Privacy Policy — bad999

This Privacy Policy ("Policy") is published by bad999 ("bad999", "we", "us", "our") and applies to all personal data collected from individuals ("you", "Player", "User") who access or use the bad999 online casino and sports betting platform available at bad999.vip, including any associated mobile web interfaces or branded sub-pages.

bad999 takes data privacy seriously. This Policy describes in clear, formal terms what personal data we collect, the lawful bases on which we process it, how long we retain it, with whom we share it, and what rights you hold with respect to your own data. By creating a bad999 account or continuing to use the platform after this Policy has been updated, you acknowledge that you have read and understood its contents.

This Policy should be read alongside our Terms & Conditions, which govern the overall relationship between bad999 and its players. In the event of any conflict between this Policy and the Terms & Conditions on a privacy-related matter, this Policy shall take precedence.

bad999 may update this Policy from time to time to reflect changes in platform features, data processing practices, or applicable legal requirements. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.

bad999 collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the site, and in limited cases from third-party verification providers. The categories of personal data we collect include the following:

2.1 Registration and Account Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you meet the 21+ age requirement).
• Mobile phone number and email address.
• Username and encrypted password hash.
• Residential address, district, and division within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).

2.2 Identity Verification (KYC) Data

• Bangladesh National Identity Card (NID) number and scanned copy or photograph.
• Passport number and copy, where provided as an alternative to NID.
• Selfie or live photograph for facial matching, where required for enhanced verification.
• Proof of address documents, such as a utility bill or bank statement, where requested.

2.3 Financial and Transaction Data

• Mobile wallet identifiers (bKash, Nagad, Rocket, Upay account numbers used for deposits and withdrawals).
• Bank account details where bank transfer is used (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank).
• Deposit and withdrawal history, including amounts in Bangladeshi Taka (৳), timestamps, and transaction reference numbers.
• Bonus claims, wager history, game session records, and win/loss summaries.

2.4 Technical and Usage Data

• IP address and approximate geographic location derived from it.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited, features used, and click-path data.
• Cookies and local storage identifiers (see Section 8 for full cookie details).

2.5 Communications Data

• Records of your interactions with bad999 customer support via live chat or email.
• Content of any complaint, feedback, or dispute you submit to bad999.
• Your marketing preferences and communication opt-in or opt-out records.

bad999 processes your personal data only for specific, legitimate purposes. The table below summarises the primary processing activities and the lawful basis for each:

bad999 does not use your personal data to make fully automated decisions that produce significant legal effects, except where this is required by applicable anti-fraud or anti-money-laundering compliance obligations. In such cases, you may request human review of any automated decision by contacting [email protected].

bad999 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

4.1 Payment and Wallet Providers

To process deposits and withdrawals, bad999 shares relevant financial identifiers with payment processors including bKash, Nagad, Rocket, Upay, and partnered banking institutions. These providers receive only the minimum data necessary to complete the transaction and are contractually bound to process it solely for that purpose.

4.2 KYC and Identity Verification Providers

bad999 uses regulated third-party KYC verification services to authenticate identity documents and confirm age eligibility. These providers process your NID scan or passport copy under strict data processing agreements and are prohibited from using your data for any purpose other than identity verification on behalf of bad999.

4.3 Game Content Providers

Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymised player identifier to facilitate gameplay. These providers do not receive your full name, NID, payment details, or contact information.

4.4 Analytics and Platform Infrastructure

bad999 uses reputable analytics and cloud infrastructure providers to maintain platform performance and analyse usage patterns. Data shared with these providers is either anonymised or pseudonymised and is used solely for platform improvement purposes.

4.5 Legal and Regulatory Disclosure

bad999 may disclose your personal data to government authorities, law enforcement agencies, or courts where we are required to do so by applicable law, lawful court order, or regulatory directive. In such cases, bad999 will disclose only the minimum data required and, where legally permissible, will notify you of the disclosure.

bad999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention framework is as follows:

• Active account data: Retained for the full duration of your account and for a minimum of five (5) years after account closure, in order to satisfy anti-money-laundering record-keeping requirements.
• KYC documents (NID, passport, selfie): Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable regulation. Original document scans are destroyed securely when no longer required.
• Transaction and wager history: Retained for a minimum of five (5) years from the date of each transaction for financial compliance purposes.
• Customer support communications: Retained for three (3) years from the date of the last interaction, or longer if the communication relates to an unresolved dispute or legal claim.
• Marketing preference records: Retained for three (3) years from the date of the last recorded opt-in or opt-out action.
• Technical and usage logs: Retained for a maximum of thirteen (13) months from the date of collection, after which they are deleted or permanently anonymised.

When data is no longer required, bad999 deletes or irreversibly anonymises it using secure data destruction procedures. Physical documents (where applicable) are shredded or incinerated in accordance with data security best practices.

As a bad999 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Data Support team at [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days.

• Right of Access: You may request a copy of all personal data that bad999 holds about you, together with information about how it is being processed.
• Right to Rectification: If any of your personal data held by bad999 is inaccurate or incomplete, you may request that we correct or update it without undue delay.
• Right to Erasure: You may request that bad999 delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (and no other lawful basis applies). Note that erasure requests may be declined where retention is required by law (e.g., AML record-keeping obligations).
• Right to Restrict Processing: You may request that bad999 restrict the processing of your data in certain circumstances, such as while a dispute about accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that bad999 provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including profiling for responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time by updating your preferences in account settings or by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

bad999 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bad999 servers.
• Encrypted storage of sensitive fields including password hashes, NID numbers, and payment account identifiers, using industry-standard encryption algorithms.
• Role-based access controls (RBAC) ensuring that bad999 staff members can only access the minimum data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Intrusion detection and monitoring systems that generate real-time alerts for suspicious access patterns or anomalous data requests.
• Secure development practices including code review, dependency auditing, and security patching cycles.

Despite these measures, no internet-based system can guarantee absolute security. In the event of a data breach that is likely to result in a risk to the rights or freedoms of players, bad999 will notify affected individuals and take appropriate remedial action as quickly as practicable.

Players are reminded that account security is a shared responsibility. bad999 strongly recommends enabling two-factor authentication (2FA) via SMS OTP and using a unique, strong password for your bad999 account. Never share your login credentials with anyone, including with individuals claiming to represent bad999 support.

bad999 uses cookies and similar local storage technologies to enable essential platform functionality, maintain your login session, and understand how players interact with our platform. We categorise cookies as follows:

Essential Cookies

These cookies are strictly necessary for the bad999 platform to function. They manage your authenticated session, preserve your language and currency preferences, and protect against cross-site request forgery (CSRF). Essential cookies cannot be disabled without rendering the platform unusable.

Analytics Cookies

bad999 uses first-party analytics cookies to collect aggregated, anonymised data about page views, session durations, and feature usage. This data helps us identify performance issues and prioritise platform improvements. Analytics cookies do not track your activity across external websites.

Functionality Cookies

These cookies remember your in-platform preferences, such as your most recently played game category, display settings, and notification preferences. They improve the personalisation of your bad999 experience without collecting personally identifiable information.

bad999 does not place advertising cookies, retargeting pixels, or any third-party tracking technologies that follow your activity across external websites or apps. You may clear cookies at any time through your browser settings. Note that clearing essential cookies will log you out of your bad999 account and reset your session preferences.

The bad999 platform is strictly intended for adults aged 21 and above. bad999 does not knowingly collect personal data from individuals under the age of 21. Our registration and KYC processes are designed to detect and prevent underage access.

If bad999 becomes aware that personal data has been collected from an individual under 21, we will immediately delete that data and close the associated account. Any funds deposited by a minor will be returned to the payment source after deducting any applicable processing fees.

If you are a parent or guardian and believe that a minor in your household has attempted to register on bad999, please contact us immediately at [email protected] so that we can investigate and act promptly.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bad999 handles your personal data, please reach out through one of the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request — [Your Username]".
• Live Chat: Available 24/7 inside the bad999 platform. Our support agents are trained to escalate privacy-specific queries to the appropriate team.

bad999 aims to acknowledge all privacy-related enquiries within 48 hours and to resolve them fully within 30 calendar days. Complex requests involving large volumes of data or legal review may take up to 60 days, in which case bad999 will notify you of the extension and the reason for it.

All privacy communications should be submitted in English. Please include your registered username and the mobile number or email address associated with your bad999 account so that we can locate your records promptly.