Privacy Policy — 399 bad

When you use the 399 bad platform, we collect personal data in three primary ways: data you provide directly during registration and use, data generated automatically by your interactions with the platform, and data received from trusted third-party service providers such as payment processors and identity verification services.

Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number, and preferred username when you create a 399 bad account.
• Identity verification data: Copies of government-issued identification (National ID card, passport, or driving licence), proof of address documents (utility bills, bank statements), and any selfie photographs submitted during the KYC verification process.
• Payment data: Mobile wallet numbers (bKash, Nagad, Rocket, Upay), bank account details, and card numbers (Visa, Mastercard) provided for deposits and withdrawals. Full card numbers are never stored directly on 399 bad servers — they are tokenised via our payment processor.
• Communication data: Messages, emails, and chat transcripts exchanged between you and the 399 bad support team.
• Responsible gaming data: Self-exclusion requests, deposit limit settings, cooling-off period activations, and any other voluntary data you provide when using our responsible gaming tools.

Data Collected Automatically

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage and behavioural data: Pages visited, time spent on each page, games played, bet amounts and outcomes, search queries within the platform, and click-path data.
• Session data: Login timestamps, session duration, and logout events.
• Cookie and tracking data: Data collected via first-party cookies, session cookies, and similar technologies as described in the Cookies section below.

Data Received from Third Parties

• Payment providers: Transaction confirmation data, payment status updates, and fraud risk scores from bKash, Nagad, Rocket, Upay, Visa, and Mastercard networks.
• Identity verification providers: Verification outcomes and document authenticity assessments from our KYC partner services.
• Fraud prevention services: Risk signals and device fingerprint data from third-party fraud detection platforms used to protect the integrity of the 399 bad platform.

399 bad does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data is shared only in the following strictly defined circumstances, and always subject to appropriate data protection safeguards.

Payment Processing Partners

To process your deposits and withdrawals, 399 bad shares the minimum necessary payment data with authorised payment processors including bKash, Nagad, Rocket, Upay, and the card networks (Visa and Mastercard). These partners process your data solely to execute payment transactions and are bound by their own regulatory obligations regarding data security and confidentiality.

Identity Verification Providers

During the KYC process, 399 bad may share your identity documents and associated personal data with a third-party identity verification service. This provider operates solely to verify the authenticity of your documents and confirm your identity. Verified data is then returned to 399 bad for compliance record-keeping; it is not retained by the verification provider beyond their operational requirements.

Game Technology Providers

Casino game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a unique anonymised player identifier and session token in order to deliver their games within the 399 bad platform. These providers do not receive your real name, contact details, payment information, or identity documents. Their access to data is limited strictly to what is necessary to operate the game session.

Fraud Prevention and Security Services

399 bad works with specialist fraud detection platforms that may receive device fingerprint data, IP addresses, and behavioural signals to assess transaction and account risk. All such partners are contractually obligated to use this data only for fraud prevention purposes on behalf of 399 bad and are prohibited from processing it for their own commercial use.

Legal and Regulatory Disclosure

399 bad may be required to disclose personal data to competent authorities, law enforcement bodies, or financial intelligence units in response to a lawful order, court order, or legal process. In such cases, 399 bad will disclose only the minimum data required to satisfy the legal obligation. Where legally permissible, we will notify the affected player of such a disclosure request.

399 bad retains your personal data for as long as your account remains active and for a defined period thereafter, in accordance with our legal and regulatory obligations. The retention periods set out below represent the standard timeframes applied to each category of data.

• Account and registration data: Retained for the duration of your account and for a minimum of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Identity verification documents: Retained for a minimum of 5 years from the date of verification, or for 5 years from account closure, whichever is later.
• Transaction and betting records: Retained for a minimum of 5 years from the date of each transaction, in line with applicable financial record-keeping regulations.
• Support communications: Retained for 2 years from the date of the last communication in a given support thread, unless the communication relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of your marketing opt-in and for 1 year following any withdrawal of consent, as evidence of the consent status.
• Anonymised analytics data: May be retained indefinitely as it cannot be linked to any identifiable individual.

Once the applicable retention period has expired and there is no continuing legal obligation to retain the data, 399 bad will securely delete or anonymise your personal data within 90 days. Deletion is carried out in a manner that renders the data permanently irrecoverable.

As a player on the 399 bad platform, you have a number of rights with respect to your personal data. These rights are set out below along with guidance on how to exercise each one. All privacy rights requests should be submitted in writing to [email protected] with the subject line "Privacy Rights Request" and your registered account username included for verification purposes.

Right to Access

You have the right to request a copy of the personal data 399 bad holds about you. We will provide a structured summary of all data categories held, the purposes for which they are processed, and the retention periods that apply, within 30 days of a verified request.

Right to Rectification

If any personal data held by 399 bad about you is inaccurate or incomplete, you have the right to request that it be corrected. For account data such as your registered email address or mobile number, you may be able to update this directly within your account settings. For identity and payment data, corrections must be submitted via the support team along with supporting documentation.

Right to Erasure

In certain circumstances, you have the right to request that 399 bad delete your personal data. This right applies where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Please note that erasure requests cannot be fulfilled where 399 bad is required by law to retain the data — for example, transaction records subject to anti-money laundering retention obligations.

Right to Restrict Processing

You may request that 399 bad restrict the processing of your personal data in specific circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed. During a restriction period, 399 bad will store but not actively process the relevant data.

Right to Object to Marketing

You have an absolute right to object to the use of your personal data for direct marketing purposes at any time. To exercise this right, contact [email protected] or update your notification preferences within your account settings. 399 bad will cease marketing communications within 5 working days of receiving your objection.

Right to Withdraw Consent

Where 399 bad processes your data on the basis of your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.