va99 Privacy Policy

Who We Are

va99 ("va99", "we", "us", or "our") is the operator of the online betting and casino platform accessible at https://va99.io (the "Platform"). va99 is the data controller responsible for the personal information collected from users ("Players", "you", or "your") of the Platform.

This Privacy Policy applies to all personal data collected, processed, and stored by va99 in connection with your use of the Platform, including account registration, identity verification, financial transactions, game activity, customer support interactions, and marketing communications.

This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference and available on the Platform.

Personal Data We Collect

va99 collects personal data in the following categories. We collect only what is necessary and proportionate to the purpose for which it is processed.

va99 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, health records, or biometric data beyond what is strictly required for identity verification purposes.

How We Collect Your Data

va99 collects your personal data through the following channels:

• Direct Interactions: Data you provide voluntarily when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting feedback.
• Automated Technologies: Technical data collected automatically when you access the Platform, including IP address, browser information, device identifiers, and session activity logs captured via server logs and cookies.
• Payment Processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a deposit or withdrawal through their respective payment infrastructure.
• Game Providers: Game session data and RNG outcome logs received from our partner game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi — in connection with games you play on the Platform.
• Identity Verification Services: Where va99 uses a third-party KYC or identity verification service, that provider may supply verification status information, which va99 processes in conjunction with the documents you have provided directly.
• Publicly Available Sources: In specific circumstances related to fraud prevention or AML checks, va99 may cross-reference data against publicly available sources such as sanctions lists or politically exposed persons (PEP) databases.

How We Use Your Personal Data

va99 uses your personal data for the following purposes:

• Account Management: To create, maintain, and administer your va99 account, verify your identity, and ensure you meet our eligibility requirements (including the 21+ age policy).
• Service Delivery: To process deposits and withdrawals, settle bets and game outcomes, credit bonuses, and provide you with access to cricket betting, live casino, slots, Muay Thai Champion, Super Keno, and all other Platform services.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, multiple accounts, unauthorised access attempts, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor gaming activity patterns that may indicate problem gambling behaviour, to enforce deposit limits and self-exclusion periods you have set, and to contact you proactively where we have a duty of care concern.
• Legal Compliance: To comply with applicable anti-money laundering (AML) obligations, identity verification requirements, and any lawful requests from competent authorities.
• Customer Support: To respond to enquiries, investigate complaints, resolve disputes, and maintain records of support interactions for quality assurance and audit purposes.
• Platform Improvement: To analyse aggregate usage patterns, game performance data, and technical metrics in order to improve Platform stability, user experience, and service offerings. This analysis is conducted on anonymised or aggregated data where possible.
• Marketing and Promotions: Where you have given explicit consent, to send you promotional offers, bonus notifications, and product updates via email, SMS, or in-Platform messaging. You may withdraw this consent at any time.

Legal Basis for Processing

va99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our contract with you — i.e., to provide the betting and gaming services described in our Terms & Conditions. This covers account creation, transaction processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable legal obligations, including AML regulations, identity verification requirements, and data retention obligations.
• Legitimate Interests: Processing carried out on the basis of va99's legitimate business interests — specifically, fraud prevention, security monitoring, platform improvement, and responsible gaming oversight — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily applicable to marketing communications. Where consent is the basis, you have the right to withdraw it at any time without detriment by contacting [email protected] or using the opt-out mechanism in any marketing message.

Data Sharing & Third Parties

va99 does not sell, rent, or trade your personal data. We share data only with the following categories of third party, and only to the extent strictly necessary:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard — to process your deposits and withdrawals. These providers receive only the transactional data necessary to execute the payment instruction.
• Game Content Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi, and other licensed studios — to deliver game content and record game outcomes. Game providers receive session tokens and anonymised player identifiers rather than full personal profiles.
• Identity Verification and KYC Partners: Third-party providers who assist in verifying your identity and screening against AML watchlists and PEP databases. These partners are bound by strict data processing agreements.
• IT Infrastructure and Cloud Providers: Hosting, database, and cloud service providers who maintain the technical infrastructure of the Platform under data processing agreements that prohibit independent use of your data.
• Legal and Regulatory Authorities: Where va99 is required by law, court order, or regulatory instruction to disclose personal data to a competent authority — for example, in connection with an AML investigation or a legal proceeding. va99 will notify you of such a disclosure where legally permitted to do so.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by va99 under professional confidentiality obligations, where access to your data is necessary to provide the relevant advice or service.

All third parties who receive personal data from va99 are required to maintain appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose other than that for which it was shared.

Cookies & Tracking Technologies

va99 uses cookies and similar tracking technologies to operate the Platform effectively, enhance your user experience, and support our security and analytics functions. A cookie is a small text file placed on your device by the Platform when you visit.

Types of Cookies Used by va99:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during an active gaming session and security tokens that protect against cross-site request forgery. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, display preferences, and responsible gaming notification timers so you do not need to re-enter them on every visit.
• Analytics Cookies: Allow va99 to measure Platform usage, identify popular game categories (including cricket betting and slots), track page performance, and diagnose technical issues. Analytics data is aggregated and does not personally identify individual users.
• Security Cookies: Used by our fraud detection systems to identify unusual access patterns, multiple logins from different geographic locations, and other signals consistent with account compromise or automated abuse.

va99 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies that monitor your activity on other websites.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. For further information on how to manage cookies, refer to your browser's documentation.

Data Security

va99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and va99 servers is protected by 256-bit SSL encryption using TLS 1.3, the current industry standard for secure web communication.
• Encryption at Rest: Sensitive personal data fields stored in va99 databases — including identity document data and financial information — are encrypted at rest using AES-256 encryption.
• Password Security: Account passwords are stored as salted cryptographic hashes using a bcrypt or equivalent algorithm. va99 personnel cannot read your password. If you forget your password, it cannot be retrieved — only reset.
• Access Controls: Access to personal data within va99's systems is restricted on a strict need-to-know basis. Staff members can only access the categories of data required for their specific role. Access logs are maintained and reviewed regularly.
• Intrusion Detection: va99 operates automated intrusion detection and anomaly monitoring systems that flag suspicious access patterns for immediate review by our security team.
• Penetration Testing: The Platform undergoes periodic security assessments, including penetration testing, to identify and remediate vulnerabilities proactively.
• Incident Response: va99 maintains a documented data breach incident response procedure. In the event of a breach that poses a risk to your rights and freedoms, va99 will notify affected individuals within a reasonable timeframe.

Data Retention

va99 retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised aggregate data may be retained indefinitely for statistical and research purposes.

Your Data Rights

As a va99 account holder, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] with your full name, registered email address, and a description of your request. va99 will respond within 30 days.

• Right of Access: You may request a copy of all personal data va99 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to va99's legal obligations — data that must be retained under AML or financial regulations cannot be deleted before the mandatory retention period expires.
• Right to Restrict Processing: You may request that va99 limit the processing of your data in certain circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: You have the right to receive a structured, machine-readable copy of personal data you have provided to va99, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes at any time. va99 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Children's Privacy

The va99 Platform is strictly intended for adults aged 21 years and older. va99 does not knowingly collect, process, or store personal data from individuals under the age of 21.

Age verification is conducted as a mandatory part of the account registration and KYC process. Any account found to have been registered by a person under the age of 21 will be immediately closed, all associated balances will be forfeited, and any personal data collected will be securely deleted in accordance with our data retention policy, subject to any legal obligations to retain records of the underage access incident.

If you have reason to believe that a person under 21 has registered an account on va99, please report this to us immediately at [email protected]. We will investigate and take appropriate action without delay.

Marketing Communications

va99 may send you promotional communications — including bonus offers, game launch announcements, seasonal promotions (such as Eid, Pohela Boishakh, and BPL season offers), and platform updates — by email or SMS, but only where you have given your explicit consent to receive such communications.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email we send;
• Replying "STOP" to any marketing SMS;
• Updating your communication preferences in your va99 account settings; or
• Contacting our support team at [email protected] with a written opt-out request.

Opting out of marketing communications does not affect transactional messages relating to your account — such as deposit confirmations, withdrawal notifications, security alerts, and KYC status updates — which va99 will continue to send as they are necessary for the operation of your account.

va99 does not engage in unsolicited bulk marketing (spam). We will not pass your contact details to third-party marketers for their own promotional purposes.

Changes to This Privacy Policy

va99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform operations. Where changes are material, we will provide reasonable advance notice to registered Players by email or via a prominent notice on the Platform before the updated policy takes effect.

The effective date displayed at the top of this policy indicates when the current version was last reviewed and approved. We encourage you to review this Privacy Policy periodically to stay informed of how we protect your personal data.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms.

Contact Us

For all privacy-related enquiries, data rights requests, or concerns about how va99 handles your personal information, please contact our dedicated support team using the details below:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the Platform at va99.io
• Response Time: Data rights requests responded to within 30 days of receipt; general privacy enquiries within 24 hours
• Operating Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

When contacting us regarding a data rights request, please include your full name, registered email address, and a clear description of your request to help us process it promptly and accurately.