999r Privacy Policy

999r operates an online casino and sports betting platform accessible at 999r.io, designed specifically for players in Bangladesh. For the purposes of this Privacy Policy, "999r", "we", "us", and "our" refer to the operator of the 999r platform. Our platform offers a comprehensive range of services including cricket betting, live casino games, slots, and virtual sports, all accessible via desktop and mobile browser.

As the data controller for personal information collected through the 999r platform, we are responsible for determining the purposes and means by which your personal data is processed. If you have any questions about how your data is handled, you may contact our Data Protection contact at [email protected].

This Privacy Policy applies to all personal data collected by 999r in connection with:

• The creation and management of a 999r player account.
• All deposits, withdrawals, and financial transactions conducted through the platform.
• Participation in any casino game, sports betting market, tournament, or promotional offer on the platform.
• All communications between you and 999r, including live chat, email, and support tickets.
• Your use of the 999r website and any mobile application made available by 999r.
• Know Your Customer (KYC) identity verification processes.

This Policy does not govern the data practices of third-party game providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi) or payment processors (such as bKash, Nagad, Rocket, or Upay) in their own capacity. Please review their respective privacy notices for information on how they handle your data.

When you register a 999r account, we collect: full legal name, date of birth, residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or elsewhere in Bangladesh), mobile phone number, and a username and password of your choosing.

To comply with anti-money laundering obligations and to verify player age, we may collect copies of identity documents including your National ID Card (NID), passport, or driving licence. We may also request a selfie or live photo for facial verification purposes where required.

We collect records of all deposits, withdrawals, and gameplay transactions associated with your account. This includes the payment method used (e.g., bKash account number, Nagad number), transaction amounts in BDT, timestamps, and transaction reference numbers. We do not store full bKash PINs or mobile banking passwords — these are handled exclusively by the relevant payment service providers.

When you use the 999r platform, we automatically collect technical data including your IP address, device type, operating system, browser type and version, screen resolution, session duration, pages visited, games played, and referring URL. This data is used for platform security, fraud detection, and service optimisation.

We retain records of all communications between you and 999r customer support, including live chat transcripts, email correspondence, and support ticket history. These records are used to resolve disputes, improve service quality, and train support staff.

Where you use responsible gaming tools — such as deposit limits, session time alerts, cooling-off periods, or self-exclusion — we record these preferences and their activation dates. This data is treated with a high level of sensitivity and is used solely to honour your responsible gaming choices and to comply with our duty of care obligations.

999r uses personal data collected from players for the following specific purposes:

• Account Management: To create, maintain, and administer your 999r player account, including processing login credentials, updating account settings, and handling account closure requests.
• Identity Verification: To verify that you meet the 21+ age requirement and to confirm your identity as required by our anti-money laundering (AML) compliance obligations.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported banking channels, and to maintain accurate financial records of all transactions.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, account takeovers, money laundering, bonus abuse, and other forms of Prohibited Conduct as defined in our Terms & Conditions.
• Platform Personalisation: To tailor the 999r experience to your preferences, including remembering your preferred language settings, game history, and responsible gaming configurations.
• Customer Support: To respond to your queries, resolve disputes, and provide technical assistance in connection with your use of the platform.
• Marketing Communications: Where you have opted in to receive promotional communications, to send you information about new games, seasonal promotions (e.g., BPL season, Eid, Pohela Boishakh offers), deposit bonuses, and platform updates via SMS or email.
• Legal Compliance: To fulfil obligations under applicable Bangladeshi law, including responding to lawful requests from law enforcement or regulatory authorities.
• Platform Improvement: To analyse aggregated usage data in order to improve platform performance, game selection, payment processing speeds, and the overall player experience.

999r processes personal data on the following legal bases, depending on the type of data and the purpose of processing:

• Contractual Necessity: Processing required to perform the contract between 999r and the Player — including account registration, transaction processing, game participation, and customer support — is carried out on the basis that it is necessary to deliver the services you have requested.
• Legal Obligation: Certain processing activities — in particular KYC identity verification, transaction monitoring, and AML reporting — are carried out to comply with applicable legal obligations.
• Legitimate Interests: Processing for fraud prevention, platform security, abuse detection, and internal analytics is carried out on the basis of 999r's legitimate interests in operating a safe and commercially viable platform, provided those interests are not outweighed by your privacy rights.
• Consent: Where 999r processes data for marketing communications, optional personalisation features, or any other purpose not covered by the above bases, we will first obtain your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

999r does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following limited circumstances:

Transaction data is shared with our payment processing partners — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other supported payment channels — to the extent necessary to process your deposits and withdrawals. These parties act as independent data controllers for their own processing activities.

KYC document data may be shared with third-party identity verification and age verification service providers engaged by 999r to perform document authentication and facial verification checks. These providers process data on our behalf under strict contractual data processing agreements.

Technical and financial data may be shared with fraud detection and anti-money laundering screening services. These providers use the data exclusively to assess risk signals associated with individual transactions and account behaviour patterns.

When you launch a game hosted by a third-party provider such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, certain session data (including your player ID and session token) is shared with that provider in order to initialise and operate the game session. No sensitive personal data (such as your full name, NID, or financial details) is shared with game providers.

999r may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, legal process, or where disclosure is necessary to protect the legal rights, safety, or property of 999r or its players.

999r retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any overriding legal obligations that require us to keep records for a defined minimum period.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player. Data retained solely in anonymised, aggregated form for analytics purposes is not subject to these retention limits.

Cookies are small text files placed on your device when you visit the 999r website. They allow the platform to recognise your device across sessions, remember your preferences, maintain your login state, and collect usage data for analytics and security purposes.

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your login state and security tokens that protect against cross-site request forgery (CSRF). You cannot opt out of these cookies without ceasing to use the platform.
• Functional Cookies: Used to remember your preferences, such as your preferred game category, responsible gaming settings, and notification preferences. These persist across sessions to improve your experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate the platform — which pages are visited most often, where users encounter errors, and how session flows unfold. This data informs platform improvements.
• Fraud Prevention Cookies: Used to assign a device fingerprint that helps detect suspicious login patterns, account takeover attempts, and multi-accounting behaviour.

You can control non-essential cookies via your browser settings. Most modern browsers allow you to block or delete cookies from specific websites. Please note that disabling certain categories of cookies may affect platform functionality, including your ability to stay logged in across sessions or access personalised features.

999r implements a multi-layered technical and organisational security framework to protect player data from unauthorised access, loss, alteration, or disclosure. Key measures include:

• TLS/SSL Encryption: All data in transit between your device and 999r servers is encrypted using current TLS standards. The padlock icon in your browser confirms an active encrypted connection.
• Password Hashing: Account passwords are never stored in plain text. They are processed through a one-way cryptographic hash function, meaning even 999r staff cannot view your actual password.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable SMS OTP-based 2FA on their accounts. Once enabled, login requires both your password and a one-time code sent to your registered mobile number.
• Role-Based Access Control: Internal access to player data is restricted to staff members who require it to perform specific, documented operational functions. Access logs are maintained and reviewed regularly.
• Intrusion Detection Systems: 999r employs real-time monitoring for anomalous access patterns, brute-force login attempts, and other indicators of platform compromise.
• Regular Security Audits: The 999r platform undergoes periodic security assessments to identify and remediate vulnerabilities in a timely manner.

As a 999r player, you have the following rights in respect of your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered username and mobile number for identity verification.

• Right of Access: You may request a copy of the personal data that 999r holds about you, together with information about how it is being used and on what legal basis.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing carried out on the basis of legitimate interests. Note that we may be required to retain certain data for legal compliance purposes even following a deletion request.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is carried out on the basis of consent or contractual necessity and is performed by automated means, you may request that we provide your data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for marketing purposes. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

999r will acknowledge receipt of a data rights request within 3 business days and aims to fulfil all requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

The 999r platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and 999r reserves the right to request documentary proof of age at any time.

If 999r becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, reverse any pending transactions where possible, and permanently delete all personal data associated with that account without delay.

The 999r platform may, from time to time, contain references to third-party services — including game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, and payment services such as bKash, Nagad, and Rocket. When you interact with a game hosted by a third-party provider or initiate a transaction via a third-party payment gateway, you are directed to that provider's own environment, which is governed by their own privacy policy and terms of service.

999r is not responsible for the privacy practices, data security standards, or content of any third-party service. We encourage you to review the privacy notices of any third-party service you interact with through the 999r platform. The inclusion of a third-party service within the 999r platform does not constitute an endorsement of that party's privacy practices.

999r may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes — such as introducing a new category of data collection, a new sharing arrangement, or a change to retention periods — we will notify registered players via the email address or mobile number associated with their account at least seven (7) days before the updated Policy takes effect.

For non-material changes — such as correcting typographical errors, clarifying existing provisions, or updating contact details — the updated Policy may take effect immediately upon publication. The effective date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the 999r platform following the publication of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with any amendment, you must cease using the platform and request account closure before the updated Policy takes effect. The most current version of this Policy is always available at /privacy-policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 999r handles your personal data, please reach out to our support team. We are available 24 hours a day, 7 days a week, including during Bangladesh public holidays.

• Email: [email protected]
• Subject Line for Data Requests: Data Rights Request — [Your Username]
• Live Chat: Available within your account dashboard after login, 24/7.
• Response Time: We aim to acknowledge all privacy-related queries within 3 business days (Bangladesh Standard Time, UTC+6) and to resolve them fully within 30 calendar days.