Privacy Policy — How 399bde Protects Your Personal Data

Data Controller & How to Contact Us

The data controller responsible for your personal information is the operator of the 399bde platform, accessible at https://399bde.app. As data controller, 399bde determines the purposes and means by which your personal data is processed. We are accountable for the personal data of all registered players and site visitors in Bangladesh and other jurisdictions from which the platform is accessed.

If you have any question, concern, or request relating to this Privacy Policy or to the personal data we hold about you, you may reach our dedicated privacy support team at the following contact point:

All communications with our privacy team are handled exclusively in English by agents based in the Bangladesh Standard Time zone (BST, UTC+6), available 24 hours a day, 7 days a week.

Information We Collect

399bde collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and from third-party partners such as payment providers and identity verification services. The table below summarises the categories of personal data we process and the primary source of each.

Data We Do Not Collect

399bde does not collect, request, or store the following categories of sensitive personal data unless legally required to do so by a competent authority: biometric data beyond what is needed for identity photograph verification, health or medical records, racial or ethnic origin, religious beliefs, or political opinions. We do not access the contents of your mobile device's contacts, camera roll, or microphone.

Data from Minors

399bde's platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. If we discover that we have inadvertently collected data from a person under 18, that data will be deleted immediately and the associated account will be closed. If you believe an underage person has registered on 399bde, please notify us at [email protected] immediately.

How We Use Your Information

399bde processes your personal data for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the purposes described in this section. Where we wish to use your data for a new purpose, we will update this Privacy Policy and notify you before doing so.

• Account creation and management: We use your identity, contact, and credential data to create and manage your 399bde account, verify your identity at registration, and maintain the accuracy and security of your account over time.
• Age and identity verification (KYC): We use your identity data and financial data to comply with our obligation to verify that all players are at least 18 years of age and to confirm the ownership of payment methods before processing withdrawals. KYC is a mandatory step for all withdrawal requests.
• Payment processing: We use your financial data to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. Financial data is shared with these payment partners only to the extent necessary to execute your transaction.
• Delivering gaming services: We use your gaming activity data to provide casino games, sports betting markets, and platform features. Game session data is also used to calculate bonus eligibility, wagering requirement progress, and promotional rewards.
• Fraud detection and prevention: We use technical data, financial data, and gaming activity data to detect and investigate potentially fraudulent activity, including multi-accounting, bonus abuse, money laundering, and chargebacks. Automated systems may flag unusual patterns for manual review by our security team.
• Responsible gaming enforcement: We use your gaming activity data and responsible gaming data to enforce deposit limits, cooling-off periods, and self-exclusion restrictions you have set. We may also proactively reach out if our systems detect patterns consistent with problem gambling behaviour.
• Customer support: We use your contact data and communications data to respond to your support enquiries, resolve disputes, and manage complaints.
• Platform improvement and analytics: We use aggregated, anonymised usage data and technical data to understand how players interact with 399bde, identify usability issues, and improve the platform's features and performance. This analysis is performed on aggregate data sets that cannot identify individual players.
• Legal compliance and regulatory obligations: We may process and disclose your personal data where required by applicable Bangladesh law, court order, or a request from a competent regulatory or law enforcement authority.
• Promotional communications (with consent): If you have opted in to receiving marketing communications during registration or through your account settings, we may use your contact data to inform you of relevant promotions, seasonal offers (such as Eid and Pohela Boishakh bonuses), and BPL cricket betting specials. You may withdraw this consent at any time by contacting support or updating your account notification preferences.

Legal Basis for Processing

Every instance of personal data processing by 399bde is underpinned by one or more recognised legal bases. The primary legal bases we rely upon are as follows:

• Contractual necessity: The majority of our data processing is necessary to perform the contract between you and 399bde — specifically, to operate your account, process your transactions, and deliver gaming services. Without processing your identity, financial, and gaming data, we could not provide the service you have registered for.
• Legal obligation: Certain processing activities — particularly KYC/identity verification and the retention of transaction records — are required by applicable laws governing financial services and anti-money-laundering (AML) obligations. We must process and retain this data to remain compliant regardless of your preferences.
• Legitimate interests: We process technical data and usage data to detect fraud, prevent multi-accounting, secure the platform, and conduct aggregate analytics for service improvement. These activities serve our legitimate business interests and the interests of our player community, and do not override your fundamental privacy rights.
• Consent: Where we send you promotional marketing communications, we rely on your prior consent. You may withdraw this consent at any time without affecting the legality of processing carried out before withdrawal. Withdrawal of marketing consent does not affect your ability to use the 399bde platform.

Data Sharing & Third Parties

399bde does not sell or rent your personal data to any third party. We share your data only where necessary to deliver services, comply with legal obligations, or protect the platform. The following categories of third parties may receive limited personal data for the purposes described.

All third-party partners who process personal data on behalf of 399bde are contractually required to handle that data in accordance with applicable data protection standards, to implement appropriate technical and organisational security measures, and to process the data solely for the purposes defined in their agreement with 399bde. They may not use player data for their own independent purposes.

Cookies & Tracking Technologies

399bde uses cookies and similar browser-based technologies to make the platform function correctly, maintain the security of your session, and understand how players use the site at an aggregate level. The following table explains each category of cookie we use.

What We Do Not Use

399bde does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or behavioural profiling networks. We do not place cookies from Google Ads, Meta Pixel, TikTok Pixel, or any other advertising platform on our site. Our analytics are conducted using first-party data only.

Managing Cookies

You can manage and delete cookies through your browser's settings at any time. Be aware that disabling strictly necessary cookies will prevent you from logging in to your 399bde account. For guidance on managing cookies in your specific browser, consult your browser's official help documentation. Most modern browsers — including Chrome on Android, which is widely used by players in Dhaka, Chittagong, and Sylhet — provide straightforward cookie management controls in the Settings menu.

Data Retention Periods

399bde retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention schedule applies to the main categories of personal data we process.

When a retention period expires, personal data is either securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised aggregate data may be retained indefinitely for statistical and platform improvement purposes.

Security Measures

399bde takes the security of your personal data seriously and implements a layered set of technical and organisational safeguards designed to protect against unauthorised access, accidental loss, disclosure, or destruction. Our security programme includes the following measures.

• SSL/TLS encryption in transit: All data transmitted between your browser or mobile device and 399bde's servers is encrypted using TLS 1.2 or higher, preventing interception of data in transit.
• AES-256 encryption at rest: Sensitive data stored on our servers — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption. Passwords are never stored in plain text; they are hashed using a cryptographically strong one-way algorithm with unique per-account salts.
• Access controls: Access to production systems and player data is restricted to authorised personnel whose job roles require it. Role-based access controls (RBAC) are enforced, and all administrative access is logged and audited.
• Two-factor authentication (2FA): 399bde offers SMS OTP-based 2FA for all player accounts. We strongly encourage all players to enable 2FA to significantly reduce the risk of unauthorised account access.
• Intrusion detection and monitoring: Our infrastructure is monitored 24/7 by automated intrusion detection systems. Anomalous activity — including unusual login patterns, large-volume data queries, and unexpected administrative actions — triggers alerts for immediate investigation.
• Regular security assessments: 399bde conducts periodic internal security reviews and vulnerability assessments of our platform and infrastructure. Identified vulnerabilities are prioritised and remediated according to their severity rating.
• Data breach response: In the event of a personal data breach that poses a risk to the rights of affected players, 399bde will notify affected players via their registered contact details without undue delay, providing details of the nature of the breach, the data categories involved, and the remediation steps taken.

Your Rights as a Player

As a 399bde player, you hold a number of rights in relation to the personal data we hold about you. We are committed to honouring these rights promptly and transparently. To exercise any of the rights described below, please contact our support team at [email protected] with the subject line "Privacy Request — [Right Type]". We will acknowledge your request within 48 hours and respond substantively within 14 business days.

• Right of access: You have the right to request a copy of the personal data 399bde holds about you, along with information about how it is processed. We will provide this information in a clear, structured format. The first access request in any 12-month period is provided free of charge.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. For account details such as your mobile number or email address, you may update these directly in your account settings without contacting support.
• Right to erasure ("right to be forgotten"): In certain circumstances — for example, where data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies — you may request that we delete your personal data. Please note that this right is not absolute: we may be required to retain certain data for legal compliance reasons (see Section 7 on retention periods), in which case we will explain why full erasure is not possible.
• Right to restriction of processing: You may request that we restrict the processing of your data — meaning we continue to store it but do not actively use it — in circumstances such as where you contest the accuracy of the data or have objected to processing pending verification of whether our legitimate interests override yours.
• Right to data portability: You have the right to receive a copy of your personal data in a structured, machine-readable format (e.g., JSON or CSV) so that you can, if you wish, transfer it to another service provider. This right applies to data you have directly provided to us and which is processed on the basis of contract or consent.
• Right to object to processing: Where we process your personal data on the basis of legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw marketing consent: If you have consented to receiving marketing communications from 399bde, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of communications sent prior to withdrawal. Following withdrawal, your contact details will be suppressed from our marketing lists within 5 business days.

Changes to This Privacy Policy

399bde reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes to this policy, we will notify registered players via their registered email address or through a prominent in-platform notification at least 7 days before the revised policy takes effect.

For minor, non-material changes — such as typographical corrections, clarifications that do not alter your rights or our core processing practices, or the addition of a new data table row that is consistent with existing processing — we may update the policy without advance notice beyond updating the "Last Updated" date at the top of this page.

Your continued use of the 399bde platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should stop using the platform and may request account closure in accordance with the Terms & Conditions. All data retained after account closure will continue to be handled in accordance with the retention periods set out in Section 7 above.

We encourage you to review this Privacy Policy periodically — particularly after receiving a change notification — to stay informed about how 399bde protects your personal information. The current version of this Privacy Policy, including its effective date, is always available at https://399bde.app/privacy-policy.