po999 Privacy Policy

01 Introduction

po999 ("we", "us", "our", "the Platform") operates an online sports betting and casino platform accessible at https://po999.io, serving players across Bangladesh. In the course of providing these services, po999 collects and processes personal data relating to registered players and visitors to the Platform.

This Privacy Policy sets out, in clear and precise terms, what personal data po999 collects, the purposes for which that data is used, the legal basis on which it is processed, the circumstances in which it may be shared with third parties, the security measures in place to protect it, and the rights available to individuals with respect to their own personal data.

This policy applies to all users of the po999 Platform regardless of the device or access method used. It applies to personal data collected through the po999 website, any mobile-optimised version of the site, and through direct communications with po999 Customer Support.

This Privacy Policy should be read in conjunction with the po999 Terms & Conditions and Responsible Gaming Policy, both of which are published on the Platform. Where any conflict arises between this Privacy Policy and those documents, this Privacy Policy shall govern in respect of privacy and data protection matters.

02 Data Controller

For the purposes of applicable data protection law, po999 is the data controller in respect of personal data collected through the Platform. As data controller, po999 determines the purposes and means by which your personal data is processed.

If you have any questions, concerns, or requests regarding the handling of your personal data, you may contact po999's data protection contact point by writing to:

03 Personal Data We Collect

po999 collects personal data through multiple channels: directly from you when you register or interact with the Platform, automatically when you browse or use the Platform, and from third-party payment service providers during the processing of deposits and withdrawals.

The categories of personal data we collect are as follows:

Data Category	Specific Data Points	Collection Method
Identity Data	Full name, date of birth, gender, National ID or passport number	Registration form; KYC submission
Contact Data	Bangladesh mobile number, email address (if provided)	Registration form; support communications
Financial Data	Mobile wallet references (bKash, Nagad, Rocket, Upay), transaction IDs, deposit/withdrawal records	Payment processing; transaction logs
Gameplay Data	Bet history, game sessions, wager amounts, outcomes, bonus usage	Automated platform logging
Technical Data	IP address, device identifiers, browser type, OS version, session timestamps (BST)	Automated collection via server logs
Communications Data	Support emails, chat transcripts, dispute records	Direct submission via support channels
KYC Documents	ID document scans, proof of address, wallet ownership screenshots	KYC submission portal

po999 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming request — in which case such disclosure is treated with the highest level of confidentiality and used solely to support the player's wellbeing.

04 How We Use Your Personal Data

po999 uses the personal data it collects for the following specific purposes:

• Account Creation and Management: To register your account, verify your identity, maintain your account settings, and communicate important account-related information to you.
• Age Verification and KYC Compliance: To confirm that you are aged 21 or above and to fulfil our obligations under applicable anti-money-laundering and identity verification requirements. This is a legal obligation that po999 cannot waive.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, and Upay, to maintain accurate transaction records, and to investigate and resolve any payment disputes.
• Service Delivery: To provide access to betting markets, casino games, slot titles, promotional offers, and all other features of the po999 Platform that you are entitled to access.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other forms of abuse on the Platform. Technical data such as IP addresses and device identifiers are central to this purpose.
• Responsible Gaming: To monitor betting patterns for signs of problem gambling, to administer deposit limits, loss limits, cooling-off periods, and self-exclusion requests, and to fulfil our duty of care to players who may be at risk.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide ongoing assistance with your account.
• Platform Improvement: To analyse aggregated and anonymised usage data in order to improve the performance, reliability, and user experience of the po999 Platform. This analysis uses anonymised data only and does not involve decisions made about you as an individual.
• Legal Compliance: To comply with applicable legal obligations, to respond to lawful requests from regulatory or law enforcement authorities, and to enforce po999's Terms & Conditions.

po999 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review, except where expressly permitted by applicable law and disclosed to you in advance.

05 Legal Basis for Processing

po999 processes your personal data on one or more of the following legal bases, depending on the specific purpose of the processing:

• Contractual Necessity: Processing that is required to deliver the services you have contracted for — including account management, payment processing, and gameplay — is carried out on the basis that it is necessary for the performance of our agreement with you.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations — including KYC verification, age verification, and anti-money-laundering screening — is carried out on the basis that it is necessary for compliance with those legal obligations.
• Legitimate Interests: Processing carried out for fraud prevention, security monitoring, responsible gaming oversight, and platform improvement is based on po999's legitimate interests in operating a safe, secure, and compliant platform. In each case, po999 has assessed that these interests are not overridden by your privacy rights.
• Consent: Where po999 sends you optional marketing communications (such as promotional offers and bonus notifications), this is based on your explicit consent. You may withdraw your consent at any time by contacting [email protected]. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

06 Sharing Your Personal Data

po999 does not sell, rent, or commercially transfer your personal data to any third party. We may, however, share your personal data in the following limited and controlled circumstances:

• Payment Service Providers: bKash, Nagad, Rocket, and Upay receive the minimum personal data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are responsible for handling data they receive in their capacity as independent financial service providers.
• Identity Verification Partners: Where po999 uses a third-party KYC technology provider to assist with document verification, that provider will receive the KYC documents you submit. Such providers are engaged under strict contractual data processing terms and are not permitted to use your data for any purpose other than identity verification on po999's behalf.
• Game Content Providers: Third-party game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, and Spribe — may receive anonymised session identifiers necessary to deliver their game content within the po999 platform. These providers do not receive personally identifiable information that would allow them to identify you as an individual.
• Legal and Regulatory Authorities: po999 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by a valid legal obligation, court order, or where po999 reasonably believes disclosure is necessary to prevent fraud, protect the safety of any person, or enforce its Terms & Conditions.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial portion of po999's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy terms applicable to your data under the new ownership before the transfer takes effect.

07 Cookies & Tracking Technologies

po999 uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and support our security and fraud prevention systems. The following types of cookies are in use:

• Strictly Necessary Cookies: These cookies are required for the Platform to function. They enable session management, login authentication, and security token validation. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, game view settings, and responsible gaming limit configurations — so that you do not need to reset them each time you visit.
• Analytics Cookies: po999 uses anonymised analytics data to understand how players navigate the Platform, which features are most used, and where technical issues arise. This data is aggregated and does not identify you as an individual. Analytics are used solely for internal platform improvement purposes.
• Security Cookies: These cookies assist in detecting and preventing fraudulent account access by flagging unusual login patterns, unrecognised devices, or IP address anomalies.

po999 does not use third-party advertising cookies or behavioural targeting cookies that track your activity across other websites. Your browsing behaviour on po999 is not shared with external advertising networks.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features or completing transactions.

08 Data Retention

po999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable legal or regulatory obligations. The following general retention periods apply:

Data Category	Retention Period	Basis
Account & Identity Data	Duration of account + 5 years after closure	Legal / AML compliance
KYC Documents	Duration of account + 5 years after closure	Legal / regulatory obligation
Financial & Transaction Data	7 years from transaction date	Financial records obligation
Gameplay & Betting History	5 years from event date	Dispute resolution / responsible gaming
Technical / Log Data	12 months from collection date	Security monitoring; fraud prevention
Support Communications	3 years from last interaction	Dispute resolution; service quality
Self-Exclusion Records	Indefinite (minimum 6 years)	Responsible gaming; legal safeguard

When a retention period expires, po999 will either securely delete the personal data or irreversibly anonymise it so that it can no longer be linked to any individual. Secure deletion involves overwriting stored data in a manner that prevents recovery. Anonymisation produces aggregated statistical data that carries no personal identifiers.

Where you request deletion of your personal data before the applicable retention period has expired, po999 will honour that request to the fullest extent permitted by law. Where legal retention obligations prevent full deletion, po999 will restrict further processing of the retained data to the minimum necessary to satisfy those obligations, and will delete it as soon as the obligation expires.

09 Security Measures

po999 takes the security of your personal data seriously and has implemented a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and the po999 Platform is encrypted using TLS 1.3. This ensures that your credentials, payment references, and personal information cannot be intercepted by third parties while in transit.
• Encryption at Rest: Personal data and sensitive account information stored on po999's servers is encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management system with strict access controls.
• Access Controls: Access to personal data within po999's internal systems is restricted on a strict need-to-know basis. Staff who require access to personal data to carry out their job functions are granted the minimum level of access necessary. All access events are logged and subject to audit.
• Two-Factor Authentication: po999's internal systems require multi-factor authentication for all staff access. Players are also strongly encouraged to enable two-factor authentication on their accounts to provide an additional layer of account security.
• Penetration Testing: po999 engages independent security professionals to conduct periodic penetration tests and vulnerability assessments of the Platform's infrastructure. Identified vulnerabilities are remediated according to a risk-based priority schedule.
• Incident Response: In the event of a data breach that is likely to result in a risk to affected individuals, po999 will notify affected players promptly and take immediate steps to contain the breach, assess its scope, and prevent recurrence.

While po999 maintains robust security measures, no online platform can guarantee absolute security against all possible threats. Players are responsible for keeping their login credentials confidential and for ensuring that their own devices are adequately secured. If you suspect unauthorised access to your po999 account, contact [email protected] immediately.

10 Your Privacy Rights

As an individual whose personal data is processed by po999, you have the following rights. To exercise any of these rights, contact po999 at [email protected] with the subject line "Privacy Request" and your registered username:

• Right of Access: You have the right to request a copy of the personal data po999 holds about you. po999 will provide this information within fourteen (14) calendar days of receiving a valid request. The first copy is provided free of charge; subsequent requests within a twelve-month period may attract a reasonable administrative fee.
• Right to Rectification: If any personal data po999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. po999 will action verified rectification requests within seven (7) calendar days.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent was the basis for processing), or where you object to processing and there is no overriding legitimate ground to continue. This right is subject to legal retention obligations as described in Section 8.
• Right to Restriction: You have the right to request that po999 restricts the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of the data is being resolved, or pending a determination of your objection to processing.
• Right to Object: Where po999 processes your personal data on the basis of legitimate interests, you have the right to object to that processing. po999 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for legal claims.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11 Children's Privacy and Age Restriction

The po999 Platform is strictly intended for adults aged 21 and above. po999 does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the po999 registration and KYC process; no player may complete registration or access real-money features without confirming that they meet the minimum age requirement.

If po999 becomes aware that personal data has been collected from an individual under the age of 21, it will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the Platform, please report this to [email protected] immediately. po999 takes the protection of minors from gambling-related harm extremely seriously and will act promptly on any credible report.

Parents and guardians who are concerned about the possibility of a minor accessing gambling platforms are encouraged to use parental control software to restrict access to gambling-related content on shared devices. po999 is not responsible for access that occurs as a result of a minor misrepresenting their age; however, any account found to have been registered by a minor will be closed immediately upon discovery and all funds will be handled in accordance with applicable legal requirements.

12 Updates to This Privacy Policy

po999 reserves the right to update or amend this Privacy Policy at any time. Changes may be made in response to developments in applicable law, changes in our business practices, feedback from players, or improvements in how we describe our existing practices.

When a material change is made to this Privacy Policy, po999 will notify registered players by displaying a prominent notice on the Platform and, where appropriate, by sending a notification to the mobile number or email address registered to your account. The notification will include a summary of the key changes and the date on which the updated policy takes effect.

The "Effective Date" displayed at the top of this document reflects the date on which the current version entered into force. The "Last Reviewed" date reflects the most recent date on which the document was assessed, even where no substantive changes were made. Continued use of the po999 Platform after the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must discontinue use of the Platform and may request account closure by contacting [email protected].

Archived versions of previous Privacy Policy editions are available upon request by contacting [email protected] with the subject line "Privacy Policy Archive Request".