Your Privacy Matters — The bx999 Privacy Policy

bx999 is an online casino and sports betting platform operating at bx999.io, serving players primarily across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and beyond. The Platform offers a comprehensive suite of casino games, live dealer tables, slots, and sports betting markets to eligible adult players aged 21 and above.

For the purposes of this Privacy Policy, bx999 acts as the data controller in respect of personal data collected directly through the Platform. When we engage third-party game providers — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Ezugi — those providers may independently process certain technical game data under their own privacy policies.

If you have any questions about how bx999 handles your data, or wish to exercise any of your privacy rights, please contact our Data Protection contact via email at [email protected].

bx999 collects personal data only to the extent necessary to provide its services, meet legal obligations, and maintain platform security. The categories of personal data we may collect include:

bx999 collects personal data through several channels depending on the nature of your interaction with the Platform:

• Direct Registration: When you create a bx999 account, you provide identity and contact data directly through the registration form.
• Payment Transactions: When you make a deposit or request a withdrawal, financial data including your mobile wallet number and transaction reference is collected and logged.
• Identity Verification: When completing KYC verification, you upload identity documents and, in some cases, a selfie for biometric matching.
• Platform Usage: As you navigate and interact with the Platform — browsing game lobbies, placing bets, using live chat — usage and technical data is automatically logged by our systems.
• Cookies & Similar Technologies: bx999 uses cookies and similar tracking technologies to collect technical and usage data. See Section 7 for full details.
• Customer Support Interactions: When you contact support via live chat, email, or WhatsApp, the content of those communications is recorded and stored.
• Third-Party Data Sources: bx999 may receive limited data about you from fraud prevention agencies, identity verification services, and payment processors to cross-check information you have provided.

bx999 uses the personal data it collects for the following specific and legitimate purposes:

• Account Management: To create, maintain, and administer your bx999 player account, including processing login authentication and managing account security settings.
• Age & Identity Verification: To confirm that you meet the minimum age requirement of 21 years and that your identity is genuine, in compliance with our KYC obligations.
• Payment Processing: To process deposits and withdrawals securely through bKash, Nagad, Rocket, Upay, and other supported payment channels, and to maintain accurate transaction records.
• Regulatory Compliance: To meet our anti-money laundering (AML) obligations, including monitoring transactions for unusual patterns and reporting to relevant authorities where required by law.
• Platform Security & Fraud Prevention: To detect and prevent unauthorised account access, bonus abuse, collusion, bot activity, and other forms of fraudulent behaviour.
• Customer Support: To respond to your queries, resolve disputes, and improve the quality of our support services.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour and, where necessary, to apply responsible gaming tools proactively.
• Marketing & Personalisation: To send you personalised promotional offers, bonuses, and platform updates where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time through your account settings or by contacting support.
• Analytics & Platform Improvement: To analyse aggregated usage data in order to improve the bx999 Platform, optimise game offerings, and enhance the overall player experience.
• Legal Claims: To establish, exercise, or defend legal claims arising in connection with your use of the Platform.

bx999 processes your personal data on one or more of the following legal bases, depending on the specific purpose of the processing:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to on registration — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including AML regulations, KYC requirements, and obligations to report suspicious activity to authorities.
• Legitimate Interests: Processing carried out to pursue bx999's legitimate business interests — including fraud prevention, platform security, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — in particular, the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Vital Interests: In exceptional circumstances, processing may be necessary to protect the vital interests of you or another person — for example, where a player discloses a crisis requiring urgent responsible gaming intervention.

bx999 may share your personal data with the following categories of recipients:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive only the transactional data necessary to process your deposit or withdrawal. These providers are bound by their own privacy policies and financial regulatory obligations.
• Identity Verification Providers: Third-party KYC and AML service providers may receive identity documents and data for the purpose of verifying your identity and screening against sanctions lists or fraud databases.
• Game Providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and necessary technical data to deliver their games. These providers operate under their own data processing agreements with bx999.
• IT & Hosting Infrastructure: Cloud hosting, server management, and cybersecurity service providers may have access to platform data as part of their operational support, subject to strict data processing agreements.
• Legal & Regulatory Authorities: bx999 may be required to disclose player data to law enforcement agencies, financial intelligence units, or regulatory bodies where required by applicable law or court order. Such disclosures are made only to the extent legally required.
• Professional Advisers: Lawyers, accountants, auditors, and insurers acting in connection with the operations of bx999 may receive access to data on a need-to-know basis, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of the Platform, player data may be transferred to the successor entity, subject to equivalent privacy protections. Players will be notified of any such transfer in advance.

bx999 uses cookies and similar tracking technologies to improve platform functionality, maintain session security, and analyse usage patterns. A cookie is a small text file stored on your device when you access the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They manage your login session, maintain your cart/wallet state, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled.
• Performance & Analytics Cookies: These cookies collect aggregated, anonymised information about how players use the Platform — for example, which pages are visited most frequently and where errors occur. This data is used to improve Platform performance and user experience.
• Functionality Cookies: These cookies remember your preferences such as preferred language, display settings, and last-visited game categories, allowing for a more personalised experience on return visits.
• Marketing & Targeting Cookies: Where you have provided consent, these cookies track your Platform interactions to enable more relevant promotional communications and to limit the number of times you see the same offer.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may impair the functionality of the Platform. Disabling other cookie categories will not prevent you from accessing or using bx999 but may reduce the personalisation of your experience.

bx999 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active bx999 account relationship and for a minimum of five (5) years following account closure, to meet our AML record-keeping obligations.
• Transaction Records: Financial transaction data is retained for a minimum of seven (7) years following the date of each transaction, in line with standard financial record-keeping requirements.
• Identity Verification Documents: KYC documents (NID copies, selfies, utility bills) are retained for a minimum of five (5) years following account closure, or longer where required by law.
• Support Communications: Live chat transcripts, email correspondence, and support ticket records are retained for three (3) years following the closure of each case.
• Marketing Data: Where consent-based marketing data is the only basis for retaining contact details, that data will be deleted within twelve (12) months of consent withdrawal if there is no other lawful basis for retention.
• Technical & Log Data: Server logs, IP address records, and session data are retained for a maximum of twelve (12) months unless required for an ongoing security investigation.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Our security infrastructure includes the following measures:

• Encryption in Transit: All data exchanged between your device and bx999 servers is encrypted using 256-bit SSL/TLS protocols. This includes login sessions, payment transactions, and document uploads.
• Encryption at Rest: Sensitive personal data and financial records stored on bx999 servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to player data within bx999's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Two-Factor Authentication: Players are strongly encouraged to enable two-factor authentication (2FA) on their accounts. 2FA adds a second layer of protection by requiring a verification code in addition to your password on each login.
• Regular Security Audits: bx999 conducts regular penetration testing and security audits to identify and remediate vulnerabilities in the Platform's infrastructure and application code.
• Incident Response: bx999 maintains a documented security incident response plan. In the event of a data breach that poses a risk to player rights and freedoms, bx999 will notify affected players and relevant authorities within the timeframes required by applicable law.

While bx999 takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for notifying bx999 immediately if you suspect any unauthorised access to your account.

As a registered player on bx999, you hold a number of rights with respect to your personal data. bx999 is committed to facilitating the exercise of these rights promptly and without undue obstacle. Your rights include:

• Right of Access: You have the right to request a copy of all personal data bx999 holds about you, along with information about how it is being used. Requests will be fulfilled within 30 days of receipt.
• Right to Rectification: If any personal data bx999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update most account details directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing. This right is subject to legal retention obligations — bx999 is required to retain certain financial and identity records for regulatory purposes even after account closure.
• Right to Restrict Processing: You may request that bx999 temporarily halt the active processing of your personal data while a complaint or accuracy dispute is being resolved.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request that bx999 provide your personal data in a structured, commonly used, machine-readable format, or that it be transferred directly to a third party where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on legitimate interests, in which case bx999 will assess whether its interests are overridden by your rights.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact bx999 by email at [email protected] with the subject line "Data Rights Request", along with your registered account email address for identification purposes. bx999 will respond within 30 days. Where a request is complex or involves a large volume of data, bx999 may extend this period by a further 60 days, with prior notice provided.

bx999 is an adult gaming platform. Access to all Platform services, including account registration, deposits, and gameplay, is strictly restricted to individuals who are at least 21 years of age. bx999 employs age verification controls at the point of registration and during the KYC process to prevent underage access.

If bx999 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, the account will be immediately suspended, any associated balances will be held pending investigation, and the personal data of the minor will be securely deleted in accordance with applicable data protection standards.

If you are a parent or guardian and believe that your child or a minor in your care has registered on bx999 or provided personal data to the Platform, please contact us immediately at [email protected] so that we may take swift corrective action.

The bx999 Platform may contain references to third-party game providers, payment processors, and other services. Where those references appear as links, clicking them may take you to a third-party website or application that operates independently of bx999 and is governed by its own privacy policy.

bx999 is not responsible for the privacy practices, content, or data handling of any third-party website or service. We recommend that you review the privacy policy of any third-party service before providing personal data to it. The inclusion of any reference to a third-party service on bx999 does not constitute an endorsement of that service's privacy practices.

Third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may collect limited technical data as part of game delivery. Such processing is governed by the respective provider's data processing terms, which bx999 reviews and assesses prior to integrating any provider onto the Platform.

bx999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Platform functionality, or data processing practices. All changes will be published on this page with an updated "Last Updated" date shown at the top of the policy.

Where changes are material — meaning they significantly affect the way your personal data is collected, used, or shared — bx999 will provide advance notice to registered players via the email address associated with their account, or through a prominent in-platform notification, no less than 14 days before the changes take effect.

Your continued use of the bx999 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material changes, you should close your account and cease using the Platform before the changes take effect. Account closure requests can be submitted to [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bx999 handles your personal data, please contact our support team using any of the following channels:

• Email: [email protected] — for data rights requests, privacy complaints, or general privacy enquiries. Please use the subject line "Privacy Enquiry" or "Data Rights Request" to ensure prompt routing.
• Live Chat: 24/7 live chat support is available within your bx999 account dashboard. Our agents can assist with general privacy questions and escalate formal data rights requests to the appropriate team.
• WhatsApp: Available after login within your account settings, for registered players who prefer messaging-based support.

bx999 aims to respond to all privacy-related enquiries within 5 business days, and to fulfil formal data rights requests within the 30-day period prescribed by applicable data protection standards. For complex requests, the response period may be extended up to 90 days in total, with advance notice provided.

All responses will be issued in English. Correspondence should be initiated from the email address registered to your bx999 account to facilitate identity verification prior to processing any data rights request.