ng999 Privacy Policy — How We Handle Your Data

1About This Policy

This Privacy Policy ("Policy") describes how ng999 ("ng999", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "the Player") who visit, register on, or use the ng999 online gambling platform accessible at https://ng999.io ("the Platform").

This Policy applies to all personal data processed in connection with the ng999 Platform, including data collected through the website, account registration forms, payment processing flows, customer support interactions, and any other channel through which you communicate with ng999.

This Policy should be read alongside the ng999 Terms & Conditions, which govern the overall relationship between you and ng999, and the ng999 Responsible Gaming policy, which describes how we use data to support player welfare.

2Data Controller

For the purposes of applicable data protection law, ng999 is the data controller in respect of all personal data collected through the Platform. As data controller, ng999 determines the purposes for which personal data is processed and the means by which that processing is carried out.

All data protection enquiries, access requests, correction requests, and deletion requests should be directed to the ng999 data protection contact at: [email protected] (plain text — not a clickable link). ng999 aims to acknowledge all data-related requests within five (5) business days and to resolve them within thirty (30) calendar days of receipt.

3Data We Collect

ng999 collects the following categories of personal data from registered players and website visitors. The table below summarises each data category, examples of specific data points within that category, and the primary purpose for which ng999 collects that data.

ng999 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (except where voluntarily disclosed in the context of a responsible gaming self-exclusion request), or biometric data.

4How We Collect Data

ng999 collects personal data through the following methods:

• Direct provision by the player: When you complete the account registration form, submit KYC documents, contact support, or interact with any Platform feature that requires you to provide information, you are providing data directly to ng999.
• Automated technical collection: When you access the ng999 website or Platform, our servers automatically record technical data including your IP address, browser type, device identifiers, referring URL, and session timestamps. This data is collected via server logs, analytics tools, and first-party cookies.
• Payment processing partners: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a partner bank, the payment provider shares transaction reference data with ng999 to confirm the status of your transaction. ng999 receives only the reference data necessary to credit or debit your account — full payment credentials are not shared with ng999.
• KYC and identity verification partners: ng999 may use third-party identity verification services to cross-reference the identity documents you submit. These services return a verification result (pass/fail/require review) and may retain a copy of your documents in accordance with their own privacy policies.
• Responsible gaming monitoring: ng999's responsible gaming system automatically generates risk flags based on your gameplay patterns, deposit frequency, session length, and account behaviour. This profiling is conducted solely for player welfare purposes and is not used for any marketing or commercial purpose.

5Legal Basis for Processing

ng999 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary for ng999 to perform the contract between you and ng999 (as set out in the Terms & Conditions). Without this processing, ng999 cannot operate your account, process deposits, or pay out winnings.
• Legal obligation: ng999 is obligated to collect and retain certain data — including KYC identity documents and transaction records — to comply with anti-money-laundering (AML) legislation and responsible gaming regulatory requirements. This processing is mandatory and cannot be refused by the player.
• Legitimate interests: ng999 processes technical data and usage data on the basis of its legitimate interest in maintaining a secure, fraud-free Platform, improving the user experience, and monitoring for signs of problem gambling. Such processing is carried out in a manner proportionate to the privacy interest of the player.
• Consent: Where ng999 sends you marketing communications (promotional emails, bonus notifications), this is done on the basis of your explicit consent, given at registration or subsequently via account settings. You may withdraw marketing consent at any time.

6How We Use Your Data

ng999 uses the personal data described in Section 3 for the following specific purposes:

• Account management: Creating, maintaining, and managing your ng999 player account, including processing login authentication, password resets, and account notifications.
• KYC and age verification: Verifying that you are at least 21 years of age and that your identity matches the information provided at registration, in compliance with our responsible gaming obligations.
• Payment processing: Facilitating deposits and withdrawals via your registered payment methods (bKash, Nagad, Rocket, Upay, and partner banks), reconciling transactions, and investigating payment disputes.
• Fraud prevention and security: Monitoring account activity for signs of fraud, money laundering, identity theft, and unauthorised access. Taking automated or manual action to suspend or investigate suspicious accounts.
• Responsible gaming: Monitoring your gameplay data to identify potential indicators of problem gambling, enforcing self-exclusion and deposit limit settings you have activated, and contacting you proactively if our monitoring systems flag a concern.
• Customer support: Responding to your support queries, managing complaints, and maintaining records of communications for quality assurance and compliance purposes.
• Legal and regulatory compliance: Retaining transaction records, KYC documents, and account history as required by applicable AML and data retention laws. Reporting to relevant authorities where legally required.
• Platform improvement: Analysing aggregated, anonymised usage data to identify popular games, improve navigation, and optimise the Platform experience for all Bangladeshi players.
• Marketing (with consent): Sending promotional emails, bonus offers, and tournament notifications to players who have consented to marketing communications. Marketing messages are always sent from ng999 and never include requests for passwords or payment information.

7Data Sharing & Third Parties

ng999 does not sell your personal data. ng999 shares personal data with third parties only in the following limited circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the minimum data necessary to process your deposit or withdrawal transaction. Each payment partner operates under its own privacy policy and is bound by Bangladesh Bank regulations.
• KYC and identity verification providers: Specialist third-party verification services receive copies of your identity documents for the sole purpose of verifying their authenticity. These providers are contractually bound to use your data only for this purpose.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other platform game providers may receive session data (player ID, wager amount, game result) necessary for game operation and dispute resolution. No identity documents or payment credentials are shared with game providers.
• IT infrastructure and hosting providers: ng999 uses third-party cloud hosting and infrastructure providers whose servers store Platform data. These providers are contracted data processors and may not use your data for any purpose other than providing infrastructure services to ng999.
• Legal and regulatory authorities: ng999 may disclose personal data to law enforcement agencies, financial regulators, or courts where required by a valid legal obligation, court order, or regulatory directive. ng999 will not notify the account holder of such disclosure where prohibited by law from doing so.
• Professional advisers: Legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis in the course of providing professional services to ng999. All such advisers are bound by confidentiality obligations.

8Cookies & Tracking Technologies

ng999 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They maintain your login session, remember your language and currency preferences, and enable secure navigation between pages. Strictly necessary cookies cannot be disabled without breaking Platform functionality.
• Functional cookies: These cookies remember your game preferences, display settings, and responsible gaming configurations (such as your active session time limit), so that you do not need to re-enter these settings on every visit.
• Analytics cookies: ng999 uses first-party analytics tools to understand how players navigate the Platform. Analytics data is aggregated and anonymised wherever possible. ng999 does not use Google Analytics or other third-party analytics services that transmit player data to external servers.
• Security cookies: Short-lived security tokens are used to protect against cross-site request forgery (CSRF) attacks and other common web security threats. These cookies contain no personally identifiable information.

ng999 does not use third-party advertising cookies, tracking pixels from social media platforms, or any tracking technology that profiles your behaviour for commercial advertising purposes.

You may manage cookie preferences through your browser settings. Disabling all cookies will prevent you from logging in to your ng999 account, as session cookies are strictly necessary for Platform operation.

9Data Security

ng999 implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and ng999 servers is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS at all times; HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields — including identity document files and financial reference data — are encrypted at rest using AES-256 encryption on ng999's database infrastructure.
• Password security: Account passwords are never stored in plain text. ng999 uses industry-standard bcrypt hashing with a unique salt per account to store password credentials.
• Access controls: Access to player personal data within ng999's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal data access is logged and subject to periodic audit.
• Intrusion detection: ng999 operates automated intrusion detection and rate-limiting systems to identify and block unauthorised access attempts, credential stuffing attacks, and other malicious activity.
• Payment data isolation: Full payment credentials (e.g., complete bKash account numbers) are never stored on ng999 infrastructure. Payment transactions are processed via the payment provider's own secure API, and only masked reference identifiers are retained by ng999.

10Data Retention

ng999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:

After the applicable retention period expires, ng999 will securely delete or anonymise the relevant data. Anonymised, aggregated data (which cannot be used to identify any individual) may be retained indefinitely for statistical and product development purposes.

11Your Privacy Rights

As a data subject, you hold the following rights with respect to your personal data held by ng999. To exercise any of these rights, contact ng999 at [email protected] with the subject line "Data Rights Request — [Your Full Name]".

• Right of access: You have the right to request a copy of all personal data ng999 holds about you. ng999 will provide this in a structured, commonly used, machine-readable format within 30 days of a verified request.
• Right to rectification: If any personal data ng999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Identity data corrections may require resubmission of KYC documents.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that data subject to mandatory AML retention obligations cannot be deleted before the statutory retention period expires.
• Right to restriction of processing: You may request that ng999 restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested or while a complaint is being investigated.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that ng999 provide your personal data in a portable electronic format suitable for transfer to another service provider.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of ng999's legitimate interests, where you believe those interests are outweighed by your privacy rights in the specific circumstances.

ng999 will respond to all verified data rights requests within 30 calendar days. Where a request is complex or involves a high volume of data, ng999 may extend this period by a further 30 days with prior notice. ng999 will not charge a fee for processing data rights requests unless the request is manifestly unfounded or excessive.

12Children & Minors

The ng999 Platform is strictly intended for adults aged 21 and above. ng999 does not knowingly collect personal data from any person under the age of 21. The registration process includes a mandatory date-of-birth declaration, and all accounts are subject to age verification as part of the KYC process.

Parents and guardians who believe that a minor has registered on the ng999 Platform should contact ng999 immediately at [email protected] with the subject line "Underage Account Report". ng999 will investigate the report as a priority and take immediate remedial action.

13International Data Transfers

ng999 operates an internationally licensed Platform and uses cloud infrastructure and service partners located in multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside Bangladesh.

Where personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable in your home jurisdiction, ng999 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses that bind the receiving party to process your data in accordance with internationally recognised data protection principles.
• Data processing agreements with all third-party service providers that receive personal data, incorporating security, confidentiality, and data subject rights obligations.
• Restriction of data transfers to jurisdictions where ng999's infrastructure providers maintain internationally certified data centres with documented security standards.

For more information about the specific safeguards applied to international transfers of your personal data, contact ng999 at [email protected].

14Marketing Communications

ng999 may send you marketing communications — including promotional offers, bonus notifications, tournament announcements, and seasonal campaign messages — where you have provided explicit consent for us to do so.

Marketing communications from ng999 will always:

• Be sent from an official ng999.io email address.
• Clearly identify ng999 as the sender.
• Include a clearly visible and functional unsubscribe mechanism.
• Never request your password, OTP, payment credentials, or any sensitive personal information.
• Comply with responsible gaming obligations — for example, ng999 does not send promotional offers to players who have activated self-exclusion or deposit limits that would make the offer irrelevant.

You may opt out of marketing communications at any time by updating your communication preferences in your ng999 account settings, or by contacting [email protected] with the subject line "Unsubscribe from Marketing". Opting out of marketing will not affect transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC requests) which are necessary for account operation.

15Changes to This Policy

ng999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, Platform functionality, or data processing practices. Where a material change is made to this Policy, ng999 will notify registered players via email at the address registered on their ng999 account, at least fourteen (14) days before the amended Policy takes effect.

The effective date and version number displayed at the top of this Policy will be updated each time a change is made. The current version of this Privacy Policy is always accessible at https://ng999.io/privacy-policy. Your continued use of the ng999 Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

If you do not accept a material change to this Policy, you must notify ng999 at [email protected] before the effective date and request closure of your account. ng999 will process your account closure and return any eligible balance to your registered payment method within five (5) business days.

16Contact & Data Requests

For all privacy-related enquiries, data rights requests, and data breach notifications, please contact ng999 using the details below:

• Email (plain text — not a clickable link): [email protected]
• Subject line for data rights requests: "Data Rights Request — [Your Full Name]"
• Subject line for underage account reports: "Underage Account Report"
• Subject line for data breach reports: "Data Security Concern — [Brief Description]"
• Response time: ng999 acknowledges all data-related requests within 5 business days and resolves them within 30 calendar days.

When submitting a data rights request, please include your full name as registered on your ng999 account, your registered email address, and a brief description of your request. ng999 may need to verify your identity before processing certain requests — particularly access and deletion requests — to ensure that personal data is not disclosed to or deleted at the request of an unauthorised third party.