Privacy Policy – b 999 Data Protection & Your Rights as a Player

This Privacy Policy explains how b 999 ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal information of users ("you", "Player") who access and use the b 999 platform at b999-bangla.com. b 999 is an online gaming and entertainment platform serving players in Pakistan, and this policy reflects our genuine commitment to protecting the privacy of every person who chooses to use our services.

By registering an account at b 999, depositing funds, or otherwise using the platform in any capacity, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this policy, you should not use b 999.

This policy should be read alongside the b 999 Terms and Conditions, which govern your use of the platform more broadly. In the event of a conflict between this Privacy Policy and the Terms and Conditions on a privacy-related matter, this Privacy Policy takes precedence.

b 999 collects several categories of personal data in the course of providing its services. The type of data collected depends on how you interact with the platform — for example, a registered and verified player will have more data on record than someone who has only browsed the website without logging in.

b 999 does not collect sensitive categories of personal data such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is strictly necessary for identity verification purposes (photograph for CNIC matching only).

b 999 collects your personal data through several different channels depending on the nature of your interaction with the platform. Understanding these collection points helps you make informed decisions about the information you choose to provide.

• Direct Collection: Data you provide voluntarily when registering an account at b 999, completing identity verification, making deposits or withdrawals, contacting customer support, participating in promotions, or updating your account settings.
• Automated Technical Collection: Data collected automatically through cookies, web server logs, and tracking technologies when you visit b 999 — including your IP address, device identifiers, browser characteristics, and navigation behaviour on the platform.
• Payment Processor Data: When you make a deposit or withdrawal at b 999 via Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, or card, our payment processor confirms transaction status and shares the minimum data necessary to record your payment in our systems.
• Identity Verification Provider Data: During the KYC verification process, b 999 uses a third-party identity verification service that may cross-reference the documents you submit against government and financial databases. The result (verified/unverified) is shared with b 999 along with the minimum identification data required.
• Third-Party Analytics: b 999 uses analytics tools to understand aggregate platform usage patterns. This data is anonymised or pseudonymised and does not identify individual players.

b 999 uses personal data only for clearly defined, legitimate purposes. We do not use your data in ways that go beyond what is reasonably necessary to provide and improve our services, protect the platform from fraud, and meet our legal obligations. The specific purposes for which your data is used are set out below.

• Account Management: Creating and maintaining your b 999 account, processing your login requests, and enabling you to access all platform features.
• Identity Verification (KYC): Confirming your identity and age before activating withdrawal functionality on your b 999 account, in compliance with anti-money laundering (AML) and responsible gaming obligations.
• Payment Processing: Processing deposits and withdrawals in PKR via your chosen payment method, maintaining accurate transaction records, and investigating any payment disputes.
• Game Service Delivery: Enabling you to access and play all games available on b 999 — including card games, crash games, sports and esports betting, and jackpot slots — and recording game outcomes and bet history accurately.
• Security and Fraud Prevention: Monitoring platform activity for signs of unauthorised access, account takeover, collusion, bonus abuse, money laundering, and other prohibited behaviours that could harm b 999 or other players.
• Responsible Gaming Compliance: Using your usage data to monitor gaming patterns, enforce deposit and loss limits you have set, and identify signs that a player may be experiencing gaming-related harm.
• Customer Support: Responding to queries, resolving complaints, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Marketing Communications: Sending you information about b 999 promotions, bonuses, and new features — but only where you have opted in to receive such communications. You can opt out at any time through your account settings or by contacting support.
• Platform Improvement: Using aggregated and anonymised usage data to understand how players interact with b 999, identify usability issues, and improve the platform over time.
• Legal Compliance: Meeting b 999's obligations under applicable data protection, anti-money laundering, and financial reporting laws, and cooperating with regulatory authorities or law enforcement agencies where legally required.

b 999 does not sell, rent, or trade your personal data to any third party for commercial purposes. Full stop. The only circumstances under which your personal data leaves b 999's systems are the specific, necessary situations described below.

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banks, and card networks receive the minimum data necessary to process your transactions — your account identifier, transaction amount, and your registered payment method details. These providers process data under their own privacy policies and are not permitted to use your data for any purpose other than transaction processing.
• Identity Verification Providers: Our KYC service provider receives your identity documents and personal information during the verification process. This provider operates under a strict data processing agreement with b 999 and is prohibited from using your data for any other purpose.
• Game and Technology Providers: Third-party game developers and RNG certification bodies may receive anonymised game log data for auditing purposes. No personally identifiable player information is shared with game providers.
• Analytics Providers: Aggregated and anonymised usage data is shared with analytics providers to help b 999 understand platform performance. This data cannot be used to identify individual players.
• Law Enforcement and Regulatory Authorities: b 999 will share personal data with government agencies, financial intelligence units, regulators, or law enforcement bodies where we are legally compelled to do so, or where we reasonably believe disclosure is necessary to prevent serious harm, fraud, or criminal activity. We are not obligated to inform you when such a disclosure has been made.
• Corporate Transactions: In the event that b 999 undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. Players will be notified of any such transfer and given an opportunity to close their accounts if they do not wish their data to be transferred.

Data security is not an afterthought at b 999 — it is built into every layer of the platform architecture. We apply multiple complementary security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction.

• Encryption in Transit: All data exchanged between your device and b 999's servers is encrypted using TLS 1.3 with 256-bit AES encryption. The padlock icon in your browser confirms this connection is always active when you use b 999.
• Encryption at Rest: Personal data stored in b 999's databases is encrypted at rest. Payment details and identity documents are stored in isolated, encrypted environments with access restricted to authorised personnel only.
• Access Controls: Internal access to player data at b 999 is strictly controlled on a need-to-know basis. Staff access is logged, audited, and subject to regular review. No single employee has unilateral access to your complete profile and financial history simultaneously.
• Two-Factor Authentication: b 999 offers two-factor authentication for player accounts and requires it for all internal staff accessing player data systems.
• Penetration Testing: b 999's platform undergoes regular third-party security testing to identify and address vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to player data, b 999 will notify affected players within 72 hours of becoming aware of the incident, along with guidance on protective steps players can take.

Despite these measures, no security system is completely impenetrable. b 999 cannot guarantee the absolute security of data transmitted over the internet. Players are encouraged to use strong, unique passwords for their b 999 accounts and to enable two-factor authentication.

b 999 retains personal data for as long as necessary to fulfil the purposes for which it was collected, and as required by applicable legal, regulatory, and financial reporting obligations.

• Active Account Data: All data associated with your b 999 account is retained for the full duration that your account remains active.
• Closed Account Data: Following the closure of a b 999 account — whether by the player or by b 999 — identity data, transaction records, and KYC documentation are retained for a minimum of five years in compliance with anti-money laundering regulations. This retention period may be extended if required by an ongoing investigation or regulatory inquiry.
• Marketing Data: If you have opted out of marketing communications from b 999, a minimal record of your opt-out status is retained indefinitely to ensure that we do not inadvertently send you communications you have declined.
• Technical Logs: Server and security logs are retained for a rolling period of twelve months, after which they are automatically deleted unless flagged in connection with a security investigation.
• Support Communications: Customer support transcripts and email records are retained for two years from the date of the last interaction, unless they relate to an unresolved dispute or regulatory matter.

When personal data is no longer required, b 999 deletes or anonymises it securely. Anonymised data — where all identifying characteristics have been removed — may be retained indefinitely for statistical analysis and platform improvement purposes.

b 999 uses cookies and similar tracking technologies to operate the platform, maintain your logged-in session, remember your preferences, and understand how players use the site. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies set by b 999 do not contain your password or financial information.

The types of cookies used by b 999 are as follows:

• Essential Cookies: Required for core platform functionality — logging in, maintaining your session, and processing transactions securely. These cookies cannot be disabled without breaking core features of b 999.
• Preference Cookies: Remember your platform settings such as language preferences and display choices so you don't have to set them again each time you visit b 999.
• Analytics Cookies: Collect anonymised data about how players navigate b 999 — which pages are visited most frequently, where players navigate from, and how long sessions typically last. This data is aggregated and does not identify individual users.
• Security Cookies: Used to detect and prevent fraudulent activity, including unauthorised login attempts and account takeover patterns.

You can control non-essential cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Note that disabling essential cookies will impair your ability to use b 999 normally. Detailed instructions for managing cookies in the most common browsers can be found in your browser's help documentation.

b 999 respects your rights over your personal data. The following rights are available to all b 999 players. To exercise any of these rights, contact our support team at support@b999-bangla.com or via live chat. b 999 will respond to all data rights requests within 48 hours and aims to resolve them within 30 days.

b 999 does not knowingly collect personal data from, or provide services to, persons under the age of 18. The platform is intended exclusively for adult players. Age verification is conducted as part of the registration and KYC process to enforce this requirement.

If b 999 becomes aware that a player under the age of 18 has registered an account, we will immediately close that account, return any balance via the registered payment method, and delete all personal data associated with the account to the extent permitted by law. If you believe a minor has registered at b 999, please contact our support team immediately.

If you are a parent or guardian and are concerned about a young person's access to gaming platforms, we encourage you to use device-level parental controls and to visit our Responsible Gaming page for further guidance on recognising and addressing problematic gaming behaviour in young people.

Some of b 999's service providers — particularly cloud infrastructure providers and analytics tools — may process data on servers located outside Pakistan. Where personal data is transferred internationally, b 999 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under applicable Pakistani data protection law.

These safeguards typically include contractual clauses requiring the overseas recipient to protect the data to the same standard as b 999 is required to meet, combined with organisational and technical security measures proportionate to the sensitivity of the data being transferred.

b 999 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. Whenever this policy is updated, the "Last Updated" date at the top of this page will be revised accordingly.

Where changes are material — meaning they significantly affect how your data is used or your rights as a data subject — b 999 will provide advance notice via email or in-platform notification at least seven days before the updated policy takes effect. For minor, non-material changes (such as formatting improvements or clarifications that don't change the substance of the policy), the updated version will be published without prior notice.

Your continued use of b 999 after the effective date of any policy update constitutes your acceptance of the revised Privacy Policy. If you disagree with any changes, you should stop using b 999 and request account closure before the changes take effect.

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how b 999 handles your personal information, please get in touch with us. We take all privacy enquiries seriously and are committed to responding promptly.

• Email: support@b999-bangla.com — for formal data rights requests and privacy complaints
• Live Chat: Available within your b 999 account — fastest response for general privacy queries
• WhatsApp: Accessible through your b 999 account support section

b 999 aims to respond to all privacy-related enquiries within 48 hours. Formal data subject access requests will be fulfilled within 30 days. If you are not satisfied with b 999's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.