Privacy Policy — How by999 Protects Your Data

by999 collects personal data from you in several ways: directly when you register an account or interact with our platform, automatically as you use our services, and from third parties such as payment processors and identity verification providers. The categories of personal data we collect are described below.

Registration and Account Data

When you create a by999 account, we collect the following information:

• Identity data: Full legal name, date of birth, gender, and nationality as provided during registration or KYC verification.
• Contact data: Email address, mobile phone number, and residential address including city (Dhaka, Chittagong, Sylhet, Khulna, or elsewhere in Bangladesh).
• Account credentials: Username and hashed password. We never store your plain-text password.
• Verification documents: Scanned copies or photographs of government-issued ID (National ID card, passport, or driving licence) and proof of address, collected as part of our KYC process prior to withdrawal processing.

Transaction and Financial Data

All financial activity on your by999 account generates records that we retain for compliance and dispute resolution purposes:

• Deposit and withdrawal amounts, dates, times, and originating payment method (bKash number, Nagad number, Rocket account, or card details — card numbers are stored in truncated form only).
• Betting and gaming history: market selections, stake amounts, odds accepted, and settlement outcomes.
• Bonus and promotion credits and associated wagering activity.
• Account balance history and any adjustments applied by the by999 compliance team.

Technical and Usage Data

When you access by999 via browser or mobile, our servers automatically record certain technical information:

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser type and version.
• Pages visited, time spent on each page, click patterns, and session duration.
• Referring URL (the page you visited immediately before arriving at by999).
• Error logs and crash reports generated during your session.

Communications Data

Any communications you send to by999 — including live chat transcripts, email correspondence with [email protected], and feedback submissions — are retained as part of your account record. This data is used to resolve disputes, improve service quality, and for staff training purposes.

by999 uses personal data only for the purposes for which it was collected or for compatible purposes that a reasonable person would expect given the context of collection. The primary purposes for which we use your data are as follows:

Marketing and Promotional Communications

by999 may send you promotional emails or SMS messages about new games, seasonal offers (such as Eid promotions or BPL match bonuses), and deposit match offers, but only if you have actively opted in to receive such communications at the time of registration or subsequently via your account settings. You may withdraw your marketing consent at any time by updating your communication preferences in your account profile or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

Every processing activity carried out by by999 rests on one of the following recognised legal bases:

• Contractual necessity: Processing required to perform the contract between you and by999 — including account management, payment processing, bet settlement, and customer support. Without this processing, by999 cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable law, including AML (Anti-Money Laundering) record-keeping, KYC identity verification, and reporting obligations to relevant authorities.
• Legitimate interests: Processing carried out for by999's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, responsible gaming monitoring, and internal analytics. by999 conducts a balancing test before relying on this basis.
• Consent: Processing carried out only where you have given a clear, freely-given, specific, and informed consent — primarily for marketing communications. Consent can be withdrawn at any time without detriment to your account status.

by999 does not process personal data for purposes that are incompatible with the original collection purpose without first obtaining fresh consent or establishing a separate lawful basis.

by999 uses cookies and similar technologies (local storage, session tokens) on its platform. The cookies we use fall into the following categories:

Strictly Necessary Cookies

These cookies are essential for the by999 platform to function and cannot be disabled. They include session authentication tokens that keep you logged in across page loads, CSRF protection tokens that prevent cross-site request forgery attacks, and load-balancing identifiers that ensure your requests reach the correct server. No personally identifiable information is stored in strictly necessary cookies beyond what is needed for session continuity.

Analytics Cookies

by999 uses first-party analytics to understand how players navigate the platform — which game categories attract the most visits, where users encounter errors, and how deposit flows can be streamlined. Analytics data is aggregated and, wherever possible, anonymised before analysis. by999 does not use Google Analytics or any third-party analytics platform that sends your usage data to external servers.

Fraud Prevention Cookies

Certain cookies and device fingerprinting technologies are used by by999 and its payment partners to detect and prevent fraud, multi-accounting, and bonus abuse. These technologies collect technical data such as browser configuration, screen resolution, installed fonts, and time-zone settings to generate a probabilistic device identifier. This processing is carried out on the basis of legitimate interests in fraud prevention.

Managing Your Cookie Preferences

You can control cookie behaviour through your browser settings. Most modern browsers allow you to block or delete cookies, but please be aware that disabling strictly necessary cookies will prevent you from logging into your by999 account. by999 does not currently use a cookie consent banner because we do not use any non-essential third-party cookies that require prior consent under applicable privacy frameworks.

by999 does not sell your personal data. We share data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose.

Payment Service Providers

To process deposits and withdrawals, by999 shares relevant transaction data with payment service providers including bKash, Nagad, Rocket, Upay, and international card processors (Visa, Mastercard). The data shared is limited to what is technically required to initiate and confirm the transaction. Each payment provider operates under its own privacy policy and is independently responsible for data it receives in that capacity.

Identity Verification Providers

For KYC purposes, by999 may use third-party identity verification services to authenticate documents submitted by players. These providers receive only the identity data and document images necessary to complete the verification check. Verified results are returned to by999 and the underlying document data is deleted from the provider's systems following verification.

Game Content Providers

Live casino tables operated by Evolution Gaming and Ezugi, and slot titles from Pragmatic Play, NetEnt, Microgaming, Spribe, and other studios, are delivered via embedded game interfaces. These providers may collect technical session data (such as round IDs and stake amounts) for game integrity and certification purposes. They do not receive your name, contact details, or payment information from by999.

Legal and Regulatory Disclosure

by999 will disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or where we believe in good faith that such disclosure is necessary to prevent fraud, money laundering, or other serious unlawful activity. Where legally permissible, by999 will notify the relevant account holder of such a disclosure request.

Business Transfers

In the event that by999 undergoes a merger, acquisition, or sale of all or substantially all of its assets, personal data held by by999 may be transferred to the successor entity as part of that transaction. Affected players will be notified via the email address on file prior to any such transfer, and the successor entity will be required to honour the commitments made in this Privacy Policy.

by999 retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable law. The retention periods we apply to the main categories of data are set out below:

When a retention period expires, data is either securely deleted (overwritten and unrecoverable) or irreversibly anonymised for statistical purposes. Data scheduled for deletion is processed in monthly batch cycles. You may request early deletion of specific data categories subject to the limitations described in the "Your Privacy Rights" section below.

As a by999 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request" and your registered account username. We will respond within 30 calendar days. Identity verification may be required before we can fulfil a request.

Right of Access

You have the right to request a copy of the personal data by999 holds about you, along with information about how it is being used, who it has been shared with, and the legal basis for processing. We will provide this information in a structured, commonly used electronic format.

Right to Rectification

If any personal data by999 holds about you is inaccurate or incomplete, you have the right to request that we correct it. Minor corrections (such as a phone number update) can be made directly via your account settings. Corrections to identity data require submission of supporting documentation.

Right to Erasure

You may request that by999 delete your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (and no other lawful basis applies), or where you object to processing and by999 has no overriding legitimate grounds. This right is subject to exceptions — in particular, by999 cannot delete data it is required to retain under AML legislation or for pending legal claims.

Right to Restrict Processing

In certain circumstances — for example, while a rectification request is being assessed — you may request that by999 pause processing of your data without deleting it. During a restriction period, by999 will continue to store your data but will not actively use it except with your consent or for legal claims.

Right to Object

You have the right to object to processing carried out on the basis of by999's legitimate interests. by999 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests. You may object to direct marketing at any time and without providing a reason, and by999 will cease marketing communications promptly upon receiving your objection.

Right to Data Portability

Where processing is carried out on the basis of your consent or contractual necessity and is performed by automated means, you have the right to receive your personal data in a machine-readable format (JSON or CSV) for the purpose of transferring it to another service provider.

by999 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in transit: All data transmitted between your device and by999 servers is protected using TLS 1.3. Connections over older, insecure protocols are rejected.
• Encryption at rest: Personal data stored in by999 databases is encrypted using AES-256. Encryption keys are managed by a dedicated key management system with quarterly rotation.
• Password hashing: User passwords are hashed using bcrypt with a per-account salt before storage. Plain-text passwords are never written to disk or logged.
• Access controls: Access to systems holding personal data is restricted to authorised by999 personnel on a strictly need-to-know basis. All access events are logged and reviewed.
• Two-factor authentication: Two-factor SMS authentication is available to all registered players and is mandatory for by999 staff accounts with data access privileges.
• Penetration testing: by999 conducts regular vulnerability assessments and periodic third-party penetration tests to identify and remediate security weaknesses before they can be exploited.
• Incident response: by999 maintains a documented data breach response plan. In the event of a breach that is likely to result in risk to affected individuals, by999 will notify affected players without undue delay and in accordance with applicable legal obligations.

Your Role in Account Security

While by999 takes extensive measures to protect your data on its side, the security of your account also depends on the precautions you take. You should use a strong, unique password for your by999 account, enable two-factor authentication, never share your login credentials with anyone, and always log out after each session — especially on shared or public devices. by999 will never ask for your password via email, live chat, or phone.

Updates to This Privacy Policy

by999 reviews this Privacy Policy at least annually and updates it whenever material changes occur to our data practices or applicable legal requirements. When we make significant changes, we will notify registered players via email to the address on file and display a prominent notice on the platform for at least 14 days following the update. The "Last Updated" date at the top of this page always reflects the most recent revision. Continued use of the by999 platform following notification of changes constitutes acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests relating to this Privacy Policy, please contact our privacy team directly at [email protected]. We are committed to handling all privacy enquiries professionally, confidentially, and in a timely manner.