Your Privacy Matters at 999bb
We Protect What's Yours

1 Introduction

Welcome to 999bb. This Privacy Policy ("Policy") sets out how 999bb ("we", "us", "our") collects, uses, stores, processes, and discloses personal information obtained from users ("you", "your") who access or use our online casino and sports betting platform at https://999bb.io and all associated subdomains, mobile interfaces, and digital touchpoints (collectively, the "Platform").

We are committed to protecting your privacy and handling your personal data with transparency, integrity, and in accordance with applicable data protection principles. This Policy has been drafted in plain English to ensure you fully understand how your information is used and what choices you have.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, both of which are accessible on the Platform. By registering an account or continuing to use the 999bb Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein.

2 Data Controller

999bb is the data controller responsible for the personal data collected and processed through the Platform. As data controller, we determine the purposes and means of processing your personal data and are accountable for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all data protection enquiries, requests, or complaints, you may contact our designated data protection contact at the following address:

• Platform: https://999bb.io
• Email: [email protected]
• Operating Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

We will endeavour to respond to all privacy-related enquiries within a reasonable timeframe, and no later than the period required by applicable law.

3 Data We Collect

The categories of personal data we collect about you depend on how you interact with the 999bb Platform. The following table summarises the data categories and typical examples:

We do not intentionally collect any special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless specifically required for identity verification purposes and with your explicit consent.

4 How We Collect Data

999bb collects personal data through a variety of channels and interactions, including:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, updating your profile, contacting customer support, or participating in promotions.
• Automated technologies: As you navigate and interact with the Platform, we automatically collect Technical Data and Usage Data via cookies, server logs, web beacons, and similar tracking technologies. See Section 10 for full details.
• Payment processors: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, we receive confirmation data and transaction identifiers from the relevant payment service provider. We do not store full card numbers or mobile banking PINs.
• Identity verification services: We may engage third-party KYC and identity verification partners to validate the documents you submit. These partners provide us with the outcome of verification checks alongside a confidence score.
• Game studios: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may share aggregated game session data with us for the purposes of dispute resolution and responsible gaming monitoring.
• Publicly available sources: We may, where permitted by applicable law, supplement the information you provide with information from publicly available sources for the purpose of fraud prevention and AML compliance.

5 Purpose & Legal Basis

We process your personal data only where we have a legitimate legal basis for doing so. The following table outlines the key purposes for which we process your data and the corresponding legal basis:

6 Data Sharing

999bb does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We may, however, share your personal data with the following categories of recipients where necessary to operate the Platform and comply with our legal obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and card payment networks (Visa, Mastercard) receive the minimum data required to process your transactions securely.
• Identity Verification Partners: Third-party KYC providers receive copies of identity documents you submit solely for the purpose of verifying your identity. These partners are bound by strict data processing agreements.
• Game Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other integrated providers receive session data necessary to deliver their games and resolve disputes.
• IT and Infrastructure Providers: Cloud hosting, security monitoring, and platform infrastructure partners who process data on our behalf under binding data processing agreements.
• Legal and Regulatory Authorities: We may be required by law to disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where required by applicable legislation, court order, or regulatory direction.
• Professional Advisers: Legal, accounting, and compliance advisers who are bound by confidentiality obligations and process data only as necessary for the relevant advisory service.

All third parties with whom we share personal data are required to handle that data securely and in accordance with applicable data protection standards. We do not permit third-party service providers to use your data for their own purposes beyond the scope of the services they provide to us.

7 International Transfers

In order to deliver the 999bb Platform to users in Bangladesh and other permitted jurisdictions, some of your personal data may be transferred to, stored on, or processed by systems located outside Bangladesh. This may occur where our infrastructure partners, game studios, or identity verification providers operate servers in other countries.

Wherever such international transfers take place, 999bb takes all reasonable steps to ensure that your data is afforded an equivalent level of protection to that which it would receive within your home jurisdiction. These steps may include:

• Entering into data processing agreements that include appropriate contractual safeguards.
• Transferring data only to countries or entities that maintain data protection standards consistent with internationally recognised practices.
• Applying technical and organisational security measures throughout the data transfer process.

If you have questions about the specific safeguards applied to any particular international data transfer, please contact us at [email protected].

8 Data Retention

We retain personal data for no longer than is necessary to fulfil the purposes outlined in this Policy, or as required to meet our legal, regulatory, and contractual obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with AML and financial record-keeping obligations.
• Transaction and Financial Data: Retained for a minimum of five (5) years following the date of the transaction, as required for financial audit and regulatory compliance purposes.
• Gaming Activity Data: Retained for three (3) years from the date of each session, or longer if required in connection with a dispute, investigation, or responsible gaming intervention.
• Communications Data: Support correspondence retained for two (2) years following closure of the relevant support interaction.
• Technical and Usage Data: Typically retained for thirteen (13) months to facilitate year-on-year performance analysis, after which it is aggregated and anonymised.
• Verification Documents: Retained for the period required by applicable law, typically five (5) years from the date of verification.

At the end of the applicable retention period, personal data is securely and permanently deleted or irreversibly anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for statistical and analytical purposes.

9 Security Measures

999bb implements a comprehensive set of technical, organisational, and procedural security measures designed to protect your personal data from unauthorised access, accidental loss, disclosure, destruction, or alteration. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encrypted Data Storage: Sensitive data at rest, including identity documents and financial records, is stored in encrypted form on access-controlled infrastructure.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access to personal data receive mandatory data protection training and are bound by confidentiality obligations.
• Two-Factor Authentication: 999bb supports two-factor authentication (2FA) for user accounts and enforces 2FA for all internal administrative access.
• Penetration Testing and Security Audits: We conduct regular security assessments and penetration testing of our Platform infrastructure to identify and remediate vulnerabilities proactively.
• Intrusion Detection: Automated systems monitor network activity for anomalous behaviour patterns and trigger alerts in the event of suspected unauthorised access attempts.
• Incident Response: In the event of a data security incident, we maintain a documented incident response procedure. Where required by applicable law, we will notify affected users and relevant authorities within the required timeframe.

While we invest significantly in security infrastructure, no platform can guarantee absolute security against all possible threats. You also have a role to play: please use a strong, unique password for your 999bb account, enable 2FA, and never share your login credentials with anyone.

10 Cookies & Tracking Technologies

999bb uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage) to operate and improve the Platform. A cookie is a small text file placed on your device by our server when you visit the Platform. The following cookie categories are used:

You can control and manage cookies through your browser settings. Most modern browsers allow you to block, delete, or restrict cookies. Please note that blocking strictly necessary or security cookies may impair your ability to use key Platform features, including logging in to your account.

We do not use cookies to serve third-party advertising or to track you across unrelated websites beyond the 999bb Platform.

11 Your Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data 999bb holds about you:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed. We will respond to access requests within a reasonable timeframe.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. You can update many details directly within your account dashboard.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request that we delete your personal data. This right is subject to our legal obligations to retain certain categories of data (e.g., AML record-keeping requirements).
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain situations — for example, while a correction request is being assessed.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, and carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., receiving marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request". We may be required to verify your identity before processing your request. We aim to respond to all valid requests within 30 days.

12 Minors & Age Restriction

999bb is an adult entertainment platform strictly intended for users who are 21 years of age or older. We do not knowingly collect, store, or process personal data belonging to individuals under the age of 21.

As part of our account registration and KYC verification process, all users are required to confirm their date of birth and submit valid government-issued identity documentation. Any account found to belong to a person under the age of 21 will be immediately suspended, all funds held will be handled in accordance with applicable regulations, and the matter may be referred to the relevant authorities.

If you are a parent or guardian and believe that a minor under your care has registered an account on the 999bb Platform or submitted personal data to us without your consent, please contact us immediately at [email protected]. We will investigate the matter promptly and take all necessary steps to delete the relevant data and close the account.

13 Marketing Communications

With your explicit consent, 999bb may send you promotional communications including information about bonuses, seasonal promotions (such as Eid, Pohela Boishakh, and BPL specials), new game releases, and platform updates. Marketing communications may be delivered via email or on-platform notification.

You may opt in to marketing communications during the registration process or at any time through your account dashboard preferences. You may withdraw your consent and opt out of all marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email we send you.
• Updating your communication preferences directly in your 999bb account dashboard.
• Contacting our support team at [email protected] with the subject line "Unsubscribe".

Please note that even if you opt out of marketing communications, we will continue to send you essential service-related communications — such as transaction confirmations, security alerts, KYC status updates, and important policy change notifications. These communications are not marketing and cannot be opted out of while your account remains active.

14 Third-Party Services

The 999bb Platform integrates with a number of third-party services that are essential to its operation — including game studios, payment processors, and identity verification providers. While we select these partners carefully and require them to maintain appropriate data protection standards, please be aware that their own privacy policies govern how they handle data within their systems.

We are not responsible for the privacy practices of third-party service providers beyond the scope of the data processing agreements we hold with them. We encourage you to review the privacy policies of any third-party services you interact with directly, particularly payment service providers such as bKash, Nagad, and Rocket, whose mobile banking platforms operate independently of the 999bb Platform.

The 999bb Platform may, from time to time, contain references to third-party services or content. The inclusion of any such reference does not constitute an endorsement of, or responsibility for, the privacy practices of those third parties.

15 Policy Amendments

999bb reserves the right to update, revise, or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and functionality of the Platform. All amendments will take effect upon publication of the updated Policy on this page.

Where changes are material — meaning they significantly affect how your personal data is processed or your rights in relation to that data — we will provide advance notice via a prominent on-platform notice or email communication to your registered address, no less than fourteen (14) days prior to the changes taking effect. Non-material changes (such as typographical corrections or clarifications that do not alter the substance of the Policy) may be made without prior notice.

The "Last Updated" date displayed at the top of this page always reflects the most recent revision. We encourage you to review this Policy periodically to stay informed of how 999bb protects your privacy. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which 999bb processes your personal data, please contact our support team using the details below:

• Email: [email protected]
• Platform: https://999bb.io
• Response Time: We aim to acknowledge all privacy enquiries within 48 hours (Bangladesh Standard Time, UTC+6) and to provide a full response within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, or if you believe that our data processing practices are not compliant with applicable data protection law, you have the right to escalate your complaint to the relevant competent authority in your jurisdiction.

We take all privacy complaints seriously and are committed to resolving them fairly and transparently. If you reach out to us with a concern, we will investigate thoroughly and communicate the outcome to you in plain English.