Privacy Policy — Your Data at dx999

1. Information We Collect

1.1 Information You Provide Directly

When you register an account with dx999, you provide us with a core set of personal details that we require to create and manage your account. This includes your full legal name as it appears on your government-issued identification, your date of birth (to confirm you meet the 18+ age requirement), your residential address in Bangladesh, a valid mobile phone number capable of receiving SMS verification messages, and a unique password of your choosing. You may also provide an email address for account notifications, though this is optional at registration.

During the Know Your Customer (KYC) verification process — which is required before we can process any withdrawal request — you will be asked to submit documentary evidence of your identity and address. This typically includes a scanned or photographed copy of your National ID Card, passport, or driving licence, a recent utility bill or bank statement dated within the last three months showing your Bangladesh address, and in some cases a selfie photograph holding your identification document to confirm it belongs to you.

If you contact our customer support team via email at [email protected], we will retain a record of that correspondence including the content of your messages, any attachments you send, and the resolution provided. This helps us improve service quality and resolve any follow-up issues that may arise.

1.2 Information Generated by Your Use of dx999

When you use the dx999 platform, our systems automatically record a range of technical and behavioural data associated with your account and session. This includes:

• Your IP address and approximate geographic location at the time of each login and transaction
• The device type, operating system, and browser or app version used to access dx999
• Session timestamps — when you logged in, how long your session lasted, and when you logged out
• Betting and gaming history, including all markets wagered on, stakes placed, odds accepted, and outcomes settled
• Deposit and withdrawal transaction records, including the payment method used, amount in BDT, and processing timestamps
• Bonus claims, wagering progress against requirements, and promotional participation history
• Responsible gaming settings you have applied, including any deposit limits, loss limits, time-outs, or self-exclusion requests
• Pages visited within the dx999 platform, clicks, and navigation patterns collected via cookies and analytics tools

1.3 Information from Third Parties

dx999 may receive limited personal information about you from trusted third-party partners in order to verify your identity, process payments, and detect fraud. Payment processors such as the operators of bKash, Nagad, Rocket, and Upay confirm transaction status and the registered account holder name associated with each mobile wallet used for deposits or withdrawals. Identity verification partners may cross-reference the documents you submit against national registry databases where permitted by applicable law. We do not receive your full financial account details or mobile wallet PIN from any payment provider at any time.

2. How We Use Your Information

2.1 Account Management and Service Delivery

The primary purpose for which dx999 processes your personal data is to provide the platform services you have signed up for. This covers creating and maintaining your account, verifying your identity and age before you can withdraw funds, processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported bank transfers, crediting and deducting funds according to bet outcomes, applying and tracking bonus wagering requirements, and maintaining your responsible gaming settings.

2.2 Security and Fraud Prevention

dx999 uses the data it collects — including IP addresses, device fingerprints, login timestamps, and transaction histories — to detect and prevent fraudulent activity, identify duplicate accounts, investigate suspected match-fixing or bonus abuse, and protect the integrity of our platform. Automated risk-scoring systems flag unusual patterns for manual review by our compliance team. Where fraud is confirmed, data may be retained beyond normal retention periods as evidence and may be shared with relevant authorities as described in Section 3.

2.3 Legal and Regulatory Compliance

dx999 is obligated to process certain personal data in order to comply with applicable laws and regulations. This includes retaining KYC documents and transaction records for the legally required retention periods, responding to lawful requests for information from government bodies, courts, or regulatory authorities, and fulfilling our obligations under applicable anti-money-laundering (AML) frameworks. We process this data on the legal basis of legal obligation; it is not subject to your consent and cannot be deleted at your request while the legal retention period remains active.

2.4 Personalisation and Responsible Gaming

dx999 may use your gaming history and account behaviour to personalise your experience on the platform — for example, by surfacing cricket betting markets relevant to BPL or T20 World Cup matches that you have previously wagered on, or by highlighting slot games from providers whose titles you have played. We also use behavioural data to monitor for signs of problem gambling patterns and to determine whether to proactively reach out with responsible gaming resources or temporarily restrict certain account features in the interest of player welfare.

2.5 Marketing Communications

With your consent, dx999 may send you promotional communications about new games, seasonal offers (such as Eid, Pohela Boishakh, or BPL season bonuses), and platform updates. These communications may be delivered via SMS to your registered mobile number or by email. You may withdraw your consent to marketing communications at any time by following the unsubscribe link included in every message or by updating your preferences in your dx999 account settings. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Sharing and Disclosure

3.1 Service Providers and Data Processors

dx999 engages a limited number of carefully selected third-party companies to help deliver and improve our platform services. These companies act as data processors on our behalf, meaning they may only process your personal data according to our documented instructions and may not use it for their own purposes. Our data processors include payment gateway operators who facilitate BDT transactions via bKash, Nagad, Rocket, and card networks; identity verification service providers who assist with KYC document review; game content providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi who may receive anonymised session data to deliver game content; cloud infrastructure providers on whose servers dx999 data is hosted; and analytics platforms that help us understand platform usage patterns using aggregated, pseudonymised data.

All of our data processors are bound by contractual data processing agreements that impose obligations on them equivalent to or greater than those described in this Privacy Policy. dx999 conducts periodic due-diligence reviews of key processors to verify ongoing compliance.

3.2 Legal Disclosures

dx999 may disclose your personal data to government authorities, law enforcement agencies, courts, or regulatory bodies where we are required to do so by applicable law or in response to a valid and lawful order. We will notify you of any such disclosure where we are legally permitted to do so. We may also disclose data without prior notification where we have a good-faith belief that disclosure is necessary to prevent imminent harm, investigate a serious crime, or protect the rights and safety of our players and staff.

3.3 Business Transfers

In the event that dx999 undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. In such circumstances, dx999 will take reasonable steps to ensure that your data continues to be handled in accordance with a privacy policy that is substantially equivalent to this one, and we will notify you of any material change in ownership or data-handling practices via email or a prominent notice on the platform.

3.4 No Sale of Personal Data

dx999 does not sell, rent, barter, or otherwise commercially transfer your personal information to any third party for their own independent marketing, advertising, or commercial use. Any sharing of data with third parties is limited to the categories described in Sections 3.1 and 3.2 above and is carried out solely to deliver and protect the dx999 service.

4. Cookies and Tracking

4.1 What Are Cookies?

Cookies are small text files that a website deposits on your device when you visit. They allow the website to recognise your device on subsequent visits, remember your preferences, maintain your session while you are logged in, and collect usage analytics. dx999 uses both first-party cookies (set by dx999 itself) and limited third-party cookies (set by our analytics and game delivery partners).

4.2 Categories of Cookies Used by dx999

• Strictly Necessary Cookies: Required for the dx999 platform to function at all. These include session authentication cookies that keep you logged in while you navigate between sections of the site, and security cookies that help detect and prevent fraudulent access attempts. These cookies cannot be disabled without preventing you from using the platform.
• Functional Cookies: Used to remember your account preferences such as your preferred language display, responsible gaming settings you have configured, and the last game lobby section you visited. Disabling these cookies means the platform will not remember your preferences between sessions.
• Analytics Cookies: Used by dx999 and our analytics partners to understand how players interact with the platform in aggregate — for example, which sections of the site are most visited, how long sessions last, and where users typically drop off during registration. All analytics data is pseudonymised before analysis. You may opt out of analytics cookies without affecting your ability to use the platform.
• Game Delivery Cookies: Set by our game content providers (including Pragmatic Play, Evolution Gaming, Spribe, and others) to deliver game content reliably, maintain game session state, and prevent cheating. These are technically necessary for the games to function and cannot be disabled while you are in an active game session.

4.3 Managing Your Cookie Preferences

You can control non-essential cookies through your browser settings. Most modern browsers — including those used on Android and iOS devices that are popular in Bangladesh — allow you to view, block, or delete cookies on a per-site or global basis. Please be aware that disabling certain categories of cookies may impair your experience on dx999, particularly the functionality of live casino games and personalised account features.

5. Data Security Measures

5.1 Technical Security

dx999 implements a multi-layered technical security framework to protect the personal data it holds. All data in transit between your device and the dx999 platform is protected by TLS 1.3 encryption (256-bit). Data at rest — including KYC documents, transaction records, and account histories — is stored on encrypted storage volumes. Our platform infrastructure is protected by enterprise-grade firewalls, web-application firewalls (WAF), and real-time intrusion-detection and prevention systems (IDS/IPS). Regular automated and manual penetration tests are conducted to identify and remediate vulnerabilities before they can be exploited.

5.2 Organisational Security

Access to personally identifiable player data within dx999's internal systems is governed by a strict least-privilege access model. Staff are granted access only to the specific data categories required for their role, and all access is authenticated, logged, and subject to periodic review. New employees with access to player data receive mandatory data protection training before they are permitted to handle live production data. Contractors and third-party service providers are subject to background checks and contractual confidentiality obligations.

5.3 Data Breach Response

In the event of a confirmed or suspected personal data breach, dx999 has an incident response plan designed to contain the breach promptly, assess its scope and likely impact on affected players, and notify impacted individuals as quickly as practicable. Where a breach involves a significant risk to the rights and freedoms of players, dx999 will notify affected users directly via their registered email address or mobile number and provide clear guidance on the steps they should take to protect themselves, such as changing their password or monitoring their bKash or Nagad account for unusual activity.

6. Data Retention

6.1 Active Account Retention

While your dx999 account is active, we retain all personal data associated with it for as long as is necessary to provide our services, maintain the security and integrity of your account, comply with our legal and regulatory obligations, and resolve any disputes that may arise. Active accounts are those in which a login has been recorded in the preceding 12-month period.

6.2 Post-Closure Retention

Following the closure of your dx999 account — whether at your request or by dx999 — we retain certain categories of data for defined periods as required by applicable laws. KYC identity documents and account verification records are retained for a minimum of five years from the date of account closure. Transaction records, including deposit and withdrawal histories, are retained for a minimum of five years to satisfy financial record-keeping obligations. Betting and gaming history records are retained for a minimum of three years. Customer support correspondence is retained for two years. After the applicable retention period has elapsed, data is securely and irreversibly deleted from our systems.

6.3 Anonymised Analytics Data

Aggregated and fully anonymised analytics data — from which no individual player can be identified — may be retained indefinitely for internal product development and business planning purposes. This data is not subject to deletion requests as it contains no personally identifiable information.

7. Your Rights and Choices

7.1 Right of Access

You have the right to request a complete copy of all personal data that dx999 currently holds about you, along with information about how that data is being used, who it has been shared with, and for how long it will be retained. We will provide this information in a structured, commonly used electronic format within 30 days of receiving your verified request. There is no charge for a standard subject-access request.

7.2 Right to Rectification

If any personal data held by dx999 is inaccurate or incomplete — for example, if your registered address has changed or your name appears with a spelling error — you have the right to request that we correct it promptly. Certain corrections to identity-critical fields such as full name and date of birth may require you to submit updated documentary evidence through the KYC process before the change can be applied.

7.3 Right to Erasure

You may request that dx999 delete your personal data in circumstances where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent on which processing was based and no other legal basis applies; or the data has been unlawfully processed. Please note that erasure requests cannot override our legal obligation to retain certain data categories (KYC records and financial transaction records) for the statutory minimum periods described in Section 6. In such cases, we will delete what we are legally able to and explain clearly which data must be retained and why.

7.4 Right to Restrict Processing

In certain circumstances you have the right to ask dx999 to restrict how your data is processed — for example, while a correction request is being assessed, or where you have objected to processing and we are in the process of verifying whether our legitimate grounds for processing override your interests. During a restriction period, we will continue to store your data but will not actively process it for other purposes.

7.5 Right to Data Portability

Where your personal data has been collected on the basis of your consent or for the performance of a contract, you have the right to receive it in a structured, machine-readable format (such as CSV or JSON) that can be transmitted to another service provider of your choice. This right applies to data you have actively provided to dx999, such as your registration details, and does not extend to derived or inferred data.

7.6 Right to Object to Marketing

You have an absolute right to object to your personal data being used for direct marketing purposes at any time. Once you object, dx999 will cease processing your data for marketing within 10 business days. This does not affect your right to continue using the platform; you will still receive essential transactional communications such as deposit confirmations, withdrawal notifications, and important account security alerts.

8. Policy Updates and Contact

8.1 How We Notify You of Changes

dx999 reviews this Privacy Policy periodically and updates it to reflect changes in our data-handling practices, the services we offer, or the applicable legal landscape. When we make a material change to this policy, we will notify registered players by displaying a prominent notice on the dx999 platform for a minimum of 14 days following the update, and where the change significantly affects your rights, we will send a direct notification to your registered mobile number or email address. The "Last Updated" date at the top of this page always reflects the effective date of the current version.

8.2 Children and Minors

dx999 does not knowingly collect or process personal data from any person under the age of 18. If we discover that an account has been registered by or on behalf of a minor, that account will be immediately suspended, all associated personal data will be deleted or returned to the legal guardian as appropriate, and any deposited funds will be refunded to the source payment method. Parents or guardians who suspect that a minor has created a dx999 account using a shared mobile device or family payment method are encouraged to contact us immediately at [email protected].

8.3 Cross-Border Data Transfers

dx999 is a platform serving the Bangladesh market. In the ordinary course of operating the platform, certain personal data may be processed by our service providers whose infrastructure is located outside Bangladesh — including cloud hosting providers and international game content studios. Where such transfers occur, dx999 ensures that appropriate contractual safeguards are in place to maintain a level of data protection consistent with the standards described in this Privacy Policy. We do not transfer personally identifiable financial data internationally without the protections of a formal data-processing agreement.

8.4 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which dx999 processes your personal data, please contact our data team at [email protected]. Please include "Privacy Policy Query" or "Data Rights Request" in your subject line so your message is routed promptly to the correct team. We aim to acknowledge all privacy-related inquiries within 2 business days and to provide a substantive response within 30 calendar days, measured from the date on which we receive your verified request.