and privacy protections.
• Transfers to processors that have been certified under internationally recognised security and privacy frameworks, where applicable.
• Pseudonymisation or anonymisation of data prior to transfer where the full dataset is not required by the receiving processor.

By using the ao99 Platform, you acknowledge that your personal data may be processed in jurisdictions outside Bangladesh as described in this section, subject to the safeguards described above. If you have questions about the international transfer of your personal data, you may contact ao99 at [email protected].

ao99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the features and services offered on the Platform. The effective date displayed at the top of this policy will always reflect the date of the most recent revision.

When ao99 makes a material change to this Privacy Policy — meaning a change that significantly affects your rights or how your data is used — ao99 will notify registered players by posting a prominent notice on the Platform and, where appropriate, by sending a notification to your registered email address. Continued use of the ao99 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the changes.

ao99 recommends that you review this Privacy Policy periodically to stay informed about how your personal data is protected. If you do not agree with any revision to this Privacy Policy, you should cease use of the Platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data ao99 holds about you, please contact the ao99 data team using the details below:

• Email: [email protected] (plain text — not a clickable link; please copy and paste into your email client)
• Subject line recommended: "Privacy Request — [Your Username]"
• Support Hours: 24 hours a day, 7 days a week, 365 days a year
• Response Time: ao99 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days
• Language: All privacy communications are handled in English

ao99 does not provide privacy support via telephone. All privacy requests must be submitted in writing via email or the in-platform live chat to ensure a clear and auditable record of the request and ao99's response.