Privacy Policy — 999ba

999ba collects personal data from players and site visitors in order to operate the platform, verify player identities, process financial transactions, and comply with applicable legal and regulatory obligations. We collect only the data that is reasonably necessary for these stated purposes and do not collect excessive or irrelevant information.

The categories of personal data we collect are described in the table below:

In addition to data you provide directly, 999ba automatically collects certain technical and usage data whenever you interact with the platform. This is standard practice for online services and is necessary for security monitoring, fraud prevention, and platform performance optimisation.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond what is required for identity document verification), or health data, except where you voluntarily disclose health-related information in the context of a responsible gaming self-exclusion request.

999ba processes your personal data only for specific, lawful purposes. We do not use your data in ways that are incompatible with the original purpose for which it was collected. The primary purposes for which 999ba uses your personal data are as follows:

• Account Management: To create, maintain, and administer your 999ba player account, including verifying your identity during registration and through our KYC process.
• Transaction Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain an accurate record of your transaction history.
• Platform Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor player activity for signs of problem gambling behaviour, to enforce self-exclusion and deposit-limit settings you have applied to your account, and to communicate responsible gaming resources when appropriate.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of our communications for quality assurance and training purposes.
• Legal Compliance: To fulfil obligations under applicable laws and regulations, including anti-money laundering (AML) requirements, and to respond to lawful requests from competent authorities.
• Platform Improvement: To analyse usage patterns and technical performance data in order to improve the quality, reliability, and functionality of the 999ba platform.
• Service Communications: To send you important account notifications — such as deposit confirmations, withdrawal status updates, password reset links, and significant changes to our Terms or Privacy Policy. These are not marketing communications and cannot be opted out of while your account remains active.

Where 999ba wishes to use your data for a new purpose that was not disclosed at the time of collection, we will notify you in advance and, where required by law, seek your explicit consent before proceeding.

999ba does not sell, rent, or otherwise commercially disclose your personal data to third parties. We share your data only in the limited circumstances described below, and always subject to appropriate contractual and technical safeguards:

• Payment Service Providers: Transaction data is shared with our payment processing partners — including the operators of bKash, Nagad, Rocket, Upay, and card-processing networks — to the extent necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to their own regulatory obligations.
• Identity Verification Partners: Where third-party KYC or identity verification services are engaged to assist with document verification, relevant identity data is shared with those providers under strict data processing agreements.
• Game Software Providers: Game studios such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive limited technical data (such as anonymised session identifiers) necessary to deliver their games within the 999ba platform. These providers do not receive your full identity or financial data.
• Analytics and Security Platforms: Anonymised or pseudonymised usage and technical data may be shared with trusted analytics and cybersecurity service providers to assist with platform performance monitoring and fraud detection.
• Legal and Regulatory Authorities: 999ba will disclose personal data to law enforcement, regulatory bodies, or courts when legally required to do so, when we have a good-faith belief that disclosure is necessary to protect our legal rights, or when disclosure is necessary to prevent imminent harm.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of 999ba's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the way your data is handled as a result.

All third parties with whom 999ba shares personal data are required to maintain the confidentiality of that data and to use it only for the specific purpose for which it was shared. We do not permit our service providers to use your personal data for their own independent marketing or commercial purposes.

999ba uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to enable core platform functionality, maintain session security, and gather anonymised analytics data. A cookie is a small text file stored on your device by your web browser when you visit a website.

The types of cookies used on the 999ba platform are as follows:

999ba does not use third-party advertising cookies or behavioural targeting cookies. We do not allow external advertising networks to place cookies on our platform.

You may manage or disable cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in or using key features of the 999ba platform. For instructions on managing cookies in popular browsers, please refer to your browser's help documentation. Disabling performance or functional cookies will not affect your ability to log in or place bets, but certain personalisation features may not operate as intended.

999ba retains your personal data for as long as your player account remains active and for a defined period thereafter, as required by our legal and regulatory obligations. We do not retain personal data for longer than is reasonably necessary for the purposes for which it was collected.

Our standard data retention periods are as follows:

• Active account data (identity, contact, transaction records): Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC verification documents (NID copies, passport scans): Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Transaction records (deposit and withdrawal history): Retained for a minimum of five (5) years following the date of each transaction.
• Support communications (chat transcripts, emails): Retained for a period of three (3) years from the date of the communication, unless a longer period is required for an unresolved dispute.
• Usage and technical data (session logs, IP addresses): Retained for a maximum of thirteen (13) months in identifiable form, after which data is anonymised or deleted.
• Responsible gaming records (self-exclusion logs, limit-setting history): Retained for five (5) years to ensure compliance with responsible gaming obligations and to prevent circumvention of exclusion periods.

All personal data held by 999ba is stored on secure servers. Access to stored personal data is restricted to authorised personnel who require access for legitimate operational purposes. All staff with access to personal data are bound by confidentiality obligations.

Where personal data is transferred or stored outside of Bangladesh, 999ba takes reasonable steps to ensure that equivalent levels of data protection are in place through contractual arrangements with the receiving party.

As a player on the 999ba platform, you hold the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact our support team using the details provided in Section 8 of this Policy.

• Right of Access: You have the right to request a copy of the personal data 999ba holds about you. We will provide this information within a reasonable timeframe, typically within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain account information directly through your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory obligations to retain certain records. Note that legal retention requirements (e.g., AML record-keeping) may limit our ability to delete certain categories of data immediately upon request.
• Right to Restrict Processing: In certain circumstances, you have the right to request that we restrict the processing of your personal data while a dispute or correction request is being resolved.
• Right to Data Portability: You may request a copy of the personal data you have provided to us in a structured, machine-readable format, where technically feasible and where processing is based on your consent or on a contractual basis.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on our legitimate interests, where you believe such interests are overridden by your own rights and freedoms.
• Right to Withdraw Consent: Where processing is based on your explicit consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

999ba takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated regularly to reflect current best practices in cybersecurity.

• Transport Layer Security (TLS/SSL): All data transmitted between your device and 999ba infrastructure is encrypted using industry-standard 256-bit TLS encryption, indicated by the HTTPS protocol in your browser address bar.
• Access Controls: Access to personal data within 999ba's systems is restricted on a need-to-know basis. Staff are granted the minimum level of access necessary to perform their duties, and all access is logged and auditable.
• Password Security: Player account passwords are stored in hashed form using a secure cryptographic algorithm. 999ba staff cannot view your password in plain text. If you forget your password, a secure reset link is issued to your registered email address.
• Fraud Detection Systems: 999ba operates automated fraud detection and anomaly monitoring systems that flag unusual account activity — such as logins from unfamiliar IP addresses or devices — for security review.
• Regular Security Reviews: 999ba conducts periodic internal security assessments and engages third-party security specialists to perform vulnerability assessments of our platform infrastructure.

While 999ba implements robust security measures, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their 999ba account and to enable two-factor authentication where available. If you suspect that your account has been accessed without your authorisation, please contact support immediately at [email protected].

In the event of a personal data breach that poses a risk to affected players, 999ba will notify affected individuals without undue delay and will take all reasonable steps to contain the breach and prevent further exposure.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data 999ba holds about you, please contact us using the details below. Our support team handles all privacy-related enquiries and will direct your request to the appropriate internal team.

999ba reserves the right to update this Privacy Policy at any time. The "Effective" date at the top of this document will be revised whenever material changes are made. Continued use of the 999ba platform following any update constitutes acceptance of the revised Privacy Policy. Where changes are material, we will endeavour to notify registered players via their registered email address in advance of the changes taking effect.

If you are not satisfied with how 999ba has handled your personal data or responded to a privacy rights request, you may escalate your concern to the appropriate data protection authority in your jurisdiction.