Privacy
Policy
— 999ba Platform

999ba ("we", "us", "our", "the Platform") is committed to safeguarding the privacy and personal data of all players who register for and use the 999ba online betting and gaming platform, accessible at https://999ba.io. We recognise that the players who trust us with their personal information — from Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and across Bangladesh — deserve transparency about how that information is managed.

This Privacy Policy sets out in plain, formal English the categories of personal data we collect, the purposes for which we process that data, the legal bases that justify our processing activities, the third parties with whom we may share data, the security measures we employ, your rights as a data subject, and how to contact us with any privacy-related concern.

We review and update this Privacy Policy periodically. The "Last Updated" date at the top of this document reflects the most recent revision. Continued use of the 999ba platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you disagree with any material change, you must cease using the platform and may request account closure by contacting [email protected].

This Privacy Policy applies to all 999ba services, including cricket betting, live casino, slots, crash games, promotional campaigns, and any future services added to the platform. It applies to data collected through the website, mobile browser interface, and any 999ba-branded application that references this policy.

For the purposes of this Privacy Policy, 999ba acts as the data controller in respect of personal data collected from players and visitors to the https://999ba.io platform. As data controller, 999ba determines the purposes for which personal data is processed and the means by which that processing is carried out.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or wish to raise a concern about how 999ba processes your personal data, you may contact our support team at the details provided in Section 15 of this policy.

999ba collects personal data in several categories depending on your level of interaction with the platform. The categories of personal data we may collect and process include the following:

999ba does not collect special categories of personal data (such as health data, religious beliefs, political opinions, or biometric data) except where strictly required for responsible gaming assessments and only with your explicit prior consent.

999ba collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide directly when registering an account, completing identity verification, making a deposit or withdrawal request, contacting our support team, or participating in a promotion.
• Automated Technical Collection: Technical and usage data collected automatically when you access the 999ba platform, including IP address logging, session cookies, browser fingerprinting for fraud prevention, and server access logs.
• Payment Processors: Confirmation and transaction reference data received from payment processors including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Islami Bank when you make a deposit or request a withdrawal.
• Identity Verification Partners: Where applicable, 999ba may use third-party identity verification services to cross-reference the documents you submit during the KYC process. These partners return a verification result to 999ba; 999ba does not receive raw third-party databases of personal information.
• Fraud Prevention Systems: Automated risk-scoring systems may analyse your account activity, device fingerprint, and IP address to generate fraud risk indicators. These are used to protect both 999ba and legitimate players from fraudulent activity.

999ba processes your personal data only where we have a legitimate purpose and a valid legal basis for doing so. The table below summarises our primary processing activities, their purposes, and the legal basis that justifies each activity:

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal. To withdraw consent, contact [email protected].

6.1 What Are Cookies. Cookies are small text files placed on your device when you visit the 999ba platform. They allow the platform to remember your preferences, maintain your session, and collect technical and usage data for the purposes described in Section 5 of this policy.

6.2 Types of Cookies We Use. 999ba uses the following categories of cookies on the platform:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session management cookies that keep you logged in, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: Used to remember your preferences such as display settings, language selection, and responsible gaming tool configurations. Disabling these cookies may affect your user experience but will not prevent platform access.
• Analytical Cookies: Used to collect anonymised or pseudonymised data about how players interact with the 999ba platform — including pages visited, time on site, navigation paths, and error reports. This data is used solely to improve platform performance and user experience.
• Fraud Prevention Cookies: Used to generate a browser fingerprint that assists our fraud detection systems in identifying suspicious login patterns, account takeover attempts, and multi-accounting activity.

6.3 Managing Cookies. You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking strictly necessary cookies will prevent you from using key platform features including account login. Instructions for managing cookies are available in the help documentation for all major browsers.

6.4 No Third-Party Advertising Cookies. 999ba does not use third-party advertising cookies or allow advertising networks to set cookies on your device through the 999ba platform. We do not participate in cross-site behavioural advertising programmes.

7.1 Our Principle. 999ba does not sell, rent, or trade your personal data to third parties for commercial or advertising purposes. We share personal data with third parties only where it is strictly necessary to operate the platform, comply with legal obligations, or protect the legitimate interests of 999ba and our player community.

7.2 Categories of Third-Party Recipients. Your personal data may be shared with the following categories of recipients:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Islami Bank receive the financial data necessary to execute deposit and withdrawal transactions. These partners operate under their own privacy policies and are subject to applicable financial services regulations.
• Identity Verification Partners: Third-party KYC service providers who process identity documents and return a verification result to 999ba for the purpose of confirming player eligibility and age.
• Fraud Prevention & Risk Management Providers: Service providers who assist 999ba in detecting and preventing fraudulent activity, money laundering, and account abuse. These providers process technical and behavioural data under strict data processing agreements.
• Game Content Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised player session data (such as a unique session token) as required to operate their games on the 999ba platform. These providers do not receive your real name, contact details, or payment information.
• Legal and Regulatory Authorities: 999ba may disclose personal data to law enforcement agencies, regulatory bodies, or other government authorities where required to do so by law, court order, or where we reasonably believe such disclosure is necessary to prevent criminal activity or protect the rights and safety of others.
• Professional Advisors: Legal counsel, auditors, and accountants who are bound by professional secrecy obligations and process data only to the extent necessary to provide their professional services to 999ba.

7.3 Data Processing Agreements. Where 999ba shares personal data with third-party service providers who process data on our behalf (as data processors), we maintain written data processing agreements with those providers that require them to process data only as instructed, implement appropriate security measures, and not engage sub-processors without prior authorisation.

8.1 Technical Measures. 999ba implements a comprehensive set of technical security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the 999ba platform;
• Encryption of sensitive data at rest within 999ba's database infrastructure;
• PCI-DSS compliant payment processing for all financial transaction data;
• Role-based access controls restricting employee access to personal data on a strict need-to-know basis;
• Two-factor authentication requirements for internal administrative access to player data systems;
• Regular automated and manual security assessments of platform infrastructure;
• Intrusion detection systems and real-time security monitoring.

8.2 Organisational Measures. In addition to technical controls, 999ba maintains organisational security measures including staff data protection training, clear internal data handling procedures, and a documented incident response plan for managing any security breach promptly and effectively.

8.3 Security Incidents. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, 999ba will notify the affected players without undue delay and will take all reasonable steps to contain and remediate the breach. Notification will be provided via the email address registered to your 999ba account.

8.4 Your Responsibility. While 999ba takes all reasonable steps to protect your data, you are responsible for maintaining the security of your own account credentials. Do not share your 999ba username or password with any third party. If you suspect your account has been compromised, contact [email protected] immediately.

9.1 Retention Principles. 999ba retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or operational obligations. We do not retain personal data in identifiable form for longer than is necessary.

9.2 Active Account Data. For the duration of your active 999ba account, we retain all data categories described in Section 3 of this policy as necessary to provide platform services, manage your account, process transactions, and comply with ongoing legal obligations.

9.3 Post-Closure Retention. Following the closure of a 999ba account — whether initiated by the player or by 999ba — we retain the following data for a minimum period of 5 years from the date of account closure:

• Identity and contact data (as required for anti-money laundering record-keeping);
• Complete transaction history, including all deposits and withdrawals;
• KYC verification documents and verification records;
• Communications data relevant to any dispute or complaint.

9.4 Marketing Data. Where you have opted in to receive marketing communications from 999ba, we retain your marketing preference data until you withdraw consent. Following withdrawal of consent, marketing preference data is retained for a further 12 months solely for the purpose of suppressing future communications.

9.5 Anonymisation. Where personal data is no longer required in identifiable form but may have residual analytical value, 999ba may anonymise the data so that it can no longer be attributed to any individual. Anonymised data is not subject to this Privacy Policy.

As a player whose personal data is processed by 999ba, you have the following rights in respect of that data. To exercise any of these rights, please contact [email protected] with the subject line "Data Subject Rights Request":

• Right of Access: You have the right to request a copy of the personal data that 999ba holds about you, together with information about how that data is processed. We will respond to access requests within 14 calendar days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update many of your account details directly through the 999ba account settings area.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. This right is not absolute — we may be required to retain certain data to comply with legal obligations (see Section 9) or to defend against legal claims.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. If you object, 999ba will cease processing unless compelling legitimate grounds exist that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

11.1 Opt-In Basis. 999ba sends promotional communications — including bonus offers, seasonal promotions tied to Eid, Pohela Boishakh, BPL season, IPL season, and other events relevant to Bangladeshi players — only to players who have explicitly opted in to receive such communications during registration or via their account settings.

11.2 Types of Marketing Communications. Where you have opted in, 999ba may contact you by email or SMS with information about welcome bonuses, reload offers, free spin promotions, cricket betting markets, live casino events, and platform updates.

11.3 Opting Out. You may withdraw consent for marketing communications at any time by contacting [email protected] with the subject line "Unsubscribe" or by updating your communication preferences in your 999ba account settings. Following a valid opt-out request, 999ba will cease sending marketing communications within 5 business days. Note that opting out of marketing communications does not affect service-related communications such as transaction confirmations, account security alerts, and important policy update notices.

11.4 No Third-Party Marketing. 999ba does not share your personal data with third-party companies for the purpose of enabling them to send you marketing communications about their own products or services. Your contact details are used exclusively for 999ba's own communications.

The 999ba platform is strictly intended for adults aged 21 years and above. 999ba does not knowingly collect personal data from any individual under the age of 21. Our registration process includes mandatory date-of-birth verification, and accounts found to belong to individuals under the minimum age are immediately suspended and all associated funds are frozen pending investigation.

If you believe that a minor has registered for a 999ba account or that personal data belonging to a minor has been submitted to the platform, please contact [email protected] immediately. Upon confirmation, 999ba will take prompt steps to close the account and delete the personal data of the minor from our systems to the extent permitted by anti-money laundering record-keeping obligations.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. 999ba supports responsible gaming and the protection of vulnerable persons. For more information, please visit our Responsible Gaming page.

13.1 Cross-Border Processing. To operate the 999ba platform and deliver the full range of services to players across Bangladesh, it may be necessary to transfer personal data to servers or service providers located outside Bangladesh. Such transfers may occur in connection with cloud hosting infrastructure, game content delivery networks operated by providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, and with global fraud prevention and identity verification service providers.

13.2 Transfer Safeguards. When personal data is transferred outside Bangladesh, 999ba takes reasonable steps to ensure that appropriate protections are in place. These steps may include entering into data processing agreements that incorporate standard contractual clauses, selecting service providers that maintain internationally recognised security certifications, and applying pseudonymisation or anonymisation techniques where practicable to reduce the risk associated with international transfers.

13.3 Game Provider Data. When you play a game provided by a third-party game studio on the 999ba platform, a pseudonymised session token — not your real identity data — is passed to the game provider's servers to facilitate the game session. Your real name, contact details, and payment data are not transmitted to game providers.

999ba reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing activities, changes in applicable law, or improvements to our platform and services. When we make material changes to this Privacy Policy, we will notify registered players by email to the address associated with their 999ba account and will update the "Last Updated" date at the top of this document.

We encourage all players to review this Privacy Policy periodically to remain informed about how 999ba protects their personal data. The most current version of the Privacy Policy will always be available at https://999ba.io/privacy-policy. If you continue to use the 999ba platform after a revised Privacy Policy has been published, you are deemed to have accepted the updated terms. If you do not accept the revised terms, please cease using the platform and contact [email protected] to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by 999ba, please contact our support team using the details below. All privacy-related communications should be addressed to [email protected] and must include your registered account username to allow us to locate your data promptly.

• Email: [email protected]
• Subject Line for Privacy Enquiries: "Privacy Enquiry"
• Subject Line for Data Subject Rights Requests: "Data Subject Rights Request"
• Subject Line for Unsubscribe Requests: "Unsubscribe"
• Response Time: Acknowledgement within 2 business days; substantive response within 14 calendar days (Bangladesh Standard Time, UTC+6)
• Support Hours: 24 hours a day, 7 days a week

For responsible gaming support requests — including self-exclusion, deposit limit adjustments, and gambling harm concerns — please mark your message as urgent in the subject line. Our team will prioritise these requests above standard enquiries. Further guidance is available on the Responsible Gaming page.