Privacy Policy — How 399bad Protects Your Personal Data

1. Information We Collect

399bad collects personal data through several channels: directly from you when you register and use the platform, automatically as you interact with our website, and from trusted third-party sources where necessary for identity verification and fraud prevention. We collect only the data that is genuinely necessary for the purposes outlined in this Privacy Policy.

The categories of personal data 399bad may collect are set out below. Not all categories will apply to every player — the data collected depends on the services you use and the actions you take on the platform.

2. How We Use Your Data

399bad uses the personal data we collect for specific, documented purposes. We do not use your data for purposes that are incompatible with those listed below, and we will notify you if we need to use your data for a new purpose not covered by this policy.

• Account management: Creating, maintaining, and securing your 399bad player account, including login authentication, password resets, and session management.
• Age and identity verification: Confirming that you are 18 years of age or older and that the identity details provided at registration are accurate, in accordance with our 18+ policy and responsible gaming obligations.
• Payment processing: Facilitating deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank transfer. This includes communicating with payment processors to initiate and confirm transactions.
• Game and betting services: Delivering the full range of 399bad games and betting markets — including live casino, slots from Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, crash games, keno, and cricket/sports betting — and recording game outcomes and bet settlement data accurately.
• Fraud prevention and security: Monitoring account activity for signs of fraudulent behaviour, money laundering, bonus abuse, multi-accounting, or any other conduct prohibited under our Terms & Conditions. Automated risk systems process behavioural and technical data to flag anomalies for review.
• Customer support: Responding to your queries, complaints, and support requests via live chat, email, and WhatsApp. Support interactions are logged to maintain quality and continuity of service.
• Responsible gaming: Using your playing history, session data, and self-reported information to support responsible gaming features including deposit limits, loss limits, session time reminders, cooling-off periods, and self-exclusion.
• Marketing communications: Sending promotional offers, bonus notifications, seasonal campaign messages (BPL, IPL, Eid, Ramadan, Pohela Boishakh), and platform updates to players who have opted in to marketing communications. You may opt out at any time via your account settings or by contacting support.
• Legal and regulatory compliance: Retaining data as required by applicable law, and providing information to authorities where legally obligated to do so.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players interact with 399bad and improve the platform's design, performance, and game offering.

3. Legal Basis for Processing

399bad processes your personal data on one or more of the following legal bases. The applicable basis depends on the specific processing activity and the nature of the data involved.

• Contract performance: Processing is necessary to perform the contract between you and 399bad — specifically, to provide the gaming and betting services you have registered for, process your transactions, and manage your account.
• Legal obligation: Processing is required to comply with applicable legal requirements, including anti-money laundering (AML) obligations, age verification requirements, and lawful requests from competent authorities.
• Legitimate interests: Processing is necessary for purposes of 399bad's legitimate interests — including fraud detection and prevention, platform security, responsible gaming monitoring, and internal analytics — provided those interests are not overridden by your rights and freedoms.
• Consent: Where we rely on your consent — such as for marketing communications or for the use of non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4. Data Sharing & Third Parties

399bad does not sell, rent, or trade your personal data to third parties. We share data only in the limited circumstances described below, and only to the extent necessary for the specific purpose stated.

• Payment providers: When you make a deposit or request a withdrawal, we share the minimum necessary transaction data with the relevant payment service provider — bKash, Nagad, Rocket, Upay, Visa, Mastercard, or your bank — to facilitate the transaction. These providers operate under their own privacy policies and data protection frameworks.
• Game providers: To deliver live casino and slot content, your player session data (including bet amounts and game results) is shared with our game technology partners, including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers are contractually required to handle data securely and only for the purpose of game delivery.
• Identity verification services: KYC document data may be shared with third-party identity verification providers to confirm your age and identity. These providers process data solely for the purpose of verification and are bound by strict data processing agreements.
• Fraud detection services: Aggregated behavioural and technical signals may be shared with specialist anti-fraud platforms to detect and prevent account compromise, bonus abuse, and money laundering. No individually identifying financial data is shared beyond what is necessary for risk scoring.
• Legal authorities: 399bad may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, or where necessary to protect the rights, property, or safety of 399bad, its players, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 399bad's business, player data may be transferred to the acquiring entity. You will be notified of any such transfer and of any changes to this Privacy Policy that arise as a result.

5. Cookies & Tracking Technologies

399bad uses cookies and similar tracking technologies — including local storage objects and session tokens — to operate the platform, remember your preferences, maintain your logged-in session, and understand how players navigate and use the site. This section explains the types of cookies we use and how you can control them.

You can control cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies will prevent you from logging in and using core platform features. Disabling functional or analytics cookies will not affect your ability to play games or place bets, but may result in a less personalised experience.

• Browser controls: Google Chrome, Mozilla Firefox, Microsoft Edge, and Safari all provide built-in cookie management tools accessible via the browser's settings or privacy menu.
• Do Not Track: 399bad recognises browser "Do Not Track" (DNT) signals on a best-efforts basis for analytics cookies. Strictly necessary and responsible gaming cookies are not affected by DNT signals.
• Third-party cookies: Some game content delivered by providers such as Pragmatic Play, Evolution Gaming, and Spribe may set their own first-party cookies within the game frame. These are governed by each provider's own cookie policy.

6. Data Retention

399bad retains personal data for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below reflect our standard practice. Individual circumstances — such as ongoing disputes, regulatory investigations, or self-exclusion orders — may result in data being retained for longer periods.

• Account data: Retained for the duration of the account's active status, and for a minimum of 5 years following account closure, to support legal, regulatory, and audit requirements.
• Transaction records: All deposit and withdrawal records in BDT are retained for a minimum of 5 years from the date of the transaction to comply with financial record-keeping obligations.
• KYC and verification documents: Identity documents (NID, passport, address proof) are retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Game records: Bet history, game outcomes, and wagering records are retained for a minimum of 3 years to support dispute resolution and responsible gaming monitoring.
• Support communications: Live chat transcripts, email threads, and support ticket records are retained for 2 years from the date of last interaction.
• Marketing data: Marketing consent records and campaign response data are retained for the duration of your account plus 1 year following opt-out or account closure.
• Analytical data: Anonymised, aggregated analytics data with no individual identifiers may be retained indefinitely for platform improvement purposes.
• Self-exclusion records: Records of self-exclusion requests are retained permanently to prevent re-registration by a player during an active exclusion period and to support responsible gaming compliance.

When personal data reaches the end of its retention period and there is no longer a legal or operational basis for retaining it, 399bad will securely delete or anonymise that data in accordance with its internal data disposal procedures.

7. Your Privacy Rights

As a player on 399bad, you have the following rights in relation to your personal data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request" and your registered account email address. We will respond within 30 days of receiving your request.

8. Data Security

399bad takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, disclosure, alteration, or destruction. The key security measures in place include:

• TLS/SSL encryption: All data transmitted between your device and 399bad's servers is protected using industry-standard TLS 1.2 or higher encryption. The padlock symbol in your browser confirms that your connection to 399bad is encrypted.
• Data encryption at rest: Sensitive personal data — including identity documents and financial records — is encrypted when stored on 399bad's servers using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data within 399bad's systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of access required to perform their role.
• Two-factor authentication: All administrative access to systems holding personal data requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their own accounts via the account settings panel.
• Payment data tokenisation: Full card numbers, mobile banking PINs, and other sensitive payment credentials are never stored on 399bad's servers. All payment data is tokenised at the point of entry by the respective payment service provider.
• Regular security testing: 399bad's platform is subject to periodic security assessments and vulnerability testing to identify and remediate potential weaknesses before they can be exploited.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 399bad will notify affected players without undue delay and take immediate steps to contain and investigate the breach.

While 399bad takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You also have a role to play in protecting your account: use a strong, unique password, enable 2FA, and never share your login credentials with anyone. 399bad will never ask for your password via email, live chat, or any other communication channel.

9. Policy Updates & Contact

399bad reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, updates to applicable law, or improvements to how we communicate our privacy commitments to players. When material changes are made to this policy, we will notify registered players via email to the address on their account, and will update the "Last updated" date at the top of this page.

Your continued use of the 399bad platform following notification of any changes to this Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with any changes, you should stop using the platform and may request account closure in accordance with the Account Suspension & Closure section of our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the way 399bad handles your personal data, you may contact our team through any of the following channels:

• Email: [email protected] — use the subject line "Privacy Policy Query" for fastest routing. Responses within 24 hours (BST).
• Live Chat: Available 24/7 via the 399bad platform, staffed in Bangladesh Standard Time (UTC+6). For privacy rights requests, live chat agents will direct you to the formal email channel.
• WhatsApp: +880 1700-000000 — for general queries only. Do not share sensitive personal data or document scans over WhatsApp.

For responsible gaming concerns — including requesting self-exclusion, setting deposit limits, or accessing player protection tools — visit our Responsible Gaming page or contact support directly. All responsible gaming requests are treated with priority and full confidentiality. 399bad's player protection team is available around the clock, 365 days a year.