bo999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes the data protection practices of bo999 ("bo999", "we", "us", "our") in connection with the bo999 platform accessible at https://bo999.io and all associated services, features, mobile experiences, and customer support channels (collectively, the "Platform"). This Policy applies to all individuals who access or use the Platform, whether as registered players, casual visitors, or support enquirers.

bo999 is committed to handling the personal data of all players in Bangladesh with integrity, transparency, and security. This Policy is written in plain, professional English so that every player understands exactly what data is collected, why it is collected, how it is protected, and what rights are available to them in relation to their data.

This Privacy Policy should be read alongside the bo999 Terms & Conditions, which govern the overall legal relationship between bo999 and its players. In the event of any conflict between this Policy and the Terms & Conditions regarding data-related matters, this Policy shall prevail.

2 Personal Data We Collect

bo999 collects the following categories of personal data from players and platform visitors. All data collection is proportionate to its stated purpose and limited to what is genuinely necessary.

bo999 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, unless directly relevant to a responsible gaming self-exclusion request made by the player themselves.

3 How We Collect Your Data

bo999 collects personal data through the following means:

• Direct submission: Data you provide when creating your bo999 account, completing identity verification, making a deposit or withdrawal request, or contacting customer support.
• Automated collection: Technical and usage data collected automatically when you access the Platform, through server logs, session analytics, and first-party cookies or similar tracking technologies operated by bo999.
• Payment processor data: Transaction reference data shared with bo999 by bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard when you initiate a deposit or withdrawal. bo999 does not receive or store your full mobile PIN or card CVV from these processors.
• Identity verification services: Where bo999 uses a third-party identity verification provider to confirm the authenticity of documents submitted during KYC, that provider may share a verification result and confidence score with bo999. bo999 does not receive raw biometric data from verification providers.
• Publicly available sources: In limited fraud prevention or AML (anti-money laundering) screening contexts, bo999 may cross-reference your provided details against publicly available databases or commercially available sanctions and politically exposed persons (PEP) screening lists.

4 How We Use Your Personal Data

bo999 uses collected personal data for the following purposes:

• Account creation and management: To register your bo999 account, verify your identity and age (21+), maintain your account profile, and enable access to all platform features.
• Payment processing: To process BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer, and to maintain an accurate transaction record for your account.
• Customer support: To respond to your enquiries, resolve disputes, and maintain a record of support interactions for quality assurance and continuity purposes.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, multi-accounting, money laundering, and other prohibited conduct as defined in the bo999 Terms & Conditions.
• Responsible gaming: To monitor player activity for indicators of problematic gambling behaviour, enforce deposit limits and self-exclusion requests, and deliver responsible gaming notifications and cooling-off features.
• Legal compliance: To fulfil obligations under applicable anti-money laundering (AML) and counter-financing of terrorism (CFT) frameworks, including retention of transaction records and identity verification documentation for the required statutory period.
• Platform improvement: To analyse aggregated, anonymised usage patterns to improve game selection, platform performance, and the overall player experience on bo999.
• Direct marketing (opt-in only): To send promotional communications, bonus offers, and platform news to players who have explicitly opted in to receive such communications. Players may withdraw marketing consent at any time by contacting support or using the unsubscribe mechanism in any marketing email.

5 Legal Basis for Processing

bo999 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between bo999 and the player, including account registration, payment processing, and customer support.
• Legitimate interests: Processing carried out in pursuit of bo999's legitimate business interests, including platform security, fraud detection, and aggregated analytics, where such interests are not overridden by the player's privacy rights.
• Legal obligation: Processing required to comply with applicable legal obligations, including AML/CFT record-keeping requirements and responses to lawful requests from competent authorities.
• Consent: Processing based on the player's freely given, specific, and informed consent, primarily in the context of direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Disclosure

bo999 does not sell your personal data. bo999 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, solely to the extent necessary to process deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers engaged to verify the authenticity of identity documents submitted by players. These providers process data under strict contractual data protection obligations.
• IT and hosting infrastructure providers: Cloud infrastructure and server hosting providers who process data solely on bo999's documented instructions and under binding data processing agreements.
• Legal and regulatory authorities: Competent government authorities, law enforcement agencies, courts, or regulators, where bo999 is required to disclose data by applicable law, court order, or lawful governmental request. bo999 will notify affected players of any such disclosure to the extent permitted by law.
• Professional advisers: Lawyers, auditors, and accountants engaged by bo999 who are subject to professional confidentiality obligations and process data only to the extent required to provide their services to bo999.

All third parties with whom bo999 shares personal data are required to maintain the confidentiality and security of that data and to process it only for the purpose for which it was shared. bo999 does not permit third parties to use shared data for their own independent marketing or commercial purposes.

7 Cookies & Tracking Technologies

The bo999 platform uses first-party cookies and similar browser-based technologies to deliver a functional, secure, and personalised experience. bo999 does not use third-party advertising cookies or cross-site tracking networks.

• Essential cookies: Required for the Platform to function correctly, including maintaining your authenticated session, storing your language and currency preferences, and enabling the shopping cart functionality for deposit selections. These cookies cannot be disabled without breaking core platform functionality.
• Analytics cookies: First-party analytics cookies that help bo999 understand how players navigate the platform, which game categories are most visited, and where technical errors occur. Data from analytics cookies is aggregated and anonymised before analysis. bo999 does not use Google Analytics or other third-party analytics platforms that share data with the analytics provider.
• Security cookies: Short-lived cookies used to detect and prevent cross-site request forgery (CSRF) attacks and session hijacking attempts. These are strictly necessary for platform security.

You may configure your browser to refuse or delete cookies. Note that disabling essential cookies will prevent you from logging in to your bo999 account. Disabling analytics cookies will not affect your ability to use any platform feature.

8 Data Retention

bo999 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active bo999 account plus a minimum of 5 years following account closure, in compliance with AML/CFT record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Customer support communications: Retained for 3 years from the date of the last support interaction, for dispute resolution and quality assurance purposes.
• Technical and usage logs: Retained for up to 12 months from the date of collection, after which they are deleted or anonymised.
• Marketing consent records: Retained for the duration of your active marketing consent plus 2 years following withdrawal of consent, to evidence compliance with consent obligations.

Upon expiry of the applicable retention period, bo999 will securely delete or irreversibly anonymise the relevant personal data, unless a longer retention period is required by a specific legal obligation or ongoing legal proceedings.

9 Your Privacy Rights

bo999 recognises the following privacy rights for all players and platform users. To exercise any of these rights, contact the bo999 support team via live chat or email. bo999 will respond to all verified privacy rights requests within 30 days.

• Right of access: You may request a copy of the personal data bo999 holds about you, including a summary of the categories of data held, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you. Certain data corrections may require supporting documentation (e.g., a corrected NID scan).
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to bo999's legal retention obligations and may not be exercisable in full where legal record-keeping requirements apply.
• Right to restriction: You may request that bo999 restrict processing of your data in certain circumstances, such as while a rectification request is being assessed.
• Right to data portability: You may request a machine-readable export of the personal data you provided directly to bo999 (e.g., account profile data), in a structured, commonly used format.
• Right to object: You may object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You may also object at any time to processing for direct marketing purposes.
• Right to withdraw consent: Where bo999 processes your data based on consent (principally for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10 Data Security

bo999 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Key security measures in place at bo999 include:

• Transport Layer Security (TLS): All data transmitted between players' devices and the bo999 platform is encrypted using TLS 1.2 or higher (256-bit SSL), ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Password security: Player passwords are hashed using a strong one-way cryptographic hashing algorithm with per-user salting. bo999 does not store passwords in recoverable form.
• Access controls: Access to personal data by bo999 staff is restricted on a strict need-to-know basis. Staff with access to personal data undergo data protection awareness training and are subject to confidentiality obligations.
• Infrastructure security: bo999's platform is hosted on hardened server infrastructure with firewall protection, intrusion detection systems, and regular security patch management applied as part of the routine maintenance cycle.
• Incident response: bo999 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in risk to affected players, bo999 will notify affected players promptly and take immediate remedial action.

11 Children & Minors

The bo999 platform is strictly intended for adults aged 21 years and above. bo999 does not knowingly collect personal data from individuals under the age of 21. All registration applicants are required to confirm their age and are subject to identity verification before their account is activated and any withdrawal is permitted.

If bo999 becomes aware that personal data has been collected from an individual who is under 21 years of age, bo999 will take immediate steps to delete that data, close the associated account, and return any deposited funds to the originating payment method. If you have reason to believe that a minor is using the bo999 platform, please report this to the bo999 support team immediately via live chat.

12 Changes to This Privacy Policy

bo999 reserves the right to update or amend this Privacy Policy at any time. Changes to this Policy will be communicated to all registered players via email notification to their registered email address and by posting the updated Policy on this page with a revised effective date. bo999 recommends that you review this Policy periodically to remain informed of how your data is being protected and used.

Material changes to this Policy — defined as changes that significantly alter how bo999 collects, uses, or shares personal data — will be communicated with at least 14 days' advance notice before taking effect. Your continued use of the bo999 platform following the effective date of any revised Policy constitutes your acknowledgment of the changes.

13 Contact & Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or to the personal data bo999 holds about you, please contact the bo999 Data Support team using the details below. bo999 aims to acknowledge all privacy-related enquiries within 5 business days Bangladesh Standard Time (BST, UTC+6) and to resolve substantive requests within 30 calendar days.

This Privacy Policy was last reviewed and updated on 1 January 2026. All previous versions of the bo999 Privacy Policy are superseded by this version as of that date.