cp999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how cp999 ("cp999", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("Player", "User", "you") who access or use the online casino and sports betting platform available at cp999.io (the "Platform"). This Policy applies to all services offered on the Platform, including account registration, deposits and withdrawals, casino gaming, sports betting, customer support, and promotional communications.

By creating an account on the cp999 Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Privacy Policy should be read alongside our Terms and Conditions, which are available at /terms-conditions, and our Responsible Gaming Policy, available at /responsible-gaming.

2 Data We Collect

cp999 collects personal data in the following categories. We collect only what is necessary for the purposes described in this Policy.

2.1 Identity Data

• Full legal name
• Date of birth
• Gender
• National Identity Card (NID) number or passport number
• Photograph or scanned copy of government-issued identification (collected during KYC verification)

2.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including district, division, and postcode within Bangladesh)

2.3 Financial Data

• Mobile financial service account numbers (bKash, Nagad, Rocket, Upay)
• Bank account details (Dutch-Bangla Bank, BRAC Bank, and others where applicable)
• Payment card details — partial card number, card type, and expiry date (full card numbers are never stored by cp999; these are handled by our PCI-DSS-compliant payment processors)
• Transaction history: deposit amounts, withdrawal amounts, and timestamps

2.4 Account and Gaming Data

• Username and encrypted password
• Account balance history
• Betting and gaming activity: wager amounts, game selections, bet outcomes, session durations
• Bonus usage and wagering requirement progress
• Responsible gaming settings and self-exclusion status

2.5 Technical and Device Data

• IP address
• Device type, operating system, and browser type/version
• Geolocation data (country and region level, derived from IP address)
• Session identifiers and authentication tokens
• Pages visited, links clicked, and time spent on each page

2.6 Communications Data

• Records of live chat conversations with our customer support team
• Email correspondence between you and cp999
• Feedback, complaints, and dispute records

3 How We Collect Data

cp999 collects your personal data through the following channels:

3.1 Directly From You

We collect data that you provide directly when you: register an account on the Platform; complete identity verification (KYC); make a deposit or withdrawal; contact our customer support team; participate in promotions or surveys; or update your account settings and responsible gaming preferences.

3.2 Automatically Through the Platform

We collect technical and behavioural data automatically as you use the Platform. This includes data collected via cookies, web beacons, server logs, and similar tracking technologies. See Section 7 (Cookies and Tracking) for full details.

3.3 From Third Parties

We may receive personal data about you from third parties in the following contexts:

• Payment processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, Visa, Mastercard, and our banking partners.
• Identity verification providers: Results of automated or manual KYC checks conducted by third-party identity verification services.
• Fraud and risk prevention services: Signals and flags from fraud detection platforms used to protect the integrity of the Platform.
• Game content providers: Game session data from Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi, and other licensed studios whose content appears on the Platform.

4 How We Use Your Data

cp999 uses the personal data it collects for the following purposes:

Purpose	Data Categories Used
Account registration and management	Identity, Contact, Account
Identity verification (KYC)	Identity, Contact, Financial
Processing deposits and withdrawals	Financial, Identity
Delivering gaming and betting services	Account, Gaming, Technical
Fraud prevention and security monitoring	Identity, Financial, Technical, Gaming
Customer support and dispute resolution	Identity, Contact, Communications, Gaming
Responsible gaming tools and compliance	Account, Gaming, Identity
Promotional communications (where opted in)	Contact, Account
Platform analytics and improvement	Technical, Gaming (aggregated/anonymised)
Legal and regulatory compliance	All categories as required

cp999 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by applicable law.

5 Legal Basis for Processing

cp999 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our contractual obligations to you under the Terms and Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing required for cp999 to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC requirements, and regulatory reporting duties.
• Legitimate interests: Processing carried out in pursuit of cp999's legitimate business interests, including fraud prevention, platform security, customer support, and analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out with your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing

cp999 does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances, and only to the extent necessary for the relevant purpose:

6.1 Service Providers and Processors

We share data with trusted third-party service providers who process data on our behalf under strict contractual data processing agreements. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard), identity verification services, cloud hosting and infrastructure providers, analytics platforms (operating on anonymised or aggregated data only), and email and communications service providers.

6.2 Game Content Providers

When you play games powered by third-party studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi — limited session data (such as session token, stake, and game outcome) is exchanged with those providers to deliver the game experience and ensure accurate settlement. These providers operate under their own privacy policies and applicable gaming regulations.

6.3 Legal and Regulatory Authorities

We may disclose personal data to law enforcement agencies, regulatory bodies, or other governmental authorities where we are required to do so by applicable law, court order, or legally binding regulatory request. In all such cases, cp999 will disclose only the minimum data necessary to satisfy the legal requirement.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of cp999's assets, personal data held by cp999 may be transferred to the acquiring entity as part of that transaction. Affected players will be notified of any such transfer and of any changes to the applicable privacy policy in advance of the transfer taking effect.

7 Cookies and Tracking

cp999 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the Platform. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, load-balancing cookies, and security tokens. They cannot be disabled without breaking core Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, responsible gaming limits, and display preferences. Disabling these may reduce your experience but will not prevent access to the Platform.
• Analytics cookies: Used to collect anonymised data about how players interact with the Platform — pages visited, session duration, and navigation paths. This data is used to improve Platform performance and usability. No personally identifiable information is transmitted via analytics cookies.
• Marketing cookies: Used to deliver relevant promotional content to players who have opted in to receive marketing communications from cp999. These cookies track interactions with promotional banners and emails. Marketing cookies are only placed with your consent.

You may manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may prevent you from accessing certain areas of the Platform. For marketing cookies, you may also manage your preferences through your account notification settings.

8 Data Retention

cp999 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for as long as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the lifetime of your account, plus a minimum of five (5) years following account closure, in accordance with anti-money laundering recordkeeping obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years following the relevant transaction date.
• KYC documentation: Retained for a minimum of five (5) years following account closure or the completion of the relevant KYC process.
• Customer support records: Retained for three (3) years from the date of the relevant support interaction or dispute resolution.
• Marketing consent records: Retained for the duration of consent, plus three (3) years following withdrawal of consent to demonstrate compliance.
• Technical and device data (server logs): Retained for up to twelve (12) months, after which logs are anonymised or deleted.

When data is no longer required and no legal obligation to retain it exists, cp999 will securely delete or anonymise that data.

9 Data Security

cp999 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive personal and financial data stored on our servers.
• Industry-standard password hashing (bcrypt with appropriate cost factor) — plaintext passwords are never stored.
• Role-based access controls (RBAC) limiting employee access to personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Multi-factor authentication (MFA) for administrative access to systems holding personal data.
• Intrusion detection and real-time security monitoring.
• Formal incident response procedures, including timely notification to affected players where a data breach is likely to result in a high risk to their rights and freedoms.

10 Your Rights

As a data subject, you hold the following rights with respect to your personal data held by cp999. To exercise any of these rights, please contact us at [email protected].

• Right of access: You have the right to request a copy of the personal data we hold about you, together with information about how it is being processed.
• Right to rectification: You have the right to request that inaccurate or incomplete personal data be corrected without undue delay.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that this right is subject to legal retention obligations that may require cp999 to retain certain data notwithstanding a deletion request.
• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where processing is based on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

cp999 will respond to all valid data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further two months, in which case you will be notified of the extension and the reasons for it.

11 Children's Privacy

The cp999 Platform is strictly intended for adults aged 21 years and older. cp999 does not knowingly collect personal data from any person under the age of 21. If we become aware that an account has been registered by or that personal data has been submitted by a person under 21 years of age, we will promptly close the account, delete or anonymise all associated personal data, and return any deposited funds in accordance with our underage account procedures.

If you believe that a person under the age of 21 has created an account on our Platform, please notify us immediately at [email protected] so that we can take appropriate action.

12 Third-Party Links

The cp999 Platform does not contain links to third-party websites for general browsing. Game content provided by third-party studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi, and others) is delivered within the Platform environment under iFrame or API integration. Where any interaction with a third-party environment does occur, cp999 is not responsible for the privacy practices of that third party. Players are encouraged to review the privacy policies of any third-party service they interact with independently of the cp999 Platform.

13 International Data Transfers

cp999 primarily serves players located in Bangladesh and processes personal data within the jurisdictions in which our service providers and infrastructure partners operate. Where personal data is transferred to a jurisdiction outside Bangladesh, cp999 ensures that appropriate safeguards are in place to protect that data, including contractual mechanisms such as standard data protection clauses, and that the transfer meets the requirements of applicable data protection law.

By using the Platform and submitting your personal data, you acknowledge and consent to the transfer of your data to the jurisdictions in which cp999 and its service providers operate, subject to the protections described in this Policy.

14 Changes to This Policy

cp999 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. The date of the most recent revision is displayed at the top of this document. When material changes are made, cp999 will notify registered players by email to the address associated with their account and/or by a prominent notice on the Platform. Players are encouraged to review this Policy periodically. Continued use of the Platform following publication of a revised Policy constitutes your acceptance of those changes.

15 Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by cp999, please contact our data protection team using the details below. We are committed to addressing all privacy-related enquiries fairly and promptly.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Data Rights Request — [Your Full Name]"
• Response time: We aim to acknowledge all privacy enquiries within 3 business days and to provide a substantive response within 30 calendar days.
• Operating hours: Our customer support team is available 24 hours a day, 7 days a week, including all Bangladesh public holidays.