ex99 Privacy Policy

This Privacy Policy applies to all personal data collected by ex99 through the ex99.io website, any associated mobile-optimised interfaces, and all related services offered by the platform. It covers data collected during account registration, identity verification, financial transactions, customer support interactions, and general platform usage.

This policy should be read alongside the ex99 Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and ex99. Where any conflict exists between this Privacy Policy and the Terms & Conditions regarding the treatment of personal data, this Privacy Policy shall prevail.

ex99 is committed to handling personal data with integrity, transparency, and in accordance with established data protection principles. The platform does not engage in data practices that are deceptive, coercive, or contrary to the reasonable expectations of its users.

ex99 collects the following categories of personal data from users of the platform:

ex99 collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide directly when registering an account, completing KYC verification, making deposits or withdrawals, or contacting customer support.
• Automated technical collection: When you access the ex99 platform, certain technical data — including your IP address, device identifiers, browser information, and session data — is automatically recorded by our servers and analytics systems.
• Cookies and similar tracking technologies: ex99 uses cookies, web beacons, and similar technologies to collect data about how users interact with the platform. Full details are set out in Section 7 (Cookies & Tracking).
• Third-party sources: In limited circumstances, ex99 may receive supplementary identity or fraud-screening data from third-party KYC verification service providers, payment processors, or fraud prevention agencies to validate the information you have provided.
• Customer support interactions: When you contact ex99 support via live chat or email, the content of those communications — including any personal data you share — is recorded and stored as part of your account record.

ex99 uses the personal data it collects for the following purposes:

• Account management: To create, maintain, and operate your ex99 account, including processing logins, managing account settings, and providing access to platform features.
• Identity verification (KYC): To verify your identity and age in accordance with our responsible gaming obligations, and to prevent the use of the platform by persons under the age of 21.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other supported payment methods, and to maintain accurate financial records for each account.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible gaming compliance: To monitor gaming activity for signs of problem gambling behaviour, to apply responsible gaming tools (deposit limits, self-exclusion) activated by users, and to comply with responsible gaming obligations.
• Customer support: To respond to your queries, complaints, and support requests, and to maintain a record of support interactions for quality assurance and dispute resolution purposes.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the functionality, performance, and user experience of the ex99 platform.
• Marketing communications: Where you have given explicit consent, to send you promotional communications about ex99 bonuses, new games, and special offers by email or SMS. You may withdraw marketing consent at any time by contacting [email protected].
• Legal compliance: To comply with applicable laws and regulations, respond to lawful requests from competent authorities, and enforce our Terms & Conditions.

ex99 does not use personal data to make fully automated decisions that have a legal or similarly significant effect on users, without human review being available.

ex99 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between ex99 and you — specifically, to operate your account, process your bets, and manage your financial transactions.
• Legitimate interests: Processing that is in the legitimate interests of ex99 and does not override your fundamental rights and freedoms — for example, fraud detection, security monitoring, and general platform analytics.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements — for example, KYC verification, transaction record-keeping, and responding to lawful requests from competent authorities.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — for example, sending marketing communications by email or SMS. Where consent is the legal basis, you have the right to withdraw it at any time.

ex99 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared with third parties only in the following circumstances and only to the extent necessary:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other payment processors receive the financial data necessary to process your deposits and withdrawals securely.
• KYC and identity verification providers: Third-party verification service providers may receive identity and address data to carry out age and identity checks on behalf of ex99.
• Game providers: Where required for the proper operation of live dealer or RNG game titles, certain technical session data may be passed to the relevant game provider (e.g., Evolution Gaming, Pragmatic Play, Ezugi, Spribe). No financial or identity data is shared with game providers beyond what is technically necessary for game session management.
• Fraud prevention and security agencies: In cases of suspected fraud, money laundering, or other prohibited activity, relevant data may be shared with fraud prevention agencies, financial intelligence units, or law enforcement authorities.
• Legal and regulatory authorities: ex99 may disclose personal data to competent authorities when required to do so by law, court order, or other binding legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data held by ex99 may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third parties with whom ex99 shares personal data are required to handle that data in a manner consistent with applicable data protection standards and the principles set out in this Privacy Policy.

ex99 uses cookies and similar tracking technologies to enhance your experience on the platform, to maintain your logged-in session, and to gather analytical data about how users interact with the site. The following types of cookies may be set when you use ex99:

• Strictly necessary cookies: Required for the platform to function correctly. These include session cookies that keep you logged in and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without impairing core platform functionality.
• Functional cookies: These cookies remember your preferences — such as preferred language, currency display, and responsible gaming settings — so that your experience is consistent across sessions.
• Analytical cookies: These cookies collect anonymised or pseudonymised data about how users navigate the ex99 platform — which pages are visited most frequently, how long users spend on particular sections, and where users encounter errors. This data is used solely to improve platform performance and user experience.
• Marketing cookies: Where you have consented to receive marketing communications, ex99 may use cookies to personalise promotional content shown to you based on your betting and gaming activity. You may withdraw consent for marketing cookies at any time.

Most web browsers allow you to control cookies through their settings. Blocking or deleting strictly necessary cookies will affect platform functionality. For analytical and marketing cookies, you may manage your preferences by contacting ex99 support or through your browser's cookie management tools.

ex99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, to comply with financial record-keeping requirements.
• Transaction records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years following the date of each transaction.
• KYC documentation: Identity verification documents are retained for a minimum of five (5) years following account closure or the completion of the relevant verification process.
• Customer support records: Records of support interactions are retained for a period of three (3) years from the date of the interaction, or longer where the interaction relates to a formal dispute or legal claim.
• Marketing data: Where you have consented to marketing communications, your marketing preferences and contact data used for that purpose are retained until you withdraw consent, after which they will be deleted or anonymised within a reasonable timeframe.
• Technical and analytical data: Anonymised analytics data may be retained indefinitely for platform improvement purposes. Pseudonymised technical data (such as IP logs) is retained for up to twelve (12) months.

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or rendered permanently inaccessible, in accordance with ex99's internal data disposal procedures.

ex99 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the ex99 platform is encrypted using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser's address bar when using the platform.
• Encryption at rest: Sensitive personal data stored on ex99 servers — including financial data and identity documents — is encrypted at rest using strong encryption standards.
• Access controls: Access to personal data held by ex99 is strictly limited to authorised personnel who require access to perform their specific job functions. All internal access is logged and audited regularly.
• Secure password storage: User account passwords are never stored in plain text. ex99 uses industry-standard one-way hashing with salting to store password credentials securely.
• Regular security reviews: ex99's platform and data infrastructure undergo regular security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: ex99 maintains an incident response plan for data security events. In the event of a data breach that is likely to result in a risk to your rights, ex99 will notify affected users without undue delay.

As a user of the ex99 platform, you have the following rights in relation to your personal data. To exercise any of these rights, contact ex99 at [email protected] with your account details and a clear description of your request:

• Right of access: You have the right to request a copy of the personal data that ex99 holds about you. ex99 will respond to verified access requests within a reasonable timeframe.
• Right to rectification: If any personal data held by ex99 is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that certain data must be retained for legal and regulatory compliance purposes and cannot be deleted on request.
• Right to restriction of processing: You may request that ex99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request a copy of the data you have provided to ex99 in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing processing, ex99 will cease processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

ex99 will aim to respond to all data rights requests within thirty (30) calendar days. Where a request is complex or numerous, ex99 may extend this period by a further thirty (30) days, with notification to the requester.

The ex99 platform is strictly intended for adults aged 21 and above. ex99 does not knowingly collect personal data from persons under the age of 21. The platform employs age verification procedures at registration and during the KYC process to prevent access by minors.

If ex99 becomes aware that personal data has been collected from a user who is under the age of 21, the account will be immediately closed, all associated data will be deleted or anonymised to the extent permitted by law, and any deposited funds will be returned to the original payment source.

If you are a parent or guardian and you believe that a minor in your care has registered an account or provided personal data to ex99, please contact [email protected] immediately so that the matter can be investigated and resolved without delay.

The ex99 platform may, on occasion, reference or display content from third-party service providers such as game studios, payment processors, or sports data providers. While ex99 takes reasonable care in selecting reputable partners, ex99 is not responsible for the privacy practices of third-party websites or services that operate independently of the ex99 platform.

If you follow a link to any third-party website or interact directly with a third-party service outside the ex99 platform, your use of that external service is governed by that party's own privacy policy. ex99 encourages you to review the privacy policies of any third-party services you use in connection with your gaming activity.

ex99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, platform functionality, or applicable legal requirements. When material changes are made, ex99 will update the Effective Date at the top of this document and, where reasonably practicable, provide notice to registered users.

It is your responsibility to review this Privacy Policy periodically. Continued use of the ex99 platform after any update to this policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must cease using the platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data that ex99 holds about you, please contact the ex99 support team. All privacy-related requests are handled with strict confidentiality and will be responded to within the timeframes set out in Section 10.

• Email: [email protected] (plain text — not a clickable link)
• Subject line: Please use "Privacy Request — [Your Account Username]" for faster routing
• Support hours: 24/7, 365 days a year, in English
• Response time: Privacy requests are acknowledged within 2 business days and fully resolved within 30 calendar days

When contacting ex99 regarding a data rights request, please include your full name, registered email address or mobile number, and a clear description of your request. ex99 may need to verify your identity before processing certain requests to protect against unauthorised access to personal data.