299db Privacy Policy

This Privacy Policy describes how 299db ("299db", "we", "us", "our") collects, uses, stores, shares, and protects personal data provided by or obtained about individuals ("you", "your", "player") who access or use the 299db platform available at 299db.io, including all associated casino games, sports betting services, account management features, and customer support channels.

This policy applies to all players based in Bangladesh and to any other individuals whose personal data is processed by 299db in connection with the delivery of our Services. It should be read alongside our Terms & Conditions, which govern the overall relationship between you and 299db.

By registering an account with 299db, using the platform, or otherwise interacting with our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this policy, you should not use the 299db platform.

299db collects personal data from you in three ways: data you provide directly when registering or using the platform, data generated automatically through your use of the platform, and data obtained from trusted third-party sources such as KYC verification providers and payment processors.

Data you provide directly:

• Registration data: Full legal name, date of birth, gender, residential address in Bangladesh (including district, division, and postcode), email address, and mobile phone number.
• Identity verification (KYC) data: Copies of your National Identity Card (NID), passport, or other government-issued identity document; selfie photographs; and proof of address documents such as utility bills or bank statements.
• Payment data: Mobile financial service numbers (bKash, Nagad, Rocket, Upay), bank account details, and card information (where card payments are used). Full card numbers are not stored by 299db — they are processed directly by PCI-DSS-compliant payment partners.
• Communications data: Records of your interactions with our customer support team via live chat or email, including the content of those communications.
• Responsible gaming data: Any deposit limits, session limits, cooling-off periods, or self-exclusion requests you submit through your account settings.

Data generated automatically:

• Device and connection data: IP address, device type, operating system, browser type and version, screen resolution, and mobile network information.
• Usage data: Pages visited, games played, bet amounts, session duration, login timestamps, and click-path data within the platform.
• Transaction data: Full history of deposits, withdrawals, bonuses claimed, bets placed, and game results associated with your account.
• Cookie and tracking data: Information collected via cookies and similar technologies as described in Section 8 of this policy.

Data from third-party sources:

• Identity verification results and fraud-risk scores from our KYC and anti-money-laundering (AML) service partners.
• Payment confirmation and transaction status data from bKash, Nagad, Rocket, Upay, and card-payment processing partners.
• Publicly available information where relevant to fraud prevention or account security investigations.

299db uses the personal data it collects for the following clearly defined purposes:

299db does not use your personal data for automated decision-making that produces significant legal effects without human review. Where profiling is used to personalise promotional content, you have the right to opt out as described in Section 9.

299db processes your personal data on the following legal grounds, depending on the specific processing activity involved:

• Contractual necessity: The majority of processing activities — including account management, payment processing, KYC verification, and delivery of gaming Services — are necessary for the performance of the contract between you and 299db as set out in our Terms & Conditions.
• Legal obligation: Certain processing activities, including AML screening, age verification, and retention of transaction records, are required by applicable law and regulatory obligations. 299db must carry out this processing regardless of consent.
• Legitimate interests: 299db processes some data — including fraud detection analytics, platform security monitoring, and internal reporting — on the basis of its legitimate interests as a business operator, provided those interests are not overridden by your privacy rights.
• Consent: Where 299db sends you marketing communications or uses non-essential cookies, this processing is based on your consent. You may withdraw this consent at any time through your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

299db does not sell or rent your personal data to any third party. We share your data only in the following limited circumstances, and only to the minimum extent necessary for each purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card-payment processing partners receive the payment-related data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are contractually bound to protect your data.
• KYC and AML partners: Identity verification and anti-money-laundering screening services receive the identity documents and personal details necessary to complete verification checks required by law and by our operational standards.
• Game technology providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised session and gameplay data necessary to deliver their games through the 299db platform. These studios do not receive your full identity data.
• IT infrastructure and security providers: Hosting, cloud storage, and cybersecurity service providers who process data on our behalf under strict data-processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory direction, 299db may be required to disclose personal data to government agencies, law enforcement, or regulatory bodies. We will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of business assets, personal data held by 299db may be transferred to the acquiring entity. Affected players will be notified in advance of any such transfer.

299db's primary operations and data storage are oriented toward serving players in Bangladesh. Some of our third-party service partners — including game technology providers and cloud infrastructure vendors — may process data on servers located outside Bangladesh.

Where personal data is transferred outside Bangladesh, 299db takes steps to ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under applicable data protection principles. These safeguards may include contractual data-transfer agreements incorporating standard data protection clauses, or reliance on the recipient country's adequacy status where recognised.

If you would like further information about the specific safeguards applied to international transfers of your data, please contact our support team at [email protected].

299db retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or operational obligations. The following general retention periods apply:

• Account and registration data: Retained for the full duration of your active account plus a period of five (5) years following account closure, to satisfy AML record-keeping requirements and to handle any post-closure disputes.
• KYC and identity documents: Retained for five (5) years from the date of submission or from account closure, whichever is later, in accordance with financial crime prevention obligations.
• Transaction and payment records: Retained for seven (7) years from the date of each transaction, in accordance with financial record-keeping best practices.
• Customer support communications: Retained for three (3) years from the date of each interaction, unless the communication relates to an ongoing dispute, in which case it is retained until the dispute is fully resolved plus one (1) year.
• Marketing consent records: Retained for the duration of the consent plus two (2) years, to provide evidence of consent in the event of a complaint.
• Cookie and analytics data: Session cookies expire at the end of your browser session. Persistent cookies expire on the schedule set out in our cookie management settings, typically between thirty (30) days and twenty-four (24) months depending on the cookie type.

When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be associated with any individual player. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

299db uses cookies — small text files stored on your device by your browser — and similar technologies including local storage and session tokens to deliver, maintain, and improve the platform. The following categories of cookies are used on the 299db platform:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming limit settings to personalise your experience on return visits.
• Analytical cookies: Collect anonymised data about how players use the platform — including which games are most popular, which pages generate the most traffic, and how players navigate between sections — to help us improve the platform. This data is aggregated and not used to identify individual players.
• Marketing cookies: Where you have consented, these cookies allow 299db to deliver promotional content and bonus offers relevant to your gameplay history and preferences. Marketing cookies do not share personally identifiable data with external advertising networks.

You can manage your cookie preferences through your browser settings. Disabling cookies beyond the strictly necessary category may affect the functionality of certain platform features. For detailed information about the specific cookies we use and their individual expiry periods, contact our support team.

As a player whose personal data is processed by 299db, you have the following rights in relation to that data. To exercise any of these rights, contact our support team at [email protected]. We will respond to all data-rights requests within five (5) business days.

• Right of access: You have the right to request a copy of the personal data 299db holds about you, along with information about how it is being processed. We will provide this in a clear, readable format.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update many data fields directly through your account settings without needing to contact support.
• Right to erasure: You may request that 299db delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Where legal or regulatory requirements prevent full deletion, we will inform you of the specific data we are required to retain and for how long.
• Right to restrict processing: In certain circumstances — for example, where you contest the accuracy of data we hold, or where you have objected to processing pending verification of our legitimate grounds — you may request that we restrict active processing of your data while the matter is resolved.
• Right to data portability: You have the right to receive a copy of personal data you have provided to 299db in a structured, commonly used, and machine-readable format, and to request that we transmit it directly to another service provider where technically feasible.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for marketing purposes. If you object to marketing communications, you can unsubscribe at any time via your account settings or by contacting support.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

The 299db platform is strictly for adults aged 21 years and above. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21. Our registration process includes mandatory age declaration and KYC age verification to prevent underage access.

If 299db becomes aware that personal data has been collected from an individual under the age of 21 — whether through self-declaration, KYC results, or any other means — the associated account will be immediately suspended, all transactions will be reviewed, and the personal data in question will be deleted in accordance with our data retention policy for underage access cases.

If you are a parent or guardian and believe that a minor in your care has registered on the 299db platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

299db implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and the 299db platform is encrypted using industry-standard TLS protocols, ensuring that your personal and financial data cannot be intercepted in transit.
• Encrypted data storage: Personal data stored in 299db's databases is encrypted at rest using AES-256 encryption. This includes identity documents, payment information, and account credentials.
• Access controls: Access to systems holding personal data is restricted to authorised 299db personnel on a role-based, need-to-know basis. All internal access is logged and audited.
• Multi-factor authentication: Internal administrative systems require multi-factor authentication. Players are encouraged to enable two-factor authentication (2FA) on their 299db accounts for additional security.
• Regular security reviews: 299db conducts periodic internal security assessments and works with independent security professionals to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that is likely to affect your rights or interests, 299db will notify affected players promptly and take immediate remediation steps.

While 299db takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You play an important role in keeping your account secure by maintaining a strong, unique password and by not sharing your login credentials with any third party.

299db reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our Services. The effective date at the top of this document indicates when the policy was last reviewed.

Where changes are material — meaning they substantially alter your rights or the way we process your personal data — 299db will provide advance notice of at least seven (7) days via in-platform notification or by email to your registered address, prior to the changes taking effect.

Non-material changes, such as typographical corrections, clarifications, or updates to contact details, may be made without advance notice. We encourage you to review this Privacy Policy periodically to remain informed about how 299db protects your data.

If you have any questions about this Privacy Policy or about how 299db processes your personal data, please contact our support team at [email protected]. Our team is available 24 hours a day, 7 days a week, and is committed to responding to all privacy-related enquiries within five (5) business days.