Privacy Policy — 399dat Casino

This Privacy Policy ("Policy") describes how 399dat ("Company", "Platform", "we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("Player", "User", "you") who register for and use the 399dat online casino and sports betting platform, accessible at https://399dat.app.

By creating a 399dat account or otherwise accessing the platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any aspect of this Policy, you should not register an account or continue using the 399dat platform.

This Policy applies to all personal data processed by 399dat in connection with the provision of its services to players based primarily in Bangladesh. It should be read in conjunction with the 399dat Terms & Conditions, which govern the broader contractual relationship between you and 399dat.

This Policy is written and published in English. In the event of any inconsistency between this English-language version and any translation, the English version shall prevail.

399dat collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and from third-party service providers who assist in delivering our services. The categories of data collected are described below.

2.1 Registration and Identity Data

When you create a 399dat account, we collect the following information:

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to verify that you meet the minimum age requirement of 18 years)
• Residential address (city, district, and division within Bangladesh)
• Mobile phone number registered to your bKash, Nagad, Rocket, or Upay account
• Email address (used for account communications and notifications)
• Username selected by you during registration

2.2 Identity Verification (KYC) Data

Where account verification is required, 399dat may additionally collect:

• Scanned copy or photograph of a government-issued photo ID (National Identity Card, passport, or driving licence)
• Proof of address document (utility bill, bank statement, or other official correspondence issued within the last three months)
• Proof of payment method ownership (screenshot of bKash/Nagad/Rocket registered name confirming ownership)
• Selfie photograph for facial verification against the submitted ID document

2.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts (in Bangladeshi Taka ৳), timestamps, and payment method references
• Mobile wallet transaction IDs from bKash, Nagad, Rocket, and Upay
• Bank account or card details where bank transfer methods are used (stored in tokenised form only)
• Cumulative deposit and withdrawal history for responsible gaming monitoring purposes

2.4 Gameplay and Betting Activity Data

• Game session logs, including game titles, session durations, bet amounts, and outcomes
• Sports betting history, including markets, stake amounts, odds accepted, and settlement results
• Bonus claims, wagering progress, and promotional participation records
• Responsible gaming tool activations (deposit limits set, self-exclusion periods initiated)

2.5 Technical and Device Data

• IP address at the time of login and during active sessions
• Device type, operating system version, and browser type
• Mobile network operator (e.g., Grameenphone, Robi, Banglalink, Teletalk)
• Session timestamps, login history, and geographic location derived from IP address
• Referral source (how you arrived at 399dat, e.g., direct URL, search engine, referral link)

2.6 Communications Data

• Contents of support ticket messages and live chat transcripts
• Email correspondence between you and the 399dat support team
• Complaint and dispute records

399dat uses the personal data it collects for the following specific purposes:

Purpose	Data Categories Used	Legal Basis
Account creation and management	Registration data, identity data	Contract performance
Age and identity verification (KYC)	KYC documents, registration data	Legal obligation
Processing deposits and withdrawals	Financial transaction data	Contract performance
Fraud prevention and AML compliance	Financial data, technical data, KYC data	Legal obligation / Legitimate interest
Delivering casino and sports betting services	Gameplay data, financial data	Contract performance
Responsible gaming monitoring	Gameplay data, financial data, registration data	Legal obligation / Legitimate interest
Customer support and dispute resolution	Communications data, account data	Contract performance
Platform security and abuse prevention	Technical data, gameplay data	Legitimate interest
Personalised promotional communications	Registration data, gameplay data	Consent (opt-in)
Platform analytics and improvement	Technical data, gameplay data (anonymised)	Legitimate interest

Where 399dat relies on your consent as the legal basis for processing — such as for marketing communications — you have the right to withdraw that consent at any time by updating your communication preferences within your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that took place prior to the withdrawal.

4.1 Service Providers. 399dat engages a limited number of trusted third-party service providers who process personal data on our behalf, strictly in accordance with documented data processing agreements. These providers include payment gateway operators (bKash, Nagad, Rocket, Upay, and partner banks), game software providers (Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi), customer support platform operators, and cloud infrastructure providers. Each provider is contractually prohibited from using your data for any purpose other than delivering the specific service engaged.

4.2 Legal and Regulatory Disclosure. 399dat may disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or where such disclosure is necessary to prevent, investigate, or prosecute criminal activity including fraud, money laundering, or unauthorised access to the platform. In such circumstances, 399dat will disclose only the minimum data necessary to fulfil the legal obligation.

4.3 Anti-Money Laundering Compliance. As part of 399dat's anti-money laundering (AML) and counter-financing of terrorism (CFT) obligations, certain player transaction data and identity information may be reported to financial intelligence units as required under applicable law. Players are notified of this obligation at the time of account registration.

4.4 Business Transfers. In the event that 399dat undergoes a merger, acquisition, restructuring, or sale of assets, personal data held by the platform may be transferred to the successor entity as part of that transaction. Affected players will be notified via their registered email address prior to any such transfer taking effect, and the successor entity will be required to honour this Privacy Policy or provide players with a materially equivalent level of protection.

4.5 No Sale of Personal Data. 399dat does not sell, rent, license, or otherwise transfer personal data to third parties for their own marketing or commercial purposes. This is an unconditional commitment and applies regardless of the commercial value of the data in question.

5.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. 399dat uses cookies and similar tracking technologies (including local storage objects and session tokens) to ensure the platform functions correctly, to maintain your login session, and to analyse platform usage patterns.

5.2 Types of Cookies Used by 399dat

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication tokens that keep you logged in during a gaming session. These cookies cannot be disabled without preventing the platform from operating correctly.
• Functional Cookies: Remember your preferences such as preferred language, last-used payment method, and responsible gaming tool settings. Disabling these cookies will not prevent platform access but may result in a less personalised experience.
• Analytics Cookies: Used to collect anonymised data about how players interact with the platform — including pages visited, session duration, and navigation paths — to help 399dat improve user experience. This data is aggregated and does not identify individual players.
• Marketing Cookies: Used only where you have provided explicit opt-in consent. These cookies enable 399dat to deliver relevant promotional communications and measure the effectiveness of marketing campaigns. You can withdraw consent at any time via your account settings.

5.3 Cookie Management. You may control cookie settings through your browser's privacy preferences. Most modern browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from accessing the 399dat platform. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

399dat retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of the active account relationship and for a period of 5 years following account closure.
• KYC and Identity Documents: Retained for 5 years following account closure in compliance with standard financial record-keeping requirements applicable to online payment platforms.
• Financial Transaction Records: Retained for 5 years from the date of each transaction, consistent with standard financial record obligations.
• Customer Support Communications: Retained for 3 years from the date of the last communication in each support thread.
• Marketing Consent Records: Retained for the duration of the consent period plus 2 years after consent withdrawal, to demonstrate compliance.
• Technical and Device Logs: Retained for 12 months on a rolling basis, after which they are automatically purged.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Anonymised or aggregated data derived from player activity may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify individual players.

399dat implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and 399dat's servers is encrypted using 256-bit SSL/TLS certificates.
• Encrypted Data Storage: Sensitive data fields including passwords (stored as salted cryptographic hashes), payment method references, and identity document files are encrypted at rest.
• Access Controls: Access to player personal data within 399dat's internal systems is restricted on a strict need-to-know basis. All staff members with data access are subject to confidentiality obligations and undergo data protection training.
• Two-Factor Authentication: Internal administrative systems require two-factor authentication for all access. Players are encouraged to enable additional login security features available within their 399dat account settings.
• Penetration Testing: 399dat's platform undergoes periodic security assessments conducted by independent third-party security specialists.
• Incident Response: 399dat maintains a documented data breach response procedure. In the event of a confirmed breach affecting player data, affected players will be notified within 72 hours, as outlined in Section 1.

Despite these measures, no internet-based platform can guarantee absolute security. Players are strongly advised to use a strong, unique password for their 399dat account, to avoid accessing the platform from public or shared Wi-Fi networks, and to contact [email protected] immediately if they suspect any unauthorised access to their account.

As a 399dat player, you have the following rights in relation to the personal data we hold about you:

• Right of Access: You may request a copy of the personal data that 399dat holds about you, including the categories of data processed, the purposes of processing, and the retention periods applied.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. Minor corrections (such as updating your contact email address) can be made directly within your account settings. Corrections to identity data require the submission of supporting documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing was unlawful. Please note that erasure requests may be declined where 399dat has a legal obligation to retain the data (e.g., financial records required for AML compliance).
• Right to Restrict Processing: You may request that 399dat restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Object: You may object to processing of your personal data where it is based on 399dat's legitimate interests, including profiling for marketing personalisation purposes. Upon receiving a valid objection, 399dat will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: You may request that the personal data you have provided to 399dat be provided to you in a structured, commonly used, machine-readable format, or transmitted directly to another data controller where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to the withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request" and include sufficient information to verify your identity as the account holder. 399dat will respond to all valid requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, and you will be notified of any such extension.

The 399dat platform is strictly intended for adults aged 18 years and above. 399dat does not knowingly collect personal data from individuals under the age of 18. Age verification is a mandatory step in the registration process, and 399dat reserves the right to request documentary proof of age at any time during the account lifecycle.

If 399dat becomes aware that personal data has been collected from a person under the age of 18, the relevant account will be immediately suspended, all associated data will be deleted (subject to any legal reporting obligations triggered by the discovery), and the matter will be treated as a priority compliance incident.

Parents and guardians who believe a minor may have registered on the 399dat platform using falsified information are urged to contact [email protected] immediately. 399dat will investigate and respond to all such reports within one business day.

399dat's primary player base is located in Bangladesh. However, certain service providers engaged by 399dat — including game software providers such as Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, and Ezugi — operate data infrastructure in multiple jurisdictions. As a result, some player data may be processed outside of Bangladesh as part of the technical delivery of those services.

Where personal data is transferred to a third country, 399dat ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that applied within Bangladesh. Such safeguards include contractual data processing clauses that impose obligations on the recipient entity equivalent to those under this Policy.

If you would like further information about the specific safeguards applied to any international data transfer, please contact us at [email protected].

11.1 Game Providers. 399dat hosts casino games developed and supplied by third-party providers including Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, and Ezugi. When you play these games, certain gameplay data (such as bet amounts and session identifiers) is transmitted to the relevant game provider's servers to facilitate the game. Each provider operates under its own privacy and data protection framework. 399dat is not responsible for the data practices of game providers beyond the scope of its contractual data processing agreements with them.

11.2 Payment Processors. Deposit and withdrawal transactions on 399dat are processed through third-party payment infrastructure including bKash, Nagad, Rocket, Upay, and participating banks. These providers receive only the transactional data strictly necessary to process the payment. Their handling of payment data is governed by their own privacy policies and applicable Bangladesh Bank regulations.

11.3 No Embedded Third-Party Trackers. 399dat does not embed third-party advertising trackers, social media pixels, or data broker tools on its platform. The platform is designed for speed and privacy, consistent with the expectations of Bangladeshi mobile users accessing the site via Grameenphone, Robi, Banglalink, or Teletalk networks.

399dat reserves the right to update or revise this Privacy Policy at any time. Where changes are material — meaning they significantly affect the way your personal data is processed or your rights in relation to it — 399dat will notify you via the email address registered to your account at least 14 days before the changes take effect.

The "Last updated" date at the top of this Policy reflects when the most recent changes were made. Your continued use of the 399dat platform following notification of changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you should cease using the platform and may request account closure by contacting [email protected].

The most current version of this Privacy Policy is always available at https://399dat.app/privacy-policy. We encourage you to review this page periodically to stay informed of how 399dat manages your personal data.

For any questions, concerns, or formal requests relating to this Privacy Policy or the personal data 399dat holds about you, please contact the 399dat Data Protection team using the details below. All enquiries are handled confidentially and in accordance with the response timeframes set out in this Policy.

• Email: [email protected] — Subject line: "Privacy Rights Request" (plain text — not a clickable link)
• Live Chat: Available within the 399dat platform from 8:00 AM to 12:00 AM BST (UTC+6) daily
• Response Time: Within 30 calendar days of receipt for all formal data subject requests

When submitting a data request, please include your registered username and the email address associated with your 399dat account so that we can verify your identity before processing the request. 399dat may ask for additional verification in cases where identity cannot be confirmed from the information provided.