Privacy Policy
299k Data Commitment

Overview

This Privacy Policy ("Policy") describes how 299k ("the Platform", "we", "us", "our") collects, processes, stores, and protects the personal information of individuals ("User", "you", "your") who access or use the 299k website, mobile interface, and any associated services. This Policy applies to all users regardless of their location, with particular relevance to players based in Bangladesh.

299k is committed to handling your personal data with transparency, integrity, and care. We recognise that trust is the foundation of every relationship between a player and a gaming platform, and we take our data protection obligations seriously. This Policy is written in accessible formal English so that every 299k user understands exactly how their data is handled.

This Policy should be read alongside the 299k Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any inconsistency between this Policy and those documents on a data-protection matter, this Policy shall take precedence.

Data Controller

For the purposes of this Policy, 299k acts as the data controller in respect of all personal information collected through the platform. As data controller, 299k determines the purposes for which and the means by which your personal data is processed. All enquiries relating to data protection, subject access requests, or complaints should be directed to the 299k data support team at: support at 299k dot io

Where 299k engages third-party service providers to process data on its behalf (for example, payment processors, game software providers, or fraud detection services), those parties act as data processors under instruction from 299k and are contractually bound to process your data only for the purposes specified by 299k and to maintain adequate security standards.

Data We Collect

299k collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and occasionally from third-party verification or payment partners. The categories of data we collect are set out below.

3.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, gender, nationality, and a copy of your government-issued identity document (National Identity Card, passport, or driving licence);
• Contact data: Mobile phone number, email address, and residential address including district, division, and postal code within Bangladesh;
• Account credentials: Username and encrypted password (we never store passwords in plain text);
• Financial data: Mobile wallet numbers (bKash, Nagad, Rocket, Upay), bank account details (for applicable bank transfer methods including Dutch-Bangla Bank, BRAC Bank, City Bank), and transaction history;
• Verification documents: Copies of identity and address verification documents submitted during KYC (Know Your Customer) checks;
• Communications: Records of your correspondence with 299k support, including chat transcripts, emails, and any attachments you provide.

3.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers;
• Usage data: Pages visited, time spent on each page, navigation paths, search queries within the platform, game sessions opened, bet types placed, and feature interactions;
• Transaction data: Full records of all deposits, withdrawals, bets, game rounds, bonus activations, and balance adjustments with timestamps (Bangladesh Standard Time, UTC+6);
• Location data: General geographic location inferred from your IP address. 299k does not collect precise GPS coordinates;
• Cookie and tracking data: Session identifiers, preference cookies, analytics cookies, and fraud-detection signals. See Section 9 for full details.

3.3 Data from Third Parties

• Payment verification: Transaction status confirmations and fraud signals from bKash, Nagad, Rocket, Upay, and partner banks;
• Identity verification: Results of document verification checks conducted by KYC service partners;
• Responsible gaming registers: Where applicable, self-exclusion status from responsible gaming databases.

How We Use Your Data

299k uses your personal data for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with those listed here without first notifying you and, where required, obtaining your consent.

299k does not use your personal data for automated individual decision-making that produces significant legal effects, except in the context of fraud detection and responsible gaming interventions where automated flags are always subject to human review before any account action is taken.

Legal Basis for Processing

299k processes your personal data on the following legal bases, referenced in the table in Section 4:

• Contract performance: Processing is necessary to provide the services you have requested as a registered 299k user — including operating your account, processing transactions, and delivering game access;
• Legal obligation: Processing is necessary to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) rules, age verification obligations, and responsible gaming requirements;
• Legitimate interests: Processing serves the legitimate interests of 299k (for example, fraud prevention, platform security, and analytics), provided those interests are not overridden by your rights and interests as a data subject;
• Consent: Where processing is based on consent (for example, receiving promotional communications about new games, BPL season bonuses, or Eid offers), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. To withdraw consent, contact us at support at 299k dot io.

Data Sharing

299k does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We share your data only in the limited circumstances described below, and always subject to appropriate contractual or legal safeguards.

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process data on our behalf and under our instruction. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank receive transaction data necessary to process your deposits and withdrawals;
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive session data necessary to deliver game functionality and record game round outcomes;
• Identity verification partners: KYC service providers receive identity document data to conduct age and identity verification checks;
• Fraud and security services: Fraud detection providers receive device and behavioural data to identify and prevent fraudulent activity;
• IT infrastructure and hosting: Cloud hosting and IT support providers may access data as necessary to maintain platform security and availability.

6.2 Legal and Regulatory Disclosures

299k may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required or permitted to do so by applicable law, or where 299k has a good-faith belief that disclosure is necessary to protect the rights, property, or safety of 299k, its users, or the public.

Data Retention

299k retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply as a general guide:

• Account data and KYC documents: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with anti-money laundering and record-keeping obligations;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Customer support communications: Retained for 3 years from the date of the last interaction;
• Usage and analytics data: Retained in aggregated or anonymised form indefinitely for platform improvement purposes; identifiable usage data is retained for up to 2 years;
• Cookie data: Session cookies are deleted when you close your browser; persistent cookies are retained for the period specified in Section 9.

Upon expiry of the applicable retention period, 299k will securely delete or anonymise your personal data so that it can no longer be associated with you. Where deletion is not technically feasible in the short term (for example, in backup archives), data will be isolated and protected from further processing until deletion is possible.

Security Measures

299k employs a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes:

• 256-bit SSL/TLS encryption across all data transmissions between your device and the 299k platform;
• Encryption at rest for sensitive fields including passwords (hashed using bcrypt), financial data, and identity documents;
• Two-factor authentication (2FA) available to all users and mandated for high-risk account actions such as withdrawal requests;
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo background screening and regular data protection training;
• Intrusion detection and monitoring: Continuous monitoring for unusual access patterns, brute-force attempts, and anomalous transaction behaviour;
• Regular security audits: Periodic third-party penetration testing and vulnerability assessments of the 299k platform infrastructure.

Cookies & Tracking Technologies

299k uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and detect fraud. A cookie is a small text file placed on your device by the 299k website. The following categories of cookies are used:

299k does not deploy third-party advertising cookies or permit external ad networks to place tracking cookies on the 299k platform. You may manage or delete cookies through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the platform. Disabling functional or analytics cookies will not affect core platform functionality.

Your Rights

As a 299k user, you hold the following rights in respect of your personal data. To exercise any of these rights, submit a written request to support at 299k dot io from the email address registered to your 299k account. 299k will respond within 30 days of receiving a valid request.

• Right of access: You may request a copy of the personal data 299k holds about you, together with information about how it is being used;
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data held about you;
• Right to erasure: In certain circumstances you may request that we delete your personal data. Note that this right is subject to our legal retention obligations (see Section 7) and may not apply where processing is required for legal compliance;
• Right to restrict processing: You may request that we limit how we use your data in certain circumstances, for example while a rectification request is being assessed;
• Right to data portability: You may request a copy of personal data you have provided to 299k in a structured, commonly used, machine-readable format;
• Right to object: You may object to processing based on legitimate interests. If you object to receiving promotional communications, you can opt out at any time by contacting us at support at 299k dot io;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting prior lawful processing.

Protection of Minors

299k enforces a strict minimum age of 21 years for all platform users. The 299k platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. If 299k becomes aware that personal data has been collected from a user who is under 21 years of age, that account will be immediately suspended, all data will be securely deleted in accordance with our retention policy, and any deposits will be returned to the original payment method pending identity verification.

If you are a parent or guardian and believe that a minor in your care has created a 299k account or provided personal data to the platform, please contact us immediately at support at 299k dot io so that we can take prompt corrective action.

International Data Transfers

Some of 299k's third-party service providers — including game software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe, and certain IT infrastructure partners — may be located outside Bangladesh. Where personal data is transferred to a third country, 299k ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. Such safeguards include contractual data protection clauses binding service providers to 299k's privacy standards.

Financial transaction data processed through Bangladeshi payment partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank) is processed within Bangladesh and subject to applicable Bangladeshi data handling regulations.

Third-Party Services

The 299k platform integrates game content delivered by third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe. When you play a game delivered by one of these providers, limited session data (such as a session token and game round results) is exchanged with that provider as necessary to operate the game. These providers operate under their own privacy policies in addition to their contractual obligations to 299k.

299k does not embed third-party social media widgets, advertisement networks, or analytics platforms from external providers on its platform pages. All analytics used by 299k are first-party and operated under 299k's direct control.

Policy Changes

299k may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, 299k will notify registered users via the email address associated with their account at least 14 days before the changes take effect and will post a prominent notice on the platform.

The "Effective" date at the top of this Policy indicates when the current version came into force. We recommend that you review this Policy periodically. Your continued use of the 299k platform following notification of a material change constitutes your acknowledgement of the updated Policy.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a data protection complaint, please contact the 299k data protection team. We are available 24 hours a day, 7 days a week and will respond to all data-related enquiries within 30 calendar days of receipt.

Contact: support at 299k dot io