999bf Privacy Policy

This Privacy Policy ("Policy") describes how 999bf ("999bf", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the 999bf online betting and casino platform, available at https://999bf.io and all associated subdomains and mobile-optimised versions thereof.

We are committed to handling your personal data with transparency, integrity, and care. This Policy is designed to help you understand exactly what information we gather about you, why we gather it, how long we keep it, and what choices and rights you have in relation to it. We encourage you to read this Policy carefully before creating a 999bf account or submitting any personal information to us.

By registering an account on the 999bf platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the 999bf Terms & Conditions and should be read alongside that document.

For the purposes of applicable data protection law, 999bf is the data controller responsible for your personal data. As data controller, 999bf determines the purposes and means of processing your personal information in connection with the operation of the online betting and casino platform.

If you have any questions, concerns, or requests regarding the way in which 999bf processes your personal data, or if you wish to exercise any of the rights described in Section 11 of this Policy, please contact our dedicated data protection point of contact using the details provided in Section 15.

999bf collects personal data from you in two primary ways: information you provide directly to us, and information collected automatically when you use the platform. The categories of personal data we collect are described below.

Information you provide directly:

• Registration Data: Full name, date of birth, gender, nationality, residential address, email address, and mobile phone number submitted when creating a 999bf account.
• Identity Verification Documents: Copies of government-issued identification (such as a National Identity Card, passport, or driving licence) and proof of address documents submitted in response to KYC (Know Your Customer) verification requests.
• Payment Information: bKash mobile number, Nagad account number, Rocket account number, Upay account details, Visa or Mastercard card details, and bank account information provided when making deposits or requesting withdrawals.
• Communications Data: The content of messages, emails, live chat transcripts, and any other communications you send to the 999bf support team.
• Responsible Gaming Preferences: Deposit limits, session time limits, cooling-off requests, and self-exclusion requests submitted through the responsible gaming tools.

Information collected automatically:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage & Activity Data: Pages visited, games played, bets placed, wagers amounts, session start and end times, click patterns, and navigation paths through the platform.
• Geolocation Data: Approximate geographic location derived from your IP address, used for compliance, fraud detection, and jurisdictional access control purposes.
• Cookie & Tracking Data: Information collected through cookies, web beacons, and similar tracking technologies as described in Section 10 of this Policy.

The table below summarises the main data categories and their associated retention periods:

999bf uses the personal data we collect for the following specific purposes. We process your data only where we have a lawful basis for doing so, as set out in Section 5.

• Account Administration: Creating, maintaining, and managing your 999bf player account, including processing registration, verifying your identity, and maintaining your account settings and preferences.
• Transaction Processing: Processing deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank transfer; reconciling your account balance; and managing bonus credits associated with your account.
• Identity Verification & KYC Compliance: Verifying that you are at least 21 years of age and confirming your identity and address in accordance with our anti-money-laundering (AML) and Know Your Customer (KYC) obligations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account takeovers, collusion between players, multi-accounting, and other suspicious behaviour on the platform.
• Responsible Gaming: Administering responsible gaming tools including deposit limits, session limits, cooling-off periods, and self-exclusion orders that you have requested; monitoring account activity to identify potential problem gambling behaviour and providing appropriate interventions.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance through live chat, email, and other support channels.
• Legal & Regulatory Compliance: Fulfilling obligations under applicable law, including retaining financial records, responding to lawful requests from regulatory or law enforcement authorities, and reporting suspicious transactions where required.
• Platform Improvement: Analysing aggregated and anonymised usage data to understand how players interact with the 999bf platform, identify areas for improvement, and develop new features and services.
• Marketing Communications: Sending you promotional offers, bonus notifications, and event-based communications (such as Eid, Pohela Boishakh, or BPL seasonal promotions) by email or SMS, where you have given your consent or where we have a legitimate interest in doing so — subject always to your right to opt out as described in Section 13.

999bf processes your personal data on the following legal bases:

• Contractual Necessity: Processing necessary to perform the contract between you and 999bf — including account creation, payment processing, and the provision of betting and gaming services — is carried out on the basis that such processing is required to fulfil our contractual obligations to you.
• Legal Obligation: Certain processing activities — including identity verification, AML record-keeping, and cooperation with law enforcement — are carried out because 999bf is legally required to do so under applicable financial crime prevention and data retention laws.
• Legitimate Interests: Processing for fraud prevention, platform security, and internal analytics is carried out on the basis of 999bf's legitimate interest in operating a secure, compliant, and commercially viable platform, provided such interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your freely given, informed, and specific consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

999bf does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing or commercial purposes. We share your personal data only in the following limited and controlled circumstances:

• Payment Processors: We share transaction-relevant personal data with payment service providers including bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner Bangladeshi banks (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and others) solely for the purpose of processing your deposits and withdrawal requests.
• Identity Verification Partners: We may engage accredited third-party KYC and identity verification service providers to assist in verifying your age, identity, and address. These providers process your data under strict contractual data processing agreements with 999bf.
• Game Content Providers: Live casino and slot game data (including game session records and bet amounts) may be shared with our licensed game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, who operate the underlying game infrastructure. These providers act as data processors under our direction.
• Fraud Prevention & Security Services: We may share data with specialist cybersecurity and fraud detection firms to help identify and prevent fraudulent activity. Such sharing is governed by appropriate data processing agreements.
• Legal & Regulatory Authorities: We will disclose personal data to law enforcement agencies, financial intelligence units, courts, or other regulatory bodies where required to do so by law, court order, or in the good-faith belief that such disclosure is necessary to prevent criminal activity or protect the rights, property, or safety of 999bf or third parties.
• Business Successors: In the event of a merger, acquisition, restructuring, or sale of all or part of 999bf's business, your personal data may be transferred to the acquiring entity, provided that entity agrees to be bound by data protection obligations no less protective than those in this Policy.

Some of the third-party service providers with whom 999bf shares personal data — including game content providers and cloud infrastructure partners — may be located outside Bangladesh or your country of residence. Where personal data is transferred to countries that may not provide the same level of data protection as Bangladesh, 999bf takes appropriate safeguards to ensure that your data remains adequately protected.

These safeguards may include: contractual clauses that require the recipient to protect personal data to standards equivalent to those applied in Bangladesh; data processing agreements that impose binding privacy and security obligations; and selecting processors that maintain internationally recognised security certifications such as ISO 27001.

If you have questions about the specific safeguards applied to any international data transfer involving your personal data, please contact us using the details in Section 15.

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, to maintain your active player account, and to comply with our legal, regulatory, and financial record-keeping obligations. The key retention periods applicable to the main categories of personal data we hold are summarised in the table provided in Section 3.

Where you request the closure of your 999bf account, we will retain the minimum data necessary to comply with anti-money-laundering record-keeping requirements (typically a minimum of five years from the date of account closure, and up to seven years for financial transaction records). After the applicable retention period expires, your data will be securely deleted or anonymised so that it can no longer be associated with you as an individual.

Data that is no longer required for any active purpose and is outside its mandatory retention window will be purged from our systems on a regular scheduled basis through our documented data lifecycle management procedures.

999bf implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the 999bf platform is encrypted using TLS 1.2 or higher. Our SSL certificate provides end-to-end encryption for all account, payment, and personal data exchanges.
• Encryption at Rest: Sensitive personal data stored on 999bf's servers — including identity documents and payment credentials — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within 999bf's systems is restricted on a strict need-to-know basis. All internal access is governed by role-based access control (RBAC) policies, multi-factor authentication requirements, and comprehensive audit logging.
• Infrastructure Security: 999bf's platform infrastructure is protected by enterprise-grade firewalls, intrusion detection and prevention systems (IDS/IPS), regular vulnerability scanning, and penetration testing conducted by independent security specialists.
• Staff Training: All 999bf personnel who handle personal data receive regular training on data protection obligations, security best practices, and the requirements of this Privacy Policy.
• Incident Response: 999bf maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players without undue delay.

While 999bf takes all reasonable and practicable steps to protect your personal data, no online platform can guarantee absolute security. You also have an important role to play — please keep your 999bf login credentials confidential and notify us immediately if you suspect any unauthorised access to your account.

The 999bf platform uses cookies and similar tracking technologies (including web beacons and local storage objects) to provide you with a functional, personalised, and secure betting experience. The table below describes the categories of cookies we use:

Strictly necessary cookies are deployed on the basis of contractual necessity and cannot be disabled without impairing the functionality of the platform. All other cookie categories are deployed on the basis of your consent. You may manage your cookie preferences at any time by contacting our support team.

As an individual whose personal data is processed by 999bf, you hold the following rights in relation to that data. To exercise any of these rights, please contact us using the details in Section 15. We will respond to all valid requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data that 999bf holds about you, along with information about how that data is processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. Note that this right may be limited by our legal obligations to retain certain data (for example, financial records and AML compliance data) for the periods described in Section 8.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while you are contesting the accuracy of the data we hold.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to processing carried out on the basis of legitimate interests, including profiling for direct marketing purposes. Where you object to direct marketing processing, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

The 999bf platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, use, or process the personal data of any individual under the age of 21. Our registration process requires all applicants to confirm that they meet the minimum age requirement, and we conduct age verification checks on all accounts in accordance with our KYC procedures.

If 999bf becomes aware that personal data has been collected from an individual who is under 21 years of age, we will take immediate steps to delete that data from our systems and permanently close the associated account. If you have reason to believe that a minor has registered on 999 bf, please notify us immediately at [email protected] (plain text — not a clickable link).

With your consent, 999bf may send you promotional emails, SMS messages, and in-platform notifications about bonuses, new game launches, seasonal promotions (such as Eid special offers, Pohela Boishakh events, BPL cricket betting promotions, and IPL season bonuses), and other news related to the 999bf platform.

You may opt out of receiving marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by 999bf.
• Replying STOP to any promotional SMS message sent by 999bf.
• Contacting the 999bf support team via live chat or email and requesting removal from all marketing lists.
• Updating your communication preferences within your 999bf account settings.

Please note that opting out of marketing communications will not affect transactional communications that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, identity verification requests, responsible gaming alerts, and security notices. These communications are sent on the basis of contractual necessity and cannot be disabled while your account remains active.

999bf reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and services available on the 999bf platform. The effective date at the top of this Policy will be updated whenever a material change is made.

Where a change to this Policy is material — meaning it significantly affects the way in which we process your personal data or the rights available to you — 999bf will provide you with advance notice by email, in-platform notification, or by displaying a prominent notice on the 999bf website prior to the change taking effect. Your continued use of the 999bf platform after the updated Policy has come into effect constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how 999bf is protecting your personal data. If you disagree with any change to this Policy, you should discontinue use of the platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights described in Section 11, or have a concern about the way in which 999bf has handled your personal data, please contact our data protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the 999bf platform — Bangladesh Standard Time (UTC+6)
• Response Time: We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a full response within 30 calendar days of receipt.

If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in your jurisdiction. 999bf takes all data protection complaints seriously and will cooperate fully with any regulatory investigation.