b399 Privacy Policy — How We Protect Your Personal Data
At b399, your privacy is not a checkbox — it is a core commitment. This Privacy Policy explains in plain terms what personal information we collect, why we collect it, how it is used, who it may be shared with, and what rights you have over your own data as a player on the b399 platform.
End-to-End Encryption
All data transmitted between your device and b399's servers is protected by 256-bit SSL/TLS encryption — the same standard used by international financial institutions. Your personal details and payment information are never transmitted in plain text.
We Don't Sell Your Data
b399 does not sell, rent, or trade your personal information to third-party marketing companies, data brokers, or advertising networks. Your data is used solely for operating and improving the b399 platform, complying with legal obligations, and protecting your account.
Purpose Limitation
Every piece of personal data b399 collects is collected for a specific, documented purpose. We do not use your data for any purpose beyond what is described in this Privacy Policy without first obtaining your consent or having a clear legal basis for doing so.
Transparent Record-Keeping
b399 maintains clear, auditable records of all data processing activities. You can request a full account of what personal data b399 holds about you at any time by contacting our support team. We aim to respond to all data access requests within 30 days.
Access Controls
Only authorised b399 staff with a genuine operational need can access your personal data. All internal access to player data is logged, role-restricted, and subject to regular internal audit. No b399 employee may access player data for personal purposes.
Bangladesh-First Approach
b399 is built specifically for Bangladeshi players. Our data practices are designed with the Bangladeshi context in mind — from bKash and Nagad payment data handling to the storage of NID verification documents — ensuring your data is treated with the cultural and legal context it deserves.
Information We Collect
b399 collects personal information from you in three principal ways: information you provide directly during registration and account use, information generated automatically by your use of the platform, and information received from trusted third-party verification and payment partners. Below is a comprehensive breakdown of each category.
1.1 Information You Provide Directly
When you register an account with b399, complete the KYC verification process, contact our support team, or interact with b399 promotions, you voluntarily provide us with personal data that may include:
- Identity Information: Full legal name, date of birth, gender, and nationality as it appears on your government-issued identity document.
- Contact Information: Mobile phone number registered in Bangladesh (used for OTP verification and account alerts), email address, and residential address in Bangladesh including division, district, and upazila.
- Identity Documents: Copies of your Bangladesh National ID Card (NID), valid passport, driver's licence, or birth certificate submitted during the KYC process.
- Payment Information: bKash account number, Nagad account number, Rocket account number, Upay account details, or bank account details (account holder name, bank name, branch, account number) used for deposits and withdrawals. b399 does not store full card numbers for Visa or Mastercard transactions — card processing is handled by our certified payment processor partners.
- Support Communications: The content of any messages, emails, or live chat communications you send to b399 support, including any attachments or screenshots you provide in connection with a dispute or technical query.
- Promotional Preferences: Your opt-in or opt-out preferences for b399 marketing communications via SMS, email, and in-platform notifications.
1.2 Information Generated by Your Platform Activity
When you use the b399 platform — whether on desktop or mobile — certain data is generated automatically as a by-product of that activity. This includes:
- Betting and Gaming History: A complete log of all bets placed, game rounds played, deposits made, withdrawals requested, bonus activity, and all associated financial outcomes, including the date, time (Bangladesh Standard Time, UTC+6), stakes, and results of each transaction.
- Login and Session Data: Date and time of each login, session duration, IP address used, device type (desktop, mobile, tablet), operating system, and browser type.
- Behavioural Data: Clickstream data, pages visited within the b399 platform, game categories browsed, search queries entered within the platform, and feature usage patterns. This data is used in aggregate form to improve platform usability and personalise your experience.
- Technical Error Logs: Crash reports, game disconnection events, and payment processing errors associated with your account, retained for technical troubleshooting and dispute resolution purposes.
1.3 Information from Third Parties
b399 may receive personal data about you from the following trusted third-party sources where it is necessary to operate the platform securely and comply with legal obligations:
- Payment Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and card processing partners may share transaction confirmation data, including the registered name and account number associated with a payment, to enable b399 to verify that payment methods belong to the account holder.
- Identity Verification Partners: b399 uses third-party KYC and identity verification services to validate the authenticity of identity documents submitted during the verification process. These partners may cross-reference your submitted documents against available government databases.
- Fraud Detection Services: b399 works with specialist fraud detection and anti-money-laundering (AML) compliance partners who may provide risk scores, device fingerprinting data, and transaction pattern analysis to help b399 identify and prevent fraudulent activity.
- Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi operate their own game environments within the b399 platform. These providers may receive your Player ID and session token to enable seamless game loading and may retain anonymised gameplay logs for their own certification and regulatory compliance purposes.
Data Categories at a Glance
- Identity & contact details
- KYC / identity documents
- bKash / Nagad / bank details
- Betting & gaming history
- Login & session logs
- Device & browser data
- Support communications
- Third-party verification data
Minimum Data Principle: b399 only collects personal data that is strictly necessary for the purpose it serves. We do not collect demographic data, social media profiles, or personal preferences beyond what is needed to operate the platform and meet our legal obligations.
How We Use Your Data
b399 processes your personal data only when there is a valid lawful basis for doing so. The primary lawful bases on which b399 relies are: (a) performance of the contract between you and b399 (i.e., operating your account and providing the services you have signed up for); (b) compliance with legal obligations applicable to b399 as a platform operator; (c) legitimate interests pursued by b399, where those interests are not overridden by your fundamental rights; and (d) your consent, where you have explicitly opted in to a specific processing activity such as marketing communications.
| Processing Purpose | Data Used | Lawful Basis |
|---|---|---|
| Account Registration & Management | Name, email, mobile number, date of birth, address | Contractual necessity |
| Identity Verification (KYC) | NID, passport, driver's licence, address proof | Legal obligation |
| Payment Processing | bKash / Nagad / bank account details, transaction history | Contractual necessity |
| Fraud Prevention & AML | Transaction patterns, IP address, device data, session logs | Legal obligation & legitimate interest |
| Customer Support | Support communications, account activity logs | Contractual necessity |
| Responsible Gaming Monitoring | Betting history, deposit frequency, session duration | Legal obligation & legitimate interest |
| Platform Improvement | Aggregated behavioural and usage data (anonymised) | Legitimate interest |
| Marketing Communications | Email, mobile number, promotional preferences | Consent (opt-in only) |
| Legal & Regulatory Compliance | Full account record, transaction history, KYC documents | Legal obligation |
Marketing Communications
b399 will only send you promotional communications — including bonus offers, seasonal promotions (Eid, Pohela Boishakh, BPL season), and new game announcements — if you have actively opted in to receive such communications during registration or through your account notification settings. You may withdraw your consent to marketing communications at any time by updating your preferences in the b399 account dashboard or by contacting [email protected]. Withdrawal of marketing consent does not affect the processing of your data for account operation, KYC, or fraud prevention purposes.
Automated Decision-Making
b399 uses automated systems for certain account management processes, including fraud scoring at registration, bonus eligibility checks, and responsible gaming alerts triggered by specific activity thresholds. Where an automated decision has a significant effect on your account (such as an automatic suspension triggered by a fraud alert), you have the right to request a manual review of that decision by a b399 compliance team member. To exercise this right, contact [email protected] with the subject line "Automated Decision Review Request".
Data Sharing & Third Parties
b399 does not sell, rent, or trade your personal data to third parties for commercial purposes. However, operating a secure, compliant, and functional online casino and sports betting platform requires b399 to share certain personal data with a limited set of trusted partners and in specific legally mandated circumstances. Every third party that receives your data from b399 is bound by a data processing agreement that restricts them to using your data only for the specific purpose for which it was shared.
Categories of Third-Party Recipients
- Payment Processing Partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and b399's card processing partners receive the transaction data necessary to process your deposits and withdrawals. These partners operate under their own regulatory frameworks and privacy policies.
- KYC & Identity Verification Providers: Third-party identity verification services receive copies of your submitted KYC documents for the purpose of validating their authenticity. These providers are contractually prohibited from retaining your documents beyond the verification process.
- Game Technology Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a session token and anonymised Player ID when you launch a game. They do not receive your name, contact details, or payment information. Game providers use this data solely to deliver the game session and maintain their own certification records.
- Fraud Detection & AML Compliance Services: Specialist third-party compliance tools receive IP addresses, device fingerprints, and anonymised transaction patterns to generate risk assessments. These services operate under strict data processing agreements and do not use b399 player data for any other commercial purpose.
- Cloud Hosting & Infrastructure Providers: b399's platform runs on enterprise-grade cloud infrastructure. Your data is stored on encrypted servers. Infrastructure providers are classified as data processors acting under b399's instructions and have no independent right to access or use your personal data.
- Legal & Regulatory Authorities: b399 may be required to disclose your personal data to law enforcement agencies, financial intelligence units, or other governmental authorities in Bangladesh or internationally, where required by applicable law, a court order, or a binding regulatory directive. b399 will not proactively disclose player data to authorities beyond what is legally mandated.
No International Data Sales: b399 does not transfer your personal data to international data brokers, third-party advertising platforms, or social media companies. Any international data transfer that does occur — for example, to a game provider's servers — is governed by data processing agreements that require the recipient to apply equivalent data protection standards to those set out in this Privacy Policy.
Our Trusted Partners
Data is shared only with partners who have a genuine operational need and are contractually bound to protect it:
- bKash & Nagad (payments)
- Bank partners (withdrawals)
- KYC verification services
- Game providers (session token only)
- Fraud & AML compliance tools
- Cloud infrastructure providers
- Legal authorities (when required)
Data Security & Storage
b399 implements a layered, defence-in-depth approach to data security. No single measure is relied upon in isolation; instead, multiple overlapping technical and organisational controls work together to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction.
Technical Security Measures
- 256-bit SSL/TLS Encryption in Transit: All data transmitted between your device and b399's servers is encrypted using TLS 1.2 or higher. This applies to login sessions, account registration, deposit flows, and all API communications between the b399 front-end and back-end systems.
- AES-256 Encryption at Rest: All sensitive personal data fields — including identity document copies, payment account numbers, and KYC verification records — are encrypted at rest using AES-256 encryption on b399's database servers.
- Secure Password Hashing: b399 never stores your password in plain text. Passwords are hashed using bcrypt with a per-account salt, making it computationally infeasible to reverse-engineer passwords even in the event of a database breach.
- OTP Two-Factor Authentication: b399 offers OTP-based 2FA via your registered Bangladesh mobile number. Players are strongly encouraged to enable 2FA to protect their account from unauthorised access.
- Web Application Firewall (WAF): b399's platform is protected by an enterprise-grade WAF that filters and monitors HTTP traffic to detect and block SQL injection, cross-site scripting (XSS), brute-force login attempts, and other common web application attack vectors.
- Penetration Testing: b399 conducts periodic third-party penetration tests of its platform infrastructure to identify and remediate security vulnerabilities before they can be exploited.
Organisational Security Measures
- All b399 staff with access to personal data are subject to strict confidentiality obligations and receive mandatory data protection training as part of their onboarding and annually thereafter.
- Access to player personal data is granted on a strict need-to-know basis. Permissions are reviewed quarterly and revoked immediately upon a staff member's departure from b399.
- b399 maintains an internal data breach response plan. In the event of a confirmed personal data breach affecting b399 players, b399 will notify affected players by email within 72 hours of becoming aware of the breach, describing the nature of the breach, the data affected, and the remediation steps taken.
Your Responsibility: While b399 implements strong technical and organisational security measures on its side, the security of your account also depends on you using a strong, unique password, enabling 2FA, and not sharing your login credentials with any third party. b399 cannot be held responsible for losses arising from a security failure on your device, network, or through your own disclosure of login details.
Your Privacy Rights
As a b399 player, you have the following rights over your personal data. b399 is committed to honouring these rights promptly and without unnecessary friction. To exercise any of the rights listed below, contact the b399 data protection team at [email protected] with the subject line "Data Rights Request" and a clear description of your request. b399 will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days.
Right of Access
You have the right to request a copy of all personal data b399 holds about you, along with information about how it is being used, who it has been shared with, and how long it will be retained.
Right to Rectification
If any personal data b399 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. b399 will update inaccurate data within 10 business days of a valid rectification request.
Right to Erasure
You may request that b399 delete your personal data where it is no longer necessary for the purpose for which it was collected. Note that this right is subject to b399's legal obligation to retain certain records (e.g., transaction records for AML compliance) for up to 5 years.
Right to Restriction
You may request that b399 restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being investigated.
Right to Data Portability
You may request a structured, machine-readable export of the personal data you have provided to b399, in CSV or JSON format, so that you can transfer it to another platform of your choosing.
Right to Object
You may object to b399 processing your personal data on the basis of legitimate interest at any time. You may also withdraw your consent to marketing communications at any time without affecting the lawfulness of prior processing.
Rights re: Automated Decisions
Where a significant decision about your account has been made solely by an automated system (such as an automatic fraud suspension), you have the right to request a human review of that decision by the b399 compliance team.
Right to Complain
If you are not satisfied with how b399 has handled your personal data or responded to a data rights request, you have the right to raise a complaint directly with b399 at [email protected]. b399 aims to resolve all data complaints within 15 business days.
Data Retention
b399 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The table below summarises the standard retention periods applied to different categories of personal data held by b399.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | AML legal obligation |
| KYC Documents (NID, Passport) | 5 years from submission or account closure | AML / KYC legal obligation |
| Transaction & Betting History | 5 years from transaction date | AML legal obligation |
| Support Communications | 3 years from last communication | Legitimate interest / dispute resolution |
| Session & Login Logs | 12 months from session date | Security & fraud prevention |
| Marketing Preferences | Until consent is withdrawn | Consent |
| Anonymised Analytics Data | Indefinite (no personal identifiers) | Legitimate interest |
| Fraud & AML Risk Records | 7 years from flagged event | Legal obligation |
When a retention period expires and there is no overriding legal basis to continue holding the data, b399 will securely delete or irreversibly anonymise the relevant personal data. Secure deletion means the data is overwritten in a manner that makes recovery technically infeasible. Anonymisation means all identifying fields are removed or replaced with random identifiers, such that the data can no longer be linked back to any individual player.
If you close your b399 account voluntarily, your active account data will be marked as inactive immediately. However, due to the 5-year AML retention obligation, your identity, KYC, and transaction records will be retained in a restricted, access-controlled archive for the legally required period before being deleted. You will not receive marketing communications after account closure regardless of your prior preferences.
Why 5 Years? Anti-money laundering (AML) regulations require financial and gaming platforms to retain customer identity and transaction records for a minimum of 5 years. This is not discretionary — it is a legal obligation that applies regardless of account status or player preference.
After Account Closure
Closing your b399 account does not trigger immediate deletion of all personal data. A legally required retention period applies to identity and transaction records. All retained data is stored in an access-restricted archive and is not used for any active marketing or operational purpose during the retention period.
Policy Updates & Contact
Changes to This Privacy Policy
b399 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, platform features, or regulatory requirements. When material changes are made to this Privacy Policy, b399 will notify active players via email to their registered address and display a prominent notice on the b399 platform for a minimum of 14 days prior to the changes taking effect.
Minor changes — such as clarifications of existing language, corrections of typographical errors, or updates to contact details — may be made without prior notice. The "Last Updated" date at the top of this Privacy Policy will always reflect the most recent revision date. Players are encouraged to review this Privacy Policy periodically to stay informed of how b399 handles their personal data.
Continued use of the b399 platform after a notified update to this Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material change to this Privacy Policy, you have the right to close your b399 account and request deletion of your personal data (subject to the legal retention obligations described in Section 7 above).
How to Contact b399 About Privacy
If you have any questions, concerns, or requests relating to this Privacy Policy or b399's handling of your personal data, please contact the b399 data protection team using the details below. All privacy-related enquiries are handled by a dedicated team member and will receive a substantive response within 5 business days.
Data Protection Contact
Email: [email protected]
Subject line: Privacy Policy Enquiry
Response time: Within 5 business days
Platform: https://b399.app
b399 takes all privacy enquiries seriously. Whether you are requesting access to your data, raising a concern about how your information has been handled, or simply seeking clarification on a point in this Privacy Policy, our team is here to assist you with transparency and professionalism.
Quick Reference
- Policy version: 2.4
- Effective date: 1 January 2026
- Last reviewed: 1 January 2026
- Contact: [email protected]
- Response SLA: 5 business days
- Fulfilment SLA: 30 calendar days
Related Policies: This Privacy Policy should be read alongside the b399 Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your use of the b399 platform and the obligations of both b399 and its players.
Your Privacy Is in Good Hands at b399
Now that you've reviewed the b399 Privacy Policy, explore the platform with confidence. Your data is protected, your rights are clear, and our team is always available to help with any privacy-related questions.