b999a Privacy Policy — How We Handle Your Data

1. Introduction

b999a operates b999a.io, an online betting and casino platform serving the Bangladesh market and the broader South Asian region. In the course of providing our services — including sports betting, live casino, slots, card games, and payment processing — b999a necessarily collects and processes personal data about the players who use our platform.

This Privacy Policy ("Policy") describes in detail what personal data b999a collects, the purposes for which it is processed, the lawful bases on which processing rests, the parties with whom data may be shared, how long data is retained, and the rights available to you as a data subject. This Policy forms an integral part of b999a's Terms & Conditions and should be read alongside them.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. If you have any questions about this Policy or about the way b999a handles your data, please contact us at the details provided in Section 15.

2. Data Controller

For the purposes of this Policy, b999a acts as the data controller in respect of the personal data of registered players and visitors to b999a.io. As data controller, b999a determines the purposes and means of processing your personal data and bears responsibility for ensuring that processing is conducted lawfully, fairly, and transparently.

Where b999a engages third-party service providers to process data on its behalf (for example, payment processors or game providers), those parties act as data processors under contractual arrangements that require them to process data only on b999a's documented instructions and to implement appropriate security measures.

3. Personal Data We Collect

b999a collects the following categories of personal data from players and platform visitors:

3.1 Identity & Registration Data

• Full legal name
• Date of birth (for age verification — players must be aged 21 or above)
• Gender (where provided voluntarily)
• Nationality and country of residence
• Username chosen at registration
• Copies of government-issued identification documents (National Identity Card, passport, or driving licence) submitted during KYC verification

3.2 Contact Data

• Email address
• Mobile telephone number (primary account contact and used for bKash, Nagad, or Rocket payment verification)
• Residential address (for identity verification purposes)

3.3 Financial & Payment Data

• Mobile wallet identifiers associated with bKash, Nagad, Rocket, or Upay accounts
• Card type and last four digits for Visa or Mastercard payments (full card numbers are never stored by b999a)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used
• Source-of-funds documentation where requested during enhanced due diligence reviews

3.4 Betting & Gaming Activity Data

• Bet history, bet amounts, odds, and settlement outcomes across all sportsbook markets including cricket BPL, IPL, T20 World Cup, and other fixtures
• Casino game session data, including games played, stakes, winnings, and session duration
• Bonus and promotion participation history
• Responsible gaming settings, including deposit limits, session time limits, cooling-off periods, and self-exclusion records

3.5 Technical & Usage Data

• IP address at the time of registration and at each subsequent login
• Device type, operating system, and browser type
• Pages visited on b999a.io, time spent on each page, and navigation patterns
• Login timestamps and session duration
• Geolocation data (country-level, derived from IP address)

3.6 Communications Data

• Records of support communications (live chat transcripts, email correspondence) between you and b999a's support team
• Dispute and complaint records
• Survey responses and feedback submitted voluntarily

4. How We Collect Your Data

b999a collects personal data through the following channels:

• Directly from you: when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, participate in a promotion, or update your account profile.
• Automatically: through cookies, web beacons, server logs, and similar technologies when you access or interact with b999a.io. See Section 11 for full details of our cookie practices.
• From third parties: from payment service providers such as bKash, Nagad, Rocket, and Upay in connection with transaction verification; from identity verification service providers during KYC processing; and from game content providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe in connection with game session data.
• From publicly available sources: where necessary to verify identity or assess fraud risk, b999a may consult publicly available databases or registries.

5. How We Use Your Personal Data

b999a processes your personal data for the following specific purposes:

Purpose	Description
Account Management	Creating, maintaining, and managing your b999a player account, including processing login authentication and account preference settings.
Identity Verification (KYC)	Verifying your identity, age (21+), and eligibility to use b999a in accordance with our Terms & Conditions and anti-money laundering obligations.
Payment Processing	Processing BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and maintaining accurate financial records.
Service Delivery	Providing access to sports betting markets, live casino, slots, and all other b999a platform features.
Fraud Prevention	Detecting, investigating, and preventing fraudulent activity, multi-accounting, money laundering, bonus abuse, and other prohibited conduct.
Responsible Gaming	Monitoring gaming behaviour to identify potential problem gambling indicators and to enforce self-exclusion, deposit limits, and cooling-off periods applied at a player's request.
Customer Support	Responding to account queries, processing disputes, and resolving technical issues raised through our support channels.
Legal Compliance	Meeting our obligations under applicable anti-money laundering, counter-terrorist financing, data protection, and other regulatory requirements.
Marketing (with consent)	Sending promotional offers, bonus notifications, and platform updates where you have given explicit consent to receive such communications.
Platform Improvement	Analysing aggregated, anonymised usage data to improve site performance, user experience, and product development.

6. Legal Basis for Processing

b999a relies on the following legal bases to process your personal data, depending on the specific purpose of processing:

• Contract performance: Processing necessary to register your account, deliver services, process payments, and fulfil our obligations under the b999a Terms & Conditions.
• Legal obligation: Processing necessary to comply with anti-money laundering laws, KYC requirements, and other applicable regulatory obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where our legitimate interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications, where you have provided explicit and freely given consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

b999a does not sell your personal data to any third party. We share your data only in the following limited circumstances and always under appropriate contractual or legal protections:

7.1 Payment Service Providers

To process BDT transactions, b999a shares necessary payment and identity data with payment partners including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. These providers process data in accordance with their own applicable data protection standards and are independent data controllers in respect of their own processing activities.

7.2 Identity Verification Partners

b999a may engage specialist third-party KYC and identity verification service providers to assist in verifying player identity and age. These providers act as data processors under contractual arrangements and are not permitted to use the data for any purpose other than the identity check requested by b999a.

7.3 Game Content Providers

Third-party game providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive session-level data necessary to deliver game content and record game outcomes. The scope of data shared is limited to what is technically necessary for game delivery and result verification.

7.4 Legal and Regulatory Disclosure

b999a may disclose personal data to law enforcement agencies, financial intelligence units, courts, or regulatory authorities where required or permitted by applicable law, including in connection with the investigation of financial crime, fraud, or other serious offences.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a material part of b999a's business assets, personal data may be transferred to the relevant acquiring entity as part of that transaction. Affected players will be notified of any such transfer and of any material change to the processing of their data that results from it.

8. International Data Transfers

b999a's core infrastructure is operated within secure data centre environments. Some of our third-party service providers — including certain game content providers — may process data in jurisdictions outside Bangladesh. Where such transfers occur, b999a ensures that appropriate safeguards are in place, including contractual data protection clauses that require the recipient to process data to a standard equivalent to that required by applicable data protection principles.

By using b999a, you acknowledge that your data may be transferred to and processed in jurisdictions other than Bangladesh where b999a's service partners are located. Such transfers are carried out only where necessary to deliver the b999a service and are always subject to appropriate protective measures.

9. Data Retention

b999a retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:

• Account data and KYC documents: Retained for a minimum of five years from the date of account closure, in order to satisfy anti-money laundering record-keeping obligations.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Betting and gaming activity records: Retained for a minimum of three years from the date of each session or bet.
• Support communications: Retained for a minimum of two years from the date of the last interaction, or longer where the communication forms part of a dispute record.
• Marketing consent records: Retained for the duration of the marketing relationship and for one year following withdrawal of consent.
• Anonymised analytics data: May be retained indefinitely as it does not constitute personal data.

Upon expiry of the applicable retention period, b999a will securely delete or anonymise your personal data in a manner that prevents its reconstruction or re-identification.

10. Security Measures

b999a implements a layered security framework to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and b999a's servers
• Encryption of sensitive data at rest, including identity documents and financial records
• Role-based access controls ensuring that only authorised personnel with a documented business need can access personal data
• Multi-factor authentication requirements for internal systems access by b999a staff
• Regular penetration testing and vulnerability assessments conducted by qualified security professionals
• Intrusion detection systems and 24/7 infrastructure monitoring
• Formal incident response procedures to detect, contain, and notify affected parties in the event of a data breach

While b999a takes every reasonable precaution to secure your data, no internet-based transmission or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your b999a account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

11. Cookies & Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit b999a.io. They allow b999a to recognise your device across sessions, remember your preferences, keep you securely logged in, and collect analytical data about how the platform is used. b999a also uses similar technologies such as web beacons and local storage objects for equivalent purposes.

11.2 Types of Cookies We Use

• Strictly necessary cookies: Essential for the b999a platform to function. These include session authentication cookies and security tokens. These cookies cannot be disabled without rendering the platform unusable.
• Functional cookies: Remember your language preferences, account settings, and responsible gaming configuration so you do not need to re-enter them on each visit.
• Analytical cookies: Collect anonymised data about how players navigate b999a.io, which pages are most visited, and where errors occur. This data is used solely to improve the platform and is not shared with third parties for commercial purposes.
• Performance cookies: Monitor platform response times, identify performance bottlenecks, and support technical troubleshooting.

11.3 Managing Cookies

You may control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in to your b999a account and will impair platform functionality. Disabling functional or analytical cookies will not prevent you from using the platform but may reduce the quality of your experience.

12. Your Data Rights

As a data subject, you have the following rights in respect of the personal data b999a holds about you. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all verified requests within 30 days.

• Right of access: You may request a copy of the personal data b999a holds about you, together with information about the purposes of processing, the categories of data held, and the recipients with whom data has been shared.
• Right to rectification: You may request that b999a corrects any inaccurate or incomplete personal data held about you. For certain data (such as account contact details), you may be able to update records directly within your account profile.
• Right to erasure: You may request that b999a deletes your personal data where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other lawful basis applies. This right is subject to b999a's legal obligations to retain certain data (see Section 9).
• Right to restrict processing: You may request that b999a restricts the processing of your data in certain circumstances, such as while a dispute about data accuracy is resolved.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request that b999a provides your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to b999a processing your data on the basis of legitimate interests. b999a will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

13. Minors & Age Policy

b999a strictly prohibits the use of its platform by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If b999a becomes aware that personal data has been collected from a player who is under 21, we will immediately suspend the relevant account, delete or return any associated funds to the originating payment method, and permanently delete the personal data collected.

If you are a parent or guardian and believe that a minor in your care has registered an account on b999a, please contact us immediately at [email protected] so that we can take prompt action. b999a takes underage access to gambling platforms extremely seriously and will co-operate fully with any legitimate investigation in this regard.

14. Changes to This Privacy Policy

b999a reserves the right to update or amend this Privacy Policy at any time. When material changes are made — for example, changes to the categories of data collected, the purposes of processing, or the parties with whom data is shared — b999a will notify registered players via the email address on file at least 14 days before the changes take effect.

Non-material changes, such as typographical corrections or clarifications that do not affect the substance of the policy, may be made without advance notice. The version of this Policy published at b999a.io/privacy-policy on the date of your access is the version that governs the processing of your personal data at that time. We encourage you to review this Policy periodically to stay informed of how b999a protects your data.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way b999a handles your personal data, please contact our Data Protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use the subject line "Privacy Request — [Your Username]" for all data rights requests to ensure prompt routing to the correct team.
• Response Time: General privacy queries within 48 hours; formal data rights requests within 30 days of identity verification.
• Operating Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

We are committed to resolving all privacy concerns fairly and transparently. If you are dissatisfied with our response to a privacy complaint, you may be entitled to escalate the matter to the relevant data protection authority in your jurisdiction.