999kg Privacy Policy —
How We Handle Your Data

Last Updated: 1 January 2026

1. Introduction

999kg operates the online casino and sports betting platform accessible at 999kg.io (the "Platform"), which is designed to serve players based in Bangladesh. This Privacy Policy describes how 999kg collects, processes, stores, shares, and protects the personal data of individuals who access or use the Platform ("you" or "the Player").

By registering an account, making a deposit, placing a bet, or otherwise using any feature of the 999kg Platform, you acknowledge that you have read and understood this Privacy Policy in full and that you consent to the processing of your personal data as described herein. If you do not agree with any part of this policy, you must discontinue use of the Platform immediately and contact [email protected] to request account closure.

This Privacy Policy should be read alongside the 999kg Terms & Conditions and the Responsible Gaming policy, both of which contain additional provisions that govern your relationship with 999kg.

2. Data Controller

For the purposes of this Privacy Policy, 999kg acts as the data controller in respect of all personal data collected from players using the Platform. As data controller, 999kg determines the purposes for which personal data is processed and the means by which that processing takes place.

All data-related queries, requests to exercise your rights, or complaints regarding 999kg's data practices should be directed to the contact details provided in Section 14 of this policy. 999kg is committed to resolving data-related concerns promptly, typically within fourteen (14) calendar days of receiving a written request.

3. Categories of Personal Data We Collect

3.1 Identity and Contact Data

When you register an account with 999kg, we collect your full legal name, date of birth, gender (where provided), nationality, residential address, email address, and mobile phone number. This information is required to create your account, verify your identity, and fulfil our Know Your Customer (KYC) obligations.

3.2 Verification Documents

As part of the KYC verification process, 999kg may collect scanned copies or photographs of government-issued identity documents such as your National Identity Card (NID), passport, or driving licence. We may also collect proof-of-address documents such as recent utility bills or bank statements, and proof-of-payment-method documents such as a photograph of your bKash-registered SIM card or a bank statement showing your account details.

3.3 Financial and Transaction Data

999kg records all financial transactions conducted through your account, including deposit amounts, withdrawal requests, transaction timestamps, payment method references, and the BDT values associated with each transaction. We do not store full payment card numbers or mobile banking PINs. Payment credentials are processed directly by our payment partners (bKash, Nagad, Rocket, Upay, and banking partners) under their own security frameworks.

3.4 Gaming and Betting Activity Data

We collect detailed records of your gaming and betting activity on the Platform, including game titles played, bet amounts, win and loss outcomes, session durations, and wagering history. This data is used to maintain accurate account records, resolve disputes, monitor for responsible gaming concerns, and comply with regulatory obligations.

3.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical information about your device and connection. This includes your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URLs, pages visited within the Platform, and timestamps of access. This data is used for security monitoring, fraud prevention, and Platform performance optimisation.

3.6 Communications Data

If you contact 999kg's customer support team — whether by email, live chat, or any other supported channel — we retain records of those communications, including the content of your messages, your contact details, and the resolution outcome. This data is retained to maintain quality assurance, resolve disputes, and provide continuity of support.

The table below summarises the main categories of personal data, the primary source of collection, and the principal purpose for which each category is processed:

Data Category	Primary Source	Principal Purpose
Identity & Contact	Player-provided at registration	Account creation, KYC, customer support
Verification Documents	Player-submitted on request	Age & identity verification, AML compliance
Financial & Transaction	Platform transaction system	Payment processing, fraud prevention, audit
Gaming & Betting Activity	Platform gameplay system	Account records, dispute resolution, responsible gaming
Technical & Device	Automatic collection via browser/app	Security, fraud detection, performance
Communications	Player-initiated contact	Support quality, dispute records, continuity

4. How We Collect Your Data

999kg collects personal data through the following channels:

• Direct collection: Information you provide when you complete the registration form, submit KYC documents, contact customer support, respond to surveys, or participate in promotions.
• Automated collection: Technical and device data collected automatically through cookies, web server logs, and similar technologies when you access the Platform. See Section 7 for details on our use of cookies.
• Transaction systems: Financial and gaming activity data generated automatically as you use the Platform's deposit, withdrawal, and gameplay features.
• Third-party verification services: In some cases, identity verification data may be supplemented by third-party KYC providers who cross-reference the documents you submit against authoritative data sources.
• Payment providers: Transaction confirmation data received from payment partners such as bKash, Nagad, and Rocket following successful deposit or withdrawal processing.

5. Purposes of Processing and Legal Basis

5.1 Contract Performance

The majority of 999kg's data processing activities are necessary for the performance of the contract between you and 999kg — specifically, to create and maintain your account, process your deposits and withdrawals in BDT, deliver gameplay access, and manage your bonus entitlements.

5.2 Legal Obligation

Certain data processing activities are required in order for 999kg to comply with its legal and regulatory obligations. These include KYC identity verification, anti-money laundering (AML) transaction monitoring, record-keeping for financial audit purposes, and age verification to ensure that no player under 21 years of age accesses the Platform.

5.3 Legitimate Interests

999kg processes some personal data on the basis of its legitimate interests as a platform operator. These include: fraud prevention and platform security; responsible gaming monitoring; customer support quality assurance; Platform performance analytics; and communicating material changes to platform terms or services. Where processing is based on legitimate interests, 999kg has assessed that its interests do not override the fundamental rights and privacy interests of individual players.

5.4 Consent

Where 999kg sends you optional marketing communications — such as promotional offers, bonus notifications, or seasonal offers related to events like Eid, Pohela Boishakh, or BPL cricket season — this is done only where you have provided explicit consent. You may withdraw your marketing consent at any time by updating your Account notification preferences or by contacting [email protected].

6. How We Share Your Data

999kg does not sell, rent, or trade your personal data to any third party. We share personal data only in the following specific circumstances:

• Payment processors: We share the minimum necessary transaction data with payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard to process deposits and withdrawals. These partners process data under their own privacy policies and applicable payment industry security standards.
• Game providers: Game session data — including your player identifier and bet/win outcomes — is shared with licensed game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to facilitate gameplay and RNG certification auditing. Your full identity details are not transmitted to game providers.
• KYC and identity verification providers: Identity document data submitted during KYC verification may be processed by authorised third-party verification service providers under strict data-processing agreements with 999kg.
• Fraud prevention and security services: Technical and device data may be shared with specialised fraud prevention providers to detect and prevent unauthorised account access, bonus abuse, and money laundering activity.
• Legal and regulatory disclosure: 999kg may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory directive, or where disclosure is necessary to protect the rights, property, or safety of 999kg, its players, or third parties.
• Business transfers: In the event of a merger, acquisition, or transfer of all or substantially all of 999kg's business assets, personal data held by 999kg may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

7. Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. 999kg uses cookies and similar technologies (including local storage and session tokens) to operate the Platform, maintain your login session, remember your preferences, and analyse how the Platform is used.

7.2 Types of Cookies Used

• Essential cookies: Required for the Platform to function. These include session authentication tokens that keep you logged in during a gaming session. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Store your preferences such as language settings and notification preferences so that the Platform remembers your choices between visits.
• Analytics cookies: Help 999kg understand how players navigate and use the Platform, which pages are most visited, and where technical errors occur. This data is aggregated and anonymised.
• Security cookies: Used to detect and prevent fraudulent activity, including cross-site request forgery (CSRF) protection tokens and device fingerprinting for login security.

7.3 Managing Cookies

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may impair your experience on the Platform — in particular, disabling session cookies will prevent you from staying logged in. Instructions for managing cookies in major browsers are available in each browser's help documentation.

8. Data Retention

999kg retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or audit obligations. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active account relationship with 999kg, plus a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of each transaction, in line with standard financial record-keeping obligations.
• KYC verification documents: Retained for five (5) years following account closure or the last date of any verified transaction, whichever is later.
• Gaming activity logs: Retained for five (5) years from the date of the relevant gaming session, for dispute resolution and responsible gaming monitoring purposes.
• Customer support communications: Retained for three (3) years from the date of the communication, unless the communication relates to an unresolved dispute, in which case it is retained until the dispute is fully resolved plus one (1) year.
• Technical and device data (logs): Typically retained for ninety (90) days for security monitoring purposes, after which logs are anonymised or deleted.

On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

9. Your Privacy Rights

As a player on the 999kg Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please submit a written request to [email protected]. 999kg will respond to all valid requests within fourteen (14) calendar days.

• Right of access: You have the right to request a copy of the personal data that 999kg holds about you, together with information about how that data is processed.
• Right to rectification: If any personal data held by 999kg is inaccurate or incomplete, you have the right to request that it be corrected or updated. For changes to core identity data such as your legal name or date of birth, supporting documentation will be required.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (where processing was based on consent), or where you object to processing based on legitimate interests and that objection overrides 999kg's interests. Please note that certain data must be retained to comply with legal obligations and cannot be erased on request.
• Right to restriction: You have the right to request that 999kg temporarily restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on a contract and is carried out by automated means, you may request that 999kg provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object at any time to the processing of your personal data where that processing is based on legitimate interests, including profiling for responsible gaming purposes. 999kg will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10. Data Security

999kg implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 999kg Platform.
• AES-256 encryption for personal data stored in 999kg's databases and file systems.
• Multi-factor authentication requirements for administrative access to systems that process personal data.
• Role-based access controls that restrict access to personal data to authorised personnel only, on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Automated intrusion detection and anomaly monitoring systems that operate on a continuous basis.
• Staff training on data protection obligations and secure data handling practices.

While 999kg takes every reasonable precaution to protect your personal data, no online platform can guarantee absolute security against all possible threats. If you become aware of any security concern related to your 999kg account, please contact us immediately at [email protected].

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 999kg will notify affected players without undue delay and will take all reasonable steps to contain, investigate, and remediate the breach.

11. Children's Privacy

The 999kg Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If 999kg becomes aware that personal data has been collected from a person under 21 years of age, that data will be deleted immediately and the associated account will be closed. If you believe that a minor has registered on the Platform, please contact us immediately at [email protected] so that we can take appropriate action without delay.

999kg employs age verification procedures at registration and at the point of first withdrawal to minimise the risk of underage access. These procedures form part of 999kg's broader responsible gaming commitment, described in detail on our Responsible Gaming page.

12. Third-Party Links

The 999kg Platform may from time to time contain references to game providers or other third-party services. This Privacy Policy applies exclusively to personal data collected and processed by 999kg through the 999kg.io Platform. 999kg is not responsible for the privacy practices of any third-party service providers, game studios, or payment processors, and their handling of your personal data is governed by their own privacy policies. We recommend that you review the privacy policy of any third-party service before providing personal data to them.

13. Amendments to This Privacy Policy

999kg reserves the right to update or amend this Privacy Policy at any time. When material changes are made — such as changes to the categories of data collected, the purposes of processing, or your rights — 999kg will notify registered players by sending a notification to the email address registered to their account and by displaying a prominent notice on the Platform homepage for a minimum of thirty (30) days.

The amended Privacy Policy will take effect fourteen (14) days after notification is dispatched, unless the change is required by law or is made in players' favour, in which case it may take effect immediately. The "Last Updated" date at the top of this document will be revised accordingly. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy.

14. Contact Information

If you have any questions, concerns, or complaints regarding this Privacy Policy or 999kg's data handling practices, or if you wish to exercise any of your privacy rights described in Section 9, please contact the 999kg Data Privacy team using the details below. All requests must be submitted in writing to ensure a proper record is maintained.

Email: [email protected]
Platform: 999kg.io
Response Time: Within 14 calendar days of receiving a written request
Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

If you are not satisfied with 999kg's response to a data privacy concern, you retain the right to escalate your complaint to the appropriate authority in your jurisdiction.