999ab Privacy Policy

This Privacy Policy is issued by 999ab (hereinafter "999ab", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at https://999ab.io and its associated subdomains. 999ab provides casino games, live dealer tables, slot games, colour prediction games, and sports betting services to registered adult players, with a primary focus on the Bangladesh market.

For the purposes of this Privacy Policy, 999ab acts as the data controller in respect of the personal data it collects from players and website visitors. This means we are responsible for deciding how and why your personal data is processed, and for ensuring that processing is carried out lawfully, fairly, and transparently.

This Privacy Policy applies to all personal data collected through the 999ab website, mobile-optimised platform, any future dedicated applications, and through direct communications between you and our support team. It does not apply to the data practices of third-party game providers, payment processors, or other external services whose own privacy policies govern their data handling.

999ab collects personal data in the following categories. We collect only what is necessary for the specific purposes described in this policy.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data unless specifically required for legal compliance and only with your explicit consent where applicable law demands it.

999ab collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting support, or using any other interactive feature of the platform.
• Automated technical collection: Data collected automatically when you access the platform, including IP address, device and browser information, session duration, pages visited, and click-path data. This collection occurs via server logs and first-party cookies.
• Payment provider data: When you initiate a transaction via bKash, Nagad, Rocket, Upay, or a bank transfer, those providers share limited transaction confirmation data with us (e.g., transaction ID, amount, status) to enable account crediting and reconciliation. Your full payment credentials remain with the provider and are not transmitted to 999ab.
• Game provider data: Third-party game studios (such as Pragmatic Play, Evolution Gaming, and Spribe) may share game session data with 999ab for the purposes of settling bets, resolving disputes, and calculating bonus contributions.
• Identity verification providers: Where required to verify your identity, we may engage third-party KYC (Know Your Customer) service providers who collect and verify documentary evidence on our behalf under strict data processing agreements.

For each category of personal data we process, 999ab relies on one or more of the following legal bases:

• Contractual necessity: Processing that is required to deliver the services you have registered for — including account management, payment processing, and game provision — is carried out because it is necessary to perform the contract between you and 999ab.
• Legal obligation: Certain processing activities are required to comply with applicable law, including age and identity verification (anti-money laundering obligations), responsible gaming record-keeping, and the maintenance of financial transaction records.
• Legitimate interests: Where we have a legitimate business interest in processing data that does not override your fundamental privacy rights, we may rely on this basis. Examples include fraud detection, platform security monitoring, and service improvement analytics.
• Consent: Where processing is not required for any of the above purposes — for example, the sending of optional marketing communications — we will ask for your explicit consent before proceeding. You may withdraw consent at any time by contacting [email protected].

999ab uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, maintain your player profile, authenticate your identity at login, and manage your account preferences and settings.
• Identity and age verification: To verify that you are at least 21 years of age and that you are who you say you are, in compliance with our strict 21+ policy and anti-money laundering obligations.
• Payment processing: To facilitate deposits and withdrawals in Bangladeshi Taka via your chosen local payment method, and to maintain accurate records of all financial transactions associated with your account.
• Game provision and bet settlement: To provide access to casino games, live dealer tables, slots, colour prediction games, and sports betting markets, and to correctly record and settle all bets and game outcomes.
• Bonus and promotion administration: To track wagering requirements, award bonus credits, process cashback, and verify eligibility for promotions in accordance with the relevant promotion terms.
• Customer support: To respond to your enquiries, process complaints, and assist with any technical or account-related issues you may experience on the platform.
• Responsible gaming compliance: To enforce deposit limits, session reminders, self-exclusion periods, and reality checks you have requested, and to monitor gaming activity for signs of problem gambling behaviour.
• Fraud and security monitoring: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and violations of our Terms and Conditions.
• Platform improvement: To analyse aggregated, anonymised usage data to improve platform performance, game selection, user experience, and the relevance of promotional offers.
• Legal compliance and record-keeping: To maintain records as required by applicable law and to cooperate with lawful requests from competent authorities.
• Marketing communications (consent-based only): To send you promotional emails or platform notifications about bonuses, new games, or special events — only where you have given your explicit consent to receive such communications.

999ab does not sell or rent your personal data to any third party under any circumstances. We may share your data with the following categories of third parties strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other local payment processors, to facilitate your deposit and withdrawal transactions. These providers receive only the data necessary to process each specific transaction.
• Game studios and content providers: Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, Spribe, and other licensed game providers, who receive session and game-play data for the purposes of game operation, dispute resolution, and RNG audit compliance.
• Identity verification (KYC) providers: Third-party services engaged to verify player identity, age, and address as required by our anti-money laundering and responsible gaming obligations.
• Technology and infrastructure providers: Cloud hosting, content delivery, and cybersecurity service providers who process data on our behalf under strict data processing agreements that prohibit any secondary use of your data.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, courts, or other competent authorities where required by applicable law, lawful court order, or where disclosure is necessary to protect the rights and safety of 999ab or third parties.

All third-party processors engaged by 999ab are required to implement appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than those specified in their contracts with us.

999ab retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual. Anonymised and aggregated data may be retained indefinitely for statistical and analytics purposes, as it no longer constitutes personal data.

999ab implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your browser and the 999ab platform is encrypted using industry-standard SSL/TLS protocols, ensuring that your data cannot be intercepted in transit.
• Password hashing: Account passwords are never stored in plaintext. They are processed using industry-standard one-way cryptographic hashing algorithms so that even 999ab's internal systems cannot read your password.
• Access controls: Access to personal data within 999ab's systems is restricted on a strict need-to-know basis. Staff with access to player data are subject to confidentiality obligations and undergo regular security training.
• Intrusion detection and monitoring: Our platform infrastructure is continuously monitored for suspicious activity, attempted breaches, and anomalous access patterns. Automated alerts and response procedures are in place to contain and address any incidents promptly.
• Regular security assessments: We conduct periodic security reviews and vulnerability assessments of our platform infrastructure to identify and remediate potential weaknesses before they can be exploited.
• Data minimisation in internal systems: Where possible, internally accessible records display only the minimum data fields required for the task at hand, reducing unnecessary exposure of full personal data profiles.

While 999ab takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. Players are also responsible for maintaining the security of their own account credentials and for reporting any suspected unauthorised access to [email protected] immediately.

As a player whose personal data is processed by 999ab, you have the following rights in respect of that data. To exercise any of these rights, please contact us at [email protected] with your full registered name and account details so that we can verify your identity before responding.

• Right of Access: You have the right to request a copy of the personal data 999ab holds about you, together with information about how and why it is being processed. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request that 999ab delete the personal data we hold about you. This right is subject to limitations where we are required to retain data to comply with legal obligations — for example, AML-mandated record-keeping — or to defend against legal claims.
• Right to Restriction of Processing: You may request that we restrict our processing of your personal data in specific circumstances, such as while the accuracy of data is being contested or while an objection to processing is under consideration.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing processing, we will cease immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

999ab uses first-party cookies and similar tracking technologies to enable essential platform functionality, maintain your login session, remember your preferences, and analyse aggregate usage patterns. We do not use third-party advertising cookies or cross-site tracking technologies.

The following categories of cookies are used on the 999ab platform:

• Strictly necessary cookies: These are essential for the platform to function. They maintain your login session, prevent cross-site request forgery, and ensure secure transmission of your requests. These cookies cannot be disabled without preventing you from using the platform.
• Functional cookies: These remember your preferences such as language settings, display options, and game lobby configurations to provide a more personalised experience across sessions.
• Analytics cookies (first-party only): These collect aggregated, anonymised data about how players navigate the platform — such as which pages are most visited, where users drop off, and how long sessions last. This data is used solely to improve platform design and performance. We do not use Google Analytics or any third-party analytics service.

You may adjust your browser settings to block or delete cookies at any time; however, disabling strictly necessary cookies will impair your ability to log in and use the platform. Adjusting cookie preferences does not affect data already collected under this policy.

The 999ab platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21, and we do not permit minors to register accounts or access any of our services.

During account registration, all players are required to confirm that they are at least 21 years of age. Identity verification procedures are in place to detect and prevent underage registration. Where 999ab discovers that an account has been registered by a person under the age of 21, the account will be closed immediately, any deposits will be returned to the original payment source, and any winnings accumulated during the period of underage access will be forfeited.

If you have reason to believe that a minor has registered an account on the 999ab platform, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

The 999ab platform may contain references to third-party game providers, payment services, and informational resources. Where the platform interface displays content served directly by third-party providers (such as game lobby iframes), those third-party services operate under their own privacy policies, which 999ab does not control.

999ab is not responsible for the privacy practices, data handling, or content of any third-party service. We encourage you to review the privacy policies of any third-party service you interact with through the 999ab platform, particularly your chosen payment provider (bKash, Nagad, Rocket, or Upay), as their data practices govern how they handle the credentials and transaction data you provide directly to them.

999ab reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, the introduction of new services or features, or improvements in how we communicate our privacy commitments to players.

When we make material changes to this Privacy Policy, we will notify registered players by posting a prominent notice on the 999ab platform and, where appropriate, by sending a notification to the email address registered to your account. The updated policy will indicate the revised effective date at the top of the document.

Your continued use of the 999ab platform following the posting of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with any changes to this policy, you should discontinue use of the platform and may request account closure by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or to how 999ab processes your personal data, please do not hesitate to reach out to our dedicated support team. We are committed to resolving all privacy-related queries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Support availability: 24 hours a day, 7 days a week, including public holidays in Bangladesh
• Response time: We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 days
• Language: English
• Coverage: Serving registered players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar

When contacting us about a data rights request, please include your registered username and the email address associated with your account so that we can verify your identity efficiently and respond to the correct account record.