Privacy Policy — goya999 Data Commitment

1. Data Controller Information

goya999 acts as the data controller in respect of all personal data collected from players and visitors to the goya999 platform. As data controller, goya999 determines the purposes and means by which personal data is processed and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all privacy-related enquiries, requests to exercise your data rights, or concerns regarding this Privacy Policy, you may contact the goya999 Data Protection team directly. All communications should be directed to the official support address: [email protected]. Please include the subject line "Privacy Request" to ensure your message is routed to the correct team promptly.

goya999 is committed to processing personal data only for legitimate purposes and in accordance with applicable data protection principles. We do not sell, rent, or otherwise commercialise your personal data to any third party for their own marketing purposes.

2. Information We Collect

goya999 collects personal data from players and visitors through several channels, including account registration, identity verification, financial transactions, gameplay activity, and technical interactions with the platform. The categories of data we collect are described below.

2.1 Registration and Account Data

When you create a goya999 account, we collect the information you provide directly, including your full name, date of birth, email address, mobile number, and residential address. This information is required to open and maintain a player account and to comply with our age verification and Know Your Customer (KYC) obligations.

2.2 Identity Verification Documents

As part of our KYC process, we may collect copies of government-issued identity documents such as a National ID card, passport, or driving licence. We may also collect proof of address documents (utility bills or bank statements) and evidence of ownership of the payment method used for deposits and withdrawals (for example, a screenshot confirming ownership of a bKash, Nagad, or Rocket account). These documents are used solely for verification purposes and are stored securely.

2.3 Financial Transaction Data

When you make a deposit or request a withdrawal, goya999 records transaction details including the payment method used, transaction amount in Bangladeshi Taka (৳), transaction date and time, and transaction reference numbers. We do not store full card numbers, CVV codes, or complete mobile banking PIN credentials — payment processing is handled by our payment partners under their own security standards.

2.4 Gameplay and Betting Activity

We collect records of all betting and gaming activity conducted through your goya999 account. This includes game type, bet amounts, game outcomes, session duration, and time-stamped activity logs. This data is used for account management, dispute resolution, responsible gaming monitoring, and fraud detection.

2.5 Technical and Device Data

When you access the goya999 platform, our systems automatically collect certain technical data, including your IP address, browser type and version, operating system, device type, referring URL, pages visited, session timestamps, and connection metadata. This data is collected via server logs and analytics tools to maintain platform performance and security.

2.6 Communications Data

If you contact the goya999 support team via email, live chat, or any other channel, we retain records of those communications including the content of your messages, timestamps, and any attachments or screenshots you share. This data is used to manage your support queries and to improve the quality of our customer service.

3. Legal Basis for Processing

goya999 processes personal data only where a valid legal basis exists for doing so. The legal bases on which we rely are set out in the table below, together with the corresponding processing activities.

Where goya999 relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. To withdraw consent for marketing communications, you may use the unsubscribe link in any promotional email or contact our support team directly.

4. How We Use Your Data

goya999 uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the original reason it was collected. The primary purposes for which we process player data include:

• Account management: Creating, maintaining, and administering your goya999 player account, including processing logins, updating account details, and managing account closure requests.
• Payment processing: Facilitating deposits via bKash, Nagad, Rocket, Upay, and other supported payment methods; processing withdrawal requests; maintaining financial records in Bangladeshi Taka (৳); and managing refunds or chargebacks where applicable.
• Age and identity verification: Confirming that all registered players are aged 18 or above; verifying identity documents as part of KYC procedures; and complying with applicable anti-money laundering requirements.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling; enforcing self-exclusion arrangements; applying deposit limits, loss limits, and session time limits requested by players; and facilitating referrals to support services where appropriate.
• Fraud prevention and security: Detecting and investigating suspicious activity, multiple account creation, bonus abuse, collusion, and other prohibited conduct; protecting the integrity of the goya999 platform; and sharing data with payment providers and law enforcement where required.
• Customer support: Responding to and resolving player queries, complaints, and disputes; improving support processes based on communication patterns and feedback.
• Platform improvement: Analysing aggregated usage data to understand how players interact with goya999 games, betting markets, and features; identifying technical issues; and informing product development decisions.
• Marketing communications: Sending promotional offers, bonus notifications, and seasonal campaigns (such as BPL, IPL, and Eid promotions) to players who have opted in to receive such communications. Players may opt out at any time.
• Legal compliance: Meeting all obligations imposed by applicable law, including responding to valid requests from law enforcement or regulatory authorities.

5. Cookies & Tracking Technologies

goya999 uses cookies and similar tracking technologies to operate and improve the platform, personalise your experience, and deliver relevant promotions. A cookie is a small text file placed on your device when you visit the goya999 platform. Cookies do not contain executable code and cannot carry viruses.

5.1 Types of Cookies We Use

• Essential cookies: Required for core platform functionality, including session management, login authentication, and security. These cookies cannot be disabled without impairing your ability to use the platform.
• Analytics cookies: Used to collect anonymous data about how visitors interact with the goya999 platform, including pages visited, time on site, and navigation paths. This data helps us identify areas for improvement.
• Preference cookies: Remember settings you have applied to the platform, such as language preference, display settings, and responsible gaming limit configurations.
• Marketing cookies: Used to deliver promotional content that is relevant to your interests and activity on the goya999 platform. These are only placed with your consent.

5.2 Managing Your Cookie Preferences

You can control non-essential cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies from specific websites. Please note that disabling essential cookies will affect your ability to log in to and use the goya999 platform. Detailed guidance on managing cookies in popular browsers is available from the browser's own help documentation.

6. Data Sharing & Third Parties

goya999 does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

6.1 Payment Processors

To facilitate deposits and withdrawals, goya999 shares relevant transaction data with our payment partners including bKash, Nagad, Rocket, Upay, SureCash, Tap, Visa, and Mastercard. These partners receive only the data necessary to process the specific transaction and are bound by their own data protection obligations. goya999 does not share full KYC documentation with payment processors unless specifically required to investigate a disputed transaction.

6.2 Game Providers

Where you play games operated by third-party providers — including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe — your session and gameplay data is shared with the relevant provider to the extent required to operate the game, resolve disputes, and comply with fair play requirements. These providers operate under their own data protection frameworks.

6.3 Fraud Prevention and Security Partners

goya999 may share player data with specialist fraud detection and security services to identify and prevent fraudulent activity, multi-accounting, and other prohibited conduct. Any such sharing is conducted under contractual data protection safeguards.

6.4 Legal and Regulatory Authorities

goya999 will disclose personal data to law enforcement agencies, regulators, or other public authorities where required to do so by applicable law, court order, or other lawful request. We will notify you of such a disclosure where we are legally permitted to do so.

6.5 Business Transfers

In the event that goya999 undergoes a merger, acquisition, or sale of all or a substantial part of its assets, player data may be transferred to the acquiring entity as part of that transaction. We will notify affected players of any such change in ownership or control and of any resulting changes to this Privacy Policy.

7. Data Retention

goya999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account data and KYC documents: Retained for the duration of your active account plus a minimum of 5 years following account closure, to comply with anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping obligations.
• Gameplay and betting records: Retained for 3 years following the last activity on your account, after which they are anonymised or deleted.
• Customer support communications: Retained for 2 years from the date of the last communication, unless a dispute or legal proceeding requires longer retention.
• Technical and device data (server logs): Typically retained for 90 days, after which they are automatically deleted or anonymised.
• Marketing consent records: Retained until you withdraw consent, plus a reasonable period thereafter to evidence the withdrawal.

Where data is no longer required for any lawful purpose, goya999 will securely delete or anonymise it. Anonymised data — which cannot be linked back to any individual — may be retained indefinitely for statistical and analytical purposes.

8. Your Privacy Rights

As a player or user of the goya999 platform, you hold a number of rights in relation to the personal data we hold about you. goya999 is committed to facilitating the exercise of these rights promptly and without unnecessary obstruction. Your rights include:

• Right of access: You have the right to request a copy of the personal data goya999 holds about you, together with information about how it is being processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to erasure: In certain circumstances, you have the right to request that we delete personal data we hold about you. This right is not absolute — it does not apply where we are required to retain the data for legal compliance purposes.
• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling. You also have the right to object to processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact the goya999 Data Protection team at [email protected] with the subject line "Privacy Request — [Right Being Exercised]". We will acknowledge your request within 5 business days and aim to provide a substantive response within 30 days. Where a request is particularly complex or we have received a high volume of requests, this period may be extended to 60 days, and we will notify you accordingly.

Please note that we may need to verify your identity before processing certain requests, in order to protect against unauthorised access to another person's data.

9. Data Security Measures

goya999 takes the security of your personal data seriously and implements a comprehensive range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

• SSL/TLS encryption: All data transmitted between your device and the goya999 platform is encrypted in transit using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser address bar when using the platform.
• Encrypted data storage: Sensitive personal data and financial information stored on goya999 servers is encrypted at rest. Access to production databases is strictly controlled and logged.
• Access controls: Access to personal data is restricted on a need-to-know basis. goya999 staff are granted access only to the data required to perform their specific role. All access is subject to authentication and is logged for audit purposes.
• Penetration testing and security audits: goya999's platform infrastructure is subject to regular independent security assessments to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: goya999 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a high risk to affected individuals, we will notify those individuals without undue delay.
• Staff training: All goya999 personnel who handle personal data receive regular data protection and information security training as part of their onboarding and ongoing professional development.

Despite these measures, no online platform can guarantee absolute security. If you become aware of any security vulnerability or suspect that your goya999 account has been compromised, please contact us immediately at [email protected].

10. Policy Updates & Contact

goya999 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will update the "Last Updated" date at the top of this page and, where appropriate, provide more prominent notice to active players — for example via a notification on the platform or by email to your registered address.

We encourage all players to review this Privacy Policy at least once every 90 days. Continued use of the goya999 platform after the effective date of any changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests in relation to this Privacy Policy or goya999's data practices more generally, please do not hesitate to contact us:

• Email: [email protected] (subject line: "Privacy Enquiry")
• Response time: We aim to acknowledge all privacy enquiries within 2 business days and to provide a full response within 10 business days.

goya999 is dedicated to maintaining the trust of every player on our platform. Protecting your personal data is not a compliance exercise for us — it is a core part of building a safe, reliable, and player-first gaming environment for the Bangladeshi community.