b3999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how b3999 ("b3999", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "your") who access or use the b3999 online casino and sports betting platform at b3999.io (the "Platform"), including all associated services, games, promotional features, and payment facilities.

This Policy forms an integral part of the b3999 Terms & Conditions. By registering an account on the Platform or otherwise submitting personal data to b3999, you acknowledge that you have read and understood this Policy and consent to the processing of your data as described herein.

b3999 is committed to handling all personal data with transparency, integrity, and in accordance with applicable data protection principles. If you have any questions about this Policy or about how your data is handled, please contact us at [email protected].

2 Data Controller

For the purposes of this Policy, b3999 acts as the data controller in respect of all personal data collected from players accessing the Platform. As data controller, b3999 determines the purposes for which personal data is processed and the means by which that processing is carried out.

All data protection enquiries, subject access requests, and complaints relating to the processing of personal data by b3999 should be directed to our dedicated data protection contact at [email protected] with the subject line "Data Protection Request". We aim to acknowledge all such requests within 3 business days and to resolve them within 30 calendar days.

3 Categories of Personal Data We Collect

b3999 collects the following categories of personal data from players:

b3999 does not collect or process special categories of sensitive personal data (such as biometric data, health information, or political opinions) except where you voluntarily disclose such information in a support communication, in which case it will be handled with the highest level of confidentiality and used only to resolve your specific query.

4 How We Collect Your Data

b3999 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, via server logs, session tracking, and analytics tools embedded within the site.
• Payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners when a deposit or withdrawal is processed.
• Identity verification services: Where required for KYC compliance, b3999 may receive verification results from third-party identity verification partners who cross-reference your submitted documents against authoritative databases.
• Fraud detection systems: Behavioural and technical signals generated during your use of the Platform are processed by automated fraud detection tools to identify irregular patterns.

5 Purpose and Legal Basis for Processing

b3999 processes your personal data only where a lawful basis exists. The following table sets out the primary purposes for which we process personal data and the corresponding legal basis for each:

Where b3999 relies on legitimate interest as the legal basis for processing, we have assessed that the relevant processing is necessary for the purpose pursued, that the purpose cannot reasonably be achieved by less intrusive means, and that our legitimate interest is not overridden by your interests, rights, or freedoms. You have the right to object to processing based on legitimate interest; please see Section 11 for details.

6 Sharing Your Personal Data

b3999 does not sell or trade your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, and partner banks receive transaction-level data necessary to execute deposits and withdrawals. These providers operate under their own privacy policies and regulatory obligations.
• Game and platform providers: Studios and content providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised session data required to deliver and audit game outcomes. No directly identifiable personal data is shared with game providers beyond what is technically necessary.
• Identity verification services: Where KYC verification is required, your identity documents and personal details may be shared with accredited identity verification partners for the sole purpose of confirming your eligibility to use the Platform.
• Fraud detection and security providers: Technical and behavioural data may be shared with third-party fraud detection services to protect the integrity of the Platform and other players.
• Legal and regulatory authorities: b3999 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by law, where necessary to prevent serious harm, or to enforce the b3999 Terms & Conditions.
• IT infrastructure providers: Cloud hosting and data storage providers used by b3999 may hold encrypted copies of personal data as part of normal platform operations. All such providers are subject to data processing agreements with binding security obligations.

7 Cookies and Tracking Technologies

b3999 uses cookies and similar tracking technologies (including local storage objects and session identifiers) to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without preventing you from using the Platform.
• Functional cookies: Store your preferences such as language settings, game view preferences, and responsible gaming tool configurations so that these are preserved across sessions.
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform, including page visit frequency, session duration, and navigation paths. This data is used solely to improve the Platform.
• Fraud prevention cookies: Collect technical signals used by b3999's fraud detection systems to identify unusual access patterns or potentially compromised accounts.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing certain features of the Platform, including your account dashboard and payment facilities.

8 Data Retention

b3999 retains personal data for the following periods:

• Account data and transaction history: Retained for a minimum of five (5) years from the date of account closure or last active use, whichever is later, to comply with anti-money laundering record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five years from the date of submission or account closure, in line with financial crime compliance requirements.
• Customer support communications: Retained for three (3) years from the date of the last communication in a thread, to support dispute resolution and training purposes.
• Technical and server logs: Retained for 12 months from the date of generation, after which they are permanently deleted or anonymised.
• Marketing consent records: Retained for the duration of your account and for three years after account closure, to demonstrate compliance with consent requirements.

Following the expiry of the applicable retention period, personal data is permanently deleted or irreversibly anonymised. Anonymised data (which can no longer be attributed to any individual) may be retained indefinitely for statistical and analytical purposes.

9 Data Security

b3999 implements a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and b3999 servers;
• One-way cryptographic hashing of account passwords — b3999 employees cannot view or retrieve your password in plain text;
• Role-based access control (RBAC) ensuring that employees access only the personal data required for their specific job function;
• Comprehensive audit logging of all access to personal data within b3999's internal systems;
• Regular penetration testing and vulnerability assessments of the Platform by independent security specialists;
• Encrypted storage of all sensitive personal data, including KYC documents and financial records;
• Multi-factor authentication (MFA) for all b3999 employee access to internal systems containing personal data.

While b3999 takes all reasonable steps to protect your personal data, no system is entirely immune to security incidents. In the event of a data breach that is likely to result in a risk to your rights and freedoms, b3999 will notify affected players without undue delay in accordance with applicable requirements.

10 International Data Transfers

b3999 primarily stores and processes personal data on servers located within or serving the Asia-Pacific region. However, certain service providers — including game studios, fraud detection partners, and cloud infrastructure providers — may process data in jurisdictions outside Bangladesh.

Where personal data is transferred to a third country or international organisation, b3999 ensures that appropriate safeguards are in place to provide a level of protection equivalent to that applied within the Platform. Such safeguards include contractual data processing agreements incorporating standard data protection clauses, and due diligence assessments of the data protection practices of all international processing partners.

11 Your Rights Over Your Personal Data

Subject to applicable law and any overriding legal obligations on b3999, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of all personal data held about you by b3999, along with information about how it is processed.
• Right to rectification: If any personal data held by b3999 is inaccurate or incomplete, you may request that it be corrected or completed.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis exists), or where the data has been unlawfully processed. This right is subject to legal retention obligations — b3999 cannot delete data it is legally required to retain.
• Right to restrict processing: You may request that b3999 restricts processing of your data in certain circumstances, for example while the accuracy of data is contested.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on b3999's legitimate interests. b3999 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will verify your identity before processing the request, and we aim to respond within 30 calendar days. Complex or multiple requests may take up to an additional 60 days, in which case we will notify you of the extension and the reason for it.

12 Children's Privacy

The b3999 Platform is strictly restricted to individuals aged 21 years and above. b3999 does not knowingly collect, solicit, or process personal data from individuals under the age of 21. If b3999 becomes aware that personal data has been collected from a person under 21 — whether through age misrepresentation at registration or any other means — that individual's account will be immediately and permanently closed, all associated data will be deleted in accordance with this Policy (except where retention is required by law), and any deposits will be returned where technically feasible.

If you are a parent or guardian and you believe that a minor under your care may have registered an account on b3999, please contact us immediately at [email protected]. We will investigate and act promptly.

13 Marketing Communications

b3999 may send promotional communications — including bonus offers, seasonal promotions, game announcements, and platform updates — via SMS and email, but only where you have provided explicit prior consent to receive such communications during registration or subsequently through your account preferences.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences within your b3999 account settings; or
• Sending a written opt-out request to [email protected] with the subject line "Unsubscribe".

Opt-out requests will be processed within 5 business days. Please note that even after opting out of marketing communications, b3999 may still send you transactional and operational messages — such as deposit confirmations, withdrawal notifications, security alerts, and account verification requests — as these are necessary for the administration of your account and cannot be disabled.

14 Changes to This Privacy Policy

b3999 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where a material change is made to this Policy, b3999 will provide advance notice to registered players via the email address associated with their account and/or via a prominent notice on the Platform, with a minimum of 14 days' notice before the revised Policy takes effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and may request account closure by contacting support.

We encourage you to review this Policy periodically to stay informed about how b3999 protects your personal data. Previous versions of this Policy are available upon request by contacting [email protected].

15 Contact Us

If you have any questions, concerns, or formal complaints about this Privacy Policy or about the way in which b3999 handles your personal data, please contact our data protection team using the following details:

• Email: [email protected] — subject line: "Privacy Policy Query" or "Data Rights Request"
• Live Chat: Available 24/7 via the in-platform chat widget
• Response time: Email responses within 24 hours; data rights requests resolved within 30 calendar days

For questions about your account security or responsible gaming tools, please visit our Responsible Gaming page or review the b3999 Terms & Conditions. For frequently asked questions about account management, deposits, and withdrawals, see our FAQ page.