Your Privacy Matters at hh99

1 Introduction

This Privacy Policy ("Policy") is issued by hh99 ("hh99", "we", "us", "our") and applies to all personal data collected from individuals ("you", "Player", "User") who access or use the hh99 platform available at hh99.io, including all associated subdomains, mobile-optimised pages, and API integrations used to deliver game, payment, and support services.

hh99 is Bangladesh's leading online cricket betting and casino platform, offering 500+ certified games to players aged 21 and above. The platform is purpose-built for the Bangladesh market and processes all financial transactions in Bangladeshi Taka (৳) via locally trusted payment partners including bKash, Nagad, Rocket, and Upay. As such, the personal data we handle relates primarily to Bangladeshi residents and is processed in accordance with internationally accepted data protection principles.

By registering an account on hh99, accessing the hh99 Login page, making a deposit, or otherwise using any feature of the platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not consent, please do not register or continue to use the platform.

This Policy should be read alongside the hh99 Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference.

2 Personal Data We Collect

hh99 collects the following categories of personal data from players. The specific data collected at any given time depends on the feature or service you are using.

hh99 does not collect special category data (such as health information, religious beliefs, or political opinions) as part of standard account operations. If such data is volunteered by a player in a support communication, it will be treated with the highest level of confidentiality and will not be processed beyond the immediate purpose for which it was shared.

3 How We Collect Your Data

hh99 collects personal data through the following means:

• Direct collection: Data you provide when filling in the registration form, completing KYC verification, using the cashier to deposit or withdraw funds, submitting a support request, or updating your account profile settings.
• Automated technical collection: Data collected automatically when you visit hh99.io, including IP address, device identifiers, browser fingerprint, and session behaviour, captured via server logs and first-party session cookies.
• Payment partner data sharing: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a linked bank account, the relevant payment provider shares transaction confirmation data (amount, timestamp, wallet/account reference) with hh99 to reconcile your account balance.
• Game provider data: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) return game round results and session metadata to hh99 systems for bet settlement and dispute resolution purposes.
• Identity verification providers: Where hh99 uses a third-party KYC service to verify your NID or passport against official records, that provider shares verification outcome data (pass/fail and the verified data fields) with hh99.
• Publicly available sources: In cases of suspected fraud or AML concern, hh99 may cross-reference your data against publicly available records or watchlists as permitted by applicable law.

4 Legal Basis for Processing

hh99 processes your personal data under the following recognised legal bases:

• Contract performance: Processing your identity data, contact data, and financial data is necessary to fulfil the contract between hh99 and you — specifically, to register your account, accept deposits, settle bets, and process withdrawals.
• Legitimate interests: hh99 has a legitimate interest in processing technical and usage data to maintain platform security, prevent fraud and multi-accounting, improve game performance, and deliver a better experience to Bangladeshi players. These interests are balanced against your privacy rights and do not override them.
• Legal obligation: hh99 is required to collect and retain certain identity and financial transaction data to comply with anti-money-laundering (AML) obligations, know-your-customer (KYC) requirements, and any applicable financial reporting standards.
• Consent: Where hh99 relies on consent as a legal basis — for example, for the use of non-essential cookies or for sending promotional communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Consent withdrawal requests can be submitted to [email protected].

5 How hh99 Uses Your Personal Data

The personal data collected is used for the following specific, documented purposes:

• Account management: Creating, maintaining, and securing your hh99 account, including authentication during hh99 Login, password resets, and account activity notifications.
• Identity and age verification: Confirming that you are at least 21 years of age and that the identity details you provided during registration are accurate, as required by the responsible gaming standards hh99 operates under.
• Payment processing: Facilitating deposits and withdrawals in Bangladeshi Taka (৳) through bKash, Nagad, Rocket, Upay, and bank transfer channels; reconciling your account balance; and investigating payment disputes.
• Game delivery and bet settlement: Communicating game round data, bet placement instructions, and settlement results between your account, hh99 systems, and third-party game providers including Pragmatic Play, Evolution Gaming, and Spribe.
• Fraud prevention and AML compliance: Monitoring account activity for patterns consistent with money laundering, bonus abuse, multi-accounting, match fixing, and other prohibited activities as defined in the hh99 Terms & Conditions.
• Responsible gaming: Tracking deposit limits, loss limits, session timers, cooling-off periods, and self-exclusion status you have set, and applying those restrictions to your account automatically.
• Customer support: Reviewing your account details and transaction history when responding to your support enquiries via email or live chat.
• Platform improvement: Analysing aggregated, anonymised usage data to improve navigation, game load times, payment flow design, and overall player experience on the Bangladesh market version of hh99.
• Marketing communications: Sending you information about hh99 promotions, bonuses, BPL season offers, IPL specials, and Eid or Pohela Boishakh seasonal offers — only where you have provided consent and have not subsequently opted out.

6 Sharing Your Personal Data

hh99 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Data is shared only in the following strictly limited circumstances:

• Payment processing partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive only the transaction data necessary to process your deposit or withdrawal. These partners operate under their own privacy policies and data security standards.
• Identity verification providers: Third-party KYC services receive your NID or passport details solely for the purpose of verifying your identity. They are contractually prohibited from using this data for any other purpose.
• Game studios: Third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a session token and player identifier to serve games. They do not receive your full name, NID, or payment details.
• IT and hosting providers: Cloud hosting and content delivery partners who provide infrastructure for hh99.io have access to server-level data under strict data processing agreements that prohibit independent use of that data.
• Legal and regulatory disclosure: hh99 may disclose personal data to law enforcement authorities, financial intelligence units, or courts where required to do so by law, court order, or to protect the legitimate rights of hh99 and its players.
• Business transfers: In the event of a merger, acquisition, or sale of hh99's assets, player data may be transferred to the acquiring entity, which will be bound by this Privacy Policy or an equivalent standard of protection.

7 Data Retention

hh99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any legal or regulatory obligation to retain it for a longer period. The following retention periods apply:

• Active account data: Retained for the duration of your active account plus a post-closure period of five years to comply with AML and KYC record-keeping requirements.
• Transaction records: Deposit and withdrawal records including bKash, Nagad, and Rocket transaction references are retained for a minimum of five years from the date of the transaction.
• Gaming session data: Bet history, game round results, and win/loss records are retained for three years from the date of the session, after which they are anonymised and retained only in aggregate form for platform analytics.
• Support communications: Email and live chat transcripts are retained for two years from the date of the final communication in a support thread.
• Marketing consent records: Records of consent granted or withdrawn for marketing communications are retained for five years from the date of the consent event to demonstrate compliance.
• Technical logs: Server access logs and IP address records are retained for 90 days for security monitoring purposes, after which they are deleted unless relevant to an ongoing fraud or AML investigation.
• Self-exclusion records: Records of self-exclusion requests are retained for the duration of the exclusion period plus five years to prevent re-registration during an active exclusion.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

8 Cookies and Tracking Technologies

hh99 uses cookies and similar technologies to operate core platform functions and to understand how Bangladeshi players use the site. The following cookie categories are in use:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in during your visit, CSRF protection tokens, and load-balancer routing cookies. These cannot be disabled without breaking the platform.
• Performance and analytics cookies: First-party analytics cookies that collect anonymised data on page visits, session duration, navigation paths, and error events. This data helps hh99 identify and fix performance issues specific to the Bangladesh market. No personally identifiable information is included in analytics reports.
• Functionality cookies: Remember your stated preferences such as display settings and previously used payment methods, to save you time on return visits.
• Security cookies: Used to detect and prevent fraudulent login attempts, multi-account activity, and bot traffic. These are set when anomalous behaviour is detected and are retained only for the duration of the investigation.

hh99 does not currently deploy third-party advertising or retargeting cookies. If this changes, this Policy will be updated with at least 30 days' notice to existing players via email, and new consent will be sought before any advertising cookies are set.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using the platform. Disabling performance cookies will not affect your ability to play.

9 Data Security

hh99 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• 256-bit SSL/TLS encryption on all data in transit between your device and hh99 servers, including the hh99 Login flow, cashier transactions, and support communications.
• Encrypted data storage for sensitive fields including NID numbers, payment wallet references, and password hashes. Passwords are stored using a one-way cryptographic hash and are never stored or transmitted in plain text.
• Access controls: Internal access to player personal data is restricted on a strict need-to-know basis. Customer support agents can access only the data fields necessary to resolve your query. Access is logged and audited.
• Intrusion detection and monitoring: hh99 systems are monitored 24/7 for anomalous access patterns, brute-force attempts, and suspicious API calls. Automated alerts trigger immediate security review procedures.
• Penetration testing: hh99 engages third-party security specialists to conduct regular penetration tests of the platform infrastructure.
• Incident response: In the event of a data breach that affects your personal data, hh99 will notify affected players within 72 hours of becoming aware of the breach and will provide clear guidance on protective steps you should take.

While hh99 takes all reasonable technical and organisational precautions, no internet-based platform can guarantee absolute security. You are responsible for keeping your hh99 Login credentials confidential and for reporting any suspected unauthorised access to [email protected] immediately.

10 Your Data Rights

As a player whose personal data is processed by hh99, you hold the following rights. To exercise any of these rights, contact hh99 at [email protected] with the subject line "Data Rights Request" and your registered username.

• Right of access: You may request a copy of all personal data hh99 holds about you. hh99 will provide this within 30 days of a verified request, free of charge for the first request in any 12-month period.
• Right to rectification: If any personal data hh99 holds about you is inaccurate or incomplete, you have the right to request correction. Most contact and address details can be updated directly in your account settings without a formal request.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and hh99 has no overriding legitimate interest. Note that data subject to legal retention obligations (such as AML transaction records) cannot be deleted before the end of the applicable retention period.
• Right to restrict processing: You may request that hh99 restrict the processing of your data while a rectification or objection request is being evaluated, or where you contest the accuracy of the data.
• Right to data portability: You may request your personal data in a structured, machine-readable format (JSON or CSV) where processing is based on consent or contract performance.
• Right to object: You may object to processing based on hh99's legitimate interests or for direct marketing purposes. Upon receiving a valid objection to direct marketing, hh99 will cease marketing communications immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

hh99 will respond to all data rights requests within 30 days. In complex cases this may be extended by a further 60 days, with notice of the extension provided within the initial 30-day window.

11 Children and Minors

hh99 is strictly an adults-only platform. Registration and use of any hh99 service is limited to individuals who are 21 years of age or older. hh99 does not knowingly collect personal data from anyone under the age of 21.

All account registration attempts are subject to age verification checks. Where hh99 has reason to believe that a registered account is held by someone under 21, the account will be suspended immediately pending identity verification. If the account holder is confirmed to be under 21, the account will be permanently closed, any funds deposited will be returned to the source payment method (net of any winnings derived from play during the underage period), and all associated personal data will be securely deleted.

If you believe that a minor has registered or is accessing an hh99 account, please notify us immediately at [email protected]. We take underage gambling extremely seriously and will act on all such reports without delay.

12 Third-Party Links

The hh99 platform may contain informational references to third-party services such as payment partners (bKash, Nagad, Rocket, Upay) and game providers. If you navigate to a third-party website or application from a reference on hh99, please be aware that hh99 has no control over the privacy practices of those external sites.

This Privacy Policy applies exclusively to data processing carried out by hh99 on the hh99.io platform. hh99 accepts no responsibility for the privacy practices, terms, or content of third-party websites. We encourage you to read the privacy policy of any third-party service before sharing your personal data with them.

13 Amendments to This Privacy Policy

hh99 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. When material changes are made, hh99 will:

• Update the "Last updated" date at the top of this document and increment the version number.
• Notify registered players via email to their registered address at least 14 days before the revised Policy takes effect.
• Display a prominent notice on the hh99 platform for a period of 30 days following the update.

Your continued use of the hh99 platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with the revised Policy, you must cease using the platform and may request account closure by contacting [email protected]. Data already collected will continue to be processed under the terms in force at the time of collection until the applicable retention period expires.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to how hh99 handles your personal data, please contact the hh99 Data Privacy team using the details below. All privacy-related enquiries are handled with strict confidentiality.

• Email: [email protected]
• Subject line: Please include "Privacy Policy Enquiry" or "Data Rights Request" to ensure your message is routed to the correct team.
• Response time: Within 5 business days for general privacy enquiries; within 30 days for formal data rights requests.
• Operating hours: 24/7, Bangladesh Standard Time (BST, UTC+6).
• Language: English support available at all times.

Please include your registered username and a clear description of your request in all correspondence. Do not include your account password or full payment wallet number in any email communication.