My99Exch Privacy Policy 2026 — How We Protect Your Personal Data

My99Exch ("we", "our", "us", "the Company") respects your privacy and is fully committed to protecting your personal data. This Privacy Policy explains, in clear language, how we collect, use, store, and safeguard the information you share with us while using our 99Exch online cricket ID services through our website 99exchanges.com and WhatsApp-based account management.

This policy works alongside our Terms & Conditions and Responsible Gaming policy to form your complete agreement with My99Exch. Please read all three before using our services.

1. What Data We Collect

When you contact us for a 99Exch betting ID or use our website, we collect only the minimum data necessary to provide our service. Here is the complete inventory:

Data Type	What We Collect	Why We Need It
Identification	Full name, mobile number, optional email	To create and verify your account; for account-related communication
Transaction Data	UPI ID, bank reference numbers, deposit & withdrawal records	To process payments and maintain a settlement audit trail
Usage Data	IP address, browser type, device type, page-visit timestamps, referring URL	To improve our website, monitor for fraud, and analyse anonymous traffic
Communication	WhatsApp messages, emails, live-chat transcripts	For customer support quality, training, and dispute resolution
Account Activity	Login times, bet history (with 99Exch), wallet balance changes	For account management, fraud prevention, and your activity statements

What We Do NOT Collect

To be crystal clear, we never ask for or store any of the following:

• PAN card number or PAN card image
• Aadhaar card number or Aadhaar XML/eKYC data
• Passport, driving licence, voter ID, or any other government-issued identity
• Bank account password, internet-banking login, UPI PIN, or card CVV
• Biometric data (fingerprint, facial recognition, voiceprint)
• Location coordinates beyond approximate IP geolocation (city/state level)
• Contacts from your phone, photos, calendar, or any other device data

2. How We Use Your Data

The data we collect is used strictly for the following purposes and nothing else:

• Account creation: Setting up your 99Exch cricket ID and delivering login credentials
• Payment processing: Crediting deposits to your wallet and processing withdrawals to your bank
• Customer support: Answering your queries via WhatsApp, email, and live chat 24/7
• Account communication: Sending essential updates (password reset, security alerts, bonus credits)
• Fraud prevention: Detecting and stopping unauthorised access, money laundering, and identity theft
• Legal compliance: Complying with applicable Indian laws including DPDPA 2023, PMLA, IT Act 2000
• Service improvement: Analysing anonymous usage patterns to enhance our website and app
• Marketing (with consent): Sending bonus offers and IPL updates ONLY to users who opt in

3. Legal Basis for Processing

Under the Digital Personal Data Protection Act 2023 (DPDPA) and other applicable laws, we process your personal data on the following legal bases:

• Consent: You voluntarily share data when requesting a 99Exch ID via WhatsApp
• Contractual necessity: Processing is required to deliver our services as agreed
• Legal obligation: Some data must be retained to comply with Indian financial and gambling regulations
• Legitimate interest: Fraud prevention, security monitoring, and service improvement
• Vital interest: Protecting your account from unauthorised access or fraudulent activity

You can withdraw consent at any time by contacting our Data Protection Officer (see Section 13). Withdrawal does not affect data processed prior to withdrawal.

4. How We Protect Your Data

Security is treated as a core engineering principle, not an afterthought. We apply industry-standard safeguards at multiple layers:

Technical Safeguards

• SSL 256-bit encryption on every page (same standard as banks)
• HTTPS-only access — automatic redirect from HTTP, with HSTS enabled
• Payment processing through PCI DSS compliant gateways only
• Encrypted database storage for all personally identifiable information
• bcrypt password hashing with per-user salt (passwords cannot be reverse-engineered)
• Multi-factor authentication available for sensitive account actions

Organisational Safeguards

• Restricted internal access: Only verified support staff with role-based permissions can view customer records
• Regular security audits by independent cybersecurity firms every 6 months
• 24/7 fraud monitoring with automatic suspicious-activity flagging
• Mandatory privacy training for all employees and contractors
• Strict NDA agreements with every team member and third-party vendor
• Incident response plan with breach notification within 72 hours as required by DPDPA

5. When We Share Data (and With Whom)

We do NOT sell, rent, or trade your personal information to any third party. Data is shared in only the following limited cases:

Recipient	What's Shared	Purpose
99Exch Network Operator	Name, mobile, account ID	To activate your account on the underlying platform
Payment Processors	UPI ID, transaction amount, reference	To process your deposits and withdrawals
Legal Authorities	As specifically required by valid court order	To comply with legal investigations or court orders
Technology Vendors	Anonymised technical data only	Hosting (Hostinger), analytics, email delivery — all bound by strict NDA
Auditors	Anonymised compliance data	For periodic security and compliance audits

We never share data with advertisers, data brokers, marketing companies, social media platforms, AI training datasets, or any other commercial third party.

6. Your Rights Under DPDPA 2023

As a data principal under India's Digital Personal Data Protection Act 2023, you have the following enforceable rights:

• Right to Access: Request a complete copy of all personal data we hold about you, delivered within 30 days
• Right to Correction: Ask us to correct any inaccurate or outdated information
• Right to Erasure (Right to be Forgotten): Request deletion of your account and associated data (subject to legal retention requirements)
• Right to Withdraw Consent: Withdraw consent for any optional data processing at any time
• Right to Grievance Redressal: File a complaint with our Data Protection Officer and receive a response within 30 days
• Right to Nominate: Designate someone to exercise your rights in case of death or incapacity
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Marketing Opt-out: Stop all promotional communications while keeping essential service notifications

To exercise any of these rights, email privacy@99exchanges.com with the relevant request type in the subject line. We respond to all valid requests within 30 days as required by DPDPA.

7. Data Retention Periods

We do not keep your data forever. Here is exactly how long different data types are retained:

Data Type	Retention Period	Legal Reason
Active account data	While your account is active	Service delivery
Identification data (post-closure)	7 years	Indian financial regulations (PMLA, IT Act)
Transaction records	8 years	Income Tax Act, anti-money-laundering law
Marketing data (after opt-out)	30 days, then deleted	DPDPA consent withdrawal
Support communication	3 years	Dispute resolution and audit
Anonymous analytics	2 years	Service improvement
Server logs	90 days	Security incident investigation

After the retention period, data is either permanently deleted or fully anonymised beyond any possibility of re-identification.

8. Cookies & Tracking Technology

We use minimal cookies and tracking technology. Full breakdown:

Cookies We Use

• Strictly necessary cookies: Session ID for login, CSRF tokens for security — these cannot be disabled
• Preference cookies: Language choice, theme preference — improves user experience
• Anonymous analytics: Google Analytics 4 (anonymised), Hotjar (if enabled) — for traffic analysis

Cookies We Do NOT Use

• Third-party advertising cookies (no Facebook Pixel, no Google Ads tracking)
• Cross-site tracking pixels or fingerprinting scripts
• Affiliate or retargeting cookies

You can disable non-essential cookies in your browser settings. The site will still work, though some convenience features (remembered language, dark mode) may reset on each visit.

9. Protection of Minors

My99Exch is strictly an 18+ platform. We do not knowingly collect data from anyone under 18 years of age. If we discover an underage account:

• The account is immediately deactivated
• Any remaining balance is refunded to the original payment source
• All personal data is deleted within 7 days (no 7-year retention applied)
• The parent/guardian is notified if contact details are available

If you are a parent or guardian and believe your child has used our service, please contact privacy@99exchanges.com immediately for emergency account closure and data deletion.

10. International Data Transfers

Your data is primarily stored on servers located in India. Limited data may be processed by:

• Hostinger (India data centres) for website hosting
• Google Workspace (regional data residency) for email and document storage
• Cloudflare for DDoS protection and CDN (anonymised technical data only)

All international transfers comply with DPDPA 2023 cross-border transfer rules. We use standard contractual clauses and rely only on vendors with strong data-protection records.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, new privacy laws, or improved practices. Significant changes (those affecting your rights or data use) will be:

• Announced via WhatsApp and email to all active users at least 7 days in advance
• Posted prominently on this page with a "Last Updated" date change
• Summarised in plain language so you understand what changed and why

Continuing to use My99Exch after such notice means you accept the updated policy. If you disagree, you may request account closure and data deletion at any time.

12. Frequently Asked Questions

What personal data does My99Exch collect?

We collect only your name, mobile number, email (optional), UPI/bank reference for payments, and usage data like IP address and device type. We never ask for PAN, Aadhaar, passport, or any government ID.

Does My99Exch sell my data to third parties?

No. We never sell, rent, or trade your personal information. Data is shared only with the 99Exch network for account activation, payment processors for transactions, and legal authorities when legally required.

How can I delete my My99Exch account and data?

Email privacy@99exchanges.com or WhatsApp +91-9310533973 with the subject "Data Deletion Request". We will process your request within 30 days as per DPDPA 2023, after settling any pending balance and transactions.

How long does My99Exch keep my data?

Active account data is kept while your account is active. After closure: identification data for 7 years (Indian financial regulations), transaction records for 8 years, and marketing data is deleted within 30 days of unsubscribe.

Is My99Exch DPDPA 2023 compliant?

Yes. My99Exch complies with the Digital Personal Data Protection Act 2023 (DPDPA), India's primary data protection law. We honour all user rights including data access, correction, deletion, and consent withdrawal as defined in the Act.

Does My99Exch use cookies?

Yes, but minimally. We use session cookies for login, preference cookies for language and theme, and anonymous analytics cookies for traffic patterns. We do NOT use third-party advertising cookies or tracking pixels.

What if My99Exch experiences a data breach?

We notify affected users and the Indian Data Protection Board within 72 hours of detecting a breach, as required by DPDPA 2023. Notification includes the nature of the breach, data affected, and remediation steps we are taking.

Can I request my data in a downloadable format?

Yes. Under your Right to Data Portability, you can request a structured machine-readable export of all your data (typically JSON or CSV format) by emailing privacy@99exchanges.com. Delivered within 30 days.

By using My99Exch services, you confirm that you have read, understood, and agreed to this Privacy Policy in full.

© 2008 – 2026 My99Exch. Privacy Policy version 4.0 — published 12 May 2026. This policy is reviewed quarterly by our Data Protection Officer for compliance with DPDPA 2023 and emerging best practices.