gd999 Privacy Policy

1. Who We Are and Scope of This Policy

gd999 (referred to as "gd999", "we", "us", or "our" throughout this document) is the operator of the online gaming platform accessible at gd999.club. This Privacy Policy applies to all personal data collected, processed, or stored in connection with your use of the gd999 website, mobile browser interface, games, payment services, customer support channels, and any other services forming part of the gd999 platform.

This policy does not apply to third-party websites, payment providers, or game studios that may be accessible via links or integrations on the gd999 platform. Those third parties operate under their own privacy policies, and gd999 is not responsible for their data practices. We encourage you to review the privacy policies of any third-party services you access in connection with your use of gd999.

2. What Personal Data We Collect

The following table summarises the categories of personal data gd999 collects, the primary purpose for collecting each category, and the legal basis on which we rely:

Data Category	Purpose	Legal Basis
Identity data (name, date of birth, national ID)	Account creation, age verification, KYC compliance	Contractual necessity; legal obligation
Contact data (mobile number, email address)	Account management, support communication, security alerts	Contractual necessity
Financial data (payment method, transaction history)	Processing deposits and withdrawals, fraud prevention, anti-money laundering checks	Contractual necessity; legal obligation
Technical data (IP address, device type, browser, session logs)	Platform security, fraud detection, service improvement	Legitimate interest
Gaming data (bet history, game sessions, responsible gaming settings)	Service delivery, responsible gaming compliance, dispute resolution	Contractual necessity; legal obligation

3. How We Use Your Personal Data

gd999 uses personal data only for legitimate, clearly defined purposes. We do not use your data for purposes that are incompatible with those described in this policy. The primary uses of your personal data are as follows:

3.1 Account Management

We use your identity and contact data to create, verify, and maintain your gd999 account. This includes processing your registration, verifying your age and identity in compliance with applicable requirements, managing your account settings, and communicating with you regarding your account status. Without this data, we cannot provide you with access to the gd999 platform.

3.2 Payment Processing

Financial data is used to process your deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other supported payment methods. Transaction records are retained to satisfy legal and regulatory obligations, to resolve payment disputes, and to fulfil anti-money laundering due diligence requirements. gd999 does not store full payment card numbers; card data is tokenised by the payment processor.

3.3 Security and Fraud Prevention

Technical data, including IP addresses, device fingerprints, and session logs, is used to detect and prevent fraudulent activity, unauthorised account access, and abuse of the platform. gd999 employs automated monitoring systems that analyse this data in real time. Where suspicious activity is detected, gd999 may temporarily suspend an account and contact the registered account holder for verification.

3.4 Responsible Gaming

Gaming data, including your bet history, session duration records, and any responsible gaming limits or self-exclusion requests you have set, is retained to enable us to monitor and support responsible gaming compliance. This data is used to enforce any limits you have set, to identify players who may be at risk, and to comply with applicable responsible gaming obligations. If you have activated self-exclusion, your data will be retained for the full duration of the exclusion period to prevent re-registration.

4. Sharing of Personal Data

gd999 does not sell, rent, or trade your personal data with third parties for marketing purposes. We may share your data with the following categories of recipients only where strictly necessary and only to the extent required:

• Payment service providers (such as bKash, Nagad, Rocket, Visa, and Mastercard) — solely for the purpose of processing your deposit and withdrawal transactions. These providers are contractually bound to handle your data securely and may not use it for any other purpose.
• Identity verification and KYC service providers — where identity or age verification is required as part of the registration or withdrawal process. These providers act under strict data processing agreements with gd999.
• Game content providers and platform technology partners — for the purpose of delivering the game services you use. These partners may receive technical session data necessary to operate the game but do not receive your identity or financial data.
• Regulatory and law enforcement authorities — where gd999 is required by applicable law, court order, or regulatory directive to disclose personal data. gd999 will notify you of any such disclosure where legally permitted to do so.
• Fraud prevention and anti-money laundering agencies — where there is a reasonable suspicion of fraud, money laundering, or other financial crime, gd999 may share relevant data with authorised agencies as required by law.

In all cases where gd999 shares your personal data with a third party, we ensure that appropriate contractual, technical, and organisational safeguards are in place to protect your data. We do not permit third parties to use your data for their own purposes beyond the specific purpose for which it was shared.

5. Cookies and Tracking Technologies

gd999 uses cookies and similar tracking technologies to provide, secure, and improve the platform. Cookies are small text files stored on your device when you visit gd999.club. They enable us to remember your session, keep you logged in securely, detect fraud, and understand how players interact with the platform so we can improve the user experience.

5.1 Essential Cookies

Essential cookies are strictly necessary for the platform to function. They manage your login session, maintain security tokens, enforce responsible gaming settings you have activated, and preserve your language preference. Essential cookies cannot be disabled without impairing your ability to use gd999. No consent is required for essential cookies as they are necessary for the provision of the service you have requested.

5.2 Analytical and Performance Cookies

gd999 may use analytical cookies to understand how players navigate the platform, which games are most popular, how long sessions last, and where technical errors occur. This data is collected in aggregate and is not used to personally identify individual players. You may opt out of analytical cookies by contacting support; however, doing so may affect platform performance and the relevance of any personalised communications you receive.

• Session cookies — expire when you close your browser. Used to maintain your login session and in-game state.
• Persistent cookies — remain on your device for a defined period (typically up to 12 months). Used to remember your preferences and responsible gaming settings between visits.
• Security cookies — used to detect and prevent fraudulent login attempts, session hijacking, and other security threats. Cannot be disabled.

6. Data Retention

gd999 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and audit obligations. The general retention periods applicable to each category of data are as follows:

• Account and identity data — retained for the duration of your active account plus a minimum of 5 years following account closure, to comply with anti-money laundering and recordkeeping obligations.
• Financial and transaction data — retained for a minimum of 7 years from the date of the transaction to satisfy tax and financial regulatory requirements.
• Gaming session data — retained for a minimum of 3 years following the session date, for the purposes of responsible gaming monitoring and dispute resolution.
• Self-exclusion records — retained for the full duration of the self-exclusion period plus 5 years thereafter, to prevent re-registration during the exclusion period and to maintain an audit record.
• Technical and security logs — retained for a minimum of 12 months from the date of generation, after which they are deleted or anonymised unless required for an ongoing investigation.
• Marketing preferences — retained until you withdraw consent or close your account, whichever is earlier.

When the applicable retention period expires, gd999 will securely delete or anonymise the relevant personal data in accordance with our internal data destruction procedures. If you request early deletion of your data, gd999 will comply where we are not legally required to retain it, and will confirm the deletion in writing within 30 days of the request.

7. Your Data Protection Rights

As a gd999 player, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact the gd999 support team via live chat or by emailing [email protected]. gd999 will respond to all data rights requests within 30 days of receipt.

7.1 Right of Access

You have the right to request a copy of the personal data gd999 holds about you. Upon verified request, we will provide a summary of your personal data in a clear, structured format within 30 days. This is sometimes referred to as a Subject Access Request (SAR). There is no charge for a SAR unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

7.2 Right to Rectification

If any personal data gd999 holds about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You may update certain account details directly through your account settings. For changes to identity data (such as your registered name or date of birth), you will be required to provide supporting documentation.

7.3 Right to Erasure

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you believe the data has been processed unlawfully. gd999 will honour erasure requests where we are not subject to a legal obligation to retain the data. Where a legal retention obligation prevents full erasure, gd999 will inform you of this and will restrict the use of the relevant data to the extent permitted by law.

8. Data Security

gd999 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL encryption on all data transmitted between your device and the gd999 platform.
• Encrypted storage of sensitive data, including passwords (stored as salted cryptographic hashes) and payment tokenisation.
• Strict access controls ensuring that only authorised personnel can access personal data, on a need-to-know basis.
• Regular security audits and penetration testing of the platform infrastructure.
• Intrusion detection systems and 24/7 security monitoring.
• Staff training and data protection awareness programmes for all personnel with access to personal data.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, gd999 will notify you without undue delay and will take all reasonable steps to contain the breach and mitigate any harm.

9. Children and Minors

The gd999 platform is strictly intended for adults aged 21 and above. gd999 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. Parents and guardians who believe that a minor has registered on gd999 should contact our support team immediately.

Age verification is a mandatory step in the gd999 registration process. Players must confirm their age during registration, and gd999 reserves the right to request documentary evidence of age at any time. Any account where the holder is subsequently found to be under 21 will be closed immediately and all funds forfeited in accordance with the gd999 Terms & Conditions.

10. Changes to This Privacy Policy

gd999 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify active players via their registered contact method. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of the gd999 platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with any changes, you may close your account by contacting support prior to the updated policy taking effect.

11. International Data Transfers

gd999 primarily processes and stores personal data within secure infrastructure serving the Bangladesh market. However, some of our technology partners and service providers may be located in other countries. Where personal data is transferred outside Bangladesh, gd999 ensures that appropriate safeguards are in place to protect the data, including contractual protections that require the recipient to maintain equivalent data protection standards.

• Standard contractual clauses or equivalent data transfer agreements with all international processors.
• Due diligence assessments of all third-party processors prior to engagement.
• Contractual requirements obliging all processors to notify gd999 of any data breach within 48 hours of discovery.
• Restrictions on sub-processing without prior written approval from gd999.

12. Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the way gd999 handles your personal data, please contact the gd999 Data Support Team via live chat (available 24 hours a day, 7 days a week) or by emailing [email protected]. Please include "Privacy Request" in the subject line of any email so we can direct your query to the correct team promptly.

If you are not satisfied with the way gd999 has handled your personal data or responded to a data rights request, you have the right to escalate your complaint. gd999 will acknowledge all formal complaints within 5 business days and will provide a full written response within 28 days of receipt. If you remain dissatisfied following gd999's response, you may refer your complaint to the relevant data protection authority in your jurisdiction.

13. Entire Agreement

This Privacy Policy, together with the gd999 Terms & Conditions, forms the complete agreement between you and gd999 with respect to the collection, use, and protection of your personal data. In the event of any conflict between this Privacy Policy and the Terms & Conditions, the Terms & Conditions shall prevail to the extent of the conflict, except where this Privacy Policy provides additional or more specific protections for your personal data.

If any provision of this Privacy Policy is found to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect. gd999's failure to enforce any provision of this Privacy Policy shall not be construed as a waiver of that provision.

14. Definitions

In this Privacy Policy: "Personal data" means any information relating to an identified or identifiable natural person, including name, contact details, financial data, and technical identifiers such as IP addresses. "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, and deletion. "Data controller" means gd999 as the entity that determines the purposes and means of processing your personal data. "Data processor" means any third party that processes personal data on behalf of gd999 under a data processing agreement. "KYC" means Know Your Customer — the process of verifying a player's identity and age in accordance with applicable requirements.