o999 Privacy Policy

This Privacy Policy ("Policy") sets out how o999 ("o999", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the o999 online betting and gaming platform located at https://o999.io and its associated services (collectively, the "Platform").

o999 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy is intended to give you a clear understanding of your data rights and the measures we take to protect your privacy as a player based in Bangladesh.

This Policy should be read alongside o999's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy.

This Policy was last updated in January 2026 and is effective from that date. The most current version is always accessible at https://o999.io/privacy-policy.

For the purposes of this Policy, o999 acts as the data controller in respect of personal data collected from players who register and use the Platform. As data controller, o999 determines the purposes and means of processing your personal data.

If you have any questions about how o999 processes your personal data, or wish to exercise any of your data rights described in Section 10 of this Policy, you may contact o999's support team at any time via:

• Live Chat: Available 24/7 directly on the Platform
• Email: [email protected] (plain text — not a clickable link)

o999 collects the following categories of personal data in connection with your use of the Platform. A summary table is provided earlier in this page for quick reference; the full detail is as follows:

3.1 Identity Data
Your full legal name, date of birth, and government-issued identification details (Bangladesh National Identity Card number, passport number, or driving licence number) collected during account registration and KYC verification. This data is necessary to confirm your identity and verify that you meet the minimum age requirement of 21 years.

3.2 Contact Data
Your mobile phone number, email address, and residential address in Bangladesh (city, district, and postal area). This data is used for account communications, transaction notifications, security alerts, and, where you have opted in, marketing communications.

3.3 Financial Data
Mobile money account identifiers (bKash, Nagad, Rocket, Upay numbers), bank account details where bank transfer is used, and a full record of deposits, withdrawals, and betting/gaming transactions conducted via your o999 account. This data is retained for financial record-keeping, AML compliance, and dispute resolution purposes.

3.4 Technical Data
Your IP address at the time of each login, device type and model, browser type and version, operating system, and session start and end timestamps. This data is used for platform security, geographic access monitoring, and fraud detection.

3.5 Usage Data
Records of your in-Platform activity, including pages visited, game sessions initiated, bet placements, game outcomes, session duration, and responsible gaming tool activations (e.g., deposit limit settings, cooling-off periods). This data supports platform improvement, responsible gaming monitoring, and — where applicable — personalised promotional communications.

3.6 Communications Data
The content of live chat sessions and support email exchanges between you and the o999 team. These records are retained for dispute resolution, quality assurance, and regulatory compliance purposes.

3.7 Marketing Preference Data
Your opt-in or opt-out status for promotional communications from o999, including SMS, email, and in-Platform notifications relating to bonuses, seasonal promotions (Eid, BPL, IPL, Pohela Boishakh), and new game releases.

o999 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, server logs, and session tracking. See Section 9 for full details of our cookie use.
• Third-party payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners to verify that a payment has been initiated and completed.
• Identity verification services: Results of automated or manual identity and document verification checks conducted as part of the KYC process, which may involve third-party verification providers operating under strict data processing agreements with o999.
• Fraud and AML screening: Screening results from third-party risk and compliance services used to detect suspicious activity, verify source of funds, or comply with anti-money laundering obligations.

o999 uses your personal data for the following purposes, each of which is tied to a defined legal basis:

• Account management: Creating, maintaining, and administering your o999 account, including processing login credentials and account preferences. Legal basis: contractual necessity.
• Identity verification (KYC): Verifying your identity and age to comply with responsible gaming obligations and applicable regulations. Legal basis: legal obligation; contractual necessity.
• Payment processing: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer in Bangladeshi Taka (BDT). Legal basis: contractual necessity.
• Customer support: Responding to queries, complaints, and disputes submitted via live chat or email. Legal basis: contractual necessity; legitimate interests.
• Responsible gaming: Monitoring usage patterns for signs of problem gambling behaviour, enforcing self-imposed limits, and actioning self-exclusion requests. Legal basis: legal obligation; legitimate interests.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, and other security incidents. Legal basis: legitimate interests; legal obligation.
• Legal and regulatory compliance: Retaining records as required by applicable law, responding to lawful requests from competent authorities, and maintaining AML and financial crime prevention programmes. Legal basis: legal obligation.
• Platform improvement: Analysing aggregated usage data to improve platform performance, game selection, and user experience. Legal basis: legitimate interests.
• Marketing communications: Sending promotional communications (bonuses, seasonal offers, BPL cricket promotions) where you have provided your consent. Legal basis: consent. You may withdraw consent at any time via your account settings or by contacting support.

o999 does not sell, rent, or commercially transfer your personal data. We share your data only in the following limited and controlled circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment partners receive the transaction data necessary to process your deposits and withdrawals. These providers are bound by their own regulatory obligations and data protection standards.
• Identity verification providers: Third-party KYC service providers that assist o999 in verifying the authenticity of identity documents. These providers operate under data processing agreements that restrict their use of your data to the verification purpose only.
• Game providers: Where you access casino games or slots hosted by third-party providers (Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe), your account session data and bet data are shared with the relevant provider solely to facilitate gameplay. The provider's own privacy policy applies to data processed within the game environment.
• Fraud and AML screening services: Third-party risk and compliance platforms that assist o999 in detecting suspicious activity and meeting anti-money laundering obligations.
• Legal and regulatory authorities: Where o999 is required by law, court order, or competent authority instruction to disclose personal data, o999 will comply with that obligation. Where legally permitted, o999 will notify the affected player of such a disclosure.
• Business successors: In the event of a merger, acquisition, or sale of all or part of o999's business, personal data held by o999 may be transferred to the acquiring entity. Affected players will be notified of any change in data controller prior to any such transfer.

All third parties with whom o999 shares personal data are required to handle that data securely and only for the purposes described above. o999 does not permit third-party service providers to use your data for their own commercial or marketing purposes.

o999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with legal, regulatory, or dispute-resolution obligations. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, to meet AML record-keeping requirements.
• Financial transaction data: Retained for a minimum of 5 years from the date of the transaction, in accordance with applicable financial record-keeping standards.
• KYC documents: Retained for a minimum of 5 years from submission or account closure, whichever is later.
• Technical and usage data: Retained for up to 24 months from collection, after which it is anonymised or deleted.
• Support communications: Retained for 3 years from the date of the interaction or resolution of the relevant dispute, whichever is later.
• Marketing preference data: Retained until you withdraw consent or close your account, whichever occurs first.

Where data is no longer required for its original purpose and no legal retention obligation applies, o999 will securely delete or irreversibly anonymise that data.

o999 implements a layered approach to data security to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• SSL/TLS encryption in transit: All data transmitted between your device and the o999 Platform is encrypted using TLS 1.2 or higher, ensuring that your personal and financial data cannot be intercepted during transmission.
• AES-256 encryption at rest: Sensitive data stored on o999 servers, including identity documents and financial data, is encrypted at rest using AES-256 encryption.
• Access controls: Access to player data within o999 is restricted to authorised personnel on a need-to-know basis. All internal access is logged and audited.
• Two-factor authentication (2FA): Players are encouraged to enable two-factor authentication on their o999 account for an additional layer of login security.
• Intrusion detection and monitoring: o999's infrastructure is monitored 24/7 for suspicious activity. Automated alerts are triggered for anomalous login attempts, unusual transaction patterns, and other security events.
• Penetration testing: o999 conducts regular third-party security assessments to identify and remediate vulnerabilities in the Platform.

Despite these measures, no internet-based service can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, o999 will notify affected players without undue delay and take all reasonable steps to contain the breach and prevent recurrence.

o999 uses cookies and similar browser-based technologies to ensure the Platform functions correctly and to collect anonymous analytics data that helps us improve the user experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to operate. These include session cookies that keep you logged in during a visit and cookies that remember your responsible gaming limit settings. These cookies cannot be disabled without impairing core Platform functionality.
• Functional cookies: Used to remember your preferences, such as your preferred game lobby view or notification settings. These improve your experience but are not essential to Platform operation.
• Analytics cookies: Anonymous cookies used by o999's internal analytics system to understand how players navigate the Platform — for example, which pages are most visited and how long game sessions last on average. This data is aggregated and cannot be used to identify individual players.

o999 does not use third-party advertising cookies, retargeting cookies, or any cross-site tracking technology. We do not permit advertising networks or social media platforms to set cookies on the o999 Platform.

You can manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in to your o999 account and using the Platform. Instructions for managing cookies are available in the help documentation of all major browsers.

As a player whose personal data is processed by o999, you have the following rights in respect of that data. To exercise any of these rights, contact the o999 support team via live chat or email at [email protected]. o999 will respond to all data rights requests within 10 business days of receipt.

• Right of access: You have the right to request a copy of the personal data o999 holds about you, together with information about how and why it is processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may also update most account information directly via your o999 account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing applies. Please note that o999 may be unable to delete data where retention is required by law (e.g., AML record-keeping obligations).
• Right to restriction of processing: You have the right to request that o999 restricts the processing of your data in certain circumstances — for example, while the accuracy of data is being disputed.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to o999 in a structured, machine-readable format.
• Right to object: You have the right to object to processing based on o999's legitimate interests. Where the objection relates to direct marketing, o999 will cease processing immediately. For other legitimate-interest processing, o999 will assess the objection and respond within 10 business days.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Rights relating to automated decision-making: You have the right to request human review of any significant decision made about your account on a solely automated basis.

The o999 Platform is strictly for individuals aged 21 years and above. o999 does not knowingly collect or process personal data of persons under the age of 21. If o999 becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed.

If you believe that a minor has registered an account on o999 or that o999 holds personal data of a minor, please contact the support team immediately via live chat so that the matter can be investigated and resolved without delay.

Parents and guardians who are concerned about minor access to online gambling platforms are encouraged to use parental control software to restrict access to gambling-related websites. More information is available on the o999 Responsible Gaming page.

With your consent, o999 may send you promotional communications about bonuses, new game releases, seasonal promotions tied to events such as the Bangladesh Premier League (BPL), IPL, Eid, and Pohela Boishakh, and other o999 offers. These communications may be delivered via SMS to your registered mobile number, email to your registered address, or as in-Platform notifications.

You may opt in to marketing communications during account registration or at any later point via your account settings. You may withdraw consent and opt out of all marketing communications at any time by:

• Updating your notification preferences in your o999 account settings
• Clicking the unsubscribe link in any marketing email sent by o999
• Contacting the o999 support team via live chat and requesting that marketing communications be stopped

Withdrawal of marketing consent does not affect the delivery of transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent regardless of your marketing preference as they are necessary to the operation of your account.

In some circumstances, your personal data may be processed outside of Bangladesh — for example, where o999 uses third-party service providers (such as identity verification or fraud screening platforms) that operate servers in other countries. Where such transfers occur, o999 takes steps to ensure that your personal data receives an equivalent level of protection to that afforded within Bangladesh, including by:

• Entering into data processing agreements with all third-party processors that impose binding data protection obligations consistent with this Policy
• Applying technical safeguards (encryption in transit and at rest) to all data transferred internationally
• Restricting international transfers to service providers that can demonstrate adequate security certifications or whose processing activities are subject to recognised data protection frameworks

o999 does not transfer personal data to third parties in jurisdictions that do not provide an adequate level of data protection without first implementing appropriate contractual safeguards.

o999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or the way in which the Platform operates. When material changes are made, o999 will notify registered players via email or in-Platform notification at least 7 days before the updated Policy takes effect.

The date on which this Policy was last updated is displayed at the top of this page and in the "Updated" badge in the sidebar. Continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the revised terms. If you do not agree to a revised Policy, you should close your account before the effective date of the changes.

All previous versions of this Policy are available on request by contacting the o999 support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which o999 handles your personal data, please contact the o999 support team using the details below:

• Live Chat: Available 24/7 directly on the o999 Platform — the fastest way to reach the team
• Email: [email protected] — responses within 2 business days
• Hours: Support is available around the clock, Bangladesh Standard Time (UTC+6)

o999 takes all privacy-related enquiries seriously. If you submit a formal data rights request (access, erasure, correction, portability, objection), please include your registered account username and a brief description of your request so the team can action it efficiently. Identity verification will be required before any request is processed.