399bad Privacy Policy

1 Information We Collect

When you register for and use the 399bad platform, we collect certain categories of personal information that are necessary for the safe, legal, and efficient operation of our services. We collect only the information that is relevant and proportionate to the purpose for which it is gathered. The categories of personal data we collect are set out below.

Registration and Account Data: When you create a 399bad account, we collect the personal information you provide during the registration process. This includes your full legal name, date of birth, email address, mobile phone number, and your chosen username. This information is required to establish your account identity, verify your eligibility to use the platform (including age verification for our strict 18+ policy), and communicate with you regarding your account activity.

Identity Verification (KYC) Data: As part of our Know Your Customer (KYC) obligations, we may request documentary evidence of your identity and address. This can include a government-issued photo identification document (such as a National ID card, passport, or driving licence), proof of residential address (such as a utility bill or bank statement dated within the last three months), and confirmation of your payment method ownership. KYC documents are processed securely and retained only for the period required by our compliance obligations.

Financial Transaction Data: We record all deposit and withdrawal transactions made through your 399bad account. This includes transaction amounts (in Bangladeshi Taka, ৳), payment method identifiers (such as the last four digits of a card or the registered mobile number of a bKash, Nagad, or Rocket wallet), transaction timestamps (in Bangladesh Standard Time, UTC+6), and transaction reference numbers. Full payment credentials (complete card numbers, wallet PINs, mobile banking passwords) are never stored by 399bad.

Gameplay and Betting Activity Data: We maintain records of your gaming and betting activity on the 399bad platform. This includes the games you play, the sports markets you bet on, your wagering history, session durations, win and loss records, and bonus usage. This data is used for account management, dispute resolution, responsible gaming monitoring, and the improvement of our service offering for Bangladeshi players.

Technical and Device Data: When you access 399bad, our systems automatically collect certain technical information about the device and connection you are using. This includes your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

Communications Data: When you contact the 399bad support team by email or live chat, we retain records of that correspondence including the content of your messages, the channel used, the date and time of each interaction, and the resolution outcome. This data is used for quality assurance, dispute resolution, and training purposes.

2 How We Use Your Data

399bad processes the personal data we collect for specific, documented purposes. We do not process your data beyond what is necessary for those stated purposes, and we do not use your data for purposes that are incompatible with those stated at the time of collection. The following sets out the primary purposes for which 399bad processes personal data:

• Account Creation and Management: We use your registration and KYC data to establish your account, verify your identity, confirm your eligibility to use the 399bad platform, and maintain accurate account records throughout the lifecycle of your membership.
• Service Delivery: Your account data, financial data, and gameplay data are processed as a fundamental requirement for delivering the core services you have requested — including processing deposits and withdrawals in Bangladeshi Taka (৳), placing bets on cricket, football, and other sports, and granting access to casino games from providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi.
• Payment Processing: Financial transaction data is processed to handle your deposit and withdrawal requests accurately, to reconcile your account balance in real time, and to ensure that withdrawals are returned to the correct bKash, Nagad, Rocket, Upay, Visa, Mastercard, or bank account registered in your name.
• Fraud Prevention and Security: Technical and device data, combined with transaction and gameplay data, is analysed by our security systems to detect and prevent fraudulent activity, money laundering, bonus abuse, account takeover attempts, and other prohibited conduct as described in our Terms & Conditions.
• Responsible Gaming Compliance: We monitor gameplay activity data to identify patterns that may indicate problem gambling behaviour. This monitoring supports our responsible gaming programme, including the delivery of reality checks, the enforcement of deposit limits, and the prompt actioning of self-exclusion requests. Our commitment to responsible gaming for all players across Bangladesh is unconditional.
• Legal and Regulatory Compliance: 399bad processes and retains personal data to the extent required by applicable laws and regulations, including anti-money laundering (AML) obligations, know your customer (KYC) requirements, and data retention mandates.
• Customer Support: Communications data is used to respond to your enquiries, resolve disputes, process complaints, and maintain a record of support interactions for quality assurance purposes.
• Platform Improvement and Analytics: Aggregated, anonymised technical and gameplay data is used internally to analyse platform performance, identify technical issues, test new features, and improve the overall experience for players in Bangladesh and beyond.
• Promotional Communications: Where you have opted in to receive marketing communications, we may use your email address or mobile number to send information about 399bad promotions, bonuses, and seasonal offers (such as those tied to Eid, Pohela Boishakh, BPL finals, or T20 tournaments). You may opt out of marketing communications at any time by contacting [email protected].

3 Data Sharing & Disclosure

399bad does not sell, rent, trade, or otherwise transfer your personal data to third parties for their own commercial purposes. Your personal information is shared externally only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

Payment Processing Partners: To process your deposit and withdrawal transactions, 399bad shares necessary financial identifiers with our payment processing partners. For mobile wallet transactions this includes bKash, Nagad, Rocket (Dutch-Bangla Bank), and Upay; for card transactions this includes Visa and Mastercard processing networks; and for direct bank transfers this includes relevant Bangladesh banking institutions such as BRAC Bank, City Bank, Islami Bank, Sonali Bank, and Dutch-Bangla Bank. These partners receive only the minimum data required to execute the specific transaction and are bound by their own data protection and financial services regulations.

Game Content Providers: The casino games available on 399bad are provided by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game from one of these providers, certain session data (such as your player session token, bet amounts, and game results) is transmitted to that provider's gaming servers. This is a technical necessity for real-time game delivery. Game providers are contractually obligated not to use session data for any purpose beyond game delivery and their own fair-play verification obligations.

Identity Verification Services: Where identity verification is carried out with the assistance of a third-party KYC or document authentication service, your submitted identity documents may be processed by that service. Such providers are bound by strict data processing agreements and handle document data solely for the purpose of confirming authenticity.

Legal and Regulatory Disclosure: 399bad may be required to disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where legally compelled to do so. We will always seek to limit such disclosures to the minimum information legally required and will notify affected users where we are permitted to do so under applicable law.

Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of 399bad's business, personal data held by 399bad may be transferred to the successor entity as part of that transaction. In such circumstances, 399bad will provide reasonable advance notice to affected users and will ensure that the successor entity is bound by privacy obligations no less protective than those set out in this policy.

4 Cookies & Tracking Technologies

The 399bad website uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. A cookie is a small text file placed on your device by a website you visit. Cookies allow the website to recognise your device on subsequent visits, remember your preferences, and maintain your session state. The cookies used by 399bad fall into the following categories:

You can manage your cookie preferences through your web browser settings. Most modern browsers allow you to block or delete cookies, or to receive a notification before a cookie is placed on your device. Please note that disabling strictly necessary cookies will impair the functionality of the 399bad platform — in particular, you may be unable to maintain a logged-in session or complete financial transactions if these cookies are blocked.

399bad does not use third-party advertising cookies or behavioural targeting cookies that track your activity across external websites for the purpose of serving you targeted advertisements on other platforms. Our analytical tracking is limited to activity on the 399bad platform itself.

5 Data Retention & Storage

399bad retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. When personal data is no longer needed, it is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

The following general retention periods apply to the principal categories of personal data held by 399bad:

• Account and Registration Data: Retained for the duration of your active account relationship with 399bad, plus a minimum period of five (5) years following account closure, to satisfy anti-money laundering (AML) record-keeping requirements.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years from the date of submission, or longer where required by applicable financial regulation. Documents are stored in encrypted form and accessible only to authorised compliance personnel.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial services record-keeping obligations applicable to our operations.
• Gameplay and Betting History: Retained for a minimum of two (2) years from the date of each transaction, and for the duration of any ongoing dispute, investigation, or regulatory inquiry in which the records are relevant.
• Support Communications: Retained for a minimum of two (2) years from the date of the most recent communication in each support thread, for quality assurance and dispute resolution purposes.
• Technical and Device Logs: Retained for a maximum of twelve (12) months from the date of collection, unless retention is extended in connection with an active security investigation or legal proceeding.

All personal data is stored on secure servers. 399bad employs both physical access controls at the server level and technical access controls at the application level to ensure that personal data is accessible only to personnel who require it to perform their authorised functions.

6 Data Security Measures

The security of your personal data is a core operational priority at 399bad. We implement and maintain a layered set of technical and organisational security measures designed to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. The following are the principal security measures in place:

• 256-Bit SSL / TLS Encryption: All data transmitted between your device and the 399bad platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This means that your login credentials, personal details, and financial transaction data are protected from interception during transmission.
• Encrypted Data Storage: Sensitive personal data — including identity documents, payment identifiers, and account credentials — is stored in encrypted form at rest. Encryption keys are managed separately from the encrypted data and are subject to regular rotation.
• Access Controls: Access to personal data within the 399bad organisation is restricted on a strict need-to-know basis. Only personnel whose job functions require access to specific categories of personal data are granted access to those data sets, and all access is logged and subject to periodic audit.
• Two-Factor Authentication: 399bad's administrative systems require multi-factor authentication for all personnel with access to player data systems, reducing the risk of unauthorised internal access resulting from credential compromise.
• Intrusion Detection and Monitoring: Our security team operates continuous automated monitoring for unusual access patterns, potential intrusion attempts, and anomalous platform behaviour. Alerts are reviewed by qualified security personnel around the clock.
• Regular Security Audits: 399bad conducts periodic internal and external security reviews of our platform infrastructure, data storage systems, and access control policies to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data security incident that may affect your personal data, 399bad has established incident response procedures that include prompt internal escalation, containment, impact assessment, and — where legally required or where your interests demand it — notification to affected users without undue delay.

7 Your Privacy Rights

As a player on the 399bad platform, you hold a number of rights with respect to the personal data we hold about you. 399bad is committed to honouring these rights promptly and without unnecessary obstacle. The following rights are available to all 399bad account holders:

To exercise any of the rights listed above, please submit your request by email to [email protected] with the subject line "Privacy Rights Request". Please include your registered account username and a brief description of the right you wish to exercise. 399bad will acknowledge your request within two (2) business days and will fulfil the request within a reasonable timeframe, typically not exceeding thirty (30) days. Where a request is complex or high in volume, we may extend this timeframe by up to a further thirty (30) days and will notify you accordingly.

Please note that certain privacy rights are subject to limitations. In particular, the right to erasure and the right to restrict processing are qualified by 399bad's legal obligations to retain financial records, KYC documentation, and transaction histories for the minimum periods required under anti-money laundering regulations. Where a deletion request cannot be fully fulfilled due to a legal retention obligation, we will explain the specific reason in our response and delete the data as soon as the retention period expires.

8 Contact & Privacy Queries

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 399bad handles your personal data, please contact our support and compliance team using the details below. We treat all privacy-related enquiries with the highest priority and are committed to responding promptly, clearly, and helpfully.

• Email: [email protected]
• Subject line for privacy matters: "Privacy Policy Enquiry" or "Privacy Rights Request"
• Support hours: 24 hours a day, 7 days a week
• Response time: Under 1 hour for general support queries; up to 2 business days for formal privacy rights requests
• Time zone: Bangladesh Standard Time (BST, UTC+6)

399bad may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will update the effective date displayed at the top of this page and, where appropriate, notify registered users by email. Continued use of the 399bad platform after an updated Privacy Policy has been published constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how we protect your personal data.