Your Privacy Matters at 999xo

Information We Collect

999xo collects personal data from players through several channels: directly during account registration, through ongoing platform use and transaction activity, through identity verification procedures, and automatically through technical systems that log device and session information. The categories of personal data we collect are described below.

999xo does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond what is strictly required for identity verification), or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request. Where such information is provided, it is used solely for the purpose of applying appropriate safeguards to the player's account and is not used for any commercial purpose.

How We Use Your Data

999xo processes your personal data only for defined, legitimate purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which we process personal data, and the legal basis for each, are set out below.

• Account Management: We use your identity and contact data to create and maintain your player account, authenticate your identity at login, and provide account recovery services. The legal basis is the performance of a contract between you and 999xo.
• Payment Processing: Financial data is used to process deposits from bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to process withdrawal requests to your registered payment method. The legal basis is the performance of a contract.
• Identity Verification & KYC: We use identity data and document uploads to verify that you meet the age and eligibility requirements to use the platform, and to fulfil our anti-money-laundering obligations. The legal basis is legal obligation and legitimate interest.
• Fraud Prevention & Security: Technical data including IP addresses, device fingerprints, and login patterns are analysed to detect and prevent fraudulent activity, account takeover attempts, and bonus abuse. The legal basis is legitimate interest in protecting the platform and its players.
• Responsible Gaming: Responsible gaming data — including deposit limits, self-exclusion status, and session time preferences — is processed to protect vulnerable players and to comply with our responsible gaming obligations. The legal basis is legitimate interest and legal obligation.
• Platform Personalisation: Account activity data may be used to personalise the 999xo interface, surface relevant game recommendations, and tailor promotional offers to your betting preferences. You may opt out of personalised offers by contacting the support team. The legal basis is legitimate interest.
• Customer Support: Communications data from live chat and email interactions is used to respond to your enquiries, resolve disputes, and improve the quality of our support services. The legal basis is the performance of a contract and legitimate interest.
• Legal Compliance: We may process and disclose personal data where required to do so by applicable law, court order, or regulatory authority. The legal basis is legal obligation.

999xo does not use automated decision-making processes — including profiling — that produce legal or similarly significant effects on players, except in the context of automated fraud detection systems that may place a temporary hold on an account pending human review. Where automated systems flag an account, a human review is always conducted before any material account action is taken.

Data Sharing & Third Parties

999xo does not sell your personal data to any third party under any circumstances. We share personal data with third parties only in the limited circumstances described in this section, and only to the minimum extent necessary for the relevant purpose.

• Payment Service Providers: We share necessary financial data with bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing partners solely to execute the payment transactions you initiate. These providers process your data under their own privacy policies and applicable payment industry security standards.
• Identity Verification Partners: Where automated KYC document verification is used, your identity documents may be processed by a third-party identity verification service operating under a data processing agreement with 999xo. Verified document data is not retained by the verification partner beyond the verification transaction.
• Game Content Providers: When you launch a game from a third-party provider such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, a session token and limited technical data are shared with the provider to authenticate your game session. Game providers do not receive your financial or full identity data.
• IT Infrastructure and Security Providers: 999xo uses third-party cloud hosting, server management, and cybersecurity services. These providers act as data processors under contractual arrangements that restrict their use of your data strictly to the delivery of the contracted technical service.
• Legal and Regulatory Authorities: 999xo may disclose personal data to law enforcement agencies, financial intelligence units, or courts where required by applicable law or in response to a valid legal order. We will notify affected players of such disclosures where we are legally permitted to do so.
• Anti-Fraud Consortia: In cases of confirmed fraud, account abuse, or money laundering activity, 999xo may share relevant account identifiers with industry anti-fraud networks to prevent the same individual from exploiting other platforms. Only data strictly necessary to support fraud prevention is shared in this context.

All third-party data processors engaged by 999xo are required to maintain adequate data security standards, to process your data only as instructed by 999xo, and to delete or return data upon termination of the service relationship. 999xo conducts due diligence on data processors prior to engagement and reviews processor agreements on a regular cycle.

Cookies & Tracking Technologies

999xo uses cookies and similar local storage technologies to keep the platform functioning correctly, to protect your session from hijacking, and to gather anonymised performance data that helps us improve the platform. We do not use third-party advertising cookies or cross-site behavioral tracking technologies.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your 999xo account, as session authentication relies on these cookies. Disabling performance cookies will not affect your ability to use the platform but will reduce our ability to identify and fix issues that affect platform quality.

999xo does not use pixel tags, web beacons, or any embedded tracking element from third-party advertising networks. Any analytics functionality used by 999xo is operated on infrastructure controlled by 999xo itself, and resulting data is not shared with advertising platforms or social media networks.

Data Security & Retention

Protecting the integrity and confidentiality of your personal data is a core operational priority for 999xo. We implement a layered security architecture that includes technical controls, procedural safeguards, and staff access restrictions.

• All data at rest is encrypted using AES-256 encryption on our hosting infrastructure. Database backups are encrypted and stored in geographically separate facilities.
• Access to personal data is restricted on a strict need-to-know basis. Support staff have access only to the data fields required to resolve the specific enquiry they are handling. Access logs are maintained and reviewed regularly.
• All internal systems that handle personal data require multi-factor authentication for staff access. Privileged access to production databases is subject to additional approval workflows and session recording.
• 999xo conducts regular vulnerability assessments and penetration testing of its web and API infrastructure. Critical findings are remediated within defined service-level targets based on severity.
• In the event of a confirmed data security incident, 999xo's incident response procedure requires immediate containment, root cause analysis, and notification of affected players within a commercially reasonable timeframe.

With respect to data retention, 999xo applies the following general principles: active account data is retained for the duration of the account relationship plus a post-closure retention period of at least five years, in accordance with standard financial services record-keeping expectations. Identity verification documents are retained for the minimum period required to satisfy applicable anti-money-laundering record-keeping obligations. Anonymised statistical data derived from platform usage may be retained indefinitely as it no longer constitutes personal data.

When personal data reaches the end of its defined retention period, it is deleted from live systems and from all backup stores within a reasonable operational cycle. Deletion is carried out using secure erasure methods that prevent recovery of the deleted data.

Your Privacy Rights

As a registered player on 999xo, you hold a number of rights in relation to your personal data. 999xo is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights listed below, contact our support team via live chat or by email at [email protected].

• Right of Access: You may request a copy of all personal data that 999xo holds about you. We will provide this in a structured, commonly used format within 30 days of a verified request. A request must be accompanied by sufficient identity verification to protect against fraudulent data access attempts.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request a correction. Contact information and address details may also be updated directly through your account settings without a formal request.
• Right to Erasure: You may request deletion of your personal data. We will comply with erasure requests subject to our legal retention obligations — specifically, we are required to retain transaction records and identity verification data for minimum periods under financial regulations, and these records cannot be erased on request until the retention period has elapsed.
• Right to Restriction: You may request that 999xo temporarily restrict the processing of your personal data while a data accuracy dispute is being resolved, or pending the outcome of an objection to processing.
• Right to Data Portability: You may request a copy of personal data you have provided to 999xo in a machine-readable format (JSON or CSV), to the extent technically feasible and where processing is based on consent or contract performance.
• Right to Object: You may object to processing of your personal data where that processing is based on legitimate interest, including personalisation and marketing communications. Objections to marketing personalisation will be actioned promptly. Objections to fraud-prevention processing may not be honoured where processing is necessary to protect the security of the platform.
• Right to Withdraw Consent: Where processing is based on your explicit consent (for example, receipt of promotional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

999xo will respond to all verified privacy rights requests within 30 calendar days. Where a request is particularly complex or where a high volume of requests has been received, the response period may be extended by a further 30 days with prior notification. There is no charge for submitting a privacy rights request, though we reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive in frequency.

Children & Age Verification

999xo is an adult gambling platform. We do not knowingly collect personal data from individuals under the age of 18. Registration on 999xo requires a declaration of age, and we conduct identity verification checks to confirm that players meet the minimum age requirement. Any account found to have been registered by an individual under the age of 18 will be immediately closed, all funds will be returned to the originating payment method (minus any winnings), and the personal data associated with the underage account will be deleted from our systems within a reasonable operational period, subject to any mandatory legal retention requirements relating to the detection of underage access.

If you are a parent or guardian and believe that a minor in your care has registered a 999xo account, please contact our support team immediately via live chat or at [email protected]. We will investigate the matter as a priority and take all appropriate steps to close the account and remove the minor's data from our systems. We recommend that parents and guardians use device-level parental controls and internet content filtering tools to prevent minors from accessing online gambling platforms.

Contact & Policy Updates

If you have any questions, concerns, or requests relating to this Privacy Policy or to 999xo's data processing practices, you may contact us through any of the following channels. All privacy-related enquiries are handled by the 999xo compliance team.

999xo reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the introduction of new platform features. Where changes are material — meaning they significantly affect the way in which we process your personal data or the rights you hold — we will notify registered players via their registered email or mobile number prior to the changes taking effect. The "Last updated" date at the top of this policy will always reflect the date of the most recent revision.

Your continued use of the 999xo platform following a notified Privacy Policy update constitutes your acceptance of the revised policy. If you do not agree with any material change to this policy, you should close your account before the revised policy takes effect. Instructions for voluntary account closure are provided in the Terms & Conditions. Historical versions of this Privacy Policy are available on request from the support team.