rk99 Privacy Policy — How We Protect Your Personal Data

1.1 rk99 is an online casino and sports betting platform operated at rk99.im, designed specifically for players in Bangladesh. We understand that privacy is important to our players and we are committed to handling all personal data responsibly, transparently, and securely.

1.2 This Policy applies to all personal data collected through the rk99 website, mobile browser interface, and any other digital touchpoint operated by rk99. It covers data collected from registered players, prospective players who visit the platform without registering, and any individual who contacts rk99 support.

1.3 This Policy should be read alongside the rk99 Terms & Conditions, which govern the overall relationship between rk99 and its players. The Terms & Conditions are available at rk99.im/terms-conditions.

1.4 rk99 acts as the data controller in respect of the personal data described in this Policy. All data-related queries, access requests, and deletion requests should be directed to [email protected].

2.1 rk99 collects personal data in three primary ways: data you provide directly when registering or interacting with the platform, data generated automatically through your use of the platform, and data received from third-party service providers such as payment processors and identity verification agencies.

2.2 Data You Provide Directly

When you register an account, make a deposit, contact our support team, or participate in a promotion, you may provide the following categories of personal data:

• Identity Data: Full name, date of birth, gender, and national identity card number or passport number (for KYC verification purposes).
• Contact Data: Email address, mobile phone number, and residential address (city, district, and division within Bangladesh).
• Financial Data: Mobile financial service account identifiers (bKash number, Nagad number, Rocket number, Upay number) and bank account details used for deposits and withdrawals. rk99 does not store full card numbers or mobile wallet PINs.
• Account Credentials: Username and hashed password (passwords are never stored in plain text).
• Verification Documents: Scanned copies or photographs of identity documents submitted for KYC purposes.
• Support Communications: Records of correspondence between you and the rk99 support team, including chat transcripts and email exchanges.

2.3 Data Collected Automatically

When you visit or use the rk99 platform, the following data is collected automatically through technical means:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, games launched, session duration, bet history, deposit and withdrawal activity, and navigation path through the platform.
• Location Data: Approximate geographic location derived from IP address, used to ensure compliance with jurisdictional restrictions.
• Cookie Data: Session identifiers, preference settings, and analytics identifiers stored via cookies and similar tracking technologies (see Section 6).

2.4 Data Received from Third Parties

rk99 may receive limited personal data from the following third-party sources:

• Payment Processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, and partner banks to verify that deposits and withdrawals have been completed successfully.
• Identity Verification Providers: Verification status outcomes from KYC service providers used to confirm player identity without rk99 needing to retain full document copies longer than necessary.
• Fraud Prevention Services: Risk scores and device fingerprinting data from fraud detection partners used to protect the platform from fraudulent activity.

3.1 rk99 uses personal data for the following purposes. For each purpose, we have identified the legal basis that justifies the processing (see Section 4 for the full legal basis explanation).

3.2 rk99 will not use your personal data for any purpose not listed above without first obtaining your explicit consent or establishing a separate legal basis for the new processing activity.

3.3 You may opt out of promotional communications at any time by contacting [email protected] with the subject line "Marketing Opt-Out — [Your Username]". Opting out of marketing does not affect service-related communications such as transaction confirmations and security alerts.

4.1 rk99 processes personal data under the following legal bases, consistent with applicable data protection principles:

• Contract Performance: Processing is necessary to perform the contract between rk99 and the player — specifically, to operate the player account, facilitate betting activity, and process financial transactions. Without this processing, rk99 cannot provide the platform service.
• Legal Obligation: Certain processing activities are required to comply with applicable legal requirements, including anti-money laundering obligations, age verification requirements, and responses to lawful requests from authorities.
• Legitimate Interests: rk99 processes certain data to pursue its legitimate business interests, including fraud detection, platform security, and service improvement — provided those interests are not overridden by your privacy rights. We conduct a balancing test for each legitimate interest processing activity.
• Consent: Where rk99 relies on your consent as the legal basis for processing (e.g., sending promotional offers), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.2 Where rk99 is required by law to process your personal data (for example, for identity verification or anti-money laundering purposes), failure to provide the requested data may result in rk99 being unable to maintain your player account.

5.1 rk99 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose.

5.2 The categories of third parties with whom rk99 may share personal data are as follows:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and Sonali Bank receive the minimum transaction and identity data necessary to process deposits and withdrawals requested by the player.
• Identity Verification Providers: KYC service providers receive copies of identity documents and identity data solely for the purpose of verifying player age and identity as required by rk99's anti-fraud and responsible gaming policies.
• Fraud Detection and Security Providers: Device fingerprinting and risk-scoring providers receive technical and usage data to identify and prevent fraudulent account activity on the rk99 platform.
• IT Infrastructure and Hosting Providers: Cloud hosting and data storage providers who host the rk99 platform infrastructure. These providers process personal data only under rk99's documented instructions and are contractually bound to maintain appropriate security standards.
• Game Content Providers: Third-party game studios including Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and Evolution Gaming may receive a session token and anonymised gameplay data to power their game engines. These providers do not receive personally identifiable player data beyond what is technically necessary to authenticate the game session.
• Legal and Regulatory Authorities: rk99 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, court order, or lawful regulatory demand. rk99 will notify affected players of such disclosures where legally permitted to do so.

5.3 All third-party data processors engaged by rk99 are subject to written data processing agreements that require them to process personal data only in accordance with rk99's instructions, maintain appropriate technical and organisational security measures, and not sub-process data without rk99's prior written consent.

6.1 The rk99 platform uses cookies and similar tracking technologies to maintain session state, remember player preferences, and collect anonymous analytics data to improve the platform. A "cookie" is a small text file placed on your device by the rk99 server when you visit the platform.

6.2 rk99 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, security tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences such as preferred language, display settings, and responsible gaming tool configurations. These cookies improve your experience but are not strictly required for core functionality.
• Analytics Cookies: Used to collect anonymised data about how players navigate the platform — for example, which game categories are most visited and which deposit flows have the highest completion rate. This data helps rk99 improve the platform experience for all players in Bangladesh. Analytics data is aggregated and does not identify individual players.
• Security Cookies: Used by rk99's fraud detection systems to identify and flag suspicious device patterns. These cookies contribute to the protection of all player accounts on the platform.

6.3 rk99 does not use advertising cookies, retargeting cookies, or any tracking technology designed to serve targeted advertisements to players on third-party websites.

6.4 You can control cookie settings through your browser preferences. Note that disabling strictly necessary cookies will prevent you from logging in to the rk99 platform. Instructions for managing cookies in popular browsers are available in each browser's help documentation.

7.1 rk99 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply as a general guide:

7.2 At the end of each applicable retention period, personal data is either securely deleted using industry-standard data destruction methods or irreversibly anonymised so that it can no longer be associated with an individual player.

7.3 Where retention is required by a legal obligation, rk99 will retain data for the full period required by that obligation even if the player requests deletion before that period has elapsed. rk99 will inform the player of any such legal basis that prevents deletion.

8.1 rk99 implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes, but is not limited to, the following measures:

• Encryption in Transit: All data transmitted between your device and the rk99 platform is encrypted using TLS 1.2 or higher. The rk99 platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data including identity documents, financial records, and account credentials is encrypted at rest using AES-256 encryption.
• Password Security: Player passwords are never stored in plain text. rk99 uses industry-standard cryptographic hashing with salting to store password credentials.
• Access Controls: Access to personal data within rk99's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo regular data protection training.
• Intrusion Detection: rk99's infrastructure is monitored continuously for signs of unauthorised access or anomalous activity using automated intrusion detection systems.
• Penetration Testing: rk99 conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in the platform.
• Incident Response: rk99 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a risk to affected players, rk99 will notify affected players without undue delay.

8.2 While rk99 takes all reasonable precautions to protect your personal data, no system connected to the internet can be guaranteed to be completely secure. Players are encouraged to use strong, unique passwords for their rk99 accounts and to report any suspected unauthorised access to [email protected] immediately.

9.1 As a player whose personal data is processed by rk99, you have the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data that rk99 holds about you. rk99 will provide this information within 30 days of receiving a valid access request.
• Right to Rectification: You have the right to request correction of any personal data that rk99 holds about you that is inaccurate or incomplete. You may update basic contact information directly through your account settings; for corrections to identity documents or KYC records, please contact support.
• Right to Erasure: You have the right to request deletion of your personal data. rk99 will honour deletion requests subject to any legal retention obligations that require rk99 to retain specific data categories (see Section 7). Note that deletion of your account will result in permanent loss of your betting history and any remaining account balance — please ensure you have withdrawn all funds before requesting account deletion.
• Right to Restriction of Processing: You have the right to request that rk99 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to rk99 in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where rk99 relies on legitimate interests as the legal basis. rk99 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where rk99 relies on your consent for processing (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

9.2 To exercise any of the above rights, please contact rk99 in writing at [email protected] with the subject line "Data Rights Request — [Your Username]". rk99 may ask you to verify your identity before processing your request to prevent unauthorised access to your personal data.

9.3 rk99 will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or voluminous, rk99 may extend this period by a further 30 days and will inform you of the extension and the reason for it.

9.4 rk99 will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive, in which case rk99 reserves the right to charge a reasonable administrative fee or decline to respond.

10.1 The rk99 platform is strictly intended for adults aged 21 and above. rk99 does not knowingly collect personal data from individuals under the age of 21.

10.2 During the account registration process, rk99 requires players to confirm that they are aged 21 or above. Where rk99 has reason to believe that an account has been registered by a person under the age of 21, the account will be immediately suspended, all associated personal data will be permanently deleted, and any deposits made by the underage individual will be returned to the originating payment method where technically possible.

10.3 If you are a parent or guardian and believe that a minor under your care has accessed or registered on the rk99 platform, please contact us immediately at [email protected] with the subject line "Underage Account Report". rk99 will prioritise such reports and take immediate action.

11.1 rk99 is a platform operated for players in Bangladesh. Your personal data is primarily processed and stored on servers located in data centres that service the rk99 platform. In some cases, personal data may be transferred to third-party service providers whose infrastructure is located outside Bangladesh — for example, cloud hosting providers, identity verification services, or game content platforms.

11.2 Where personal data is transferred outside Bangladesh, rk99 takes steps to ensure that appropriate safeguards are in place to protect the data. These safeguards may include:

• Contractual clauses with the recipient that require them to protect the data to a standard equivalent to that applicable within Bangladesh.
• Transferring data only to recipients in jurisdictions that have been assessed as providing an adequate level of data protection.
• Obtaining your explicit consent to the transfer in circumstances where no other safeguard is available.

11.3 If you have questions about the safeguards in place for any specific international transfer of your personal data, please contact [email protected].

12.1 rk99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. The date of the most recent update is displayed at the top of this page.

12.2 Where an update to this Policy involves a material change to how rk99 processes your personal data, rk99 will notify registered players by email to the address on file or via an in-platform notification at least 14 days before the change takes effect. Continued use of the rk99 platform after the effective date of the updated Policy constitutes acceptance of the revised terms.

12.3 We encourage you to review this Privacy Policy periodically to stay informed about how rk99 protects your personal data. If you have any concerns about any change to this Policy, please contact us at [email protected] before the effective date of the change.

12.4 Previous versions of this Privacy Policy are available on request by contacting [email protected] with the subject line "Previous Privacy Policy Version Request".

13.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way rk99 processes your personal data, please contact our dedicated data protection team using the details below.

13.2 All privacy-related enquiries should be submitted in writing to ensure a clear record of the communication and to facilitate timely resolution.

• Email (Privacy Enquiries): [email protected]
• Subject Line Format: "Privacy Enquiry — [Your Username]" or "Data Rights Request — [Your Username]"
• Response Time: rk99 aims to respond to all privacy-related enquiries within 5 business days and to all formal data rights requests within 30 calendar days.
• Business Hours: Our support team is available 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6).

13.3 rk99 is committed to resolving all privacy-related concerns directly and promptly. If you feel that your concern has not been adequately addressed by rk99, you may have the right to escalate your complaint to an applicable data protection authority.