bm999 Privacy Policy

1 Data We Collect

bm999 collects personal data from players through a number of channels: directly via the registration and verification process, automatically through your use of the platform, and occasionally from trusted third-party partners where necessary for compliance or fraud prevention purposes. This section describes each category of data in detail.

1.1 Registration & Identity Data

When you create a bm999 account, we collect the following information that you provide voluntarily:

• Full legal name as it appears on your government-issued identification document.
• Date of birth to verify that you are aged 18 or above at the time of registration.
• Residential address including street, city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or other), and postal code.
• Email address used to communicate account notices, transaction confirmations, and (where opted in) promotional offers.
• Mobile number used for OTP verification, account security, and (where opted in) SMS notifications.
• Username and password (passwords are stored in hashed, salted form — they are never stored in plain text).

1.2 Identity Verification (KYC) Documents

During the Know Your Customer (KYC) verification process, bm999 may request copies of the following documents:

• A government-issued photo ID such as a National Identity Card (NID), passport, or driving licence.
• A proof of address document such as a utility bill, bank statement, or mobile wallet statement dated within three months of the request.
• Proof of payment method ownership, such as a screenshot of your bKash or Nagad account showing your registered name and mobile number.

KYC documents are stored securely and accessed only by authorised bm999 compliance personnel. Documents are retained for the period required by applicable anti-money laundering regulations and are securely deleted thereafter.

1.3 Financial Transaction Data

When you make a deposit or withdrawal using bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard, bm999 records the following transaction details:

• Transaction amount in BDT (Bangladeshi Taka).
• Transaction date, time, and reference number.
• Payment method type and (where applicable) the last four digits of the card or registered mobile number associated with the payment account.
• Deposit and withdrawal status logs for auditing and dispute resolution purposes.

bm999 does not store full payment card numbers, CVV codes, or mobile wallet PINs on its own servers. All sensitive payment data is processed by our PCI-DSS compliant payment partners.

1.4 Technical & Usage Data

When you access bm999 via a browser or mobile device, our servers automatically record certain technical data to ensure platform security and improve performance:

Data Type	Purpose	Retention Period
IP address	Fraud detection, geo-compliance, security logging	12 months
Device type & OS	Platform optimisation and compatibility	12 months
Browser type & version	Technical support and session management	12 months
Session timestamps	Security audit trail, responsible gaming monitoring	24 months
Pages visited & features used	Product analytics and UX improvement	24 months
Game play history	Account statement, dispute resolution, bonus tracking	5 years

2 How We Use Your Data

bm999 uses the personal data it collects only for the specific purposes described below. We do not process your data for any purpose that is incompatible with those listed here without first obtaining your explicit consent.

2.1 Account Management

Your registration data is used to create and maintain your bm999 player account, authenticate your identity at login, process deposits and withdrawals to and from your account balance, and communicate essential account notices such as password changes, security alerts, and transaction confirmations.

2.2 Legal & Regulatory Compliance

bm999 is required to collect and retain certain categories of personal data to comply with its obligations under applicable anti-money laundering (AML) frameworks, counter-terrorism financing (CTF) requirements, and age verification duties. This data is shared with relevant authorities only when legally compelled to do so via a valid court order or official regulatory request.

2.3 Fraud Prevention & Security

We analyse usage patterns, IP addresses, device fingerprints, and transaction histories to detect and prevent fraud, account takeovers, bonus abuse, money laundering, and other prohibited conduct described in our Terms and Conditions. Automated systems may flag accounts for manual review where suspicious patterns are identified.

2.4 Responsible Gaming

bm999 uses gameplay data, session duration logs, and deposit frequency records as part of its responsible gaming monitoring programme. This data enables us to identify players who may be showing signs of harmful gambling behaviour and to offer appropriate interventions such as deposit limit prompts or self-exclusion tools. For more information, visit our Responsible Gaming page.

2.5 Marketing Communications

Where you have explicitly opted in to receive marketing communications, bm999 will use your email address and/or mobile number to send promotional offers, bonus announcements, tournament invitations, and seasonal campaigns (such as BPL promotions, Eid bonuses, and Pohela Boishakh special offers). You may withdraw your marketing consent at any time via the unsubscribe link in any email or through your account settings.

2.6 Platform Improvement

Anonymised and aggregated usage data helps bm999 improve the performance, design, and game selection of the platform. This analysis does not identify individual players and is used solely for product development purposes.

3 Data Sharing & Third Parties

bm999 does not sell, rent, or trade your personal data to any third party for commercial purposes. However, in order to operate the platform effectively and comply with legal obligations, we share certain data with the following categories of trusted partners and service providers.

3.1 Payment Processors

To process your deposits and withdrawals, bm999 shares the minimum necessary transaction data with our payment partners including bKash, Nagad, Rocket, Upay, and our card processing partners for Visa and Mastercard transactions. Each payment partner operates under its own privacy policy and data security standards. bm999 selects payment partners who maintain at minimum PCI-DSS Level 1 compliance for card data handling.

3.2 Game Studios & Software Providers

Certain game studios and live casino providers (such as Evolution Gaming, Ezugi, Pragmatic Play, Spribe, Microgaming, and NetEnt) may receive a limited set of session identifiers and game-specific data necessary to render games within the bm999 platform and to resolve any technical disputes regarding game outcomes. These providers do not receive your full name, payment details, or address.

3.3 Identity Verification Partners

To fulfil our KYC and AML obligations, bm999 may use third-party identity verification services. Where such a service is used, your submitted ID documents and personal details are processed under strict data processing agreements that prohibit the partner from using your data for any purpose other than the verification service.

3.4 Legal & Regulatory Authorities

bm999 will disclose personal data to government authorities, law enforcement agencies, or regulatory bodies when required to do so by a valid legal obligation, court order, or official request. We will notify affected players of such disclosures where we are legally permitted to do so.

4 Cookies & Tracking Technologies

bm999 uses cookies and similar tracking technologies to maintain your session, personalise your experience, and analyse how the platform is used. This section explains each category of cookie we deploy and your options for managing them.

4.1 Strictly Necessary Cookies

These cookies are essential for the bm999 platform to function. They maintain your login session, remember your preferred language and currency settings, and ensure that security tokens function correctly. These cookies cannot be disabled without rendering core platform features inaccessible.

4.2 Analytical Cookies

bm999 uses anonymised analytical cookies to understand how players navigate the platform — which pages receive the most visits, how long sessions last, and where players encounter difficulties. This data is processed in aggregate form and does not identify individual users. Analytical cookies can be disabled via your browser settings without affecting your ability to use bm999.

4.3 Functional Cookies

Functional cookies remember your preferences, such as your preferred game lobby view, recently played games, and chat settings in live casino environments. These enhance your experience but are not strictly required for the platform to operate.

4.4 Managing Cookies

You can control or delete cookies through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to stay logged in and use core bm999 features. Guidance on managing cookies in popular browsers is available from the browser vendor's support documentation.

Cookie Category	Can Be Disabled?	Impact If Disabled
Strictly Necessary	No	Login and core features will not work
Analytical	Yes	No impact on platform functionality
Functional	Yes	Preferences will not be saved between sessions

5 Data Retention & Storage

bm999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention principles apply to each major category of data held by bm999.

• Account registration data is retained for the lifetime of your active bm999 account, plus a minimum of five years following permanent account closure to satisfy AML record-keeping requirements.
• KYC identity documents are retained for a minimum of five years from the date of verification, as required by applicable anti-money laundering regulations.
• Financial transaction records are retained for a minimum of five years from the date of each transaction for auditing and regulatory compliance purposes.
• Gameplay history and betting logs are retained for a minimum of five years to support dispute resolution, responsible gaming monitoring, and fraud investigations.
• Technical and session logs are retained for 12 to 24 months depending on the specific data category, as detailed in the table in Section 1.4.
• Marketing consent records are retained for three years from the date of the most recent consent action (opt-in or opt-out) to demonstrate compliance in the event of a complaint.

5.1 Data Storage Location

bm999 stores player data on secure servers. Data may be processed by service providers located outside Bangladesh where such processing is necessary for the operation of the platform (for example, by international game studio servers or global fraud detection systems). In all cases, data transfers to third parties are governed by data processing agreements that require the recipient to maintain security standards equivalent to those applied by bm999.

5.2 Deletion Requests

Where you request deletion of your personal data, bm999 will evaluate the request against its legal retention obligations. Data that must be retained under AML or regulatory requirements cannot be deleted prior to the expiry of the legally mandated retention period. All other data that is no longer required for any legitimate purpose will be securely deleted or anonymised within 30 days of a valid deletion request being received.

6 Your Privacy Rights

As a bm999 player, you have the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact the bm999 support team at the email address listed at the end of this policy. We will acknowledge your request within five business days and complete it within 30 days unless an extension is required, in which case we will notify you in writing.

6.1 Right of Access

You have the right to request a copy of all personal data bm999 holds about you. We will provide this information in a structured, readable format. This includes your account registration details, KYC status, transaction history, and any marketing consent records associated with your account.

6.2 Right to Rectification

If any personal data bm999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your email address or mobile number) can be made directly from your account settings. For corrections to identity data, you may be required to submit supporting documentation.

6.3 Right to Erasure

Subject to bm999's legal retention obligations described in Section 5, you may request that we delete your personal data. We will fulfil this request for all data that we are not legally required to retain. Note that deleting your account data will result in permanent closure of your bm999 account and forfeiture of any bonus funds that have not met applicable wagering requirements.

6.4 Right to Data Portability

You may request a portable export of your personal data in a common machine-readable format (such as CSV or JSON). This export will include your account details, transaction history, and gameplay records for the retention periods specified in Section 5.

6.5 Right to Withdraw Marketing Consent

You may withdraw your consent to receive marketing communications from bm999 at any time. You can do this by clicking the unsubscribe link in any marketing email, by sending an SMS reply of STOP to any marketing message, or by updating your preferences in your bm999 account settings. Withdrawal of marketing consent does not affect your ability to continue using the bm999 platform or receive essential account-related communications.

7 Data Security Measures

bm999 implements a multi-layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, and destruction. The following measures are in place at all times across the bm999 platform.

• SSL/TLS encryption: All data transmitted between your browser or device and the bm999 servers is encrypted using TLS 1.2 or higher, indicated by the padlock icon in your browser's address bar.
• Password hashing: Passwords are never stored in plain text. bm999 uses industry-standard bcrypt hashing with unique salts for every account, making stored password data useless even in the unlikely event of a database breach.
• Two-step verification: Players are encouraged to enable SMS OTP-based two-step verification on their bm999 accounts, adding a second layer of authentication beyond the password.
• Access controls: Access to player personal data within the bm999 organisation is restricted on a strict need-to-know basis. Staff who process player data undergo regular security awareness training.
• Infrastructure security: bm999's hosting infrastructure is protected by firewalls, intrusion detection systems, and regular penetration testing by qualified security professionals.
• Incident response: In the event of a data breach that is likely to result in a risk to player rights, bm999 will notify affected players and relevant authorities within the timeframes required by applicable law.

7.1 Your Role in Keeping Data Secure

While bm999 takes every reasonable precaution to secure your data on its end, security is a shared responsibility. We strongly recommend that you use a unique, strong password for your bm999 account, enable two-step verification, never share your login credentials with any other person, and log out of bm999 when using shared or public devices. If you suspect that your account has been accessed without your authorisation, please contact bm999 support immediately.

8 Changes to This Policy

bm999 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this policy, we will update the "Last Reviewed" date displayed at the top of this page and, where the changes are significant, we will notify registered players by email or via an in-platform notification.

We encourage you to review this page periodically to stay informed about how bm999 protects your personal data. Your continued use of the bm999 platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms.

8.1 Contact & Questions

If you have any questions, concerns, or complaints about this Privacy Policy or about the way bm999 handles your personal data, please contact our support team. We are available 24 hours a day, 7 days a week.

Email: [email protected] (plain text — not a clickable link)