Data Protection & Privacy
bad999 Privacy Policy — Your Data, Your Rights
At bad999, protecting the personal information of every player on our platform is a responsibility we take seriously. This Privacy Policy explains precisely what data we collect, why we collect it, how it is stored and processed, who it may be shared with, and the rights you hold over your own information. We are committed to full transparency so you can use bad999 with complete confidence.
Privacy at a Glance
How bad999 Protects Your Data
The following cards provide a plain-English overview of our core privacy commitments. These summaries do not replace the full legal text below, which remains the authoritative version of our Privacy Policy.
1. Data Controller & Contact Information
bad999 (the "Company", "we", "us", or "our") acts as the data controller in respect of all personal data collected from users of the bad999 online casino and sports betting platform, accessible at bad999.app and any associated subdomains or applications (collectively, the "Platform"). As data controller, bad999 determines the purposes and means by which your personal data is processed.
If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, you may contact us at any time through the following channel:
- Email: [email protected]
- Support Availability: 24 hours a day, 7 days a week
- Response Time: Within 2 business days for general enquiries; within 30 calendar days for formal data subject requests
- Time Zone: All response times are measured in Bangladesh Standard Time (BST, UTC+6)
This Privacy Policy applies to all individuals who register an account on the bad999 Platform, visitors who browse the Platform without registering, and any person who contacts bad999 support for assistance. By accessing or using the Platform in any capacity, you acknowledge that you have read this Privacy Policy and that you consent to the data practices described herein.
2. Information We Collect
bad999 collects personal data in several ways: directly from you during the registration and verification process, automatically through your use of the Platform, and from third-party service providers where applicable. The categories of data we collect are set out in the following table.
| Category | Examples of Data Collected | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, government-issued ID number | Provided by you at registration and KYC |
| Contact Data | Email address, mobile phone number, residential address (city, district) | Provided by you at registration |
| Financial Data | Payment method type (bKash, Nagad, Rocket, Upay, bank, card), transaction reference numbers, deposit and withdrawal amounts in BDT | Provided by you and by payment processors |
| KYC Document Data | Scanned copies or photographs of National ID (NID), passport, driver's licence, utility bill, bank statement | Provided by you during identity verification |
| Technical Data | IP address, device type and model, operating system, browser type and version, screen resolution, time zone setting | Collected automatically via Platform access |
| Usage Data | Login timestamps, pages visited, games played, bets placed, session duration, click-stream data, bonus redemptions | Collected automatically during Platform use |
| Communications Data | Support chat transcripts, email correspondence, feedback submissions | Generated during support interactions |
| Marketing Preferences | Email marketing opt-in/opt-out status, preferred communication language, promotion history | Provided by you and inferred from usage |
Data We Do Not Collect
bad999 does not collect your full card number, CVV, or online banking PIN. Payment card transactions are processed by PCI-DSS-compliant payment processors who handle sensitive card data directly; bad999 receives only a tokenised reference. bad999 also does not collect biometric data, health data, religious or political beliefs, or any other special-category personal data as defined under international data protection frameworks.
3. Legal Basis for Processing
bad999 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases we rely upon are as follows:
- Contractual Necessity: Processing is necessary to perform the contract between you and bad999 — specifically to operate your account, process deposits and withdrawals, settle wagers, and provide customer support. Without this processing, we cannot provide the Platform services to you.
- Legal Obligation: Processing is required to comply with applicable legal obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) obligations, and fraud prevention duties. Retention of certain records for defined periods is also legally mandated.
- Legitimate Interests: Processing is necessary for the legitimate interests of bad999, including fraud detection and prevention, platform security monitoring, responsible gaming programme management, service analytics, and improving the user experience. We apply a balancing test to ensure that our legitimate interests do not override your fundamental rights and freedoms.
- Consent: Where we rely on consent as the legal basis — for example, for sending you marketing communications about promotions, bonuses, or seasonal offers — we will obtain your explicit consent before processing. You may withdraw consent at any time by contacting support or adjusting your account preferences.
4. How We Use Your Data
bad999 uses the personal data it collects for the following specific purposes:
- Account Management: To create, maintain, verify, and administer your bad999 player account, including processing deposits, withdrawals, and wager settlements;
- Identity Verification & KYC: To verify your identity, age (18+ confirmation), and the ownership of payment methods, in compliance with our obligations under applicable AML and fraud prevention frameworks;
- Platform Security: To detect, investigate, and prevent unauthorised access, multi-accounting, bonus abuse, collusion, money laundering, and other forms of fraudulent or abusive behaviour;
- Responsible Gaming: To monitor gambling patterns, identify indicators of problem gambling, apply self-exclusion restrictions, enforce deposit limits, and provide intervention support where appropriate under our Responsible Gaming Policy;
- Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance;
- Service Improvement: To analyse platform usage patterns, conduct A/B testing, improve game offerings, and enhance the overall user experience for players in Bangladesh;
- Regulatory Compliance: To meet our record-keeping, reporting, and audit obligations under applicable laws and regulations;
- Marketing Communications (with consent): To send you information about promotions, bonuses, new game releases, and seasonal offers (such as Eid promotions, BPL cricket betting specials, and Pohela Boishakh incentives) where you have opted in to receive such communications. You may unsubscribe at any time.
bad999 will not use your personal data for any purpose that is incompatible with the purposes described above without first obtaining your consent or establishing a fresh legal basis for processing.
5. Data Sharing & Third Parties
bad999 does not sell, rent, or otherwise commercialise your personal data. We share personal data with third parties only in the following circumstances and only to the minimum extent necessary for each purpose:
Payment Processors
To facilitate deposits and withdrawals, bad999 shares necessary transactional data with payment service providers, including mobile financial service operators (bKash, Nagad, Rocket, Upay), banks (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and international card networks (Visa, Mastercard). Each payment processor operates under its own privacy policy and is responsible for the security of payment data it directly handles.
Game Studio Providers
Games on the bad999 Platform are delivered by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive your player session ID and anonymised gameplay data necessary to render and settle game rounds. Game studios do not receive your name, financial details, or contact information.
Identity Verification Services
bad999 uses third-party KYC and identity verification services to assist with the verification of identity documents. These providers process identity document images and biographic data solely for the purpose of verification and are contractually bound to strict data handling and deletion obligations.
Analytics & Platform Technology Providers
bad999 uses vetted technology partners to support platform analytics, fraud detection, infrastructure hosting, and customer support tooling. These partners act as data processors on our behalf under written data processing agreements and are not permitted to use your data for their own independent purposes.
Legal & Regulatory Disclosures
bad999 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or to protect the rights, property, or safety of the Company, its players, or the public. We will notify you of such a disclosure where legally permitted to do so.
6. Cookies & Tracking Technologies
bad999 uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage) on the Platform. Cookies are small text files placed on your device that allow the Platform to remember your preferences, maintain your session, and gather analytical data.
Categories of Cookies We Use
- Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable core features such as account login session management, security token validation, and page navigation. These cookies cannot be disabled without significantly impairing Platform functionality.
- Functional Cookies: These cookies remember your preferences such as language settings, interface customisations, and last-visited game categories, allowing us to deliver a more personalised experience on return visits.
- Analytical / Performance Cookies: These cookies collect anonymised data about how players use the Platform — which pages are visited most frequently, how long sessions last, and where users navigate from. This data helps us improve Platform design and content. We use first-party analytics tools for this purpose.
- Fraud Prevention Cookies: These cookies form part of our security infrastructure, helping us detect suspicious login patterns, automated bot activity, and multi-accounting behaviour.
Managing Your Cookie Preferences
Most web browsers allow you to control cookies through their settings. You can configure your browser to refuse all cookies, delete existing cookies, or alert you when a cookie is being set. Please note that disabling strictly necessary or fraud prevention cookies may prevent you from using certain features of the bad999 Platform, including the ability to log in to your account. For instructions on managing cookies in your browser, please consult your browser's help documentation.
7. Data Retention Periods
bad999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal obligation / AML compliance |
| KYC identity documents | Duration of account + 5 years post-closure | Legal obligation / fraud prevention |
| Financial transaction records | 7 years from transaction date | Legal obligation / audit requirements |
| Betting and gaming history | Duration of account + 3 years post-closure | Legitimate interests / dispute resolution |
| Customer support communications | 3 years from date of last interaction | Legitimate interests / dispute resolution |
| Marketing consent records | Until consent is withdrawn + 2 years | Legal obligation / proof of consent |
| Technical / access logs | 13 months from date of creation | Legitimate interests / security monitoring |
| Self-exclusion records | Duration of exclusion + 7 years post-expiry | Legal obligation / responsible gaming duty of care |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual. Anonymised aggregate data (e.g., aggregate platform usage statistics) may be retained indefinitely for legitimate business analytics purposes.
8. Security Measures
bad999 employs a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational security measures include:
- 256-bit TLS/SSL Encryption: All data transmitted between your device and the bad999 Platform is encrypted in transit using Transport Layer Security (TLS) 1.2 or higher;
- Data Encryption at Rest: Sensitive personal data fields stored in our databases are encrypted at rest using AES-256 encryption;
- Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal systems operate on role-based access control (RBAC), and all access to production data is logged and audited;
- Two-Factor Authentication: Administrative access to systems that store personal data requires multi-factor authentication (MFA);
- Penetration Testing: bad999 conducts periodic third-party security assessments and penetration tests of its infrastructure;
- Incident Response Plan: bad999 maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected individuals as promptly as practicable;
- Staff Training: All personnel with access to personal data receive regular data protection and security awareness training.
While bad999 takes all reasonable steps to protect your data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the security of your own account credentials and for reporting any suspected unauthorised access to your account promptly.
9. Your Privacy Rights
As a user of the bad999 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all verified requests within 30 calendar days.
- Right of Access: You have the right to request a copy of the personal data bad999 holds about you. We will provide this in a structured, commonly used format.
- Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update basic contact details directly within your account settings.
- Right to Erasure: You may request that bad999 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing has been unlawful. This right is subject to our legal retention obligations — for example, we are required to retain KYC and financial transaction data for defined periods regardless of an erasure request.
- Right to Restrict Processing: You may request that bad999 restrict the processing of your data in certain circumstances — for example, while a dispute about accuracy is being resolved.
- Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format and to transmit that data to another controller, where technically feasible.
- Right to Object: You have the right to object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
bad999 will not charge a fee for exercising any of the above rights in standard circumstances. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or to decline the request, providing written reasons for the decision.
10. Children & Minors
The bad999 Platform is strictly intended for adults aged 18 and above. bad999 does not knowingly collect personal data from any person under the age of 18. If you are under 18 years of age, you must not register an account, deposit funds, or use any feature of the Platform.
If bad999 becomes aware that it has inadvertently collected personal data from a person under the age of 18, it will take immediate steps to delete that data from its systems and permanently close any associated account. Any funds deposited into an underage account will be returned via the original payment method, with the exception of any winnings generated, which will be void.
If you are a parent or guardian and you believe that your child may have registered an account on the bad999 Platform, please contact us immediately at [email protected] so we can investigate and take appropriate action. We take our safeguarding obligations regarding minors extremely seriously.
11. Updates to This Privacy Policy
bad999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, Platform functionality, applicable law, or regulatory guidance. The most current version of this document will always be available at the /privacy-policy URL on the bad999 Platform, and the "Last Updated" date at the top of this page will reflect the date of the most recent revision.
Where a proposed change to this Privacy Policy is material — meaning it significantly alters how we collect, use, or share your personal data — bad999 will provide advance notice to registered players via email notification, in-platform notification, or both, prior to the change taking effect. Non-material changes (such as typographical corrections or clarifications that do not alter the substance of our data practices) may take effect immediately.
Your continued use of the bad999 Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must cease using the Platform and may request voluntary account closure by contacting our support team.