cd999 Privacy Policy

This Privacy Policy ("Policy") is issued by cd999 ("cd999", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the cd999 website at https://cd999.io, any associated subdomains, the cd999 mobile interface, and all services and features accessible through those platforms (collectively, the "Platform").

This Policy explains: what personal data cd999 collects about you; why and how that data is used; with whom it may be shared; how long it is retained; and what rights you have to access, correct, export, or request deletion of your data. Reading this Policy in full before registering an account or using the cd999 Platform is strongly recommended.

This Policy should be read alongside the cd999 Terms & Conditions and Responsible Gaming Policy, all of which together form the complete agreement governing your relationship with cd999. By registering an account or continuing to use the cd999 Platform, you acknowledge that you have read and understood this Privacy Policy.

cd999 acts as the data controller in respect of all personal data collected through the Platform. As data controller, cd999 determines the purposes for which your personal data is collected and the means by which it is processed. All data rights requests, privacy complaints, and data-related enquiries should be directed to the cd999 data support team using the contact details set out in Section 14 of this Policy.

cd999 operates under the brand name "cd999" and delivers its services to players located in Bangladesh. All references to "cd999", "we", "us", and "our" in this Policy refer to the data controller entity operating the cd999 Platform.

cd999 collects the following categories of personal data in connection with your account and use of the Platform:

cd999 does not collect or process special category data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data used for identification, or health data) except where a player voluntarily discloses health-related information in the context of a responsible gaming support request, in which case that information is handled with the highest level of confidentiality and used solely to provide the requested support.

cd999 collects your personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, or voluntarily update your account profile.
• Automatically through platform use: Technical and behavioural data is collected automatically when you access the cd999 Platform, including through server logs, session tracking, and analytics tools. This includes IP addresses, device identifiers, and gameplay data.
• From third-party verification providers: Where cd999 engages regulated third-party KYC or identity verification services to confirm the accuracy of the documents you provide, those providers may return data confirming or supplementing your submitted identity information.
• From payment providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment provider confirms transaction details including the registered account holder name and transaction reference to cd999's payment gateway.
• From fraud and risk detection systems: cd999's automated fraud monitoring systems generate risk scores and flags based on combinations of technical and behavioural data. These are used internally by the cd999 compliance team and are not shared externally.

cd999 processes your personal data on one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and cd999 — including account creation, payment processing, game delivery, and withdrawal handling. Without this processing, cd999 cannot provide you with platform access.
• Legal obligation: Processing required for cd999 to comply with applicable legal obligations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and record-keeping mandates. cd999 cannot waive these obligations even at a player's request.
• Legitimate interests: Processing carried out for cd999's legitimate business interests, including fraud detection, platform security, abuse prevention, and internal analytics to improve service quality — provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — principally for optional marketing communications such as promotional emails and SMS notifications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

cd999 uses your personal data for the following specific purposes:

• Account management: Creating, maintaining, and securing your cd999 account, processing password resets, and verifying your identity at login.
• Payment processing: Processing deposits and withdrawal requests, reconciling transactions, and resolving payment disputes or discrepancies.
• KYC and AML compliance: Verifying your identity and age before account activation and on an ongoing basis as required by compliance obligations. Monitoring transaction patterns for indicators of money laundering or financial crime.
• Fraud prevention and platform security: Detecting and preventing fraudulent account activity, bonus abuse, collusion, and unauthorised account access. Investigating suspected breaches of the cd999 Terms & Conditions.
• Customer support: Responding to your enquiries, complaints, and requests via live chat, email, and WhatsApp. Maintaining records of support interactions for quality assurance purposes.
• Responsible gaming: Identifying behavioural patterns that may indicate problem gambling and, where relevant, proactively reaching out to offer responsible gaming tools or support. Enforcing self-exclusion requests and deposit limits.
• Platform analytics and improvement: Using anonymised and aggregated behavioural data to understand how the Platform is used, identify technical issues, and improve user experience. Individual player data is not used for this purpose in an identifiable form.
• Marketing communications (consent-based): Sending promotional emails, SMS notifications, or in-platform messages about bonuses, new games, and seasonal offers — only where you have provided explicit consent to receive such communications.

cd999 does not use automated decision-making processes that produce legal or similarly significant effects for individual players, other than risk-scoring systems used to flag accounts for human review by the compliance team. No fully automated decision to permanently close or ban an account is made without human review.

cd999 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. Personal data is shared only in the following limited and controlled circumstances:

• Identity and KYC verification providers: Regulated third-party verification services that assist cd999 in confirming the authenticity of identity documents submitted by players. These providers are contractually bound to use the data only for the verification purpose and to maintain appropriate security standards.
• Payment processing partners: bKash, Nagad, Rocket, Upay, and partner banks receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy frameworks and are independently regulated by Bangladesh Bank.
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game studios may receive a session token and anonymised player identifier to deliver their game content to your device. These providers do not receive your full identity or payment data.
• Fraud detection and security services: cd999 may share technical data (such as IP addresses and device fingerprints) with fraud intelligence services to identify and block malicious actors. No identity or payment data is included in these exchanges.
• Legal and regulatory authorities: Where cd999 is required by applicable law, court order, or regulatory direction to disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities, it will do so in accordance with the applicable legal requirements and will, where legally permissible, notify the affected player.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of cd999's business or assets, player data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

cd999 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential session cookies: These cookies are necessary for the Platform to function correctly. They maintain your login session, store your authentication token securely, and prevent cross-site request forgery attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Security cookies: Used to detect and prevent suspicious activity such as account takeover attempts, unusual login patterns, and bot traffic. These are functional security tools, not tracking tools.
• Analytics cookies (anonymised): cd999 uses anonymised analytics to understand aggregate user behaviour — such as which pages are most visited and where users encounter technical errors. These cookies do not identify individual users and the resulting data is used exclusively to improve the Platform.

cd999 does not use:

• Third-party advertising cookies or pixel trackers from ad networks.
• Cross-site tracking cookies that follow your browsing activity on other websites.
• Social media tracking pixels (e.g., Facebook Pixel, Twitter Pixel).
• Fingerprinting scripts designed to identify your device across sessions without a cookie.

You may control cookie settings through your browser's privacy preferences. Blocking essential session cookies will prevent you from logging in to your cd999 account. Blocking analytics cookies will not affect your ability to use the Platform.

cd999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention guidelines apply:

• Active account data: Retained for the full duration of your active account relationship with cd999 and for a minimum of five (5) years following permanent account closure, in compliance with AML record-keeping obligations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, consistent with financial record-keeping requirements applicable in Bangladesh.
• KYC verification documents: Retained for a minimum of five (5) years following account closure. In cases where a fraud or AML investigation was initiated, documents may be retained for the duration of the investigation and any subsequent legal proceedings.
• Customer support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, to demonstrate compliance with consent obligations.
• Technical and analytics data: Anonymised after thirteen (13) months from collection. Raw technical log data is deleted after ninety (90) days unless retained for an active security investigation.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and research purposes, as it can no longer be linked to any individual.

cd999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and cd999 servers is protected by TLS 1.2 or higher, providing 256-bit AES encryption for all communications.
• Encryption at rest: Sensitive personal data stored in cd999 databases — including identity documents, payment details, and KYC records — is encrypted at rest using industry-standard encryption protocols.
• Access controls: Access to personal data within cd999's systems is restricted on a strict need-to-know basis. Staff with access to player data are subject to background screening, confidentiality obligations, and mandatory data protection training.
• Two-factor authentication: All internal cd999 systems that hold personal data require two-factor authentication for staff access. Players are strongly encouraged to enable two-factor authentication on their own accounts.
• Regular security audits: cd999 conducts periodic internal security reviews and works with third-party security specialists to perform penetration testing and vulnerability assessments on the Platform infrastructure.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cd999 will notify affected players without undue delay, providing clear information about what data was affected, what actions have been taken, and what steps you should take to protect yourself.

As a cd999 player, you have the following rights in respect of your personal data. These rights may be subject to certain conditions and exemptions as permitted by applicable data protection law:

• Right of access: You may request a copy of the personal data cd999 holds about you, along with information about how it is processed and with whom it is shared. cd999 will respond to access requests within 30 days of receipt.
• Right to rectification: If any personal data cd999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account details (such as email address and phone number) directly through your account settings.
• Right to erasure: In certain circumstances, you may request that cd999 delete your personal data. This right applies where the data is no longer necessary for the purpose it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where processing was unlawful. Note that cd999 cannot delete data that it is legally required to retain under AML or financial record-keeping obligations.
• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request that cd999 provide your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You may object at any time to processing carried out on the basis of legitimate interests, including any profiling based on legitimate interests. cd999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to restrict processing: You may request that cd999 restrict the processing of your personal data in specific circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being evaluated.

To exercise any of the above rights, please contact the cd999 data support team at [email protected] with the subject line "Data Rights Request", your registered account username, and a clear description of the right you wish to exercise. cd999 may need to verify your identity before processing your request.

The cd999 Platform is strictly intended for adults aged 21 years and over. cd999 does not knowingly collect, store, or process personal data relating to individuals under the age of 21. If cd999 discovers that it has inadvertently collected data from a person under 21, that account will be immediately suspended, all associated data will be securely deleted, and any deposits made by that individual will be returned through the original payment method.

If you are a parent or guardian and believe that a minor under your care has registered a cd999 account or provided personal data to cd999 without your consent, please contact us immediately at [email protected] so that we can take appropriate action.

cd999 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — cd999 will provide at least fourteen (14) days' advance notice to registered players via their registered email address or through a prominent in-platform notification.

Non-material changes, such as corrections to typographical errors or clarifications of existing provisions that do not reduce your rights, may take effect immediately upon publication without advance notice. The effective date displayed at the top of this document will always reflect when the current version of the Policy came into force.

Players are encouraged to review this Privacy Policy periodically, particularly after receiving a change notification. Continued use of the cd999 Platform after an updated Privacy Policy has taken effect constitutes your acknowledgement of and agreement to the revised terms.

For all privacy-related enquiries, data rights requests, or concerns about how cd999 handles your personal data, please contact the cd999 data support team through the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request" for faster routing to the appropriate team.
• Live Chat: Available 24 hours a day, 7 days a week from the cd 999 Platform. Average response time is 2–5 minutes.
• WhatsApp: The dedicated WhatsApp support number is available within your cd999 account dashboard after login.

When submitting a data rights request, please include your registered account username, the email address associated with your account, and a clear description of the request or concern. cd999 will acknowledge all written data rights requests within 24 hours (Bangladesh Standard Time, UTC+6) and provide a substantive response within 30 days of receipt.

If you believe cd999 has failed to handle your personal data in accordance with this Privacy Policy or applicable data protection law, you have the right to raise a formal complaint. cd999's internal complaints process will review your complaint and provide a written response within 10 business days. If you remain unsatisfied with cd999's response, you may escalate your complaint to the relevant data protection authority in your jurisdiction.