cry99 Privacy Policy
We respect your privacy and are committed to protecting your personal data. This policy explains what we collect, why we collect it, and how you can exercise your rights.
This Privacy Policy ("Policy") describes how cry99 ("we", "us", "our") collects, uses, stores, shares, and protects personal data about registered players and visitors to cry99.org. By registering an account or using the cry99 platform, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not register or continue to use the cry99 platform.
Your Data, Your Rights
cry99 does not sell your personal data to third parties. We do not share your data with advertisers or data brokers. Your personal information is used only for the purposes of running your cry99 account, processing payments, preventing fraud, and complying with our legal obligations. You have the right to access, correct, and delete your personal data at any time by contacting [email protected].
How cry99 Protects Your Privacy
Six key commitments that define how cry99 handles your personal data.
SSL Encryption
All data transmitted between your device and cry99.org is encrypted with SSL/TLS. Your payment details and login credentials are never sent in plain text.
No Data Selling
cry99 never sells, rents, or trades your personal data to advertisers, data brokers, or any commercial third party for marketing purposes.
Access Rights
You can request a full copy of all personal data cry99 holds about you at any time. We will respond to data access requests within 30 days.
Deletion Right
You may request deletion of your personal data at any time, subject to legal retention requirements. Verified requests are processed within 30 days.
Secure Storage
Personal data is stored on servers protected by industry-standard security controls, access controls, and regular security audits.
bKash & Nagad Safety
Payment data for bKash and Nagad transactions is processed directly by the payment provider. cry99 never stores your full mobile banking PIN or wallet password.
1. What Personal Data We Collect
cry99 collects personal data about you through three channels: data you provide directly when registering or using the platform, data generated automatically by your use of the platform, and data received from third-party service providers involved in payment processing and fraud detection. Below is a complete list of the categories of personal data we collect.
Registration and Account Data
When you create a cry99 account, we collect the following information:
- Full name as it appears on your government-issued identity document.
- Date of birth — used to verify that you meet the 21+ age requirement.
- Bangladeshi mobile phone number — used as your primary account identifier and for SMS-based account security.
- Email address (optional at registration, required for withdrawal notifications and account recovery).
- KYC identity documents — NID, Birth Registration Certificate, or valid Bangladeshi Passport — submitted during the identity verification process before your first withdrawal.
Transaction and Payment Data
When you make deposits or request withdrawals, we collect and retain the following transaction data:
- Transaction amounts, timestamps, and payment method references (bKash transaction ID, Nagad reference number, bank transfer reference, or card last 4 digits). cry99 never stores complete card numbers or mobile wallet PINs.
- Account balance history — deposits, withdrawals, wagers placed, bonus credits, and adjustments.
- Bonus and promotional offer claim records.
- Customer support communication logs — including live chat transcripts and email correspondence related to your account.
Technical and Usage Data
When you access cry99.org, our systems automatically collect technical data about your connection and device. This data is used for security monitoring, fraud detection, and improving the platform experience for Bangladesh players:
- IP address and approximate geographic location (used to detect account sharing or multiple account violations, not for granular location tracking).
- Device type, operating system, browser type, and screen resolution — used to optimise the platform display for your specific device. This is especially relevant given the range of Android devices used by Bangladesh players.
- Session logs — pages visited, games played, betting activity, session start and end times, and actions taken within your account. These logs are retained for a maximum of 12 months for security purposes.
2. How We Use Your Personal Data
cry99 uses the personal data we collect only for the following specific, defined purposes. We do not use your data for purposes beyond those listed below without first obtaining your explicit consent:
- Account creation and management — setting up and maintaining your cry99 player account, processing login requests, and managing account settings and preferences.
- Payment processing — processing your deposits and withdrawal requests through bKash, Nagad, bank transfer, and card payment channels, and maintaining your account balance records.
- Identity verification (KYC) — verifying your age and identity to comply with our responsible gaming policies and to prevent underage gambling and identity fraud.
- Fraud prevention and security — monitoring account activity to detect and prevent fraudulent transactions, multiple account registrations, bonus abuse, money laundering, and other prohibited conduct as defined in the Terms and Conditions.
- Responsible gaming — using your deposit history, session duration data, and betting patterns to identify potential problem gambling behaviours and to apply responsible gaming tools (deposit limits, time-outs, self-exclusion) where appropriate or as requested by you.
- Customer support — using your account data and communication history to resolve support queries, process complaints, and improve the quality of our support service.
- Service communications — sending you account-related notifications such as deposit confirmations, withdrawal processing updates, KYC verification status updates, and security alerts. These communications are transactional, not promotional, and cannot be opted out of while your account is active.
cry99 does not use your personal data for automated decision-making that produces legal effects or similarly significant effects on you without human review. Where cry99's fraud detection systems flag an account for review, the final decision to suspend or close an account is made by a human member of the compliance team, not by an automated system alone.
3. Legal Basis for Processing Your Data
cry99 processes your personal data under one or more of the following legal bases depending on the specific processing activity:
- Contractual necessity — processing your registration data, transaction data, and KYC data is necessary to perform the contract between you and cry99 (i.e., to run your player account and process your deposits and withdrawals).
- Legal obligation — processing your identity documents for KYC verification and retaining transaction records is required by applicable anti-money laundering, fraud prevention, and responsible gaming regulations.
- Legitimate interests — processing technical and usage data for fraud detection, security monitoring, and platform improvement serves the legitimate interests of cry99 and its players in maintaining a secure and fair gaming environment. These interests are balanced against your privacy rights and do not override them.
- Consent — where cry99 sends you optional promotional communications (such as bonus offer notifications or seasonal promotions tied to cricket tournaments, Eid, or Pohela Boishakh), we do so on the basis of your consent. You may withdraw consent to promotional communications at any time by contacting [email protected].
4. Sharing Your Personal Data
cry99 does not sell your personal data. We do not share your personal data with advertisers, data brokers, social media platforms, or any third party for commercial marketing purposes. Personal data is shared only in the limited circumstances described below.
Service Providers and Data Processors
cry99 engages the following categories of third-party service providers to process personal data on our behalf, under data processing agreements that require them to maintain the same level of data protection as cry99:
- Payment processors — bKash, Nagad, and banking partners process transaction data as independent data controllers under their own privacy policies. cry99 shares only the minimum transaction data necessary for payment processing.
- Identity verification providers — KYC document verification is processed by certified identity verification service providers. Your identity documents are shared only for the purpose of confirming your name, date of birth, and document authenticity.
- Game providers — Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming receive a player session token to authenticate game sessions. They do not receive your full name, date of birth, KYC documents, or payment data.
- Fraud detection and security services — technical data including IP addresses and session patterns may be shared with fraud detection service providers to identify and block fraudulent access attempts.
Legal Disclosure
cry99 may be required to disclose personal data to law enforcement agencies, regulatory authorities, or courts in response to a valid legal order, warrant, or court judgment. cry99 will notify affected players of any such disclosure request to the extent permitted by law. Where notification is prohibited by law (for example, in connection with an active criminal investigation), cry99 will comply with the legal order without prior notification.
No Cross-Border Data Transfers Without Safeguards
Where personal data is transferred to service providers located outside Bangladesh, cry99 ensures that appropriate safeguards are in place to protect your data to the same standard as it would be protected within Bangladesh. cry99 does not transfer personal data to countries that do not maintain adequate data protection standards without first implementing appropriate contractual protections.
5. Cookies and Tracking Technologies
cry99.org uses cookies and similar tracking technologies to operate the platform, maintain your login session, remember your preferences, and analyse platform usage patterns for security and performance monitoring purposes. cry99 does not use advertising cookies or tracking technologies that share data with third-party advertising networks.
Types of Cookies Used
- Essential cookies — required for the cry99 platform to function. These include your session authentication cookie (which keeps you logged in during a session), security tokens, and CSRF protection tokens. These cookies cannot be disabled without breaking the platform's core functionality.
- Functional cookies — remember your platform preferences such as language setting (English or Bengali), sound preferences, and display settings. These improve your experience but are not strictly required for the platform to operate.
- Analytics cookies — collect anonymised data about how players navigate and use cry99.org, including which pages are visited most frequently and where players exit the site. This data is used internally to improve platform design and performance.
- Security cookies — used by cry99's fraud detection systems to identify suspicious access patterns, detect bot traffic, and protect player accounts from unauthorised access.
You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in to your cry99 account. Disabling functional or analytics cookies will not affect your ability to play games or make transactions. cry99 does not use persistent tracking cookies that follow you across other websites.
6. Data Retention
cry99 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to legal retention obligations that require certain categories of data to be kept for defined minimum periods. The following retention periods apply:
- Account data (name, date of birth, mobile number, email) — retained for the duration of your active account, plus 5 years following permanent account closure to satisfy anti-money laundering record-keeping obligations.
- Transaction records (deposit history, withdrawal history, betting history) — retained for 7 years from the date of each transaction in accordance with financial record-keeping requirements.
- KYC identity documents — retained for 5 years following permanent account closure. After this period, document images are securely deleted and only a record of the verification outcome (verified / not verified) and verification date is retained.
- Technical and session logs — retained for a maximum of 12 months from the date of the session. After 12 months, session logs are deleted unless they are required as evidence in connection with an ongoing fraud investigation or legal proceeding.
If you request deletion of your personal data before these retention periods have expired, cry99 will delete all data that is not subject to a mandatory legal retention obligation. Data subject to a legal retention obligation will be marked as restricted — it will not be used for any active purpose and will be deleted automatically at the end of the mandatory retention period.
Your Rights Over Your Personal Data
As a cry99 player, you have the following rights over your personal data. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request".
- Right of Access — you may request a copy of all personal data cry99 holds about you. We will provide this in a structured, machine-readable format within 30 days of receiving your verified request.
- Right of Rectification — if any personal data cry99 holds about you is inaccurate or incomplete, you may request that we correct or complete it. We will process rectification requests within 14 days.
- Right to Erasure — you may request deletion of your personal data. We will delete all data not subject to a mandatory legal retention obligation within 30 days. Data subject to legal retention obligations will be restricted and deleted automatically at the end of the mandatory period.
- Right to Restriction — you may request that we restrict the processing of your personal data in certain circumstances, for example if you dispute the accuracy of data we hold or if you have objected to processing pending verification of whether our legitimate interests override your rights.
- Right to Data Portability — you may request a copy of your personal data in a portable, machine-readable format (JSON or CSV) so that you can transfer it to another service provider of your choice. This right applies to data you have provided directly and that we process on the basis of your consent or contractual necessity.
- Right to Object — you may object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
How to Submit a Data Rights Request
Send your request to [email protected] with the subject line "Data Rights Request". Include your full name, the mobile number registered to your account, and a description of the right you wish to exercise. We will verify your identity before processing the request to protect against fraudulent requests. All verified data rights requests are processed at no charge to you.
7. Data Security
cry99 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The following security controls are in place:
- SSL/TLS encryption on all data transmissions between your device and cry99.org. All login credentials and payment data are transmitted over encrypted connections only.
- Password hashing — player passwords are stored using a one-way cryptographic hash function. cry99 staff cannot read your password; only you know it. If you forget your password, it must be reset, not recovered.
- Access controls — access to personal data within cry99's internal systems is restricted to staff members who need it to perform their specific job functions. All internal data access is logged and audited.
- Regular security assessments — cry99's platform and data storage infrastructure undergo regular security reviews to identify and address potential vulnerabilities before they can be exploited.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, cry99 will notify affected players without undue delay and will take immediate steps to contain the breach and assess its impact. cry99 will cooperate fully with any investigation by relevant authorities following a reportable data breach.
8. Children and Minors
The cry99 platform is strictly for adults aged 21 and above. cry99 does not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not register an account, use the cry99 platform, or submit any personal data to cry99.org.
If cry99 discovers that personal data has been collected from a person under the age of 21, the account will be permanently closed, all data will be deleted as promptly as possible (subject to any mandatory legal retention periods), and the matter will be referred to the relevant authorities. cry99 uses date-of-birth verification at registration and KYC age verification as part of its underage prevention programme.
Parents and Guardians
If you are the parent or guardian of a person under 21 and you believe they have registered an account or submitted personal data to cry99.org, please contact [email protected] immediately. We will investigate and take appropriate action, including permanent account closure and data deletion, as quickly as possible.
9. Third-Party Links
The cry99 platform may contain references to third-party services such as payment providers (bKash, Nagad) and game providers (Pragmatic Play, Evolution Gaming). While these providers are integrated into the cry99 platform experience, they operate under their own independent privacy policies. cry99 is not responsible for the data practices of third-party service providers and recommends that you review the privacy policy of any third-party provider whose services you use.
cry99.org does not contain outbound links to external websites. All navigation on cry99.org remains within the cry99 platform. This policy therefore applies to all pages and sections of cry99.org, and there are no third-party website links on this platform through which your data could be shared with external parties without your knowledge.
10. Changes to This Privacy Policy
cry99 reserves the right to update or amend this Privacy Policy at any time. Where an amendment materially affects how we process your personal data or materially reduces your privacy rights, we will provide at least 14 days' notice before the amendment takes effect, either by displaying a prominent notice on cry99.org or by sending an SMS or email notification to your registered contact details.
The version date at the top of this page will be updated to reflect all amendments. The most current version of this Privacy Policy is always available at cry99.org/privacy-policy. Your continued use of the cry99 platform following any amendment constitutes your acceptance of the revised Policy.
11. Contact and Data Protection Enquiries
If you have questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how cry99 has handled your personal data, please contact our data protection team using the details below. We aim to respond to all data protection enquiries within 5 business days and to resolve all substantive data rights requests within 30 days of receipt of a verified request.
For formal data rights requests, please use the subject line "Data Rights Request" in your email. For general privacy enquiries, the subject line "Privacy Enquiry" is sufficient. All communications are handled in strict confidence by our data protection team.
Data Protection Contact
Email: [email protected] — Response time: within 5 business days for general enquiries, within 30 days for data rights requests. Please include your full name and the mobile number registered to your account so we can verify your identity before processing your request.
Your Privacy Is Our Priority
Have more questions about how we protect your data? Visit our FAQ or explore cry99 Casino — Bangladesh's trusted online gaming platform with SSL encryption and instant bKash support.
Explore cry99 Casino Visit Our FAQ Read Terms & Conditions 21+ only. Gambling involves financial risk. Please play within your means.