bd399 Privacy Policy —
Your Data, Handled With Care

This Privacy Policy ("Policy") describes how bd399 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal information about individuals who register an account, visit the bd399 website, or interact with any of our services — including casino games, sportsbook, payment processing, customer support, and promotional communications.

This Policy applies to all users of the bd399 platform, including registered players, prospective players who browse the site without registering, and any person who contacts bd399 support. By using the bd399 platform or creating an account, you acknowledge that you have read, understood, and accepted the terms of this Policy.

This Policy should be read in conjunction with the bd399 Terms & Conditions, which govern the overall relationship between you and the platform. In the event of any conflict between this Policy and the Terms & Conditions on matters of data handling, this Policy shall take precedence.

bd399 collects personal information through several channels: directly from you when you register or interact with the platform, automatically through your use of our services, and in limited circumstances from third-party sources as described below.

2.1 Information You Provide Directly

• Registration data: full name, date of birth, gender, email address, mobile number, and residential address (including city, district, and postcode) provided when creating your bd399 account.
• Identity verification documents: scanned copies or photographs of your National Identity Card (NID), passport, or birth certificate submitted during Know Your Customer (KYC) verification.
• Payment information: mobile wallet identifiers (bKash, Nagad, Rocket, Upay account numbers), bank account details (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and transaction reference numbers. Note: bd399 does not store full card numbers or mobile banking PINs.
• Support communications: the content of messages, emails, chat transcripts, and any attachments you send to the bd399 customer support team.
• Preference settings: responsible gaming limits, notification preferences, and language or display settings configured within your account.

2.2 Information Collected Automatically

• Device & technical data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage data: pages visited, games played, bet history, session start and end times, navigation paths, and feature interactions within the platform.
• Transaction logs: deposit and withdrawal amounts, timestamps, payment method used, and transaction status records.
• Cookies and similar tracking data: session cookies, persistent cookies, and local storage data as further described in Section 6 of this Policy.
• Geolocation data: approximate location derived from your IP address, used for compliance and fraud prevention purposes. bd399 does not collect precise GPS-level location data.

2.3 Information from Third Parties

• Payment processors: confirmation of successful or failed transactions from bKash, Nagad, Rocket, Upay, and banking partners.
• Identity verification services: results of automated document verification checks where bd399 uses a third-party KYC provider.
• Fraud prevention databases: risk scoring and flagging data from anti-fraud service providers used to protect the integrity of the platform and its players.

bd399 uses the personal data we collect for the following purposes:

bd399 processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual necessity: Processing required to perform our contract with you — i.e., to operate your account, process deposits and withdrawals, and deliver the gaming services you have signed up for.
• Legal obligation: Processing required to comply with applicable laws, including AML/CTF regulations, age verification mandates, and responsible gaming requirements.
• Legitimate interests: Processing carried out to pursue bd399's legitimate business interests — such as fraud prevention, platform security, and improving our services — where those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your explicit consent, primarily in relation to marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

bd399 does not sell, rent, or trade your personal data. We may share your information with the following categories of recipients, strictly as necessary and under appropriate data-protection agreements:

• Payment processing partners: bKash, Nagad, Rocket, Upay, and banking partners receive only the transaction data necessary to process your deposits and withdrawals.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified providers receive session tokens and game-interaction data required to operate their games. These providers do not receive your full profile or payment details.
• Identity verification providers: Third-party KYC service providers receive the documents and personal details you submit for age and identity verification, under strict contractual data-processing agreements.
• Fraud prevention services: Anonymised or pseudonymised risk indicators may be shared with anti-fraud and responsible gaming screening services to protect the platform.
• IT and infrastructure providers: Cloud hosting, database management, and cybersecurity vendors who process data on bd399's behalf under binding data-processor agreements.
• Legal and regulatory authorities: Where required by law, court order, or a legitimate request from a competent authority in Bangladesh, bd399 may disclose your personal data to the relevant body. We will notify you of such a request where legally permitted to do so.
• Business transfer: In the event of a merger, acquisition, or sale of all or part of bd399's business, personal data held by bd399 may be transferred to the acquiring entity, subject to equivalent data-protection obligations.

All third-party recipients of personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the purposes for which it was shared.

bd399 uses cookies and similar technologies (local storage, session tokens) to operate the platform, remember your preferences, and gather analytics data. Cookies are small text files placed on your device when you visit the site.

Categories of cookies used by bd399:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies, CSRF-protection tokens, and load-balancing cookies. These cannot be disabled without breaking core functionality.
• Functional cookies: Store your preferences such as display language, responsible gaming settings, and last-visited game category, so these are remembered across sessions.
• Performance and analytics cookies: Collect aggregated, anonymised data about how players interact with the platform — pages visited, time on site, error events — to help bd399 identify and fix issues and improve the user experience.
• Anti-fraud and security cookies: Used to detect suspicious patterns, identify automated bot activity, and protect player accounts from unauthorised access.

You may control cookie behaviour through your browser settings. Blocking strictly necessary cookies will impair your ability to use the platform. Disabling functional or analytics cookies will not prevent you from accessing the platform, though some preferences may not be retained between sessions.

bd399 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account data: Retained for the lifetime of your account and for a period of 5 years after account closure, to satisfy AML/CTF and responsible gaming record-keeping requirements.
• Transaction records: Financial transaction logs are retained for a minimum of 5 years from the date of the transaction, in compliance with financial record-keeping obligations.
• Identity verification documents: KYC documents are retained for 5 years after account closure or the last transaction, whichever is later.
• Support communications: Customer support records are retained for 2 years from the date of the final correspondence in a support thread.
• Marketing consent records: Records of your opt-in or opt-out status for marketing communications are retained for the lifetime of your account plus 2 years.
• Analytics data: Aggregated and anonymised usage data may be retained indefinitely as it no longer constitutes personal data once anonymisation is complete.

When data reaches the end of its retention period, it is securely deleted from active systems and backups in accordance with bd399's internal data deletion procedures.

bd399 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key measures include:

• Transport encryption: All communications between your device and bd399 servers are encrypted using TLS 1.2 or higher (256-bit SSL).
• Data-at-rest encryption: Sensitive personal data stored on bd399 servers is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Internal access to personal data is strictly role-based. Only authorised bd399 personnel with a legitimate business need are granted access to player data, and all access is logged and audited.
• Penetration testing: bd399 commissions regular independent security assessments and penetration tests to identify and remediate vulnerabilities in the platform.
• Incident response: bd399 maintains a documented data breach response procedure. In the event of a security incident that is likely to result in a risk to your rights and freedoms, bd399 will notify affected individuals without undue delay.
• Employee training: All bd399 staff with access to personal data receive regular data protection training and are bound by confidentiality obligations.

Depending on applicable law, you may have some or all of the following rights in relation to your personal data held by bd399:

• Right of access: You may request a copy of the personal data bd399 holds about you, along with information about how it is processed.
• Right to rectification: If your personal data is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account information directly through your account settings page.
• Right to erasure ("right to be forgotten"): In certain circumstances, you may request that bd399 delete your personal data. This right is subject to exceptions, including where retention is required by law or for the establishment, exercise, or defence of legal claims.
• Right to restriction of processing: You may request that bd399 restrict processing of your data in certain circumstances — for example, while the accuracy of your data is being disputed.
• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data where bd399 relies on legitimate interests as its legal basis. You have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". bd399 will acknowledge your request within 5 business days and provide a substantive response within 30 days. In complex or high-volume cases, this period may be extended by a further 30 days, in which case we will notify you of the extension.

bd399 may request that you verify your identity before processing a rights request, to ensure we do not disclose or delete data belonging to another individual.

The bd399 platform is strictly intended for adults aged 21 years and above. bd399 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The platform employs active age-verification mechanisms at registration, and may request documentary evidence of age at any point during the player lifecycle.

If bd399 becomes aware that personal data has been collected from an individual under 21 years of age, that data will be deleted immediately and the associated account permanently closed. If you are a parent or guardian and believe that a person under 21 in your care has registered an account with bd399, please contact us immediately at [email protected] so that we may take appropriate action.

bd399 primarily stores and processes player data on servers located in or serving the Bangladesh region. However, some of our third-party service providers — including game providers, cloud infrastructure vendors, and KYC partners — may process data in jurisdictions outside Bangladesh.

Where personal data is transferred internationally, bd399 ensures that appropriate safeguards are in place, including:

• Data processing agreements that impose equivalent data-protection obligations on the receiving party.
• Standard contractual clauses or comparable transfer mechanisms that bind the recipient to protect your data to a standard consistent with this Policy.
• Due-diligence assessments of third-party recipients' security posture and data-handling practices prior to engagement.

By using the bd399 platform and accepting this Policy, you acknowledge that your personal data may be processed in jurisdictions outside Bangladesh as described above.

bd399 reserves the right to update or amend this Privacy Policy at any time. The revised Policy will be published on this page with an updated effective date. Where a change is material — meaning it significantly affects how we collect or use your personal data — bd399 will provide advance notice via email to your registered address or through a prominent notification on the platform, at least 14 days before the change takes effect.

Your continued use of the bd399 platform after a revised Policy becomes effective constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the platform and contact support to close your account before the revised Policy takes effect.

We encourage you to review this Privacy Policy periodically to stay informed about how bd399 protects your personal information. The "Last Updated" date at the top of the policy and the version number in the footer of this document will always reflect the most current revision.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how bd399 handles your personal information, please contact us through the following channel:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Privacy Rights Request" as appropriate.
• Support Hours: 24 hours a day, 7 days a week, 365 days a year — including Eid, Pohela Boishakh, Victory Day, and all public holidays.

bd399 aims to respond to all privacy-related enquiries within 5 business days. For formal data rights requests, we will provide a substantive response within 30 calendar days of receipt, as described in Section 9 of this Policy.