999ak Privacy Policy — How We Handle Your Personal Data

999ak ("we", "us", "our") operates the online casino and sports betting platform accessible at https://999ak.org. This Privacy Policy applies to all personal data processed by 999ak in connection with the operation of that platform and the provision of services to registered players in Bangladesh. By registering an account or continuing to use the 999ak platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your data as described herein.

This Policy should be read together with the 999ak Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. Defined terms used in this Policy carry the same meaning as in the Terms & Conditions unless otherwise stated. If you do not agree with any part of this Privacy Policy, you must not register an account or use the 999ak platform.

999ak collects personal data from you directly (when you register, deposit, or contact support) and automatically (when you use the platform). The categories of data we collect are described below.

999ak uses the personal data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes listed here without first obtaining your explicit consent.

• Account creation and management — registering your account, verifying your identity, managing your login credentials, and maintaining your BDT wallet balance.
• Transaction processing — processing deposits via bKash, Nagad, Rocket and Upay; settling game outcomes and sports bet results; processing withdrawal requests to your registered mobile wallet.
• Fraud prevention and security — detecting and preventing unauthorised access, multi-accounting, bonus abuse, money laundering, and other fraudulent or prohibited conduct.
• Responsible gaming — monitoring play patterns to identify indicators of problem gambling and making responsible gaming tools (deposit limits, self-exclusion) available to you.
• Legal and regulatory compliance — complying with applicable laws, responding to lawful requests from government authorities, and fulfilling our obligations under anti-money-laundering requirements.
• Platform improvement — using anonymised and aggregated activity data to improve game performance, page load times, and the overall experience on 999ak for Bangladesh players.

We do not use your personal data to build advertising profiles, to sell to data brokers, or to target you with third-party promotional content. Any direct marketing communications from 999ak (such as bonus offer notifications sent to your registered mobile number) are based on your account relationship with us and may be opted out of at any time by contacting [email protected].

999ak processes your personal data on the following legal bases, depending on the specific purpose for which the data is being used.

• Contractual necessity — processing required to perform the contract between you and 999ak, including account registration, transaction processing, game settlement, and withdrawal of funds.
• Legitimate interests — processing necessary for fraud detection and prevention, security monitoring, and platform improvement, where those interests are not overridden by your privacy rights.
• Legal obligation — processing required to comply with applicable laws, including anti-money-laundering obligations, responses to lawful government requests, and age verification requirements.
• Consent — for direct marketing communications and any other processing for which consent is specifically required. You may withdraw your consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

999ak does not sell your personal data. We share your data only with the following categories of third parties, and only to the extent necessary for the purposes described in this Policy.

• Game studio providers (Evolution Gaming, Pragmatic Play, PG Soft, Spribe, NetEnt, Microgaming, Ezugi) — these providers receive only the session data required to deliver the game to your device and record the outcome of your wager. They do not receive your full identity data, mobile wallet number, or financial transaction history.
• Payment processing partners (bKash, Nagad, Rocket, Upay) — transaction data is shared with the relevant mobile wallet operator solely to execute your deposit or withdrawal instruction. These operators have their own privacy policies governing how they process payment data.
• Identity verification and KYC service providers — where required to verify your identity before processing a withdrawal, we may share identity documents with a regulated third-party KYC provider. These providers are contractually bound to process the data only for verification purposes.
• Regulatory and law enforcement authorities — where 999ak is legally required to disclose personal data (e.g., in response to a court order, anti-money-laundering investigation, or regulatory inquiry), we will comply with that legal obligation. We will, where legally permitted, notify you of such disclosure.

All third parties with whom 999ak shares personal data are required, by contract or by law, to process that data only for the specified purpose, to maintain appropriate security standards, and not to disclose the data to further parties without 999ak's authorisation.

When you make a deposit or withdrawal at 999ak using bKash, Nagad, Rocket or Upay, the transaction is initiated through the respective mobile wallet operator's own secure payment gateway. 999ak receives confirmation of the transaction (amount, timestamp, and the last four digits of the mobile wallet number) but does not receive or store your full mobile wallet PIN, password, or any authentication credentials used with the operator's app. Your full mobile wallet credentials are entered directly into the operator's interface — not into any 999ak form.

999ak retains transaction records — including the mobile wallet number used, the transaction amount in BDT, the date and time, and the transaction status — for a minimum of five years from the date of the transaction. This retention period reflects our legal obligations relating to financial record-keeping and anti-money-laundering compliance. Transaction records are not accessible to other players and are accessed internally only on a need-to-know basis.

999ak uses first-party cookies — small data files stored on your device by the 999ak website — to operate core platform functionality and to improve your experience. We do not use third-party advertising cookies or tracking pixels from external advertising networks. The cookies 999ak places fall into three categories.

• Essential cookies — required for the platform to function. These include session authentication cookies that keep you logged in during a game session, and security cookies that help detect and prevent fraudulent login attempts. These cookies cannot be disabled without breaking core functionality.
• Functional cookies — store your preferences such as language setting and display options so you do not have to re-enter them on each visit. These cookies are set only when you actively configure a preference on the platform.
• Analytics cookies — collect anonymised data about how players navigate the 999ak platform, which pages are visited most frequently, and where technical errors occur. This data is used in aggregate form only and cannot be linked back to an individual player.

You may manage or delete cookies through your mobile browser's settings at any time. Please be aware that disabling essential cookies will impair your ability to log in, play games, or process transactions on 999ak. Functional and analytics cookies may be disabled without affecting your ability to use the core service.

999ak retains personal data for the periods set out below. When data is no longer required for the purpose for which it was collected and no legal obligation requires its continued retention, it is securely deleted or anonymised so that it can no longer be linked to an individual.

Account data and transaction records are retained for a minimum of five years from the date of account closure or the date of the last transaction, whichever is later. This period reflects anti-money-laundering and financial record-keeping obligations. Game activity logs are retained for two years. KYC documents submitted for identity verification are retained for five years from the date of submission. Cookie and analytics data that is not linked to an identifiable individual is retained for up to twelve months in aggregate form.

999ak implements technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include SSL encryption for all data transmitted between your device and the 999ak platform, bcrypt-hashed password storage, access controls limiting internal data access to staff with a documented operational need, and regular security audits of platform infrastructure.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 999ak will notify affected players without undue delay after becoming aware of the breach, and will provide information about the nature of the breach, the categories of data affected, and the steps being taken to address it. Notification will be sent to your registered mobile number or email address on file.

As a registered 999ak player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact [email protected] with your registered mobile number and a description of your request. 999ak will respond within 30 days of receiving a valid request.

To exercise any of the rights described above, send a written request to [email protected] from the email address or mobile number registered to your 999ak account. 999ak will verify your identity before processing the request and will respond within 30 days. There is no fee for submitting a rights request. Where a request is manifestly unfounded or excessive, 999ak reserves the right to charge a reasonable administrative fee or to decline to act on the request.

999ak services are strictly restricted to persons aged 21 years and above. 999ak does not knowingly collect personal data from persons under the age of 21. If 999ak becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately, the associated account will be closed, and any balance will be returned to the payment source used at registration. If you are a parent or guardian and believe a minor has registered on 999ak, please contact [email protected] immediately.

999ak reserves the right to update or replace this Privacy Policy at any time. Where a material change is made — that is, a change that affects your privacy rights in a meaningful way — 999ak will provide notice to registered players via the mobile number or email address on file at least seven days before the change takes effect. Non-material updates (such as clarifications or typographical corrections) may take effect immediately.

The version of this Privacy Policy currently published on this page is the governing version. The date at the top of this page indicates when the Policy was last reviewed and updated. By continuing to use the 999ak platform after a material update takes effect, you accept the revised Privacy Policy. If you do not accept the revised Policy, you must stop using the platform and contact [email protected] to arrange closure of your account.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to make a complaint about how 999ak has handled your personal data, please contact our support team at [email protected]. Please include your registered mobile number and a clear description of your query. We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve them fully within 30 days.

All privacy-related correspondence should reference your 999ak account mobile number and be sent from a contact method registered to your account where possible. This allows us to verify your identity promptly and handle your request without unnecessary delay. 999ak is committed to handling all data rights requests and privacy complaints fairly, transparently, and within the timescales stated in this Policy.