299vat Privacy Policy

This Privacy Policy ("Policy") applies to all users of the 299vat Platform, including visitors who browse without registering, registered account holders, and players actively using our gaming or betting services. By accessing or using the 299vat Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy.

299vat ("the Company", "we", "us", or "our") is the data controller responsible for your personal information collected through the Platform. As data controller, 299vat determines the purposes and means of processing personal data and is accountable for ensuring that processing is carried out lawfully, fairly, and transparently.

This Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy, both of which are published on this website and incorporated herein by reference. If there is any inconsistency between this Policy and another document in respect of data privacy matters, this Policy shall take precedence.

299vat collects personal data through several distinct channels. The type and volume of data collected depends on how you interact with our Platform:

Data you provide directly: When you register an account, you supply identity and contact data including your full name, date of birth, email address, and mobile number. During identity verification, you may be asked to upload copies of government-issued identity documents such as your National Identity Card (NID) or passport, along with proof of address. When you make a deposit or withdrawal, you provide financial account details for your chosen payment method such as bKash, Nagad, Rocket, Upay, USDT wallet address, Visa, or Mastercard.

Data collected automatically: When you access the Platform, our servers and analytics systems automatically record technical data including your IP address, the type of device and operating system you are using, browser version, referring URL, pages visited, session start and end times, and in-session interaction patterns. This data is collected via server logs, cookies, and similar technologies described further in Section 5 of this Policy.

Data collected through gameplay: Every wager placed, game launched, bonus activated, and live chat message sent through the 299vat Platform generates usage data that is associated with your account. This data is used to fulfil our contractual obligations to you (for example, correctly settling bets), to monitor for responsible gaming indicators, and to improve the overall quality of the Platform.

Data received from third parties: In certain circumstances we may receive information about you from third-party identity verification providers, fraud prevention agencies, or payment processors in connection with our compliance and security obligations. Any such data is handled in accordance with this Policy.

299vat processes your personal data for the following defined purposes:

• Account creation and management: To register your account, verify your identity, maintain your account balance, and administer your player profile throughout your relationship with us.
• Service delivery: To process deposits and withdrawals, settle bets and game outcomes, credit bonuses, and deliver all other core platform services that you request.
• Identity and age verification (KYC): To confirm that you meet the 18+ age requirement and to satisfy our obligations under applicable Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations.
• Fraud and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, collusion, and other activities that breach our Terms and Conditions or applicable law.
• Responsible gaming: To monitor betting and gaming patterns that may indicate problem gambling behaviour, to enforce deposit limits and self-exclusion requests, and to provide proactive responsible gaming interventions where warranted.
• Customer support: To respond to your queries, resolve complaints, process refunds, and maintain records of our communications for quality assurance and dispute resolution purposes.
• Legal and regulatory compliance: To fulfil our reporting and record-keeping obligations to applicable regulatory and law enforcement authorities, including the provision of transaction records when lawfully required.
• Platform improvement: To analyse aggregated and anonymised usage data to identify performance issues, improve user experience, test new features, and optimise game and betting product offerings.
• Marketing communications (with consent): To send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, and seasonal offers where you have provided explicit consent. You may withdraw this consent at any time.

299vat relies on the following legal bases when processing your personal data. We will always identify the applicable legal basis before commencing any new processing activity:

• Contract performance: Processing that is necessary to perform the contract between you and 299vat — primarily account registration, service delivery, payment processing, and bet settlement.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC identity checks, AML transaction monitoring, data retention requirements, and responses to lawful authority requests.
• Legitimate interests: Processing carried out to pursue the legitimate business interests of 299vat, provided those interests are not overridden by your rights and freedoms. This includes fraud prevention, platform security, responsible gaming monitoring, and product analytics. We conduct a balancing test before relying on this basis.
• Consent: Processing based on your freely given, specific, and informed consent. We rely on consent solely for the purpose of sending direct marketing communications. You may withdraw consent at any time by contacting our support team or using the unsubscribe mechanism in any marketing email.

Cookies are small text files placed on your device by the 299vat Platform when you visit. They enable us to recognise your browser, maintain your session while you are logged in, and collect aggregate data about how the Platform is used. 299vat uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be switched off. They are set in response to your actions such as logging in, setting your preferences, or filling in forms. They do not store any personally identifiable information.
• Performance and analytics cookies: These cookies allow us to count visits and traffic sources so we can measure and improve Platform performance. All data collected is aggregated and anonymised. We do not use this data to identify individual players.
• Functionality cookies: These cookies enable the Platform to remember choices you have made — such as your preferred language or display settings — in order to provide a more personalised experience.

You may control or delete cookies through your browser settings at any time. Please be aware that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or accessing certain services. For detailed guidance on managing cookies in your specific browser, please consult your browser's help documentation.

299vat does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment processors: bKash, Nagad, Rocket, Upay, USDT gateway operators, Visa, and Mastercard receive the minimum financial data required to process your transactions securely.
• Identity verification providers: Third-party KYC and AML service providers that assist us in verifying your identity and screening your account against applicable sanctions and watchlists.
• Game content providers: Software studios such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi receive session data necessary to deliver their games through the 299vat Platform. These providers operate under their own data protection frameworks and are contractually prohibited from using your data for any purpose other than game delivery.
• Fraud prevention agencies: Specialist third-party services that assist us in detecting and preventing fraudulent activity on the Platform.
• Regulatory and law enforcement authorities: We will disclose personal data to regulators, government bodies, courts, or law enforcement agencies where we are required to do so by applicable law, or where we believe disclosure is necessary to protect the rights, property, or safety of 299vat, our players, or the public.
• Professional advisers: Lawyers, auditors, and consultants where necessary for the conduct of our business, subject to strict confidentiality obligations.

In the event that 299vat undergoes a merger, acquisition, or sale of all or substantially all of its assets, personal data held by the Company may be transferred to the successor entity as part of that transaction. You will be notified in advance of any such transfer that materially changes the handling of your personal data.

The 299vat Platform serves players based in Bangladesh, and the majority of our data processing operations are conducted within the region. However, some of our technology infrastructure and third-party service providers — including game studios and identity verification platforms — may be located in other jurisdictions.

Where personal data is transferred outside Bangladesh to a jurisdiction that does not offer an equivalent level of data protection, 299vat ensures that appropriate safeguards are in place prior to the transfer. These safeguards may include contractual clauses that impose equivalent data protection standards on the receiving party, or reliance on the recipient's certification under a recognised international data protection framework.

If you would like further information about the specific safeguards applied to any particular international transfer of your personal data, please contact us at the address set out in Section 15 of this Policy.

299vat retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, and in any event for no longer than required by applicable legal, regulatory, or accounting obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with 299vat plus a minimum of 5 years following account closure, in accordance with applicable AML and financial record-keeping requirements.
• Transaction records: Financial transaction data is retained for a minimum of 5 years from the date of the transaction, as required for AML compliance and potential dispute resolution.
• Support and communication records: Live chat logs, email correspondence, and complaint records are retained for a minimum of 3 years from the date of the interaction.
• Technical and usage data: Server log and session data is retained for up to 12 months on active systems, after which it is either deleted or anonymised for aggregate analytics purposes.
• Marketing consent records: Records of your consent to receive marketing communications are retained for the duration of your active consent plus 2 years following its withdrawal, for compliance verification purposes.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures. Where data cannot be immediately deleted due to technical constraints — for example, data held in backup archives — it will be isolated from active processing until deletion is possible.

The security measures implemented by 299vat to protect your personal data include, but are not limited to, the following:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encrypted storage for sensitive personal data at rest, including identity documents and financial account identifiers.
• Role-based access controls that restrict employee access to personal data on a strictly need-to-know basis.
• Two-factor authentication requirements for internal staff systems that hold or process personal data.
• Regular vulnerability assessments and penetration testing conducted by qualified third-party security specialists.
• Automated anomaly detection systems that flag unusual access patterns or potential data breaches for immediate investigation.
• Formal information security policies and mandatory staff training on data protection and privacy obligations.

While 299vat employs commercially reasonable and industry-standard security measures, no system is entirely immune from risk. You are responsible for maintaining the security of your own account credentials, including your password and any two-factor authentication device. 299vat will never ask you to share your password via email or live chat.

As an individual whose personal data is processed by 299vat, you hold the following rights in respect of that data. You may exercise any of these rights at any time by contacting our support team using the contact details in Section 15:

• Right of access: You may request a copy of all personal data that 299vat holds about you, together with information about how it is used, where it is stored, and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure ("right to be forgotten"): In certain circumstances, you may request the deletion of your personal data. This right is not absolute — we may be required to retain certain data to comply with legal obligations or to establish, exercise, or defend legal claims.
• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances, for example while a correction request is being assessed, or where you have objected to processing based on legitimate interests.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, and to opt out of direct marketing communications at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

299vat will respond to all data subject rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by up to an additional 60 days, in which case you will be notified of the extension and the reasons for it. We will not charge a fee for handling requests unless they are manifestly unfounded or excessive.

299vat implements age verification procedures at the point of registration and as part of our ongoing KYC process to prevent minors from accessing the Platform. These measures include requiring date-of-birth disclosure at sign-up, requesting government-issued identity documents where age cannot be confirmed electronically, and monitoring account usage patterns for indicators of underage access.

If you are a parent or guardian and believe that your child has registered an account on the 299vat Platform without your knowledge, please contact us immediately at [email protected]. We will take prompt action to investigate and close the account, and will delete all associated personal data to the extent permitted by law.

We encourage parents and guardians in Bangladesh to use available internet filtering tools to restrict access to online gambling platforms. Free parental control software is widely available and can be configured to block access to gambling-related websites and applications.

299vat may send you promotional communications about bonuses, new games, seasonal offers, and other platform updates where you have provided your explicit consent to receive such communications at the time of registration or through your account preferences.

We send marketing communications via email and in-platform notifications only. We do not make unsolicited marketing telephone calls, and we do not send SMS marketing messages without explicit prior consent.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "unsubscribe" link present in the footer of any marketing email sent by 299vat.
• Updating your communication preferences within your 299vat account settings.
• Contacting our support team at [email protected] and requesting removal from our marketing list.

Please note that withdrawing marketing consent does not affect your receipt of service-related communications — such as account security alerts, deposit confirmations, withdrawal notifications, and support responses — which are sent on the basis of contract performance and are necessary to manage your account.

The 299vat Platform may contain references to or links to third-party websites, applications, or services — for example, payment provider portals or game studio websites. This Privacy Policy applies solely to personal data collected and processed by 299vat through the Platform. We are not responsible for the privacy practices of any third-party website or service, and we encourage you to review the privacy policies of any external sites you visit.

The inclusion of a link to a third-party website on the 299vat Platform does not constitute an endorsement of that website or any representation regarding its privacy practices, security standards, or content.

299vat reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. When we make material changes to this Policy, we will notify registered account holders by email and display a prominent notice on the Platform for a period of at least 14 days prior to the changes taking effect.

The "Effective Date" displayed at the top of this Policy indicates the date on which the current version came into force. We encourage you to review this Policy periodically to stay informed about how 299vat is protecting your personal data. Your continued use of the Platform following the effective date of any updated version constitutes your acknowledgement of the revised Policy.

If you object to any change in this Policy, you should cease using the Platform and may request closure of your account by contacting our support team. We will process any outstanding withdrawals and close your account in accordance with our standard account closure procedures.

You may contact 299vat regarding any matter relating to this Privacy Policy using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Support hours: 24 hours a day, 7 days a week
• Response time: 2–5 minutes for live chat; up to 2 business days for email
• Time zone: Bangladesh Standard Time (BST, UTC+6)

When submitting a data subject rights request, please include your registered email address and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request in order to protect your data from unauthorised access.

If you are not satisfied with our response to any privacy concern, you have the right to lodge a complaint with the appropriate data protection authority in your jurisdiction. We would, however, appreciate the opportunity to address your concerns directly before you escalate to a regulatory authority, and we encourage you to contact us in the first instance.