999bh Privacy Policy — Your Data, Your Rights

When you interact with the 999bh platform, we collect certain categories of personal information. This section explains precisely what data we gather, and under what circumstances each category arises.

Information You Provide Directly

During registration and ongoing use of your 999bh account, you provide us with information that is necessary to deliver our services. This includes:

• Identity data: Your full legal name, date of birth, and nationality, collected during account registration and KYC verification.
• Contact data: Your email address, phone number, and residential address in Bangladesh (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or elsewhere).
• Account credentials: Your chosen username and a hashed, encrypted version of your password. We never store passwords in plain text.
• Payment data: Details of the payment methods you use, such as your bKash mobile number, Nagad account reference, Rocket account number, or the last four digits and expiry date of a Visa or Mastercard. Full card numbers are handled exclusively by our PCI-compliant payment processors and are never stored on 999bh servers.
• Verification documents: Copies of your national identity card, passport, birth certificate, or utility bill, submitted during the KYC process.
• Communications: Records of any messages, emails, or support tickets you send to our team, including the content of those communications and associated metadata.

Information Collected Automatically

When you access and use the 999bh platform, certain technical data is collected automatically through your browser, device, and our servers:

• Device and browser data: Your device type, operating system version, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, games played, bet amounts, session duration, features used, and navigation paths through the platform.
• Log data: Your IP address, time and date of each access, referring URL, and server response codes.
• Location data: General geographic location inferred from your IP address, used to apply appropriate regional settings and verify compliance with our eligibility requirements.
• Cookies and similar technologies: Session identifiers, preference tokens, and analytics data as described in Section 4 of this policy.

999bh processes your personal data only for the purposes listed below. We rely on one or more recognised legal bases for each processing activity, including contractual necessity, legitimate interests, legal obligation, or your consent.

Where we rely on your consent for a specific processing activity — such as sending you promotional emails about upcoming BPL betting markets, seasonal Eid bonus offers, or new slot releases — you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

We do not use your personal data to make fully automated decisions that produce significant legal or similarly significant effects on you without providing the ability to request human review.

999bh does not sell, rent, or trade your personal data to third parties for marketing purposes. However, in certain circumstances, we share data with carefully selected partners and service providers, as described below.

Service Providers

We engage third-party companies to assist with specific aspects of platform operation. These service providers act as data processors on our behalf and are contractually bound to process your data only as directed by 999bh, for no other purpose, and in accordance with appropriate security standards. Categories of service providers include:

• Payment processors: Partners who handle transaction processing for bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard transactions. These providers receive only the minimum payment data necessary to complete your transaction.
• Identity verification providers: Specialist KYC platforms that assist in verifying the identity documents you submit during account verification.
• Cloud hosting and infrastructure: Providers of the server infrastructure on which the 999bh platform runs. These providers do not access your personal data in the ordinary course of their services.
• Analytics platforms: Services that help us understand aggregated usage patterns on the platform, enabling improvements to design and performance. Data shared for analytics is anonymised or pseudonymised where feasible.
• Customer support tooling: Platforms used to manage and respond to support tickets and live chat enquiries.

Legal and Regulatory Disclosure

999bh may disclose your personal data to law enforcement agencies, regulatory bodies, or other competent authorities where we are legally required to do so, where disclosure is necessary to protect the rights, safety, or property of 999bh or third parties, or where we are required to report suspicious activity under applicable anti-money laundering obligations. In such cases, we disclose only the minimum data required to fulfil the legal obligation.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving 999bh, your personal data may be transferred to the acquiring or successor entity. You will be notified of any such transfer and of any material changes to the terms under which your data is processed before the transfer takes effect.

The 999bh platform uses cookies and similar technologies to ensure the platform functions correctly, to keep your session secure, and to gather aggregated performance data that helps us improve the user experience. This section explains the categories of cookies we use and how you can manage them.

What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites work, to work more efficiently, and to provide reporting information. Cookies set by the website you are visiting are called first-party cookies; cookies set by other parties are called third-party cookies.

Categories of Cookies We Use

999bh does not use advertising cookies, retargeting pixels, or any tracking technology that follows your browsing activity across third-party websites. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies may affect your ability to log in or use core platform features.

999bh retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention schedule provides guidance on how long different categories of data are held:

• Account and identity data: Retained for the duration of your account relationship with 999bh, plus a period of five (5) years following account closure. This extended retention period is required to satisfy our legal obligations under anti-money laundering and financial record-keeping regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable financial regulations.
• KYC verification documents: Retained for five (5) years following account closure or the completion of the relevant KYC procedure, whichever is later.
• Support communications: Retained for three (3) years from the date of the last communication in a support thread, to enable us to refer back to previous interactions in the event of a dispute.
• Marketing preferences and consent records: Retained for the duration of your account relationship, and for up to two (2) years following account closure for audit purposes.
• Analytical and usage data: Retained in anonymised or aggregated form for up to three (3) years for platform performance analysis purposes.

When the applicable retention period expires, your personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original information. Where data is anonymised rather than deleted, the anonymised dataset no longer constitutes personal data and may be retained indefinitely for statistical purposes.

As a player on the 999bh platform, you have a number of rights in relation to your personal data. We are committed to honoring these rights in a timely and transparent manner. To exercise any of the rights listed below, contact our support team at [email protected] with the subject line "Data Rights Request".

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used format within a reasonable timeframe following receipt of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You may also update certain information directly through your account settings.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. This right is not absolute — it does not apply where we are required to retain data by law (for example, under AML record-keeping obligations). We will inform you of any constraints on deletion when processing your request.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing and a determination is pending.
• Right to Data Portability: Where we process your data on the basis of your consent or contractual necessity, and where processing is carried out by automated means, you have the right to receive your data in a machine-readable format and to request that it be transferred to another service provider where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We aim to respond to all data rights requests within 30 days of receipt of a verified request. Where a request is complex or where we receive a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

999bh implements a layered approach to data security, combining technical controls, organisational policies, and ongoing monitoring to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

Technical Safeguards

• Transport Layer Security (TLS): All data in transit between your browser or device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive data categories, including identity documents and payment references, are stored in encrypted form on our servers.
• Password hashing: Account passwords are never stored in plain text. We use industry-standard cryptographic hashing algorithms with per-account salting.
• Access controls: Access to player data within our organisation is role-based and restricted to personnel who need it to perform their job functions. Access logs are maintained and reviewed regularly.
• Intrusion detection: Our infrastructure is monitored continuously for anomalous activity, and automated alerts are triggered by patterns associated with unauthorised access attempts.

Organisational Safeguards

All 999bh staff who handle personal data receive training on data protection obligations and platform security procedures. Our data handling policies are reviewed and updated regularly. Where third-party service providers process personal data on our behalf, we conduct due diligence on their security practices and require them to maintain appropriate technical and organisational safeguards by contract.

Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, 999bh will notify affected players without undue delay and will take all reasonable steps to contain the breach, assess its impact, and prevent recurrence. You are encouraged to notify us immediately if you suspect your 999bh account has been compromised.

999bh reserves the right to update or amend this Privacy Policy at any time. We will publish the revised policy on this page and update the effective date shown at the top of the document. Where changes are material — meaning they significantly affect how we process your data or your rights in relation to that data — we will notify you by email to the address registered on your account or by a prominent notice on the platform prior to the changes taking effect.

Your continued use of the 999bh platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with the revised policy, you should discontinue use of the platform and may request account closure in accordance with our Terms & Conditions.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your personal data by 999bh, please contact our support team using the details below. All data-related enquiries are handled confidentially and with the care they deserve.

• Email: [email protected]
• Subject line for data requests: "Data Rights Request"
• Response time: We aim to acknowledge all privacy enquiries within 2 business days and to resolve them fully within 30 days.

This Privacy Policy was last reviewed and updated on 1 January 2026. It applies to all players accessing the 999bh platform from Bangladesh and all other jurisdictions where the platform is accessible.