Privacy Policy — Your Data, Protected by xx399

1 Data We Collect & Why

xx399 collects personal data from members and visitors through several channels: directly from you when you register an account or contact support; automatically when you use the platform; and from third-party identity verification and payment processing partners. The following table sets out the categories of personal data we collect, the specific data items within each category, and the primary purpose for which each category is collected.

1.1 Data You Provide Voluntarily

When you complete the xx399 account registration form, you provide identity and contact data directly. When you submit KYC verification documents, you provide copies of official government-issued identification. When you use the live chat or WhatsApp support channel, you may voluntarily share additional personal information in the course of the conversation. xx399 collects only the information that you actively provide and does not seek to extract information beyond what is necessary for the stated purposes.

1.2 Data Collected Automatically

When you access the xx399 platform, our servers and analytics systems automatically record technical data about your session, including your IP address, device identifiers, and browsing behaviour within the platform. This data is collected via server logs and session cookies. It is used to maintain platform security, detect unusual access patterns indicative of fraud or unauthorised access, and to ensure that the platform functions correctly across different devices and network conditions.

2 How We Use Your Data

xx399 processes your personal data only where a lawful basis exists for doing so. The lawful bases on which xx399 relies are: the performance of a contract (your account agreement with xx399); compliance with a legal obligation; the legitimate interests of xx399 in operating a secure, fair, and commercially sustainable platform; and, in limited circumstances, your explicit consent. The following sets out the primary uses of your personal data and the corresponding lawful basis for each use.

2.1 Platform Operation and Contract Performance

The core purpose of collecting your personal data is to enable xx399 to deliver the services you have contracted for when you open an account. This includes processing your deposits and withdrawals via bKash, Nagad, Rocket, and other accepted payment partners; crediting your account with bonus funds; recording your bet placements and settling winnings; maintaining your VIP loyalty programme tier and points balance; and providing 24/7 customer support when you contact us.

2.2 Legal and Regulatory Compliance

xx399 is subject to anti-money laundering (AML) obligations that require us to verify the identity of our members, monitor transaction patterns for suspicious activity, and maintain records of financial transactions for defined retention periods. We are also subject to responsible gaming obligations that require us to monitor member behaviour for indicators of problem gambling and to take protective action where appropriate. Your personal and financial data is processed to fulfil these obligations. Compliance with legal obligations constitutes a lawful basis independent of your consent.

2.3 Fraud Prevention and Platform Security

xx399 processes technical data and account activity data to detect and prevent fraudulent account access, multi-accounting, bonus abuse, payment fraud, and other security threats to the platform. This processing is carried out on the basis of xx399's legitimate interest in maintaining a secure and fair gaming environment for all members. Where fraud is detected, xx399 may share relevant data with payment providers or law enforcement authorities as required by law.

2.4 Personalisation and VIP Programme Management

With your consent as part of your account registration, xx399 may use your account activity data to personalise your experience on the platform — for example, by surfacing game recommendations aligned with your betting history, or by tailoring VIP bonus offers to your preferred game categories. You may withdraw consent for personalisation at any time via your account settings without affecting the lawfulness of processing that occurred prior to withdrawal.

2.5 Marketing Communications

If you have opted in to receive marketing communications from xx399 during account registration or subsequently via your account settings, we may use your contact data and account activity data to send you promotional emails or SMS notifications about new games, seasonal promotions, VIP tier upgrade offers, and platform updates. You may unsubscribe from marketing communications at any time by using the unsubscribe link in any email we send, or by contacting support directly. Unsubscribing from marketing does not affect transactional communications such as deposit confirmations, withdrawal notifications, and account security alerts.

3 Data Sharing & Third Parties

xx399 does not sell or rent your personal data to any third party. We share personal data only with carefully selected categories of third-party service providers who are contractually bound to process data solely on xx399's instructions and in accordance with this Privacy Policy. The categories of third parties with whom xx399 shares data, and the purpose of each sharing arrangement, are set out below.

3.1 Identity Verification Providers

To fulfil our KYC obligations, xx399 shares identity data — including copies of government-issued identification documents — with accredited identity verification service providers. These providers are engaged solely to verify the authenticity of your identity documents and to confirm that your identity matches the information you provided at registration. They are contractually prohibited from using your data for any other purpose.

3.2 Payment Processing Partners

To process your deposits and withdrawals, xx399 shares relevant financial data with payment partners including bKash, Nagad, Rocket, Upay, and our banking partners. The data shared is limited to the information required to complete the specific transaction — typically your registered mobile number or bank account details and the transaction amount. Payment partners operate under their own privacy policies, which govern their handling of your payment data.

3.3 Game Content Providers

The xx399 platform hosts games developed and operated by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game provided by one of these studios, limited session and bet data may be transmitted to the game provider's systems for the purpose of game operation and result validation. Game providers do not receive your identity or contact data and are contractually restricted from using session data for any purpose beyond the operation of their games on the xx399 platform.

3.4 Law Enforcement and Regulatory Authorities

xx399 will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where we are legally required to do so, or where disclosure is necessary to prevent, detect, or prosecute criminal activity including fraud, money laundering, or terrorist financing. Such disclosures are made in strict compliance with applicable law and are limited to the minimum data necessary to fulfil the legal obligation.

4 Cookies & Tracking Technologies

The xx399 website uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your logged-in session, and to gather anonymised analytics data that helps us understand how members use the platform so that we can improve it. This section explains what cookies we use, why we use them, and how you can manage your cookie preferences.

4.1 Essential Cookies

Essential cookies are strictly necessary for the xx399 website to operate. Without them, core functions such as account login, session management, and the display of your account balance would not work. Essential cookies cannot be disabled via your cookie preferences because they are a prerequisite for platform functionality. They include session tokens, CSRF protection tokens, and load balancing cookies. Essential cookies do not track your activity for marketing purposes and are deleted when you close your browser session or log out of your account.

4.2 Analytics Cookies

With your consent, xx399 deploys first-party analytics cookies that collect anonymised data about how visitors navigate the platform — for example, which pages are visited most frequently, how long sessions last, and which game categories attract the most engagement. This data is aggregated and cannot be used to identify individual members. It is used solely to improve the design, performance, and content of the xx399 platform. You may decline analytics cookies without affecting your ability to use any feature of the platform.

4.3 Security and Fraud Detection Cookies

xx399 uses security cookies to detect and prevent fraudulent account access, automated bot activity, and suspicious login behaviour. These cookies record technical identifiers such as device fingerprints and session continuity markers. They are processed on the basis of xx399's legitimate interest in maintaining platform security and protecting all members from fraud. They are retained only for the duration necessary to fulfil their security function.

4.4 Managing Your Cookie Preferences

You may manage your cookie preferences at any time via the cookie settings panel accessible in your account settings or via the consent banner displayed on your first visit to the xx399 platform. You may also configure your browser to block or delete cookies entirely; however, please note that disabling essential cookies will prevent you from logging in to your xx399 account. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

5 Data Security Measures

xx399 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated regularly in line with evolving security standards and threat landscapes.

5.1 Technical Safeguards

• TLS/SSL Encryption: All data transmitted between your device and xx399 servers is encrypted using TLS 1.2 or higher. This applies to all pages of the platform, including account login, cashier transactions, and support chat.
• Encrypted Data Storage: Sensitive data fields — including identity document data, financial account numbers, and passwords — are stored using industry-standard encryption at rest. Passwords are hashed using a strong one-way hashing algorithm and are never stored in plain text.
• Two-Factor Authentication (2FA): xx399 offers two-factor authentication for member accounts as an additional layer of protection. Members are strongly encouraged to enable 2FA via their account security settings.
• Intrusion Detection Systems: xx399's infrastructure is monitored 24/7 by automated intrusion detection and anomaly monitoring systems that generate alerts for any access patterns inconsistent with normal platform usage.
• Regular Security Audits: xx399 conducts periodic security assessments of its platform infrastructure, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses before they can be exploited.

5.2 Organisational Safeguards

Access to personal data within xx399's internal systems is restricted on a strict need-to-know basis. Staff who require access to member data to perform their job functions are subject to confidentiality agreements and receive regular data protection training. Access privileges are reviewed periodically and revoked immediately upon the termination of any employment or service relationship.

6 Data Retention & Deletion

xx399 retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or to comply with applicable legal and regulatory obligations. The following retention periods apply to the principal categories of data we hold:

Upon the expiry of the applicable retention period, personal data is either securely and permanently deleted from xx399's systems or anonymised such that it can no longer be associated with any individual member. Anonymised data may be retained indefinitely for aggregate statistical analysis.

6.1 Early Deletion Requests

You may request deletion of your personal data before the end of the applicable retention period by submitting a written request to the xx399 support team. xx399 will fulfil deletion requests to the fullest extent possible; however, where retention is required to comply with a legal obligation — for example, AML record-keeping requirements — full deletion may not be possible until the legal retention period has elapsed. In such cases, xx399 will confirm which data must be retained and for how long.

7 Your Privacy Rights

As a member of the xx399 platform, you hold the following rights in relation to your personal data. xx399 is committed to honouring these rights promptly and without undue bureaucracy. All requests should be submitted to the support team via live chat in your account dashboard or via the support email address listed in the Contact Us section of this policy.

• Right of Access: You have the right to request a copy of all personal data that xx399 holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 calendar days of receiving your verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Where the data in question is held in a verified KYC record, we may require supporting documentation before making the correction.
• Right to Erasure: Subject to our legal retention obligations, you have the right to request that xx399 delete your personal data. We will action valid erasure requests within 30 calendar days and confirm completion in writing.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of data or object to our processing — you may request that we restrict processing of your data while the matter is resolved, rather than deleting it outright.
• Right to Object: Where xx399 processes your data on the basis of legitimate interests — for example, for direct marketing or profiling for VIP personalisation — you have the right to object to that processing. Upon receipt of a valid objection, xx399 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: You have the right to request that xx399 provide your personal data in a portable format so that you can transfer it to another service provider. This right applies specifically to data that you provided to us and that we process on the basis of contract performance or your consent.
• Right to Withdraw Consent: Where xx399 processes your data on the basis of your consent — for example, for marketing communications or analytics personalisation — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

8 Policy Updates & Contact

xx399 reviews this Privacy Policy periodically and updates it where necessary to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where an update is material — meaning it affects the way we collect, use, or share your personal data in a way that is less favourable to you than the previous version — we will notify active members via their registered email address at least 14 days before the revised policy takes effect. Minor updates, such as corrections to typographical errors or clarifications that do not change the substance of the policy, may be made without prior notice.

The effective date displayed at the top of this page reflects the date on which the current version of the Privacy Policy came into force. We encourage you to review this page periodically so that you remain informed of how xx399 protects your data.

8.1 Contact for Privacy Matters

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a concern about xx399's data processing practices, please contact the xx399 data protection team using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, via your account dashboard. This is the fastest channel for routine privacy queries.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in the subject line so that your message is routed to the correct team promptly.
• WhatsApp: +880 1700-xx399. Available for support queries including data rights requests during Bangladesh Standard Time (BST, UTC+6) business hours.

All times referenced above are in Bangladesh Standard Time (BST, UTC+6). xx399 aims to acknowledge all privacy-related communications within 2 business days of receipt and to provide a substantive response within the 30-day statutory period.

8.2 Relationship to Other Policies

This Privacy Policy forms part of the overall legal framework governing your use of the xx399 platform. It should be read in conjunction with the Terms & Conditions and the Responsible Gaming policy. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a matter relating to data protection, this Privacy Policy shall prevail.