999f Privacy
Policy

999f Full Privacy Policy

1 Data Controller

1.1 For the purposes of this Privacy Policy, the data controller responsible for your personal information is 999f, the online gaming and sports betting platform accessible at https://999f.io and all associated sub-domains and mobile interfaces.

1.2 As data controller, 999f determines the purposes and means by which your personal data is processed. If you have any questions about how 999f handles your data, or if you wish to exercise any of your rights described in Section 9 of this policy, you may contact us at any time using the details provided in Section 13.

1.3 This Privacy Policy applies exclusively to data processed by 999f in connection with your use of the platform. It does not cover the data practices of third-party game providers, payment service operators (such as bKash, Nagad, Rocket, and Upay), or any other external services you may interact with in the course of using 999f. Those third parties operate under their own privacy policies and 999f is not responsible for their data practices.

2 Data We Collect

2.1 999f collects personal data across several categories, depending on the nature of your interaction with the platform. The following table sets out the main categories of personal data we process:

2.2 999f does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation. If any such data is incidentally included in a document you submit for KYC purposes, it will not be recorded, processed, or retained beyond the verification check.

3 How We Collect Data

3.1 Directly from you. The majority of personal data 999f holds about you is information you provide directly — during the registration process, when completing KYC verification, when making a deposit or withdrawal request, when contacting our support team, or when updating your account settings.

3.2 Automatically. When you visit and use the 999f platform, certain Technical Data and Usage Data is collected automatically through server logs, cookies, and similar tracking technologies. This data is collected regardless of whether you are logged into an account. For more detail on cookies and tracking, see Section 8.

3.3 From third parties. 999f may receive limited personal data from third-party service providers in the following contexts:

• From identity verification providers used to conduct KYC checks, such as confirmation that a National ID document is authentic.
• From payment processors and MFS operators such as bKash and Nagad, confirming the successful completion or failure of a deposit or withdrawal transaction.
• From fraud detection and anti-money-laundering (AML) screening services that flag suspicious patterns against known risk indicators.
• From game providers such as Pragmatic Play, Evolution Gaming, and Spribe, to the extent that game session data is generated and shared as part of the technical integration between 999f and the provider's platform.

4 Purpose & Legal Basis for Processing

4.1 999f processes your personal data only for specific, legitimate purposes and on a clearly defined legal basis. The table below summarises the primary processing activities carried out by 999f:

5 Data Sharing

5.1 999f does not sell, rent, or trade your personal data to any third party. We share your data only in the circumstances and with the categories of recipients described below, and only to the minimum extent necessary for the stated purpose.

• Payment processors and MFS operators: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data strictly necessary to process your deposit or withdrawal. 999f does not share your full identity profile with these providers.
• Identity verification providers: Third-party KYC service providers receive a copy of identity documents you submit for verification purposes. These providers are contractually bound to use the data only for verification and to delete it after the check is complete.
• Game providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a session token and anonymised player identifier necessary to load and run their games. They do not receive your full name, contact details, or financial data via 999f.
• Fraud and AML screening services: Specialist providers may receive certain transaction and identity data to screen against risk databases. These providers process data strictly as data processors acting on 999f's instructions.
• Legal and regulatory authorities: 999f may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory direction. 999f will not notify you of such a disclosure if doing so is prohibited by law or would prejudice an investigation.
• Business successors: In the event of a merger, acquisition, or sale of all or part of the 999f business, personal data held about players may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer in advance where operationally feasible.

6 Data Retention

6.1 999f retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account's active life, plus a minimum of 5 years following account closure, to satisfy anti-money-laundering record-keeping obligations.
• KYC documentation: Retained for a minimum of 5 years from the date of the verification check, in line with standard financial services compliance requirements.
• Transaction records: Retained for a minimum of 7 years to enable audit, dispute resolution, and regulatory reporting.
• Customer support communications: Retained for 3 years from the date of the most recent interaction, unless the communication relates to a dispute that remains unresolved, in which case it is retained until the dispute is closed plus 12 months.
• Marketing preference records: Retained for the duration of the account and for 2 years following account closure, to maintain an accurate suppression list.
• Technical and usage logs: Retained for 12 months on a rolling basis, after which they are aggregated and anonymised for platform analytics purposes.

6.2 When personal data is no longer required and the applicable retention period has expired, 999f will securely delete or anonymise that data in accordance with our internal data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify any individual.

7 Security Measures

7.1 999f employs a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your browser or device and 999f servers.
• Encryption at rest for sensitive data categories including financial records and identity documents held on 999f infrastructure.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis, with all access logged and auditable.
• Regular vulnerability assessments and penetration testing of the 999f platform and supporting infrastructure.
• Multi-factor authentication requirements for internal administrative access to systems holding personal data.
• Formal incident response procedures enabling 999f to detect, contain, and report data security incidents in a timely manner.

7.2 While 999f maintains robust security practices, no online platform can guarantee absolute security. In the event that a data security incident occurs that is likely to result in a risk to your rights and freedoms, 999f will notify affected players as soon as reasonably practicable. You can help protect your account by using a strong, unique password and by never sharing your login credentials with anyone else.

8 Cookies & Tracking Technologies

8.1 The 999f platform uses cookies and similar tracking technologies to deliver core platform functionality, remember your session and preferences, detect fraud, and analyse aggregate usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the platform to function and cannot be switched off. They include session authentication tokens, security cookies, and load-balancing cookies. No consent is required for these cookies.
• Functional cookies: These cookies remember your language preferences, your last-accessed game category, and other personalisation settings. They improve your experience but are not essential to platform operation.
• Analytics cookies: These cookies collect aggregated, anonymised data about how players navigate the platform — which pages are visited most often, where players encounter errors, and which features drive engagement. This data helps 999f improve the platform over time.
• Security and fraud-detection cookies: These cookies assist 999f and its fraud-prevention partners in identifying unusual or suspicious session behaviour, including automated bot activity and account-sharing patterns.

8.2 999f does not use third-party advertising or retargeting cookies. You will not be tracked across other websites for the purpose of serving 999f advertisements on external platforms.

8.3 You may manage cookie preferences through your browser settings. Please be aware that disabling certain cookies — particularly strictly necessary and security cookies — may impair your ability to use the 999f platform fully.

9 Your Rights

9.1 As a data subject, you have the following rights in relation to the personal data 999f holds about you. To exercise any of these rights, contact 999f at [email protected] with a clear description of your request and sufficient information to verify your identity. 999f will respond within 5 business days of receipt.

• Right of access: You may request a copy of the personal data 999f holds about you, along with information about how it is processed.
• Right to rectification: If any of the personal data 999f holds about you is inaccurate or incomplete, you have the right to request correction or completion of that data.
• Right to erasure: In certain circumstances, you may request the deletion of your personal data. This right is not absolute — 999f may be required to retain data for legal, regulatory, or legitimate business reasons, in which case we will explain the applicable grounds for retention.
• Right to restriction of processing: You may request that 999f restricts the processing of your personal data in certain situations — for example, while a rectification request is being assessed.
• Right to data portability: Where processing is carried out on the basis of your consent or on the basis of a contract, you may request that 999f provides your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for fraud detection purposes. 999f will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

9.2 999f will not charge a fee for processing a data rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. 999f will notify you before any fee is applied.

10 Minors

10.1 The 999f platform is strictly for adults aged 21 and above. 999f does not knowingly collect, store, or process personal data belonging to any person under the age of 21. Registration attempts by individuals who are under the required age are rejected during the verification process.

10.2 If 999f discovers that personal data has been collected from a person under the age of 21 — whether through a deliberate misrepresentation of age at registration or any other means — the account will be closed immediately, all personal data associated with the account will be securely deleted, and any funds held in the account will be handled in accordance with the Terms & Conditions underage player provisions.

10.3 Parents and guardians who believe that a minor may have registered on the 999f platform are encouraged to contact [email protected] immediately. 999f will investigate and respond to all such reports as a matter of priority.

11 Cross-Border Data Transfers

11.1 To operate the 999f platform effectively, personal data may be transferred to and processed in countries other than Bangladesh, including countries where third-party infrastructure providers, game studios, and fraud-detection services are hosted. Such transfers are carried out only where appropriate safeguards are in place to ensure that your personal data receives a level of protection consistent with the standards described in this Privacy Policy.

11.2 Appropriate safeguards for cross-border transfers may include contractual clauses requiring the recipient to protect the data to a standard equivalent to that described in this Privacy Policy, or reliance on the adequacy of the recipient country's data protection framework as assessed by 999f's compliance team.

11.3 By using the 999f platform, you acknowledge that your personal data may be transferred outside Bangladesh as described in this section. If you wish to obtain more information about the specific safeguards applied to any particular transfer, please contact [email protected].

12 Changes to This Policy

12.1 999f reserves the right to update or amend this Privacy Policy at any time. The most current version will always be available at https://999f.io/privacy-policy, along with the effective date of the current version.

12.2 Where a material change is made to this Privacy Policy — particularly one that affects how your personal data is used or shared — 999f will notify registered players via the email address on file at least 7 days before the change takes effect. For non-material updates (such as clarifications of existing practices, corrections of typographical errors, or minor structural reorganisation), 999f may update the policy without prior notice.

12.3 Your continued use of the 999f platform after the effective date of any update to this Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree with a material change, you may close your account before the effective date in accordance with the Terms & Conditions.

13 Contact Us

13.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way 999f handles your personal data, please contact the 999f support team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Platform: https://999f.io — Live chat support available during operational hours (Bangladesh Standard Time, UTC+6)
• Response time: 999f aims to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within 5 business days.

13.2 When contacting 999f about a data rights request (see Section 9), please include your registered username and a clear description of the data you are enquiring about. For identity verification purposes, you may be asked to provide a copy of a government-issued ID before your request is processed.