gr999 Privacy Policy — How We Collect, Use and Protect Your Personal Data

1. Who We Are

This Privacy Policy is issued by gr999, the operator of the online betting and casino platform accessible at gr999.io (the "Platform"). References to "gr999", "we", "us" or "our" throughout this Policy refer to the gr999 platform and its operating entity. References to "you", "your" or "player" refer to any individual who visits, registers with or uses the gr999 Platform.

gr999 is the data controller in respect of personal data collected through the Platform. This means gr999 determines the purposes and means by which your personal data is processed. If you have any questions regarding this Policy or the way in which your data is handled, please contact us at [email protected].

2. Information We Collect

gr999 collects personal data in several ways: information you provide directly, information generated automatically through your use of the Platform, and information received from third parties where permitted. The categories of data collected are set out below.

2.1 Information You Provide Directly

• Registration Data: Full legal name, date of birth, residential address, email address, mobile phone number and username chosen at account creation.
• Identity Verification (KYC) Documents: Copies of your Bangladesh National Identity Card (NID), passport, driving licence or other government-issued photo identification; proof of address documents such as utility bills or bank statements.
• Financial Information: Payment method details including bKash account numbers, Nagad wallet references, Rocket mobile banking identifiers, Upay account details, and bank account numbers for direct transfer. gr999 does not store full card numbers for card-based transactions; card data is handled directly by the relevant payment processor.
• Communications Data: The content of messages sent to gr999 via live chat, email or support ticket, including any attachments submitted as part of a dispute or complaint.
• Preferences and Settings: Responsible gaming limits, communication preferences and account settings you configure on the Platform.

2.2 Information Collected Automatically

• Device and Technical Data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers.
• Usage Data: Pages visited on the Platform, games played, bets placed, session start and end times (recorded in Bangladesh Standard Time, UTC+6), navigation paths and feature interactions.
• Transaction Data: Records of all deposits, withdrawals, bets, game outcomes and bonus redemptions associated with your account.
• Cookies and Tracking Data: Information collected via cookies, web beacons and similar technologies as described in Section 5 of this Policy.

2.3 Information from Third Parties

• Identity Verification Partners: Results of document verification and identity checks conducted by third-party KYC service providers.
• Payment Processors: Transaction status and confirmation data from bKash, Nagad, Rocket, Upay and partner banks.
• Fraud Prevention Services: Risk scores and alerts generated by fraud detection partners based on device fingerprinting and behavioural analysis.

3. How We Use Your Information

gr999 uses the personal data it collects for the following purposes:

Purpose	Data Categories Used
Account registration and management	Registration data, device data
Identity verification and KYC compliance	Registration data, KYC documents, verification partner data
Processing deposits, withdrawals and bet settlements	Financial information, transaction data, payment processor data
Providing and improving platform features and games	Usage data, transaction data, preferences
Fraud detection, prevention and security monitoring	Device data, usage data, transaction data, fraud service data
Responsible gaming compliance and player protection	Transaction data, usage data, preferences, communications data
Customer support and dispute resolution	Communications data, account data, transaction data
Sending transactional communications (account alerts, withdrawal confirmations)	Registration data, transaction data
Sending marketing communications (where consent has been given)	Registration data, usage data, preferences
Legal and regulatory compliance and record-keeping	All categories as required by applicable law

4. Legal Basis for Processing

gr999 processes personal data on one or more of the following legal bases depending on the specific processing activity:

• Contract Performance: Processing necessary to provide the services you have registered for, including account management, bet settlement, deposit processing and withdrawal execution.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations, identity verification requirements and financial record-keeping mandates.
• Legitimate Interests: Processing necessary for gr999's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring and service improvement, provided these interests are not overridden by your rights and interests.
• Consent: Where gr999 relies on your consent — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Cookies and Tracking Technologies

gr999 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that enable the Platform to recognise your browser, remember your preferences and deliver a consistent user experience across sessions.

The types of cookies used by gr999 include:

• Essential Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during a betting session. These cookies cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to understand how players interact with the Platform, which pages are visited most frequently, and where technical issues occur. Data collected by these cookies is aggregated and does not identify individual players.
• Functional Cookies: Remember your preferences such as display settings, responsible gaming limits you have configured, and language preferences.
• Fraud Prevention Cookies: Used by gr999's fraud detection systems to identify unusual or potentially fraudulent activity based on device and session patterns.

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will prevent you from logging in and using the Platform. gr999 does not currently use third-party advertising or behavioural targeting cookies.

6. Sharing Your Information

gr999 does not sell, rent or trade your personal data. gr999 shares personal data with third parties only in the following limited circumstances:

• Identity Verification Partners: KYC and document verification service providers who assist gr999 in confirming player identity and age in compliance with responsible gaming obligations.
• Payment Processors: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay (UCB), and partner banks including BRAC Bank, City Bank, Islami Bank, Sonali Bank and Dutch-Bangla Bank, solely for the purpose of processing deposits and withdrawals on your account.
• Game Content Providers: Third-party game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe and Ezugi receive session data necessary to deliver their games within the gr999 Platform. These providers process data in accordance with their own privacy policies and gr999's data processing agreements with them.
• Fraud Prevention and Security Services: Service providers that assist gr999 in detecting and preventing fraudulent activity, money laundering and account takeover attempts.
• Legal and Regulatory Authorities: gr999 may disclose personal data to law enforcement agencies, regulatory bodies or courts where required to do so by applicable law or in response to a valid legal request.
• Professional Advisors: Lawyers, accountants and auditors engaged by gr999 who are bound by professional confidentiality obligations.

All third-party service providers who receive personal data from gr999 are required to process that data only for the specific permitted purpose and to maintain security standards consistent with those applied by gr999.

7. International Data Transfers

gr999 primarily serves players resident in Bangladesh and processes the majority of player data within its secure server infrastructure. Where data is transferred to service providers operating in other countries — for example, internationally headquartered game studios or fraud prevention platforms — gr999 takes appropriate steps to ensure that such transfers are conducted with adequate safeguards, including contractual data processing agreements that impose equivalent privacy and security obligations on the receiving party.

By registering an account and using the gr999 Platform, you acknowledge that your personal data may be transferred to, stored in and processed in countries other than Bangladesh in the circumstances described above.

8. Data Retention

gr999 retains personal data for the period necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law, whichever is longer. The following general retention periods apply:

• Account Data: Retained for the lifetime of your gr999 account and for a minimum period of five years following account closure, in accordance with financial record-keeping requirements.
• Transaction Records: Retained for a minimum of five years from the date of each transaction to comply with anti-money laundering and financial reporting obligations.
• KYC Documents: Retained for a minimum of five years following account closure or the completion of the relevant identity verification process, whichever is later.
• Support Communications: Retained for three years from the date of the communication or the resolution of any related dispute, whichever is later.
• Marketing Preferences: Retained until you withdraw your consent or request deletion, after which your opted-out status is recorded to prevent future unsolicited contact.

When personal data is no longer required and no legal retention obligation applies, gr999 securely deletes or anonymises the data using industry-standard data destruction procedures so that it can no longer be linked to any individual.

9. Your Rights Over Your Data

Subject to applicable law, you have the following rights in respect of your personal data held by gr999:

• Right of Access: You may request a copy of the personal data gr999 holds about you, together with information about how it is being used.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. You may also update certain account details directly through your gr999 account settings.
• Right to Erasure: You may request that gr999 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to gr999's legal obligations to retain certain data.
• Right to Restriction of Processing: You may request that gr999 restrict the processing of your data in certain circumstances, for example while a dispute regarding the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on consent or contract performance and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of gr999's legitimate interests. gr999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact gr999 at [email protected] with the subject line "Data Rights Request". gr999 will acknowledge your request within 48 hours and will fulfil it within 30 days. gr999 may request proof of identity before processing a data rights request to ensure that personal data is not disclosed to an unauthorised individual.

10. Children and Minors

The gr999 Platform is strictly for adults aged 21 years and above. gr999 does not knowingly collect personal data from individuals under the age of 21. If gr999 discovers or has reason to believe that a registered account belongs to a person under 21, that account will be closed immediately, all pending transactions will be cancelled and any data held in relation to that account will be handled in accordance with gr999's underage account closure procedure.

If you believe that a person under 21 has registered an account or provided personal data to gr999, please contact us immediately at [email protected] so that we can take prompt action.

11. Security Measures

gr999 implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and gr999 servers;
• Encryption of sensitive data fields at rest within gr999's database infrastructure;
• Role-based access controls that limit employee access to personal data on a strict need-to-know basis;
• Regular internal and third-party security audits and penetration testing;
• Multi-factor authentication requirements for administrative access to Platform systems;
• Intrusion detection and monitoring systems that provide real-time alerts for suspicious activity;
• Incident response procedures that include player notification in the event of a data breach affecting their personal data.

While gr999 takes all reasonable steps to protect player data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the security of your own account credentials and for notifying gr999 promptly if you suspect unauthorised access to your account.

12. Third-Party Links and Services

The gr999 Platform may contain references to third-party game providers and payment services. These third parties operate under their own privacy policies, which gr999 does not control. gr999 is not responsible for the privacy practices of third-party game studios or payment processors once data leaves the gr999 Platform environment. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of gr999.

13. Changes to This Privacy Policy

gr999 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law or Platform features. When material changes are made, gr999 will notify registered players by email and by displaying a prominent notice on the Platform for a minimum of 14 days prior to the changes taking effect. The "Last Updated" date at the top of this Policy will be revised accordingly.

Your continued use of the gr999 Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and may close your account in accordance with the account closure procedure described in the gr999 Terms & Conditions.

14. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the way gr999 processes your personal data, please contact the gr999 Data Protection team using the details below:

• Email: [email protected]
• Subject Line: Privacy Policy Enquiry
• Response Time: Acknowledgement within 48 hours; full response within 30 days
• Support Hours: 24 hours a day, 7 days a week

For data rights requests specifically (access, erasure, portability, objection), please use the subject line "Data Rights Request" when emailing support to ensure your request is correctly categorised and actioned within the required timeframe.