399o Privacy Policy —
How We Protect Your Data

1 Who We Are

399o is an online betting and casino platform operated for the Bangladeshi market. Our platform provides access to sports betting (including cricket, football, kabaddi, and other sports), live casino games, slot titles, crash games, and related entertainment services. All services are delivered in English and all financial transactions are conducted in Bangladeshi Taka (BDT).

For the purposes of this Privacy Policy, 399o is the data controller — meaning we are the entity that determines the purposes and means of processing your personal data. Our contact details for all data-related enquiries are set out in Section 13 of this Policy.

This Policy applies to all personal data collected through the 399o website at 399o.io, through our customer support channels, through third-party payment processors operating on our behalf, and through any other service we provide in connection with the 399o platform.

2 Data We Collect

399o collects personal data in three ways: data you provide directly, data we collect automatically when you use the platform, and data we receive from third-party service providers. The following tables summarise what we collect and why.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (other than problem gambling disclosures made voluntarily for responsible gaming purposes), or biometric data beyond what is required for identity verification.

3 How We Use Your Data

399o uses personal data only for legitimate purposes directly connected to the operation of the platform and the delivery of services to players in Bangladesh. We do not use your data for unrelated commercial purposes. The following table sets out each processing purpose and the type of data used.

4 Legal Basis for Processing

399o processes personal data on the following legal bases, depending on the purpose of the processing activity:

• Contract performance: Processing necessary to register your account, verify your identity, process transactions, and deliver the betting and gaming services you have requested. Without this processing, we cannot provide the 399o service to you.
• Legal obligation: Processing required to comply with anti-money laundering (AML) requirements, responsible gaming regulations, and any other applicable legal obligations — including the retention of transaction records and the enforcement of age restrictions (21+ only).
• Legitimate interests: Processing for fraud detection, platform security, abuse prevention, analytics, and service improvement, where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for marketing communications and the use of non-essential cookies, where you have given freely, specific, and informed consent. You may withdraw consent at any time without penalty.

5 Cookies & Tracking Technologies

399o uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and improve your experience. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, remember your language preference (English), and enable core security features. These cookies cannot be disabled without breaking the service.
• Functional cookies: These cookies remember your preferences — such as your preferred payment method, responsible gaming settings, and display preferences — so you do not need to re-enter them on each visit.
• Analytics cookies: These cookies collect anonymous data about how players use the platform, which pages are visited most frequently, and where users encounter errors. This helps 399o improve the platform experience. Analytics data is aggregated and does not identify you personally.
• Security cookies: These cookies help 399o detect and prevent fraudulent activity, protect against account takeover attempts, and enforce the single-account rule (see Terms & Conditions, Section 3).

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your 399o account. Most modern browsers allow you to block third-party cookies without affecting first-party session cookies.

399o does not use cross-site tracking cookies to follow your browsing activity on other websites. Our cookies are scoped exclusively to the 399o domain.

6 Sharing Your Data

399o does not sell, rent, or trade your personal data to third parties. We share your data only in the limited circumstances described below, and always subject to contractual obligations that require the recipient to protect your data to a standard equivalent to this Policy.

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive the financial data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and data protection obligations.
• Identity verification providers: Third-party KYC (Know Your Customer) service providers may receive your identity documents and biographical data for the purpose of verifying your age and identity as required by our responsible gaming and anti-money laundering obligations.
• Game content providers: When you play a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), technical data such as your session token and game-round results is shared with that provider to enable gameplay. These providers do not receive your full personal profile.
• Analytics providers: Anonymised, aggregated usage data may be shared with platform analytics providers to help us understand player behaviour and improve the service. No personally identifiable information is shared in this context.
• Legal and regulatory authorities: 399o will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, court order, or other binding legal obligation — for example, in connection with an anti-money laundering investigation or a court-ordered disclosure.
• Business transfers: In the event that 399o undergoes a merger, acquisition, or sale of all or part of its assets, player personal data may be transferred to the acquiring entity. You will be notified of any such transfer and its privacy implications in advance.

7 Data Retention

399o retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply:

When the retention period for a category of data expires, 399o will securely delete or irreversibly anonymise that data. Where deletion is not immediately possible due to technical constraints (for example, data held in encrypted backup archives), the data will be isolated from active processing until it can be securely deleted at the next scheduled archive purge.

8 Data Security

399o implements technical and organisational security measures proportionate to the risks posed by the processing of your personal data. Our security framework includes the following safeguards:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the 399o platform is encrypted in transit using industry-standard 256-bit SSL/TLS protocols. This prevents interception of your personal and financial data during transmission.
• Encryption at rest: Sensitive personal data — including identity documents, financial records, and authentication credentials — is encrypted at rest in our database infrastructure using AES-256 encryption.
• Access controls: Access to personal data within 399o's systems is restricted on a strict need-to-know basis. Each team member has access only to the data categories required for their specific role. Access logs are maintained and reviewed regularly.
• Two-factor authentication (2FA): 2FA is available for all player accounts and is strongly recommended. Internal 399o systems that hold personal data require 2FA for all staff access.
• Regular security testing: 399o conducts regular penetration testing and vulnerability assessments of the platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Data breach response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, 399o will notify affected players as promptly as reasonably practicable. We will provide details of the nature of the breach, the data affected, the likely consequences, and the measures taken to address it.

While 399o takes every reasonable precaution to protect your data, no online platform can guarantee absolute security against all threats. You are responsible for maintaining the security of your own device and login credentials. Please refer to Section 4 of the Terms & Conditions for your account security obligations.

9 Your Rights

As a 399o player based in Bangladesh, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team using the details in Section 13. We will acknowledge your request within 48 hours and respond in full within 30 days.

• Right of access: You have the right to request a copy of all personal data that 399o holds about you. We will provide this in a clear, readable format within 30 days of your request.
• Right to rectification: If any data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many of your own details directly via your account settings; for changes to identity or verification documents, please contact the support team.
• Right to erasure ("right to be forgotten"): You may request that 399o delete your personal data. We will act on deletion requests within 30 days, subject to our legal retention obligations (see Section 7). Data that we are legally required to retain cannot be deleted before the applicable retention period expires.
• Right to restriction of processing: In certain circumstances — for example, while a dispute is under review — you may request that 399o restricts the processing of your data to storage only, without using it for other purposes.
• Right to data portability: You have the right to request that 399o provide your personal data in a structured, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider if you choose.
• Right to object: You have the right to object to processing based on legitimate interests (including profiling for platform analytics) and to processing for direct marketing purposes. Marketing objections are acted on immediately; legitimate-interest objections are assessed within 30 days.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications or non-essential cookies), you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

10 Children & Minors

If you are a parent or guardian and you believe that a person under the age of 21 in your care has registered a 399o account or provided personal data to us, please contact our support team immediately at [email protected]. We will investigate promptly and take all necessary remedial action.

399o uses age verification checks as part of the registration process and the KYC verification workflow specifically to prevent minors from accessing the platform. These checks form part of our broader commitment to responsible gaming and player protection.

11 International Data Transfers

The 399o platform primarily serves players in Bangladesh, and our primary data storage infrastructure is configured with the privacy needs of Bangladeshi players in mind. However, some of our third-party service providers — including game content studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and platform analytics tools — may process data on servers located outside Bangladesh.

Where personal data is transferred to a third party in another country, 399o ensures that adequate safeguards are in place to protect your data to a standard at least equivalent to this Privacy Policy. These safeguards may include:

• Data processing agreements with contractual clauses that require the recipient to protect your data to the same standard as 399o.
• Processing only anonymised or pseudonymised data where the full personal record is not required for the third-party service to function.
• Transferring data exclusively to providers who operate under recognised data protection frameworks and have robust security certifications.

If you would like more information about the specific safeguards in place for any international data transfer, please contact our support team at [email protected].

12 Changes to This Policy

399o reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal requirements. When material changes are made, we will:

• Publish the updated Policy on this page with a revised "Last Updated" date at the top of the document.
• Notify registered players via the email address or contact information associated with their account, providing a summary of the key changes and the date on which the updated Policy takes effect.
• Where the change involves a new processing purpose that requires your consent (e.g., a new type of marketing communication), we will seek fresh consent before commencing that processing activity.

Your continued use of the 399o platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must stop using the platform and may request account closure by contacting our support team. The current version of this Policy is always available on this page and is the authoritative version.

13 Contact & Complaints

For all privacy-related enquiries, data rights requests, or complaints about how 399o handles your personal data, please contact our dedicated support team using the details below. All communications regarding data privacy must be submitted in English.

When submitting a data rights request, please include: your full name as registered on your 399o account, your registered email address or phone number, the specific right you wish to exercise or the nature of your complaint, and any relevant supporting details (such as transaction dates or account activity). This information helps us locate your records and respond to your request accurately and efficiently.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter. We take all privacy complaints seriously and will engage with any formal escalation process in good faith. Our support team will provide guidance on available escalation channels upon request.