cn999 Privacy Policy — How We Handle Your Personal Data

1 Introduction

cn999 is an online casino and sports betting platform operated for players based in Bangladesh, with particular depth in cricket betting, live casino, slot games, and crash games. As part of delivering these services, cn999 processes certain personal data relating to its registered players. We recognise that privacy is a fundamental right and we are committed to handling your personal data with care, transparency, and respect.

This Policy applies to all personal data collected through the cn999 website at cn999.io, any mobile browser interface, the player account registration and management system, the cashier and payment processing features, customer support communications, and all promotional and marketing communications issued by cn999 to registered players.

This Policy is effective as of 1 January 2026 and supersedes all prior privacy notices issued by cn999. The most current version of this Policy is always available at cn999.io/privacy-policy. We encourage players to review this Policy periodically to remain informed of any updates.

2 Data Controller

For the purposes of this Policy, cn999 acts as the data controller in respect of personal data collected from players who register and use the cn999 platform. As data controller, cn999 determines the purposes and means by which personal data is processed.

Where cn999 engages third-party service providers — such as payment processors, game studios, or identity verification services — those providers may act as data processors on cn999's behalf, or in certain cases as independent data controllers in respect of their own data processing activities. cn999 takes reasonable contractual steps to ensure that all third-party processors handle personal data in a manner consistent with this Policy.

All data protection queries, subject access requests, correction requests, and deletion requests should be directed to the cn999 data protection contact at [email protected], clearly marking the subject line as "Data Protection Request".

3 Personal Data We Collect

3.1 Registration Data

When you register a cn999 account, we collect the personal data you provide during the registration process. This typically includes your full legal name, date of birth, residential address in Bangladesh, email address, and a mobile phone number associated with your registered payment method (bKash, Nagad, Rocket, or Upay).

3.2 Identity Verification (KYC) Data

To comply with identity verification requirements and to protect the platform against fraud and money laundering, cn999 may request copies of government-issued identity documents. Acceptable documents include a Bangladeshi National Identity Card (NID), passport, or driving licence. We may also request a recent utility bill, bank statement, or other proof-of-address document.

3.3 Financial Data

When you make deposits or request withdrawals, cn999 collects transaction-level financial data, including the payment method used, transaction amounts in Bangladeshi Taka (BDT/৳), transaction timestamps, and the reference numbers associated with bKash, Nagad, Rocket, Upay, or bank transfer transactions. cn999 does not store full debit or credit card numbers — card processing is handled by PCI-DSS compliant third-party payment processors.

3.4 Gameplay and Betting Data

cn999 collects records of all gameplay and betting activity associated with your account, including game titles played, bet amounts, outcomes, session durations, and sports betting selections across markets including cricket (BPL, IPL, T20 World Cup), football, and kabaddi. This data is used for account management, dispute resolution, responsible gaming monitoring, and platform improvement.

3.5 Technical and Device Data

When you access the cn999 platform, we automatically collect certain technical data about your device and connection, including your IP address, browser type and version, device operating system, device identifiers, and the pages or features you access within the platform. This data is collected to ensure platform security, detect fraud, and improve the player experience.

3.6 Communications Data

If you contact the cn999 support team by email or through the platform's live chat system, we retain records of that correspondence, including the content of your messages, the date and time of contact, and any attachments you provide. This data is retained to provide continuity of support and to resolve disputes.

3.7 Responsible Gaming Data

Where you voluntarily activate responsible gaming tools — such as deposit limits, session time limits, reality checks, temporary breaks, or self-exclusion — cn999 records the details of those settings and any changes made to them. This data is used solely to administer your responsible gaming preferences and is treated with the highest degree of sensitivity.

4 How We Use Your Personal Data

cn999 uses the personal data we collect for the following purposes:

• Account Administration: Creating and maintaining your cn999 player account, authenticating your identity at login, and processing account-related requests such as password resets and contact detail updates.
• Payment Processing: Processing deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Verifying that payment methods are registered in the account holder's name.
• Identity Verification and Fraud Prevention: Verifying that you meet the minimum age requirement of 21 years, confirming your identity in accordance with KYC requirements, detecting and preventing fraudulent activity, money laundering, and multi-accounting.
• Platform Delivery: Providing access to casino games, live dealer tables, slots, crash games, and sports betting markets. Personalising the platform experience based on your gameplay preferences where you have consented to this.
• Responsible Gaming: Monitoring gameplay patterns for signs of problem gambling behaviour, administering responsible gaming tool settings you activate, and fulfilling self-exclusion requests.
• Customer Support: Responding to support queries, resolving account disputes, and following up on complaints submitted to the cn999 support team.
• Legal and Compliance: Complying with applicable anti-money laundering obligations, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records required by applicable financial compliance frameworks.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the platform's features, performance, and player experience. Individual players are not identified in analytical reporting.
• Marketing Communications: Sending promotional emails and in-platform notifications about bonuses, seasonal offers (such as Eid, Pohela Boishakh, and Victory Day promotions), and new game releases — but only where you have given your consent to receive such communications, and only via email to the address registered on your account.

5 Legal Basis for Processing

cn999 processes personal data on the following legal bases:

• Contractual Necessity: The majority of personal data processing by cn999 is necessary for the performance of the contract between cn999 and the player — namely, the Terms & Conditions governing use of the platform. This includes account creation, payment processing, game access, and customer support.
• Legal Obligation: Certain data processing activities are required by applicable law, including identity verification (KYC), anti-money laundering record-keeping, and responding to regulatory or law enforcement requests.
• Legitimate Interests: cn999 processes certain technical and security data on the basis of its legitimate interest in maintaining platform security, detecting and preventing fraud, and protecting the integrity of the gaming environment — provided that this interest is not overridden by the player's privacy rights.
• Consent: Where cn999 processes personal data for marketing communications or for non-essential personalisation features, we do so only on the basis of your freely given, specific, and informed consent. You may withdraw your consent at any time by contacting [email protected] without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing and Disclosure

6.1 Service Providers

cn999 shares personal data with a limited set of third-party service providers who assist in delivering the platform's services. These include payment processing partners (including the operators of bKash, Nagad, Rocket, Upay, and card processing networks), identity verification and KYC service providers, game content studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), platform hosting and infrastructure providers, and customer support tooling providers. All service providers are subject to contractual data protection obligations consistent with this Policy.

6.2 Legal and Regulatory Disclosure

cn999 may disclose personal data to regulatory bodies, law enforcement agencies, or other public authorities where required to do so by applicable law, court order, or other lawful process. cn999 will take reasonable steps to notify affected players of such disclosure requests where legally permitted to do so.

6.3 Business Transfers

In the event that cn999 undergoes a merger, acquisition, restructuring, or sale of all or part of its business, personal data held by cn999 may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and the acquiring entity will be required to honour the commitments made in this Policy.

6.4 No Sale of Data

cn999 does not sell, rent, lease, or otherwise transfer personal data to third parties for their own commercial purposes. Your personal data is not a commodity at cn999 — it is information we hold in trust for the purpose of delivering services to you.

7 Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits, remember your preferences, and collect information about how you interact with the site. cn999 uses cookies and similar technologies (including local storage and session tokens) on the cn999 platform.

7.2 Types of Cookies Used by cn999

• Essential Cookies: These cookies are strictly necessary for the platform to function. They include session authentication tokens that keep you logged in to your cn999 account and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Analytics Cookies: cn999 uses first-party analytics cookies to understand how players navigate and use the platform — for example, which game categories are most visited and how long sessions typically last. This data is aggregated and anonymised before analysis. cn999 does not use third-party advertising analytics networks.
• Preference Cookies: These cookies remember your platform preferences, such as your preferred language setting and display configuration, so that you do not need to reconfigure these settings on each visit.

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site or global basis. Please note that blocking essential cookies will prevent you from logging in to your cn999 account and will significantly impair your ability to use the platform. Instructions for managing cookies are available in the help documentation of your browser.

8 Data Retention

cn999 retains personal data for as long as is necessary for the purpose for which it was collected, subject to the following minimum retention periods:

• Account and Registration Data: Retained for the duration of the active account relationship and for a minimum of five years following account closure, in line with standard financial record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five years from the date of submission or account closure (whichever is later), in accordance with applicable anti-money laundering obligations.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, in line with financial compliance requirements.
• Gameplay and Betting Records: Retained for a minimum of three years from the date of each session, for dispute resolution and compliance purposes.
• Customer Support Communications: Retained for a minimum of two years from the date of the most recent communication in a given support thread.
• Technical and Security Logs: Retained for up to 12 months from the date of collection, after which they are securely deleted or anonymised.
• Marketing Consent Records: Retained for the duration of the active account relationship, or until consent is withdrawn, whichever is earlier.

Where retention beyond these minimum periods is required by applicable law or ongoing regulatory proceedings, cn999 will retain the relevant data until the legal requirement is satisfied. On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

9 Your Data Rights

As a cn999 player whose personal data is processed by the platform, you hold the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data that cn999 holds about you. This is known as a Subject Access Request (SAR). cn999 will respond to SARs within 30 days of receipt.
• Right to Rectification: If you believe that any personal data cn999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You may update certain account details directly within the account management section; for other corrections, please contact [email protected].
• Right to Erasure: In certain circumstances you have the right to request that cn999 delete the personal data it holds about you. This right is subject to overriding legal obligations — for example, cn999 cannot delete financial transaction records that are required to be retained for anti-money laundering compliance purposes.
• Right to Restrict Processing: You have the right to request that cn999 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing pending verification of whether cn999's legitimate interests override your rights.
• Right to Data Portability: Where personal data is processed on the basis of your consent or for the performance of a contract, and is processed by automated means, you have the right to receive a copy of that data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object at any time to the processing of your personal data where that processing is based on cn999's legitimate interests. cn999 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, contact [email protected].

To exercise any of the above rights, please contact the cn999 data protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a full response within 30 calendar days.

10 Children and Underage Players

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with cn999 or provided personal data to the platform, please contact the cn999 support team immediately at [email protected] with the subject line "Underage Account — Urgent". cn999 takes all underage access concerns extremely seriously and will investigate and act upon all such notifications as a priority.

cn999 employs technical and procedural safeguards to detect and prevent underage registration, including date-of-birth verification at the point of registration and KYC document checks that include age verification. These measures are regularly reviewed and updated.

11 Security Measures

cn999 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption in Transit: All data transmitted between your device and the cn999 platform is protected using 256-bit Transport Layer Security (TLS/SSL) encryption. The cn999 platform uses HTTPS across all pages without exception.
• Encryption at Rest: Sensitive personal data held in cn999's databases — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within cn999's internal systems is restricted on a strict least-privilege basis. Only personnel with a specific operational need to access personal data are granted that access, and all access is logged and auditable.
• Intrusion Detection: cn999 operates continuous intrusion detection and monitoring systems across its platform infrastructure. Anomalous access patterns are flagged for immediate investigation by the platform security team.
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication (2FA) on their cn999 accounts. Internal platform administration systems require multi-factor authentication for all personnel access.
• Security Testing: cn999 conducts periodic security assessments of its platform infrastructure and data handling systems to identify and remediate vulnerabilities before they can be exploited.

While cn999 takes all reasonable precautions to protect personal data, no internet-based system is completely immune to risk. In the event of a data security incident that is likely to result in a risk to the rights and freedoms of affected players, cn999 will notify affected individuals without undue delay and take all reasonable steps to mitigate the impact of the incident.

12 Third-Party Links and Integrations

The cn999 platform may from time to time contain references to or integrations with third-party game providers and payment services. While cn999 takes reasonable care in selecting its service partners, cn999 is not responsible for the privacy practices of those third-party entities in respect of their own independent data processing activities.

Game content delivered by studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi is rendered within the cn999 platform environment. These studios may collect certain technical data about gameplay sessions in their capacity as independent data controllers, subject to their own privacy policies. Players are encouraged to review the privacy policies of individual game providers where they have concerns about studio-level data processing.

Payment service providers including bKash, Nagad, Rocket, Upay, and card networks operate under their own privacy policies and regulatory frameworks. cn999 has no control over and accepts no responsibility for the data practices of those payment providers beyond the specific contractual data processing arrangements it has in place with them for the purpose of processing cn999 transactions.

13 Updates to This Privacy Policy

cn999 reserves the right to update, amend, or replace this Privacy Policy at any time. The effective date of the current version of this Policy is clearly stated at the top of the document and in the table of contents sidebar. When changes are material — meaning they affect player rights or data processing activities in a significant way — cn999 will notify registered players by email to the address on record and by displaying a prominent notice on the platform for a period of not less than 14 days prior to the changes taking effect.

Non-material changes, such as typographical corrections, clarifications of existing provisions, or additions of new illustrative examples, may be made without advance notice and take effect upon publication of the updated Policy.

Your continued use of the cn999 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept an updated Policy, you must discontinue use of the platform and may request voluntary account closure in accordance with the Terms & Conditions.

Archived versions of previous Privacy Policy documents are available upon request by contacting [email protected] with the subject line "Privacy Policy Archive Request".

14 Contact Us — Data Protection

For all privacy-related queries, data subject requests, marketing opt-out requests, or concerns about how cn999 handles your personal data, please contact the cn999 data protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line (Data Rights): "Data Rights Request"
• Subject Line (Data Breach / Security Concern): "Data Security — Urgent"
• Subject Line (Underage Account): "Underage Account — Urgent"
• Response Time: Acknowledgement within 5 business days; full response within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week
• Time Zone: Bangladesh Standard Time (BST, UTC+6)