co999 Privacy Policy

1 Introduction

co999 ("co999", "we", "us", "our") is committed to protecting the privacy and personal data of every person who visits, registers on, or interacts with the co999 platform at co999.io (the "Platform"). This Privacy Policy ("Policy") describes in clear and accessible language the personal data we collect, the purposes for which we use it, the parties with whom we may share it, and the rights that you ("Player", "User", "you", "your") hold in relation to your own information.

This Policy applies to all data processing activities carried out by co999 in connection with your use of the Platform, including account registration, identity verification, payment processing, gameplay, customer support interactions, and marketing communications. It applies regardless of the device or software you use to access the Platform.

We encourage you to read this Policy in full. If you have any questions about how co999 handles your personal data, please contact us at [email protected] before using the Platform.

2 Who We Are

co999 operates as an internationally licensed offshore online gaming platform providing casino games, live casino products, sports betting, and related entertainment services to registered players. The Platform is accessible globally and is specifically designed for English-speaking players in the Bangladesh market.

For the purposes of data protection law, co999 acts as the data controller in respect of all personal data collected directly from Platform users. Where co999 engages third-party service providers — such as payment processors, game studios, or identity verification services — those providers may act as data processors on co999's behalf, or in some cases as independent data controllers, subject to their own privacy policies and applicable law.

For any data-related enquiry, including requests to exercise your rights, please contact the co999 Data Protection contact at [email protected] with the subject line "Privacy Enquiry".

3 Data We Collect

co999 collects the following categories of personal data in connection with your use of the Platform:

3.1 Identity & Registration Data

• Full legal name
• Date of birth
• Gender (optional)
• Nationality
• Government-issued identification number (e.g., National Identity Card number)

3.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including city, district, and postal code)

3.3 Financial & Transaction Data

• Payment method details (e.g., bKash account number, Nagad number, Rocket number, bank account details)
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference numbers
• Bonus and promotional credit history
• Account balance information

3.4 Identity Verification (KYC) Data

• Copies of government-issued identity documents (NID, passport, driving licence)
• Proof of address documents (utility bills, bank statements dated within 3 months)
• Selfie or live photograph (where required for identity matching)

3.5 Gameplay & Behavioural Data

• Games played, bet amounts, win/loss records, session duration
• Sports betting activity: markets selected, odds, stakes, outcomes
• Responsible gaming tool usage (deposit limits set, self-exclusion requests)
• Account login timestamps and session data

3.6 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Referral source and landing page URL
• Cookie identifiers and similar tracking data (see Section 10)

3.7 Communications Data

• Records of customer support interactions (live chat transcripts, email correspondence)
• Responses to surveys, promotions, or feedback requests
• Marketing communication preferences

4 How We Collect Data

co999 collects personal data through the following channels:

• Directly from you: During account registration, KYC submission, payment transactions, customer support contact, and completion of surveys or promotional forms.
• Automatically: Through cookies, web beacons, server logs, and similar technologies when you browse or interact with the Platform (see Section 10).
• From third parties: From identity verification providers, payment processors (e.g., bKash, Nagad, Rocket, Upay), fraud detection services, and game data providers, where necessary to verify your identity, process payments, or protect the integrity of the Platform.

co999 does not purchase personal data from data brokers or third-party list providers for marketing purposes.

5 How We Use Your Data

co999 uses your personal data for the following purposes:

6 Legal Basis for Processing

co999 processes your personal data on the following legal grounds, depending on the nature of the processing activity:

• Contractual necessity: Processing required to perform the agreement between you and co999 — including account registration, payment processing, and gameplay delivery.
• Legal obligation: Processing required to comply with applicable law, including KYC, AML, and data retention obligations.
• Legitimate interests: Processing carried out for co999's legitimate business interests, including fraud prevention, platform security, and Platform improvement, where those interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications, where you have given clear and informed consent. You may withdraw consent at any time by contacting [email protected] or updating your communication preferences in Account Settings.

7 Data Sharing

co999 does not sell, rent, or trade your personal data. We share your information only in the following limited circumstances:

7.1 Service Providers

co999 engages trusted third-party service providers to assist in operating the Platform. These providers are contractually bound to process your data only on co999's documented instructions and to maintain appropriate security standards. Categories of service providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks
• Identity verification providers: KYC and document verification services
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed studios
• IT infrastructure and hosting providers
• Customer support platform providers
• Fraud detection and security services

7.2 Legal & Regulatory Disclosure

co999 may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other government bodies where required to do so by applicable law, court order, or lawful request. co999 will make reasonable efforts to notify you of any such disclosure unless prohibited by law from doing so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of co999's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to the processing of your data that result from it.

7.4 Aggregated and Anonymised Data

co999 may share aggregated, statistical, or anonymised data — which cannot reasonably be used to identify any individual — with business partners, analytics providers, or industry bodies for research and reporting purposes.

8 Data Retention

co999 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to maintain your active account, and to comply with applicable legal obligations. The following retention periods apply as a general guide:

Where data is no longer needed for any legitimate purpose, co999 will securely delete or irreversibly anonymise it. You may request early deletion of your data under the conditions described in Section 11, subject to overriding legal retention obligations.

9 Data Security

co999 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption at rest for sensitive stored data, including identity documents and payment references.
• Access controls and role-based permissions restricting internal access to personal data on a strict need-to-know basis.
• Multi-factor authentication for internal administrative systems.
• Regular security assessments and penetration testing of Platform infrastructure.
• Intrusion detection systems and 24/7 security monitoring.
• Staff data protection training for all personnel with access to personal data.

Despite these measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials. If you suspect that your account has been compromised, please contact [email protected] immediately.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, co999 will notify you without undue delay using the contact details registered on your account.

10 Cookies & Tracking Technologies

co999 uses cookies and similar technologies (such as web beacons and local storage) on the Platform. These technologies help us deliver a functional, secure, and personalised experience.

Types of Cookies Used

co999 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. Our analytics data is processed in aggregated, anonymised form and is not used to build individual user profiles for advertising.

Managing Cookies

You may control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Disabling functional or analytics cookies will not affect your ability to play games or make transactions.

11 Your Rights

Subject to applicable law, you have the following rights in relation to the personal data co999 holds about you:

• Right of Access: You may request a copy of the personal data co999 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data without undue delay.
• Right to Erasure: You may request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal retention obligations (e.g., AML record-keeping requirements).
• Right to Restriction: You may request that co999 restricts the processing of your personal data in certain circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that co999 provides your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including any direct marketing processing. co999 will cease such processing unless it can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to [email protected] with the subject line "Data Rights Request". co999 will acknowledge your request within 48 hours and aim to respond in full within thirty (30) calendar days. We may require you to verify your identity before processing your request. Where a request is complex or high in volume, the response period may be extended by a further thirty (30) days, with prior notice.

12 Minors

The co999 Platform is strictly intended for adults aged 21 years and above. co999 does not knowingly collect, process, or store personal data relating to any person under the age of 21. If co999 discovers that personal data has been collected from a person under the minimum age, that data will be deleted immediately, the associated account will be closed, and any funds deposited will be handled in accordance with applicable law.

If you are a parent or guardian and believe that a minor has registered an account or provided personal data to co999 without your knowledge, please contact us immediately at [email protected].

13 International Data Transfers

co999 operates as an internationally licensed platform, and your personal data may be transferred to and processed in countries other than the country in which you are located. These countries may have data protection laws that differ from those in your own jurisdiction.

Where co999 transfers personal data internationally, we ensure that appropriate safeguards are in place to protect your data, including contractual obligations on recipient parties that are consistent with applicable data protection standards. Service providers who receive personal data from co999 are required to process it solely for the purposes specified in their agreements with co999 and in accordance with appropriate security standards.

By using the co999 Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in locations outside Bangladesh as described in this Policy.

14 Changes to This Policy

co999 reserves the right to update or revise this Privacy Policy at any time. Where changes are material — for example, a new category of data being collected, a new purpose of processing, or a new category of third-party recipient — co999 will provide notice via email to your registered address and/or via a prominent notification on the Platform, with a minimum of fourteen (14) days' advance notice before the change takes effect.

Minor updates, such as clarifications of existing language or corrections of typographical errors, may be made without advance notice. The "Last Updated" date at the top of this document will always reflect the date of the most recent revision.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with the co999 Terms & Conditions.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way co999 handles your personal data, please contact the co999 Data Protection team using the details below. Our support team is available in English, 24 hours a day, 7 days a week.

Email: [email protected]

Please use the subject line "Privacy Enquiry" for general privacy questions, or "Data Rights Request" when submitting a formal request to exercise your data subject rights. co999 aims to acknowledge all privacy-related emails within 48 hours of receipt.