ca999 Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") describes how ca999 Group ("ca999", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("Player", "User", "you") who access or use the ca999 online gaming and sports betting platform at ca999.io and any associated mobile or web interfaces.

ca999 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy should be read alongside our Terms and Conditions, which govern the contractual relationship between ca999 and every registered Player.

By registering an account, making a deposit, or otherwise accessing any feature of the ca999 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not use the ca999 platform.

For the purposes of applicable data protection law, the data controller responsible for your personal data is:

As data controller, ca999 determines the purposes and means of processing your personal data. Where ca999 engages third-party processors (such as payment providers or identity verification services) to handle data on its behalf, those parties act strictly as data processors under written agreements that bind them to the same standards of confidentiality and security that ca999 applies internally.

ca999 collects the following categories of personal data in the course of operating the platform and serving registered Players:

ca999 does not collect special category data (such as racial origin, health data, or political opinions) and does not require Players to provide any such data. If such data is volunteered incidentally in a support communication, it will not be stored beyond the resolution of the relevant matter.

ca999 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey.
• Automated technologies: Technical and usage data collected automatically as you browse and interact with the ca999 platform, via server logs, cookies, and similar tracking technologies (see Section 9 for full details).
• Third-party sources: Identity and address data received from regulated identity verification providers (such as those that cross-reference your NID with official Bangladeshi government databases), and fraud-prevention data received from payment processors.
• Payment processing: Financial transaction data received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard when you make deposits or withdraw funds.

ca999 processes personal data on the following legal bases:

• Contract performance: Processing necessary to fulfil our contractual obligations to you as a registered Player — including operating your account, processing deposits and withdrawals, and delivering the gaming services you have requested.
• Legal obligation: Processing required to comply with applicable laws — including anti-money laundering (AML) regulations, Know Your Customer (KYC) obligations, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing that serves ca999's legitimate business interests where those interests are not overridden by your rights — including fraud detection, platform security, internal analytics, and responsible gaming monitoring.
• Consent: Processing for purposes where we have sought and obtained your explicit consent — primarily the delivery of promotional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ca999 uses the personal data it collects for the following specific purposes:

• Creating, administering, and maintaining your ca999 account.
• Verifying your identity, age, and eligibility to use the platform (KYC process).
• Processing deposits, withdrawals, and all related financial transactions.
• Detecting, investigating, and preventing fraud, money laundering, cheating, and other prohibited conduct.
• Monitoring account activity as part of our responsible gaming obligations, including identifying patterns that may indicate problem gambling.
• Delivering customer support, responding to enquiries, and resolving disputes.
• Sending transactional communications — including deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional communications where you have opted in — including bonus offers, seasonal promotions (such as Eid, BPL season, and T20 World Cup offers), and platform news.
• Improving and personalising the ca999 platform based on aggregated, anonymised usage analytics.
• Complying with all applicable legal and regulatory obligations.

ca999 does not sell, rent, or otherwise commercialise your personal data. We share data with third parties only in the following specific and limited circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive the financial data necessary to process your transactions.
• Identity verification providers: Regulated KYC and AML service providers receive identity documents and biometric data strictly to verify your identity and age.
• Fraud prevention services: Risk analytics providers may receive anonymised or pseudonymised technical and transaction data to assist in detecting and preventing fraud.
• Legal and regulatory authorities: ca999 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, court order, or regulatory directive.
• Business successors: In the event of a merger, acquisition, or sale of all or part of ca999's business, Player data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy.

All third-party processors engaged by ca999 are contractually bound to process data only on ca999's instructions, to maintain appropriate technical and organisational security measures, and to delete or return data upon termination of their engagement.

ca999 operates a platform that serves Players primarily in Bangladesh. Some of our third-party service providers (including cloud infrastructure providers and KYC technology vendors) may process data in countries outside Bangladesh. Where such international transfers occur, ca999 ensures that adequate safeguards are in place, including:

• Contractual clauses that impose equivalent data protection standards on the receiving party.
• Transfers to countries that are recognised as providing an adequate level of data protection by the relevant supervisory authorities.
• Technical measures such as pseudonymisation and encryption applied prior to transfer where the sensitivity of the data warrants it.

If you have concerns about any international data transfer, please contact us at [email protected] and we will provide specific information about the safeguards applicable to your data.

ca999 uses cookies and similar tracking technologies (including web beacons and local storage) on the ca999 platform. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functioning of the ca999 platform. For analytics and marketing cookies, you may withdraw consent at any time by contacting [email protected].

ca999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following specific retention guidelines:

• Active account data: Retained for the full duration of your account membership and for a period of five (5) years following account closure, in compliance with standard AML record-keeping obligations.
• Transaction records (financial data): Retained for a minimum of seven (7) years from the date of the transaction in accordance with financial record-keeping requirements.
• KYC documentation: Retained for five (5) years following the end of the business relationship, unless a longer period is required by applicable law or regulatory directive.
• Customer support communications: Retained for three (3) years from the date of the last communication, or until a related dispute is fully resolved.
• Marketing consent records: Retained for three (3) years from the date consent was last given or withdrawn, as evidence of compliance.
• Technical/usage logs: Retained for thirteen (13) months from the date of collection and then anonymised or deleted.

At the end of the applicable retention period, ca999 will securely delete or anonymise your personal data so that it can no longer be associated with your identity. Where deletion is not immediately feasible (for example, due to data stored in backup systems), the data will be isolated from active processing and deleted in the next scheduled purge cycle.

As a ca999 Player whose personal data is processed under this Policy, you hold the following rights. To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Data Rights Request" and we will respond within 30 calendar days.

• Right of Access: You may request a copy of all personal data ca999 holds about you, together with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no longer a legitimate basis for its retention. This right is subject to certain exceptions, including where retention is required for legal compliance.
• Right to Restriction: You may request that ca999 restricts the processing of your data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data where ca999 relies on legitimate interests as the legal basis, and where you believe your interests, rights, and freedoms override those legitimate interests.
• Right to Withdraw Consent: Where ca999 processes data on the basis of your consent (such as for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The ca999 platform is strictly intended for adults aged 21 years and over. ca999 does not knowingly collect personal data from any individual under the age of 21. Access to the platform by persons under the age of 21 is prohibited under our Terms and Conditions.

If ca999 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any deposits made by an underage user will be returned and any associated winnings will be voided.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms, including ca999.io. If you believe that a minor has registered an account on ca999, please contact us immediately at [email protected].

ca999 may send you promotional communications — including bonus offers, seasonal promotions, new game announcements, and BPL / IPL / T20 World Cup betting promotions — where you have provided explicit consent to receive such communications at the time of registration or subsequently through your account settings.

We may communicate via the following channels where consent has been provided:

• Email to your registered email address.
• SMS to your registered mobile phone number.
• In-platform notifications displayed within your ca999 account dashboard.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any promotional email.
• Updating your communication preferences in your ca999 account settings.
• Contacting [email protected] with the subject line "Marketing Opt-Out".

Opting out of marketing communications will not affect the delivery of transactional messages such as deposit confirmations, withdrawal notifications, and security alerts, which are sent as a necessary part of operating your account and cannot be suppressed while your account remains active.

ca999 implements a layered approach to data security, combining technical, administrative, and physical controls to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and the ca999 platform.
• Encryption at rest for sensitive data stored on ca999 servers, including financial data and KYC documentation.
• Role-based access controls that restrict access to personal data to only those ca999 staff members who require it to perform their specific job function.
• Multi-factor authentication for internal ca999 systems that store or process personal data.
• Regular security audits and penetration testing conducted by independent third-party security specialists.
• Intrusion detection and monitoring systems that operate continuously to identify and respond to anomalous activity.
• Staff training on data protection and information security practices, conducted on a regular basis.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ca999 will notify affected Players without undue delay, and in any case within 72 hours of becoming aware of the breach, providing details of the nature of the breach, the data affected, and the steps ca999 is taking in response.

The ca999 platform may contain references to third-party game providers, payment processors, or sporting bodies (such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, the Bangladesh Cricket Board, or the ICC). Where the ca999 platform connects to third-party systems — for example, when you access a live casino table powered by Evolution Gaming — that third party may process certain technical data in accordance with their own privacy practices.

ca999 is not responsible for the privacy practices of third-party game providers or payment processors beyond the contractual data processing agreements we maintain with each of them. We encourage you to review the privacy policies of any third-party service you interact with. ca999 does not endorse or make any representations about third-party privacy practices.

ca999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, ca999 will notify registered Players via the email address associated with their account and will display a prominent notice on the ca999 platform for a minimum of 14 days prior to the changes taking effect.

The date at the top of this Policy ("Last Updated") will always reflect the date of the most recent version. We encourage you to review this Policy periodically to stay informed about how ca999 protects your personal data.

Your continued use of the ca999 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you must discontinue use of the ca999 platform and close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ca999 handles your personal data, please contact our Data Privacy team directly:

ca999 takes all privacy complaints seriously. Upon receipt of a complaint, we will acknowledge it within 5 business days and provide a substantive response within 30 calendar days. Where a complaint is complex or requires further investigation, we will notify you of the extended timeframe and keep you informed of progress.

If you are not satisfied with ca999's response to your complaint, or if you believe that ca999 is processing your personal data in a manner that is inconsistent with applicable data protection law, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. ca999 will cooperate fully with any such supervisory authority investigation.