Privacy Policy — 399d

1. Data We Collect

When you interact with the 399d platform — whether by browsing the site, registering an account, making a deposit, or contacting support — we collect certain categories of personal data. The data we collect depends on the nature of your interaction with us. We collect only what is necessary for the specific purpose described in this policy.

1.1 Registration Data

When you create a 399d account, we collect the following information:

• Full legal name as it appears on your government-issued identity document
• Date of birth (for mandatory age verification)
• Residential address, including district, city, and postal code
• Email address (used for account communications and verification)
• Mobile phone number (used for account security and payment verification)
• Chosen username and a securely hashed version of your password

We do not store passwords in plain text. All passwords are processed using a one-way cryptographic hashing algorithm with a unique per-user salt before being written to our database.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations and our commitment to preventing underage gambling and financial fraud, we may request the following identity verification documents from registered players:

• A scanned copy or photograph of a valid National Identity Card (NID), passport, or driving licence
• Proof of address (such as a utility bill or bank statement issued within the last three months)
• Proof of payment method ownership (such as a screenshot confirming that a bKash, Nagad, or Rocket account is registered in your name)
• A selfie photograph for biometric comparison with the identity document submitted, where required

KYC documents are processed and reviewed by our compliance team. Copies of documents are stored securely in encrypted storage and are never shared with third parties except where legally required.

1.3 Financial Data

When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, or bank transfer, we collect transaction metadata including the payment method type, the registered phone number or account number associated with the payment method, the transaction amount in BDT, and the transaction timestamp. We do not store full bank account numbers, card numbers, or mobile financial service PINs. Payment credentials are processed directly by the relevant financial service provider and are not retained by 399d beyond the information required for transaction reconciliation.

1.4 Usage and Technical Data

When you access the 399d platform, our servers automatically collect certain technical information that is necessary to operate the service and maintain security. This includes:

• IP address and approximate geographic location derived from IP
• Browser type, version, and operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Pages visited, time spent on each page, and navigation paths through the platform
• Game sessions initiated, bets placed, and game outcomes (aggregated for player history and dispute resolution)
• Login timestamps and session duration

1.5 Communications Data

If you contact the 399d support team via live chat or by email, we retain a record of the correspondence, including your contact details, the content of your messages, and any attachments you provide. This data is used to resolve your query and to maintain a history of support interactions for quality assurance and dispute resolution purposes.

2. How We Use Your Data

399d uses the personal data it collects for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The following table summarises our primary data processing activities and the lawful basis for each.

Where 399d relies on your consent as the lawful basis for processing — such as for sending promotional emails — you may withdraw that consent at any time by updating your communication preferences within your account settings or by contacting the support team at [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before consent was withdrawn.

3. Data Sharing

399d does not sell your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent necessary for the specified purpose.

3.1 Service Providers

We engage a number of carefully selected third-party service providers to help us operate the 399d platform. These providers process personal data on our behalf and are permitted to use it only for the specific purposes we have instructed. Our service providers include:

• Game software providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) — who require certain session identifiers to deliver game content and verify game outcomes.
• Payment processors (including the operators of bKash, Nagad, Rocket, and Upay integrations) — who require transaction data to facilitate deposit and withdrawal processing.
• Identity verification services — who assist with KYC document review and biometric comparison where required.
• Cloud infrastructure and hosting providers — who store and process platform data on our behalf within secured data centre environments.
• Customer support software providers — who power the live chat and email ticketing system used by our support team.

All service providers are required to enter into a data processing agreement with 399d before being granted access to any personal data. These agreements impose strict confidentiality, security, and usage restrictions.

3.2 Legal and Regulatory Disclosure

399d may disclose personal data to law enforcement agencies, regulatory bodies, or other authorised authorities without prior notice to you where we are legally compelled to do so, where disclosure is necessary to prevent or detect criminal activity (including money laundering or fraud), or where disclosure is required to protect the rights, safety, or property of 399d, its employees, or its users.

3.3 Business Transfers

In the event that 399d undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, player data may be transferred to the acquiring entity as part of that transaction. If such a transfer occurs, 399d will take reasonable steps to ensure that the receiving entity honours the privacy commitments made in this policy and will notify affected players where it is legally permitted and practicable to do so.

4. Cookies & Tracking Technologies

The 399d platform uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to provide core platform functionality, improve user experience, and support fraud prevention and security operations. By continuing to use the 399d platform, you acknowledge the use of these technologies as described in this section.

4.1 What Are Cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work efficiently and to provide usage information to the site operator. Cookies set by 399d are first-party cookies — they originate from the 399d domain and cannot be read by other websites.

4.2 Categories of Cookies We Use

4.3 Managing Cookies

Most modern browsers allow you to control cookie storage through the browser's settings menu. You can configure your browser to block certain categories of cookies, delete existing cookies, or receive a notification before a new cookie is stored. Please note that disabling strictly necessary or security cookies will impair the functionality of the 399d platform and may prevent you from logging in or completing transactions. Instructions for managing cookies are available in the help documentation of your specific browser.

5. Data Security

399d takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. No system can guarantee absolute security, but the following measures represent our current standard of care.

5.1 Technical Safeguards

• TLS/SSL encryption: All data in transit between your device and 399d servers is encrypted using Transport Layer Security (TLS 1.2 or higher).
• Encryption at rest: Sensitive data fields — including KYC document files and identity information — are encrypted at rest using AES-256 encryption.
• Password hashing: Passwords are never stored in recoverable form. They are processed using a strong one-way hash function with a unique per-record salt.
• Firewall and intrusion detection: Our server infrastructure is protected by network-level firewalls and continuous intrusion detection and prevention systems.
• Access controls: Role-based access controls ensure that only authorised team members with a verified operational need can access personal data. All access events are logged.

5.2 Organisational Safeguards

• All 399d staff with access to personal data receive regular training on data protection obligations and information security best practices.
• Access credentials to production systems are subject to multi-factor authentication requirements.
• Third-party service providers undergo a security review before being granted access to 399d systems or data.
• Security patches and software updates are applied to all platform components on a regular, scheduled basis.

5.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 399d will notify affected players as promptly as reasonably practicable. Notification will be sent to the email address registered on your account and will describe the nature of the breach, the categories of data involved, the likely consequences, and the measures taken or proposed to address it.

6. Data Retention

399d retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or to comply with applicable legal, regulatory, accounting, or reporting obligations. The specific retention periods we apply are summarised below.

Once the applicable retention period expires, 399d will either securely delete the data or anonymise it so that it can no longer be linked back to an individual player. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes without restriction.

7. Your Privacy Rights

As a player registered with 399d, you have a number of rights in relation to the personal data we hold about you. We are committed to honouring these rights and will respond to all valid requests within a reasonable timeframe.

7.1 Right of Access

You have the right to request a copy of the personal data that 399d holds about you, along with information about how it is being used. Access requests can be submitted by emailing [email protected] with the subject line "Data Access Request" and your registered account username. We will provide a response within 30 days of receiving a valid request.

7.2 Right to Rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update certain account details directly through your 399d account settings. For changes to identity verification data or other records that cannot be self-edited, please contact the support team directly.

7.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the data has been unlawfully processed. Please note that this right is not absolute — 399d is legally required to retain certain categories of data (such as transaction records and KYC documents) for defined periods even after account closure, and erasure requests cannot override those obligations.

7.4 Right to Restrict Processing

In certain circumstances — for example, where you contest the accuracy of the data we hold or where you have objected to processing pending our review — you may request that we restrict the use of your data to storage only, without further active processing.

7.5 Right to Data Portability

Where processing is based on your consent or the performance of a contract, and the processing is carried out by automated means, you have the right to receive a structured, commonly used, and machine-readable copy of the personal data you have provided to 399d. This allows you to transmit that data to another service provider if you choose.

7.6 Right to Object

You have the right to object to the processing of your personal data where 399d relies on legitimate interests as the lawful basis for processing. Upon receiving a valid objection, 399d will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

7.7 How to Exercise Your Rights

To exercise any of the rights described above, contact the 399d data protection team by email at [email protected]. Please include your full name, registered email address, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing the request to ensure that data is not disclosed or modified in response to fraudulent requests.

8. Policy Updates & Contact

8.1 Changes to This Privacy Policy

399d reserves the right to update or revise this Privacy Policy at any time. When we make material changes — that is, changes that meaningfully affect how we collect, use, or share your data — we will notify registered players by email to the address on record and will update the "Effective" date at the top of this page. We encourage you to review this policy periodically to stay informed of how 399d protects your information.

Your continued use of the 399d platform following the notification of a material change constitutes your acceptance of the revised Privacy Policy. If you do not agree with any change, you should discontinue use of the platform and may request account closure by contacting the support team.

8.2 Third-Party Websites

The 399d platform does not contain links to third-party websites or external services. This Privacy Policy applies solely to data processing activities carried out by 399d in connection with the 399d platform. It does not extend to any third-party platforms, mobile financial service applications (such as bKash or Nagad), or bank websites that you may access independently in connection with your use of 399d services.

8.3 Children's Privacy

The 399d platform is strictly for individuals aged 18 years and above. 399d does not knowingly collect personal data from individuals under the age of 18. If we become aware that an account has been registered by someone under 18, we will immediately suspend the account, delete the associated personal data, and return any deposited funds. If you believe a minor has registered on the 399d platform, please notify us immediately at [email protected].

8.4 Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or about how 399d handles your personal data, please contact us using the details below. We take all privacy concerns seriously and will investigate and respond to every query promptly.

Data Protection Contact:
Email (plain text, not a link): [email protected]
Support Hours: 24/7 — Bangladesh Standard Time (BST, UTC+6)