Privacy Policy — How 399d Protects Your Personal Data

1 About This Policy

This Privacy Policy describes how 399d ("we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("Players", "users", "you") who access or use the 399d Platform at 399d.io. It applies to all products and services offered through the Platform, including casino games, sports betting, live dealer tables, crash games, and customer support services.

399d operates primarily for players based in Bangladesh and takes seriously its obligation to handle personal data with care, transparency, and security. The Platform is designed with privacy considerations built in from the ground up — from encrypted payment processing to minimal data collection principles in our marketing systems.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference into the agreement between you and 399d.

2 Data We Collect

399d collects personal data in several categories depending on the nature of your interaction with the Platform. The following table sets out the categories of data we collect and examples within each category:

We do not collect sensitive special-category data such as racial or ethnic origin, religious beliefs, political opinions, biometric data, or health data, except where strictly required by applicable law for identity verification or responsible gaming compliance purposes.

What we do NOT store: 399d does not store your bKash, Nagad, or Rocket mobile wallet PINs, your online banking passwords, or your full Visa or Mastercard card number. Payment credentials are tokenised by our payment processing partners at the point of transaction, and only the token reference is retained by 399d for reconciliation purposes.

3 How We Collect Your Data

399d collects your personal data through the following channels:

• Direct collection: Data you provide voluntarily when creating an Account, completing KYC verification, submitting a deposit or withdrawal request, contacting our support team, or completing a promotional form.
• Automated collection: Data collected automatically when you visit or use the Platform, including via cookies, web beacons, session tracking, server logs, and similar technologies. This includes your IP address, device identifiers, and in-session behaviour patterns.
• Third-party providers: Data received from KYC verification service providers (identity document checks), payment processing partners (transaction status, fraud signals), and game providers (game session data from Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming).
• Publicly available sources: In limited circumstances related to fraud prevention, 399d may cross-reference data against publicly available records or fraud-alert databases to verify identity information.

4 Why We Process Your Data

399d processes your personal data for the following specific purposes. Each purpose is linked to a defined legal basis (set out in Section 5):

• Account creation and management: To register your Account, verify your identity, maintain your account settings, and respond to account-related queries.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard, and to maintain accurate transaction records.
• Identity verification (KYC/AML): To verify that you meet the minimum age requirement of 21 years, to comply with anti-money-laundering obligations, and to detect and prevent fraud.
• Platform service delivery: To provide access to casino games, sports betting markets, live dealer tables, crash games, and all other features of the Platform.
• Customer support: To respond to queries, resolve complaints, and deliver support via live chat and email.
• Responsible gaming monitoring: To monitor gaming behaviour for patterns that may indicate problem gambling, to enforce deposit limits and self-exclusion requests, and to comply with responsible gaming obligations.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, account takeovers, and abuse of the Platform's bonus systems.
• Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from authorities, and maintain records required for audit purposes.
• Marketing communications: To send promotional offers, bonus notifications, and event updates (e.g., BPL season promotions, Eid special offers, Pohela Boishakh bonuses) to Players who have opted in to receive such communications.
• Platform analytics and improvement: To analyse Platform usage patterns, improve game performance, optimise the user interface, and develop new features.

5 Legal Bases for Processing

399d processes personal data under the following recognised legal bases:

• Contract performance: Processing necessary to provide the Platform services and fulfil our contractual obligations to you as a registered Player — including account management, payment processing, and game access.
• Legal obligation: Processing required to comply with applicable laws, including identity verification (KYC), anti-money-laundering (AML) screening, and responsible gaming obligations.
• Legitimate interests: Processing for fraud prevention, Platform security, abuse detection, and internal analytics, where our interests do not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications and certain non-essential cookies, where you have given explicit, informed consent. You may withdraw this consent at any time by adjusting your Account preferences or contacting [email protected].

Where processing is based on consent, withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Withdrawal of marketing consent will not affect your ability to use the Platform or access your Account.

6 Data Sharing and Third Parties

399d does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared with third parties only in the following strictly controlled circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable payment industry standards.
• KYC and identity verification providers: Specialist third-party verification services receive identity document data (NID, passport) to perform age and identity checks required for Account activation and withdrawal processing. All such providers are contractually bound to handle your data securely and only for the stated verification purpose.
• Game providers: Game session data is shared with game software providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming) to the extent necessary to deliver the game and record the outcome. These providers do not receive your financial or contact data.
• Fraud prevention and security services: Anonymised or pseudonymised technical data may be shared with fraud-detection service providers to identify and block abusive activity, bot traffic, and account takeover attempts.
• Legal and regulatory authorities: 399d will disclose personal data to law enforcement agencies, courts, or regulatory bodies when required to do so by a valid legal obligation, court order, or lawful request. We will notify affected Players of such disclosures where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of 399d's business assets, Player data may be transferred to the acquiring entity as part of the transaction. 399d will notify affected Players prior to any such transfer and ensure the acquiring entity is bound by equivalent data protection obligations.

7 Cookies and Tracking Technologies

399d uses cookies and similar tracking technologies on the Platform to ensure functionality, improve performance, and — where you have consented — to deliver relevant marketing communications. The following categories of cookies are used:

You can manage your cookie preferences at any time through your browser settings or by contacting [email protected]. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling functional cookies may reset your saved preferences on each visit.

399d does not use third-party advertising networks to serve advertisements to you on external websites based on your activity on the 399d Platform. Our marketing cookies are used exclusively for communications delivered through the 399d Platform itself.

8 Data Security

399d employs a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• Transport encryption: All data transmitted between your browser and the 399d Platform is encrypted using TLS 1.3. Connections using older, insecure protocol versions are rejected at the server level.
• Password security: Account passwords are stored as salted cryptographic hashes using a strong hashing algorithm. 399d staff cannot view your password in plain text under any circumstances.
• Payment credential tokenisation: Mobile wallet numbers (bKash, Nagad, Rocket, Upay) and card details (Visa, Mastercard) are tokenised by certified payment partners. 399d stores only a non-reversible token reference, never the raw credential.
• Access controls: Access to personal data by 399d staff is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit. Staff with access to personal data undergo mandatory data security training.
• Infrastructure security: The Platform is hosted on secure, redundant infrastructure with automated intrusion detection, DDoS mitigation, and regular penetration testing conducted by independent security professionals.
• Incident response: 399d maintains a documented data breach response plan. In the event of a confirmed data breach affecting your personal data, 399d will notify affected Players without undue delay and take all necessary steps to contain and remediate the breach.

9 Data Retention

399d retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

10 Your Rights

As a Player on the 399d Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our Data Support team at [email protected] with the subject line "Data Rights Request" and include your Account username and a description of your request.

• Right of access: You may request a copy of the personal data 399d holds about you. We will provide this within 30 days of receiving a verified request.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected. Minor corrections (e.g., contact details) can be made directly in your Account settings. Corrections to identity data require re-submission of KYC documents.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that KYC and financial transaction data must be retained for defined periods regardless of an erasure request.
• Right to restrict processing: You may request that we restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing pending verification of our legitimate interests.
• Right to data portability: You may request a structured, machine-readable copy of the personal data you have provided to 399d, where technically feasible and where processing is based on consent or contract performance.
• Right to object: You may object to processing of your personal data where it is based on legitimate interests, including profiling for marketing segmentation purposes. You may also withdraw marketing consent at any time through your Account preferences.
• Rights related to automated decision-making: 399d may use automated systems to detect fraud, enforce self-exclusion, or flag responsible gaming concerns. You have the right to request human review of any automated decision that significantly affects your Account.

11 Children and Minors

The 399d Platform is strictly an adult-only service. Registration and use of the Platform is prohibited for any person under 21 years of age. 399d does not knowingly collect or process personal data from individuals under the age of 21.

All new Accounts are subject to age verification checks as part of the KYC process. If 399d discovers or has reason to believe that an Account belongs to a person under 21 years of age, the Account will be immediately suspended, all funds will be returned to the depositing payment method (minus any winnings accrued during the underage use), and any personal data collected in connection with the Account will be deleted from our systems within 30 days, subject to any legal retention obligations relating to the detection and reporting of underage gambling.

If you believe that a minor has created an Account on the 399d Platform, please notify us immediately at [email protected]. 399d treats all reports of potential underage gambling as a high-priority matter and will investigate promptly.

12 Changes to This Privacy Policy

399d may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. The "Effective Date" at the top of this document will be updated whenever material changes are made.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will notify registered Players by sending an email to their registered address and/or displaying a prominent notice on the Platform at least 14 days before the changes take effect. Non-material changes (such as formatting corrections or clarifications that do not affect the substance of the policy) may be published without prior notice.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must stop using the Platform and request Account closure by contacting [email protected].

The current version of this Privacy Policy is always available at 399d.io/privacy-policy. Previous versions are available upon written request to [email protected].

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to 399d's data processing practices, please contact our support team using the details below. All privacy-related enquiries are handled by staff with specific data protection responsibilities.

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" so your message reaches the appropriate team promptly
• Live Chat: Available 24 hours a day, 7 days a week inside your Account dashboard — English and Bengali agents available
• Response Time: Privacy and data rights enquiries are responded to within 5 business days for general questions and within 30 calendar days for formal rights requests
• Operating Hours Reference: Bangladesh Standard Time (BST, UTC+6)

This Privacy Policy was last reviewed and updated on 1 January 2026.