Privacy Policy

1. Information We Collect

When you create an account or use cr999, we collect certain personal data that is necessary to provide our services, verify your identity, and comply with applicable legal obligations. The types of data we collect vary depending on how you interact with the Platform.

We collect information in three primary ways: information you provide directly during registration or account management; information generated automatically when you use the Platform (such as log files, device identifiers, and usage analytics); and information received from third-party payment processors such as bKash, Nagad, Rocket, and Upay in connection with deposits and withdrawals.

2. Categories of Personal Data

The personal data we may process includes, but is not limited to, the following categories:

• Identity data: full name, date of birth, nationality, and government-issued identification documents submitted for Know Your Customer (KYC) verification.
• Contact data: email address, mobile number, and residential address (city or district level — for example, Dhaka, Chittagong, or Sylhet).
• Financial data: payment method references (such as bKash or Nagad mobile wallet numbers), transaction amounts in BDT, deposit and withdrawal history. We do not store full card numbers or CVV codes.
• Technical data: IP address, browser type and version, device type and operating system, time zone (Bangladesh Standard Time, UTC+6), cookie identifiers, and session tokens.
• Usage data: pages visited, games played, betting history, click patterns, session duration, and feature interactions within the Platform.
• Communications data: records of your correspondence with cr999 support, including live chat transcripts, email exchanges, and any documents you voluntarily submit.

3. How We Use Your Data

cr999 processes your personal data only for specific, legitimate purposes. We do not use your information for any purpose not listed below without first obtaining your explicit consent. The lawful bases for our processing include contractual necessity, legal obligation, legitimate interests, and — where required — your explicit consent.

• Account creation and management: to register your account, verify your identity, manage your profile, and give you access to the Platform's features.
• Payment processing: to facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain accurate transaction records in BDT.
• Regulatory compliance: to meet Know Your Customer (KYC), anti-money laundering (AML), and responsible gaming obligations, including the enforcement of our 21+ age restriction policy.
• Service improvement and personalisation: to analyse usage patterns, improve game offerings, tailor promotional content, and enhance the overall user experience on the Platform.

4. Cookies and Tracking Technologies

cr999 uses cookies and similar tracking technologies (such as pixels and local storage) to ensure the Platform functions correctly, remember your preferences, and provide analytics. Cookies are small text files stored on your device. We categorise them as strictly necessary cookies (required for core functionality), performance cookies (anonymous usage statistics), and preference cookies (personalisation settings).

You may disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of some features on cr999. Strictly necessary cookies cannot be disabled as they are essential for the Platform to operate securely.

5. Data Sharing and Disclosure

cr999 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may, however, share your data with carefully selected third parties in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive only the transaction data strictly necessary to process your payment. These providers operate under their own privacy policies and are bound by data-processing agreements with cr999.
• Technology and analytics partners: anonymised or aggregated usage data may be shared with analytics providers to help us understand Platform performance. No individually identifiable data is shared in this context.
• Legal and regulatory authorities: where required by applicable law, court order, or competent regulatory authority, cr999 may be obligated to disclose personal data. We will notify you of such requests where legally permitted to do so.
• Corporate transactions: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections described in this policy.

6. Data Retention

cr999 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The specific retention periods we apply are as follows: account data is retained for the duration of your account and for a period thereafter as required by applicable regulations; transaction records are retained for a minimum of five years in compliance with financial record-keeping obligations; technical and usage data is retained for up to 24 months from the date of collection.

When data is no longer required, we securely delete or anonymise it in accordance with our internal data-destruction procedures. If you close your cr999 account, we will delete or anonymise your personal data within 90 days, unless a longer retention period is required by law.

7. Data Security

The security of your personal data is a top priority at cr999. We implement a range of technical and organisational security measures to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or mobile device and our servers, ensuring that information cannot be intercepted in transit.
• Role-based access controls: cr999 staff can only access personal data on a strict need-to-know basis, and all access is logged and audited.
• Encrypted data storage: all sensitive personal and financial data stored in our databases is encrypted at rest using industry-standard algorithms.
• Regular security assessments and penetration testing carried out by qualified third-party security professionals to identify and remediate vulnerabilities before they can be exploited.

8. Your Rights as a Data Subject

cr999 respects your rights in relation to your personal data. Regardless of where you are located in Bangladesh — whether in Dhaka, Chittagong, or any other city — you have the following rights with respect to the personal data we hold about you:

Right of access: you may request a copy of the personal data we hold about you. Right of rectification: if any personal data is inaccurate or incomplete, you may request that we correct or update it. Right of erasure: in certain circumstances, you may request that we delete your personal data (for example, if you believe the data is no longer necessary, or if you withdraw consent). Right to restrict processing: you may ask us to limit the way in which we use your data in specific circumstances. Right to object: you may object to processing carried out on the basis of our legitimate interests. Right to data portability: you may request that we transfer a copy of your data in a structured, machine-readable format. To exercise any of these rights, please contact our support team at [email protected]. We will respond to verified requests within 30 days.

9. Age Restriction and Minor Protection

cr999 is an online gaming and betting platform strictly intended for adults aged 21 and above. We do not knowingly collect or process personal data from individuals under the age of 21. Registration on the Platform constitutes a representation by the user that they are at least 21 years of age. As part of ourKYC verification process, we may require users to submit proof of age before withdrawals are processed. If we become aware that a minor has accessed our Platform or provided personal data, we will immediately suspend the relevant account and delete the associated data.

Parents and guardians who believe their child has registered on cr999 or submitted personal data to us are encouraged to contact us immediately at [email protected] so that we may take prompt corrective action.

10. International Data Transfers

cr999 operates primarily within Bangladesh and stores data on servers in secured facilities. In some instances, your personal data may be processed by service providers located outside Bangladesh, for example when we use cloud infrastructure or third-party analytics tools. When such transfers occur, we ensure that appropriate safeguards are in place to protect your data, including:

• Data processing agreements that legally bind our third-party processors to handle your data only as instructed and to implement security measures equivalent to those we apply ourselves.
• Standard contractual clauses or equivalent transfer mechanisms that ensure personal data moving across borders remains subject to a consistent level of data protection.
• Minimisation practices: we only transfer the minimum amount of personal data necessary for each specific processing purpose, reducing exposure in the event of a security incident.
• Vendor due diligence: all international processors are subject to a security and compliance review before being approved to handle cr999 user data.

11. Changes to This Privacy Policy

cr999 reserves the right to update or modify this Privacy Policy at any time. When we make material changes, we will post a prominent notice on the Platform and, where reasonably practicable, notify registered users via email or in-app notification at least 14 days before the new policy takes effect. The updated policy will be identified by a revised effective date at the top of this page.

Your continued use of cr999 after an updated Privacy Policy has been posted constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Platform and, if you wish, request deletion of your account and associated personal data.

12. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact the cr999 Data Privacy Team. Our dedicated support staff are available 24/7 to assist you. You can reach us by email at [email protected]. Please include your registered account name, a brief description of your query, and, where applicable, the specific right you wish to exercise. We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve them fully within 30 days.

cr999 is committed to resolving all privacy concerns in a fair, transparent, and timely manner. We value your trust and understand that the security of your personal data is essential to your confidence in our Platform. Our team will treat every request with the utmost respect and confidentiality.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws applicable to digital services operating in Bangladesh. Any disputes arising in connection with this policy shall be subject to the jurisdiction of the competent courts of Bangladesh. cr999 is committed to operating as a safe and reliable platform and will cooperate fully with any lawful regulatory inquiry or investigation conducted by competent authorities.