Privacy Policy — How 999cd Protects Your Data

This Privacy Policy applies to all personal data processed by 999cd in connection with the operation of the online casino and sports betting platform accessible at https://999cd.app. It applies to all registered players, prospective players who visit the platform without registering, and individuals who contact 999cd for support purposes.

In this policy, "999cd", "we", "us", and "our" refer to the operator of the 999cd platform. "You" and "your" refer to the individual whose personal data is being processed. "Personal data" means any information that identifies or could reasonably be used to identify a living individual, whether directly or in combination with other information.

By accessing or using the 999cd platform, you acknowledge that you have read and understood this Privacy Policy. This policy should be read alongside our Terms & Conditions and Responsible Gaming page, which together form the full framework governing your relationship with 999cd. If you do not agree with the practices described in this policy, you should not use the 999cd platform.

This Privacy Policy is written in English. In the event of any conflict or ambiguity, the English-language version is the authoritative version. 999cd may make this policy available for reference purposes in other languages, but the English text governs in all circumstances.

999cd collects personal data through several channels: directly from you when you register or use the platform, automatically through the operation of the platform, and in limited cases from third-party sources such as payment processors or identity verification providers. The categories of data we collect are described below.

Registration & Identity Data

When you create a 999cd account, we collect your full legal name, date of birth, country and city of residence, email address, and mobile number. This data is required to establish your account, verify your identity, and communicate with you about your account activity.

KYC Verification Data

To comply with our Know Your Customer (KYC) obligations and anti-money laundering (AML) requirements, 999cd collects copies of government-issued identity documents (such as your National Identity Card or passport), proof of address documents, and evidence of ownership of the payment methods used to deposit funds. These documents are processed securely and retained only for as long as required by applicable regulations.

Financial & Transaction Data

We collect data relating to all deposits, withdrawals, and in-game transactions carried out on your 999cd account. This includes the amounts, timestamps, payment methods used (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard), and transaction reference numbers. This data is necessary for payment processing, fraud prevention, and audit purposes.

Usage & Gameplay Data

We automatically collect data about how you interact with the 999cd platform, including games played, bet amounts and outcomes, session duration, pages visited, features accessed, and timestamps of all significant account events. This data is used for platform improvement, responsible gaming monitoring, and fraud detection.

Technical & Device Data

We collect technical information about the device and connection used to access 999cd, including IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone. This data supports platform security, fraud prevention, and service optimisation.

Communications Data

When you contact 999cd support via live chat or email, we retain a record of those communications, including your name, contact details, the nature of your enquiry, and our response. This data is used for quality assurance, dispute resolution, and improving the support experience.

999cd processes your personal data only for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we use personal data are as follows:

Platform Operation & Account Management

Your registration and identity data is used to create and manage your 999cd account, verify your age and identity, process your deposits and withdrawals, and ensure that your account reflects your transaction history accurately. Without this processing, we cannot operate your account.

Legal & Regulatory Compliance

999cd is obligated to verify the identity of all players (KYC), monitor transactions for suspicious activity (AML), and retain records for a prescribed period. This processing is not optional — it is required to operate a legitimate online gaming platform. Where required by law or a valid authority request, 999cd may disclose personal data to competent regulatory or law enforcement bodies.

Fraud Prevention & Platform Security

We use technical, device, and transaction data to detect and prevent fraud, account takeover, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms & Conditions. This includes automated screening systems that flag unusual patterns for review by our compliance team.

Responsible Gaming Monitoring

999cd uses gameplay and session data to monitor for indicators of problem gambling behaviour, such as rapid escalation of deposit amounts, extended unbroken play sessions, or repeated failed self-exclusion attempts. This processing is in your vital interest and forms part of our responsible gaming commitment.

Customer Support

Communications and account data are used to respond to your support queries, process account actions you request (such as self-exclusion or deposit limit changes), and resolve any disputes relating to game outcomes, transactions, or bonus eligibility.

Platform Improvement & Analytics

Aggregated and anonymised usage data is used to improve the 999cd platform — identifying popular features, optimising page performance, and refining the user experience for players across Bangladesh. This analytics processing does not identify you as an individual.

Marketing Communications

With your explicit consent at registration, 999cd may send you promotional communications about new games, bonus offers, seasonal campaigns (such as BPL cricket promotions, Eid special offers, and Pohela Boishakh bonuses), and platform updates. You may withdraw consent and unsubscribe from marketing communications at any time via your account settings or by emailing [email protected]. Withdrawal of marketing consent does not affect your ability to use the platform.

999cd does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the specified purpose.

Payment Processors

To process your deposits and withdrawals, 999cd shares necessary transaction data with the payment processors you use — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. These processors are bound by their own privacy obligations and handle your financial data in accordance with applicable payment industry standards.

Identity Verification Providers

999cd works with specialist KYC and identity verification service providers to process and validate the documents you submit. These providers act under strict contractual data processing agreements and are not permitted to use your data for any purpose beyond the verification service they provide to 999cd.

Game Providers

Casino games on the 999cd platform are supplied by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers receive anonymised session tokens and game-play data sufficient to operate each game session. They do not receive your full personal profile or payment data.

Legal & Regulatory Disclosures

Where required by applicable law, court order, or valid request from a competent regulatory or law enforcement authority, 999cd will disclose personal data as required. We will notify affected players of such disclosures where legally permitted to do so.

Business Transfers

In the event that 999cd undergoes a corporate restructuring, merger, acquisition, or sale of assets, personal data held about registered players may be transferred to a successor entity as part of that transaction. Affected players will be notified of any such transfer and of any changes to the privacy terms that apply to their data.

999cd uses cookies and similar tracking technologies (such as local storage and session tokens) to operate the platform effectively, remember your preferences, and understand how players interact with the site. This section explains what types of cookies we use and why.

Essential Cookies

These cookies are strictly necessary for the 999cd platform to function. They enable core features such as account login sessions, maintaining your BDT wallet balance display across pages, and preserving responsible gaming settings you have configured. Essential cookies cannot be disabled without impairing your ability to use the platform.

Analytical Cookies

We use analytical cookies to collect aggregated, anonymised data about how players navigate the 999cd platform — which pages are visited most frequently, how long sessions last, and where players encounter difficulty. This data is used exclusively to improve the platform and is not linked to your personal identity.

Functional Cookies

Functional cookies remember your preferences such as display settings and previously visited game categories, making your return visits to 999cd more convenient. These cookies do not track you across other websites.

What We Do Not Use

999cd does not deploy third-party advertising cookies, cross-site tracking pixels, or social media tracking scripts. We do not share cookie data with advertising networks. Our cookie use is limited to what is necessary to operate, secure, and improve the 999cd platform for players in Bangladesh.

Managing Cookies

You can manage or delete cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in to your 999cd account. For guidance on managing cookies in your specific browser, refer to your browser's help documentation. Clearing cookies will log you out of any active 999cd session.

999cd retains your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable legal, regulatory, tax, or anti-money laundering obligations. The following retention principles apply:

• Active account data: Retained for the full duration of your registered account with 999cd, and for a minimum of five years following account closure, in compliance with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five years from the date of submission, in accordance with anti-money laundering regulations applicable to online gaming operators.
• Transaction records: Retained for a minimum of five years to support financial auditing, dispute resolution, and regulatory reporting obligations.
• Support communications: Retained for three years from the date of the most recent communication, to support dispute resolution and quality assurance processes.
• Marketing consent records: Retained for the duration of your consent and for one year following withdrawal of consent, to demonstrate compliance with marketing regulations.
• Technical and device logs: Typically retained for 12 months on a rolling basis, unless a specific security incident requires longer retention for investigation purposes.

When retention periods expire, personal data is securely deleted or irreversibly anonymised in accordance with 999cd's internal data lifecycle procedures. Anonymised data that cannot be used to re-identify any individual may be retained indefinitely for statistical and platform improvement purposes.

999cd implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Security is reviewed and updated continuously in response to emerging threats and best-practice standards in the online gaming industry.

Technical Measures

• SSL/TLS encryption: All data in transit between your device and the 999cd platform is encrypted using current-generation SSL/TLS protocols.
• Encryption at rest: Sensitive personal and financial data stored on 999cd servers is encrypted using AES-256 or equivalent standards.
• Two-factor authentication (2FA): Available to all players and strongly recommended as an additional layer of account access protection.
• Access controls: Internal access to personal data is restricted to authorised 999cd personnel on a strict need-to-know basis. Access is logged and periodically audited.
• Intrusion detection: Automated monitoring systems scan for anomalous access patterns, brute-force attempts, and other indicators of platform compromise.

Organisational Measures

• All 999cd staff with access to personal data receive regular data protection training.
• Third-party processors are subject to contractual data security obligations before being granted access to any player data.
• 999cd maintains an incident response plan to ensure rapid containment and notification in the event of a data breach.

Your Responsibilities

While 999cd takes extensive measures to protect your data, the security of your account also depends on actions you take. You are responsible for maintaining the confidentiality of your login credentials, enabling 2FA on your account, using a strong and unique password for 999cd, and logging out of your account when using a shared or public device. If you suspect your 999cd account has been compromised, contact support immediately at [email protected].

999cd respects your rights over your personal data. As a registered player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact the 999cd support team at [email protected] with a clear description of your request and sufficient information to verify your identity.

• Right of Access: You may request a copy of the personal data 999cd holds about you, along with information about how it is used and with whom it is shared. We will respond within 30 days of receiving a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. Minor corrections (such as updating your contact number) can be made directly in your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you have objected to processing. Note that this right is subject to our legal retention obligations — we cannot delete data that we are required by law to retain.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is being disputed.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format, and to have it transferred to another service provider where technically feasible.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to other types of processing where we rely on legitimate interests as the legal basis, subject to overriding legitimate grounds on our side.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We aim to respond to all privacy rights requests within 30 calendar days. In complex or high-volume cases, we may extend this to 60 days, in which case we will notify you of the extension and the reason for it. All responses are provided free of charge for the first request per 12-month period.

The 999cd platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If 999cd discovers or has reasonable grounds to suspect that personal data has been collected from a person under the age of 18, we will immediately suspend the associated account, delete the data concerned, and return any deposited funds to the originating payment method.

If you are a parent or guardian and believe that a person under your care has registered an account or provided personal data to 999cd, please contact us immediately at [email protected]. Include sufficient details for us to identify the account in question. We will prioritise such reports and take immediate action.

999cd's age verification processes are designed to prevent under-18 registration at the point of account creation. However, if age misrepresentation occurs, the enforcement actions described above apply without exception. No winnings generated during a period of underage use will be paid out.

999cd reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. The effective date displayed at the top of this document indicates when the current version came into force.

Where a change is material — meaning it meaningfully affects your privacy rights or the way your personal data is used — 999cd will provide at least 14 days' advance notice to registered players via their registered email address, or via a prominent notice on the 999cd platform. Non-material changes (such as typographical corrections or clarifications that do not alter the substance of the policy) may be made without prior notice.

Your continued use of the 999cd platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes, you should stop using the platform and contact support to request account closure and the deletion of your personal data, subject to our legal retention obligations.

Prior versions of this Privacy Policy are available to registered players on request by emailing [email protected]. We will provide prior versions within 5 business days of a verified request.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 999cd handles your personal data, please contact our support team using the details below. All privacy and data protection enquiries are handled in English, 24 hours a day, 7 days a week, staffed on Bangladesh Standard Time (BST, UTC+6).

• Email: [email protected]
• Live Chat: Available within the 999cd platform after login
• Response Time: Within 2 hours for standard privacy queries; within 24 hours for formal data rights requests
• Support Hours: 24/7, Bangladesh Standard Time (UTC+6)

When submitting a data rights request, please include your full registered name, the email address associated with your 999cd account, and a clear description of your request. We may ask for additional information to verify your identity before processing the request. This is a security measure to ensure that personal data is not disclosed to an unauthorised party.

For responsible gaming support — including self-exclusion, deposit limit requests, and time-out activation — please visit our dedicated Responsible Gaming page or contact support directly. Responsible gaming requests are treated as a priority and actioned immediately upon receipt.