Privacy Policy — How 399bad Collects, Uses, and Protects Your Personal Data

1.1 Registration Data

When you create a 399bad account, we collect the following information:

• Full legal name — as it appears on your official government-issued identification document.
• Date of birth — to verify that you meet the minimum age requirement of 21 years.
• Residential address — including division, district, and postal code within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).
• Contact details — a valid mobile phone number and email address linked to your account.
• Username and encrypted password — stored using industry-standard one-way hashing; 399bad staff cannot view your plain-text password.

1.2 Identity Verification (KYC) Documents

To comply with Know Your Customer (KYC) obligations and to process your first withdrawal, 399bad may request one or more of the following documents:

• National Identity Card (NID) issued by the Bangladesh Election Commission.
• Valid passport (biographical data page).
• Driver's licence issued by the Bangladesh Road Transport Authority.
• Proof of payment method ownership — for example, a screenshot of your registered bKash, Nagad, or Rocket account showing your name and registered mobile number.

Submitted documents are used solely for identity verification purposes and are stored in an encrypted document management system with access restricted to authorised compliance staff.

1.3 Financial and Transaction Data

399bad records all deposit and withdrawal transactions processed through your account. This includes the transaction amount in Bangladeshi Taka, the payment method used (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard), the transaction timestamp in Bangladesh Standard Time (BST, UTC+6), and the transaction reference number issued by the payment provider. We do not store full card numbers or mobile wallet PINs on our servers.

1.4 Gameplay and Behavioural Data

399bad automatically logs session activity associated with your account, including game titles accessed, bet amounts placed, game outcomes, session start and end times, and responsible gaming tool usage (such as deposit limit changes or self-exclusion requests). This data is used for account security monitoring, responsible gaming compliance, dispute resolution, and platform improvement. It is not used to profile you for advertising purposes.

1.5 Technical and Device Data

When you access 399bad, our servers automatically collect certain technical information, including your IP address, device type, operating system version, browser type and version, screen resolution, and the referring URL (if any). This information is used to detect unauthorised account access, prevent fraud, and optimise platform performance across the range of devices used by players in Bangladesh.

1.6 Communications Data

If you contact 399bad via email or through the support system, we retain a record of your correspondence, including the content of messages sent and received, timestamps, and the support agent who handled your enquiry. This information is used to resolve your query, improve our support service quality, and maintain an audit trail for compliance purposes.

3.1 Contractual Necessity

The majority of personal data that 399bad processes is necessary to perform the contract between us — specifically, to operate your account, process your BDT transactions, and deliver the gaming services you have signed up for. Without this data, we cannot provide the 399bad service.

3.2 Consent

Where we process personal data for purposes beyond contractual necessity — such as sending you promotional communications about bonuses, seasonal events (for example, Eid promotions, Pohela Boishakh offers, or BPL cricket special offers), or new game releases — we rely on your explicit consent. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting [email protected].

3.3 Legal Obligation

Certain processing activities — including identity verification, transaction record-keeping, and cooperation with competent regulatory or law enforcement authorities — are required by applicable law. 399bad cannot lawfully omit this processing regardless of any consent withdrawal by the player.

3.4 Legitimate Interests

399bad processes certain technical and behavioural data on the basis of our legitimate interest in maintaining a secure, fair, and fraud-free platform. This includes IP-based fraud detection, device fingerprinting for unauthorised-access prevention, and game-session logging for dispute resolution. We conduct this processing in a manner that does not override your fundamental privacy interests.

4.1 Payment Service Providers

To process your BDT deposits and withdrawals, 399bad shares the minimum necessary transaction data with the relevant payment service provider (bKash, Nagad, Rocket, Upay, Visa, or Mastercard). This data is used solely to execute the requested transaction and is subject to each provider's own privacy policy.

4.2 Identity Verification Partners

399bad may engage third-party identity verification service providers to assist with KYC document checks. These partners process your submitted identification documents under a strict data processing agreement with 399bad and are prohibited from using your data for any purpose other than fulfilling the verification request.

4.3 Game Providers

When you play a game supplied by a third-party Game Provider (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), limited session data — including a tokenised player identifier, bet amounts, and game outcomes — is transmitted to that provider's servers to deliver the game. Game Providers do not receive your full name, contact details, or payment information.

4.4 Legal and Regulatory Authorities

399bad may disclose personal data to competent regulatory, law enforcement, or judicial authorities where required to do so by applicable law, court order, or other legally binding process. In such cases, 399bad will disclose only the minimum data required to fulfil the legal obligation and will, where legally permitted, notify the affected player of the disclosure.

4.5 Business Transfers

In the event that 399bad undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via your registered contact details prior to any such transfer, and the acquiring entity will be bound by the terms of this Policy or a policy offering equivalent protections.

5.1 What Cookies We Use

399bad uses the following categories of cookies on the platform:

• Strictly necessary cookies — required for the platform to function, including session authentication tokens and security cookies. These cannot be disabled.
• Functional cookies — remember your preferences such as language, last-visited game category, and responsible gaming settings between sessions.
• Analytics cookies — collect anonymised, aggregated data about how players navigate the platform, which pages receive the most visits, and where technical errors occur. This data helps us improve the 399bad experience.

5.2 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging into your 399bad account or completing financial transactions. Disabling functional cookies will mean that certain preferences will not be saved between sessions. Disabling analytics cookies will not affect your ability to use the platform in any way.

6.1 Active Accounts

While your 399bad account remains active, we retain all personal data associated with it for as long as necessary to provide the service, comply with our legal obligations, and resolve any disputes that may arise. You may request a summary of the data we hold about you at any time.

6.2 Closed Accounts

Following the closure of your 399bad account — whether voluntarily or as a result of administrative action — we retain your account records, KYC documents, and transaction history for a minimum period of five (5) years. This retention period is required to meet financial record-keeping and anti-money-laundering compliance obligations. After the retention period has expired, your personal data will be securely deleted or anonymised.

6.3 Support Correspondence

Records of customer support communications are retained for a period of three (3) years from the date of the final message in each support thread. This retention enables us to provide consistent support in the event of recurring issues and to meet our dispute-resolution obligations.