i999 Privacy Policy — Your Data, Your Rights

01 About This Policy

This Privacy Policy ("Policy") describes how i999 ("we", "us", "our") collects, uses, stores, shares, and protects personal data in connection with your use of the i999 platform, accessible at https://i999.im and any associated mobile interface (collectively, the "Platform"). It applies to all registered players, prospective registrants, and any other individual whose personal data is processed in connection with the Platform's operation.

This Policy should be read alongside the i999 Terms & Conditions and the Responsible Gaming Policy, both of which are available on the Platform. By creating an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

i999 operates internationally and serves the Bangladesh market. Where this Policy refers to applicable law, this encompasses both the jurisdiction under which i999 is licensed to operate and any applicable data protection legislation relevant to our players in Bangladesh. i999 applies GDPR-aligned data protection principles as a benchmark standard across all markets.

02 Data We Collect

i999 collects personal data in the following categories:

2.1 Registration & Identity Data

When you create an i999 account, we collect the information you provide during registration, including your full name, date of birth, residential address, email address, and mobile phone number. This data is required to open your account, verify your identity, and comply with our Know Your Customer (KYC) obligations.

2.2 Identity Verification Documents

To comply with anti-money laundering (AML) requirements and to verify that you meet the minimum age requirement of 21 years, we may collect copies of government-issued identity documents such as your National ID Card (NID), passport, or driving licence, along with supporting proof of address documents.

2.3 Financial & Transaction Data

We collect records of all deposits and withdrawals made through your i999 account, including transaction amounts, dates, payment method references (e.g., bKash account numbers, Nagad wallet references, Rocket IDs, card BIN data), and transaction status. We do not store full card numbers — card data is tokenised by our PCI-DSS compliant payment processors.

2.4 Gaming & Betting Activity Data

We record your betting and gaming activity on the Platform, including bets placed, games played, bet amounts, winnings, bonus usage, and session durations. This data is used for account management, fraud detection, responsible gaming monitoring, and regulatory compliance.

2.5 Technical & Device Data

We automatically collect certain technical data when you access the Platform, including your IP address, device type, operating system, browser type and version, screen resolution, time zone settings, and session timestamps. This data helps us secure your account and optimise the Platform's performance.

03 How We Use Your Data

i999 uses your personal data for the following purposes:

• Account management: Opening, maintaining, and closing your i999 account; processing deposits and withdrawals; applying bonuses and promotions; and providing customer support.
• Identity verification and KYC: Verifying your age (21+), identity, and residential address to comply with our legal and regulatory obligations, including anti-money laundering (AML) requirements.
• Fraud prevention and security: Detecting and investigating suspicious activity, unauthorised account access, duplicate account creation, and any conduct that may constitute a breach of our Terms & Conditions or applicable law.
• Responsible gaming monitoring: Monitoring your betting patterns and account activity to identify signs of problem gambling and to enforce any limits, cooling-off periods, or self-exclusions you have requested or that we have applied in accordance with our Responsible Gaming Policy.
• Legal and regulatory compliance: Retaining transaction records and identity data as required by applicable financial crime legislation, responding to lawful requests from regulatory or law enforcement authorities, and enforcing our contractual rights under the Terms & Conditions.
• Service improvement: Analysing aggregated and anonymised usage data to improve the Platform's features, performance, game offerings, and user experience.
• Communications: Sending you transactional communications related to your account (e.g., deposit confirmations, withdrawal approvals, verification requests) and, where you have opted in, marketing communications about promotions and new features. You may opt out of marketing communications at any time by contacting [email protected].

04 Legal Basis for Processing

i999 processes your personal data on the following legal bases:

• Contractual necessity: Processing your registration data, transaction data, and gaming activity data is necessary to perform the contract between you and i999 (as set out in the Terms & Conditions). Without this processing, we cannot provide you with the services you have requested.
• Legal obligation: Processing your identity verification documents, financial transaction records, and AML-related data is necessary for i999 to comply with applicable legal and regulatory obligations, including requirements under international financial crime and anti-money laundering frameworks.
• Legitimate interests: Processing your technical data, device data, and gaming behavioural data for fraud prevention, platform security, and responsible gaming monitoring is based on i999's legitimate interest in protecting the integrity of the Platform and the welfare of its players. These interests are not overridden by your privacy rights, given the security context in which this processing occurs.
• Consent: Where we send you marketing communications, we do so on the basis of your consent, which you may withdraw at any time without affecting the lawfulness of processing prior to withdrawal.

05 Data Sharing & Third Parties

i999 does not sell your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: We share necessary transaction data with our payment partners (including bKash, Nagad, Rocket, Upay, and card processing networks) solely to execute deposit and withdrawal transactions on your behalf. These partners are contractually bound to process your data only for payment execution purposes.
• Identity verification providers: We may share your identity documents with accredited KYC and AML verification service providers to carry out age and identity verification checks. These providers operate under strict data processing agreements with i999.
• Fraud prevention services: We may share technical identifiers (such as IP addresses and device fingerprints) with fraud detection platforms to identify and prevent suspicious activity across the Platform.
• Game software providers: Game providers (such as Pragmatic Play, Evolution Gaming, Spribe, and others) may receive session tokens and anonymised player identifiers as part of the technical integration required to deliver their games on the Platform. Full personal identity data is not shared with game providers.
• Legal and regulatory authorities: We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, or where necessary to establish, exercise, or defend our legal rights.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of i999's business, your data may be transferred to the acquiring entity, subject to equivalent privacy protections.

06 Cookies & Tracking Technologies

i999 uses cookies and similar tracking technologies on the Platform to ensure its proper operation, enhance your experience, and collect analytical data. The following categories of cookies are used:

• Essential cookies: Required for the Platform to function correctly. These include session cookies that maintain your login state and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to collect anonymised data about how players navigate the Platform, which pages are most visited, and how long sessions last. This data helps us improve the Platform's layout and performance.
• Functional cookies: Used to remember your preferences, such as your preferred language setting or display options, so you do not need to re-enter these on each visit.
• Security cookies: Used to detect and prevent fraudulent account access attempts, including identifying unusual login patterns or device changes associated with your account.

You may control cookie preferences through your browser settings. Please be aware that disabling essential cookies will impair the functionality of the Platform and may prevent you from accessing your account. i999 does not use cookies for third-party advertising or cross-site behavioural tracking.

07 Data Security

i999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between your device and the i999 Platform.
• Encryption at rest for all personally identifiable information and financial records stored on i999 servers.
• Two-factor authentication (2FA) options available on player accounts to prevent unauthorised access.
• Role-based access controls limiting internal access to personal data to authorised personnel on a strict need-to-know basis.
• Regular security audits and penetration testing conducted by independent third-party security specialists.
• Intrusion detection systems and real-time monitoring for anomalous access patterns or potential data breaches.
• PCI-DSS compliant card data handling through certified third-party payment processors — full card numbers are never stored by i999.

In the event of a data breach that poses a risk to your rights and freedoms, i999 will notify affected players without undue delay and will take all appropriate remedial steps. If you become aware of any actual or suspected security incident involving your i999 account, please contact [email protected] immediately.

08 Data Retention

i999 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and analytical purposes.

09 Your Data Rights

Subject to applicable law, you hold the following rights in relation to your personal data held by i999. To exercise any of these rights, contact [email protected] with your full name, registered email address, and a description of your request. i999 will respond within 30 days.

• Right of access: You may request a copy of all personal data that i999 holds about you, along with information about how it is being processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to our legal retention obligations — data that we are required to retain by law cannot be deleted upon request.
• Right to restriction of processing: You may request that we restrict our processing of your personal data in certain circumstances, for example while the accuracy of data is being disputed.
• Right to data portability: Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, machine-readable format.
• Right to object: You may object to processing of your personal data carried out on the basis of legitimate interests. i999 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

10 Children's Privacy

The i999 Platform is strictly intended for adults aged 21 years and older. i999 does not knowingly collect personal data from any person under the age of 21. If you are under 21 years of age, you are not permitted to register an account, and you must not submit any personal data to i999.

If i999 becomes aware that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that i999 may have collected data from an underage individual, please notify us at [email protected] so that we can investigate and act promptly.

11 International Data Transfers

i999 operates internationally and some of the third parties with whom we share data — including payment processors, KYC providers, and game software partners — may process data in countries outside Bangladesh. Where such international transfers occur, i999 takes steps to ensure that appropriate safeguards are in place to protect your personal data to a standard equivalent to that described in this Policy.

Such safeguards may include contractual data processing agreements incorporating standard data protection clauses, transfer to countries with adequacy decisions under applicable data protection frameworks, or reliance on the binding corporate rules of our service providers. If you have questions about the safeguards applicable to a specific international transfer of your data, please contact [email protected].

12 Updates to This Policy

i999 may update this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, or applicable legal requirements. When we make material changes to this Policy, we will notify you by posting the revised Policy on the Platform with an updated effective date, and by sending a notification to your registered email address where the changes materially affect your rights.

We encourage you to review this Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must cease using the Platform and contact us to close your account.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to i999's handling of your personal data, please contact our support team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: "Privacy Request — [Your Registered Email]"
• Support hours: 24 hours a day, 7 days a week — Bangladesh Standard Time (BST, UTC+6)
• Response time: Within 30 days for data rights requests; within 24 hours for general privacy enquiries.

i999 takes all privacy concerns seriously. If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to a relevant supervisory authority in your jurisdiction.