b399 Privacy Policy

b399 ("we", "us", "our", "the Platform") is committed to safeguarding the privacy and personal data of every individual ("Player", "User", "you") who interacts with the b399 online gaming platform at b399.io and any related subdomains or mobile-optimised interfaces.

This Privacy Policy describes the types of personal data b399 collects, the purposes for which that data is processed, the conditions under which it may be shared with third parties, the security measures we apply to protect it, how long we retain it, and the rights available to you in respect of your personal data.

b399 acts as the data controller in respect of personal data collected directly from players through the b399.io platform. Where data processing is carried out by third-party service providers on behalf of b399, those providers act as data processors and are bound by contractual obligations that require them to handle data only as directed by b399 and to maintain appropriate security standards.

This policy should be read alongside the b399 Terms & Conditions and the Responsible Gaming Policy, both of which incorporate data processing activities relevant to their respective subject matter. Together, these three documents form the complete framework governing your relationship with b399.

b399 collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises the main categories of data collected and provides examples of specific data points within each category.

b399 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data (beyond the liveness check described above), or data concerning health or sexual orientation. If any such data is incidentally disclosed in a support communication, it will not be processed for any purpose beyond resolving the immediate query.

b399 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide voluntarily when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or updating your account profile.
• Automated collection: Technical and usage data collected automatically when you access, browse, or interact with the b399 platform, including data collected via cookies, web beacons, and server logs.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a deposit or withdrawal through those providers.
• Identity verification providers: Results of identity and age verification checks performed by third-party KYC service providers, where b399 uses such a provider to assist with document authentication.
• Fraud prevention services: Device fingerprinting data and risk signals provided by third-party fraud prevention tools used to protect the platform and its players from fraudulent activity.
• Responsible gaming databases: Where a player has registered with an independent self-exclusion scheme or problem gambling support service, b399 may receive notification data to prevent that player from accessing the platform.

b399 uses the personal data it collects for the following specific purposes. We process data only to the extent necessary for each stated purpose and do not use data collected for one purpose as the primary driver of an unrelated processing activity.

• Account creation and management: Processing your registration, maintaining your account record, authenticating your identity when you log in, and enabling you to update your account details.
• Age and identity verification: Confirming that you are at least 21 years of age and that your identity matches the information provided at registration, in compliance with our responsible gaming obligations.
• Payment processing: Facilitating deposits and withdrawals through your chosen payment method, recording transaction history, and reconciling payment records.
• Service delivery: Providing access to the b399 casino games, sportsbook markets, live dealer tables, and all other platform features that form the core service.
• Customer support: Responding to queries, resolving complaints, providing technical assistance, and maintaining records of support interactions for quality and training purposes.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling behaviour, administering deposit limits and self-exclusion requests, and communicating with players who reach out for responsible gaming support.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, money laundering, and other prohibited activity that could harm players or the platform.
• Regulatory compliance: Meeting obligations under applicable anti-money laundering frameworks, age verification requirements, and other legal or quasi-legal obligations relevant to the operation of an online gaming platform.
• Platform improvement: Analysing aggregated usage data to understand how players navigate the platform, identify usability issues, and inform decisions about new features or content.
• Marketing communications: Sending promotional emails, SMS messages, or in-platform notifications to players who have explicitly opted in to receive marketing communications. You may withdraw marketing consent at any time via your account settings or by contacting [email protected].

b399 processes personal data on the following legal bases, which correspond to the processing purposes described in Section 4:

• Contractual necessity: Processing required to fulfil the contract between b399 and the player — including account setup, payment processing, service delivery, and customer support — is carried out on the basis that it is necessary for performance of that contract.
• Legal obligation: Processing carried out to comply with applicable legal requirements — including age verification, anti-money laundering checks, and record-keeping obligations — is carried out on the basis that it is required by law.
• Legitimate interests: Processing carried out for fraud prevention, platform security, and aggregated platform analytics is based on b399's legitimate interest in operating a safe, secure, and commercially viable gaming platform. Before relying on legitimate interests, b399 conducts a balancing test to confirm that our interests are not overridden by your rights and interests.
• Consent: Processing carried out for marketing communications and for the use of non-essential cookies is based on your explicit consent. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

b399 does not sell your personal data. We share personal data only in the circumstances described below, and only to the extent necessary for the relevant purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other payment partners receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are independently responsible for data they receive in their capacity as payment processors.
• Identity verification providers: Third-party KYC and age-verification service providers receive copies of identity documents and verification results solely to perform the verification service on b399's behalf.
• Game technology providers: Software providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised player session data to enable game delivery, calculate RTP statistics, and investigate game-related disputes.
• Fraud prevention and security partners: Device fingerprinting and risk-scoring providers receive technical data to generate fraud risk assessments. These providers are bound by contractual restrictions that prohibit them from using b399 player data for any purpose beyond delivering the fraud prevention service.
• Legal and regulatory authorities: b399 may disclose personal data to competent authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction. b399 will notify affected players of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of the b399 business, player data may be transferred as part of that transaction. Affected players will be notified in advance of any such transfer and of any changes to this Privacy Policy that may result.

All third parties with whom b399 shares personal data are required to maintain adequate technical and organisational measures to protect that data and to process it only in accordance with b399's written instructions.

b399 uses cookies and similar tracking technologies — including web beacons, pixel tags, and local storage objects — to operate and improve the platform. The table below describes the main categories of cookies used on b399.io.

You can manage or disable non-essential cookies through your browser's privacy or settings menu. Note that disabling strictly necessary cookies will prevent the b399 platform from functioning correctly and you will not be able to log in or place bets. b399 does not currently respond to "Do Not Track" signals from browsers, as there is no consistent industry standard for their interpretation.

b399 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal retention obligations, whichever is longer. The following general retention periods apply:

• Active account data: Retained for the duration of your active account relationship with b399, plus a minimum post-closure period as described below.
• Post-closure retention: Following account closure — whether by the player or by b399 — identity, financial, and transaction records are retained for a minimum period necessary to meet anti-money laundering record-keeping requirements and to resolve any disputes that may arise after closure.
• KYC and verification documents: Retained for the period required by applicable verification obligations. Document copies are deleted or securely destroyed once the retention obligation expires.
• Support communications: Live chat transcripts and email correspondence are retained for a period sufficient to provide continuity of support and to handle escalated complaints. Routine support records are purged on a rolling basis.
• Marketing consent records: Records of marketing consent and opt-out requests are retained indefinitely to demonstrate compliance with marketing communications obligations, even if all other data associated with an account has been deleted.
• Cookies and technical data: Session cookies expire when you close your browser. Persistent cookies expire on the date indicated in your browser's cookie store, typically between 30 days and 12 months depending on cookie type.

b399 takes the security of your personal data seriously and applies a layered set of technical and organisational measures designed to protect data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption in transit: All data exchanged between your device and b399.io is encrypted using 256-bit TLS/SSL protocols. Connections using deprecated protocols are rejected at the server level.
• Encryption at rest: Sensitive data fields — including financial identifiers and verification document references — are encrypted within the b399 database using industry-standard encryption algorithms.
• Password security: Account passwords are hashed using a modern, salted hashing algorithm before storage. b399 staff do not have access to your plaintext password and will never ask for it.
• Access controls: Access to systems containing personal data is restricted to b399 staff and contractors who have a legitimate operational need to access that data. Access rights are reviewed periodically and revoked promptly upon role changes or departures.
• Intrusion detection: b399 operates automated monitoring systems designed to detect anomalous access patterns, brute-force login attempts, and other indicators of unauthorised system access.
• Vendor security assessments: Third-party service providers who process personal data on behalf of b399 are evaluated for their data security practices prior to onboarding and are required to maintain security standards consistent with those applied by b399.

Despite these measures, no internet-based system can be guaranteed to be completely free from security vulnerabilities. b399 encourages all players to practise good personal security hygiene — including using a strong unique password, not sharing account credentials, and contacting b399 immediately if you suspect your account has been compromised.

As a player whose personal data is processed by b399, you have the following rights in respect of that data. To exercise any of these rights, please contact b399 at [email protected] with the subject line "Data Rights Request" and include your registered username and a clear description of the right you wish to exercise. b399 will respond to all verifiable requests within a reasonable timeframe.

• Right of access: You have the right to request a copy of the personal data b399 holds about you, together with information about how that data is used, where it came from, and with whom it has been shared.
• Right to rectification: If any personal data b399 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure: In certain circumstances — such as where data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies — you have the right to request that b399 delete your personal data. Note that b399 may be required to retain certain data for legal or regulatory compliance reasons even following a valid erasure request, in which case we will inform you of the specific retention obligation that applies.
• Right to restriction of processing: You have the right to request that b399 restrict the processing of your personal data in certain circumstances, for example while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to object: Where processing is based on b399's legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. b399 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Right not to be subject to automated decision-making: b399 does not make decisions that produce legal or similarly significant effects on players solely by automated means without human review. Where automated tools assist in fraud detection or responsible gaming assessments, a human review is available upon request.

The b399 platform is strictly intended for adults aged 21 years and above. b399 does not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is a mandatory step in the b399 account registration and KYC process, and accounts where the age verification check is not passed will not be permitted to access real-money gaming services.

If b399 becomes aware that personal data belonging to a person under the age of 21 has been collected — whether through a fraudulent registration or any other means — that data will be deleted promptly and the associated account will be permanently closed. Any funds associated with such an account will be handled in accordance with applicable law.

Parents, guardians, and other responsible adults who believe that a person under the age of 21 in their care has registered an account or accessed the b399 platform are strongly encouraged to contact b399 immediately at [email protected] so that the matter can be investigated and the account closed without delay.

b399 also recommends that parents and guardians use parental control software to prevent minors from accessing online gambling platforms. Several independent services offer free or low-cost filtering tools specifically designed to block gambling content on shared devices.

The b399 platform may from time to time contain references to game providers, payment partners, or other third-party services. Where such references include links to external websites, please be aware that those websites operate under their own privacy policies and terms of use, which are entirely independent of this Privacy Policy.

b399 has no control over the content, privacy practices, or data handling of third-party websites and accepts no responsibility or liability for the privacy practices of any third-party operator. Before providing any personal data to a third-party website, we strongly encourage you to review that website's privacy policy.

The inclusion of a link to or reference to a third-party service on the b399 platform does not constitute an endorsement of that service or any representation that its privacy or security practices meet any particular standard.

b399 reserves the right to amend, update, or replace this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes in our data processing practices, the introduction of new platform features, or feedback from players and regulators.

When material changes are made to this Privacy Policy, b399 will notify active players via their registered email address at least 14 days before the updated policy takes effect. The updated policy will also be published on this page with a revised "Last Updated" date at the top of the document. Minor corrections — such as typographical fixes, clarifications that do not change the substance of a provision, or updates to contact details — may be made without prior notice.

Continued use of the b399 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the updated policy, you should discontinue use of the platform and contact [email protected] to request account closure before the effective date of the change.

Previous versions of this Privacy Policy are available upon request by contacting [email protected] with the subject line "Previous Privacy Policy Version". b399 maintains an archive of all superseded versions of this document.

If you have any questions, concerns, or complaints about this Privacy Policy or about the way b399 handles your personal data, please contact the b399 Data & Privacy team using the details below. All privacy-related communications should be submitted in English and should include your registered account username to enable us to locate your account record.

If you are not satisfied with b399's response to a privacy complaint, you have the right to escalate the matter through appropriate channels available in your jurisdiction. b399 takes all privacy complaints seriously and commits to working in good faith with any player or authority to resolve disputes fairly and transparently.

This Privacy Policy was last reviewed and updated on 1 January 2026. The version number of this document is 1.0. This policy supersedes all previous versions of the b399 Privacy Policy.