Privacy Policy
for cu999 Platform

Introduction

This Privacy Policy ("Policy") describes how cu999 ("we", "us", "our", "the Platform") collects, uses, stores, and shares personal data in connection with the operation of the cu999 website at https://cu999.io and all associated services, including sports betting, live casino, slot games, crash games, and fishing arcade titles.

cu999 is committed to protecting the privacy and personal data of every player who registers and interacts with our platform. We operate primarily for players based in Bangladesh and handle all personal data with the care, transparency, and security that our players deserve.

By registering for a cu999 account, making a deposit, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the complete agreement between you and cu999 and should be read alongside our Terms & Conditions and Responsible Gaming Policy.

Data We Collect

cu999 collects personal data only to the extent necessary to provide our services, verify player identities, process financial transactions, and comply with applicable legal and regulatory obligations. The categories of personal data we collect include:

2.1 Registration & Identity Data

When you create a cu999 account, we collect your full legal name, date of birth, gender, residential address (including division, district, and upazila within Bangladesh), email address, and mobile phone number. This data is used to create and manage your player account and to fulfil our Know Your Customer (KYC) obligations.

2.2 Identity Verification Documents

To comply with our KYC requirements and to verify your age (21+ mandatory) and identity, we may request copies of government-issued identification documents, including your National Identity Card (NID), passport, or birth registration certificate. We may also request utility bills or bank statements as proof of address, and confirmation of ownership of your payment method (e.g., a screenshot of your bKash or Nagad account registered under your name).

2.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, bets, and game sessions conducted through your cu999 account. This includes transaction amounts in BDT, timestamps, payment method references (such as bKash transaction IDs or bank reference numbers), and balance history. Full payment card numbers and mobile banking PINs are never stored by cu999 directly.

2.4 Technical & Usage Data

When you access cu999, our systems automatically collect technical data including your IP address, browser type and version, device type and operating system, screen resolution, preferred language settings, pages visited, time spent on pages, clickstream data, referring URLs, and session duration. This data helps us understand how players use the platform and allows us to identify and resolve technical issues promptly.

2.5 Communications Data

We retain records of all communications between you and the cu999 support team, including emails, live chat transcripts, and any documents or screenshots you share with us. This data is used to resolve disputes, improve our support quality, and maintain a complete history of your interactions with the platform.

How We Use Your Data

cu999 uses the personal data we collect for the following specific and legitimate purposes:

• Account Management: To create, maintain, and administer your cu999 player account, including verifying your identity and age during registration and processing any changes to your account details.
• Service Delivery: To enable you to place bets, play casino and arcade games, make deposits, and request withdrawals — the core services that constitute the cu999 platform experience.
• KYC & Regulatory Compliance: To verify your identity and age in accordance with our legal and regulatory obligations, and to fulfil our anti-money laundering (AML) and counter-terrorism financing (CTF) reporting requirements.
• Fraud Prevention & Security: To monitor player accounts and transactions for signs of fraudulent activity, unauthorised access, collusion, bonus abuse, or other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance in connection with your use of the cu999 platform.
• Platform Improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall performance and user experience of the cu999 platform.
• Responsible Gaming: To monitor betting patterns that may indicate problem gambling behaviour and to enforce responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion requests made by players.
• Marketing & Promotions: To send you promotional offers, bonuses, and news about cu999 products and features — but only where you have given explicit consent to receive such communications.
• Legal Obligations: To comply with applicable laws and regulations, to respond to lawful requests from competent authorities, and to exercise or defend legal claims.

cu999 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you as an individual, except for fraud detection systems where automated flags are always reviewed by a human member of our compliance team before any account action is taken.

Legal Basis for Processing

cu999 processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual Necessity: Processing that is necessary to perform the contract between you and cu999 — i.e., to provide the betting, casino, and gaming services you have registered for and to process your financial transactions.
• Legal Obligation: Processing that is required for cu999 to comply with applicable laws and regulations, including KYC and AML obligations, age verification requirements, and responses to lawful requests from public authorities.
• Legitimate Interests: Processing that serves the legitimate business interests of cu999, including fraud prevention, platform security, abuse detection, internal analytics, and improving the quality of our services — where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

Cookies & Tracking Technologies

cu999 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate and improve the platform. Cookies are small text files placed on your device when you visit the cu999 website. They serve several important functions:

• Essential Cookies: Required for the platform to function correctly. These include session cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery (CSRF), and load-balancing cookies that ensure a consistent connection to our servers. These cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised information about how players navigate and use the cu999 platform, which pages are most visited, and where errors occur. This data helps us improve platform performance and user experience. These cookies do not identify you personally.
• Functional Cookies: Used to remember your preferences such as your preferred language, display settings, and game lobby filters, so you do not need to reconfigure these on each visit.
• Marketing Cookies: Used, with your consent, to track your engagement with cu999 promotional content so that we can present offers that are relevant to your interests. These cookies may be shared with trusted advertising partners who assist in delivering our promotions.

You can manage your cookie preferences through your browser settings at any time. Please be aware that disabling non-essential cookies may affect the functionality of certain platform features. A cookie consent notice is presented on your first visit to the cu999 platform, where you can make granular choices about which categories of cookies you accept.

Third-Party Sharing

cu999 does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. We may share your data with carefully selected third parties only in the following circumstances and only to the minimum extent necessary:

• Payment Service Providers: We share transaction data with payment processors including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard for the purpose of processing your deposits and withdrawals. Each of these providers operates under their own privacy policy and is bound by contractual obligations to protect your data.
• KYC & Identity Verification Partners: We may share identity documents and personal details with third-party KYC verification service providers who assist us in confirming player identities and ages. These partners are contractually prohibited from using your data for any purpose other than the verification service.
• Game Content Providers: Game session data (such as bet amounts and outcomes) may be shared with game studios and content providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — to the extent required to deliver and audit the games you play. These providers do not receive your identity or financial account data.
• IT & Infrastructure Providers: We use third-party cloud hosting, data storage, and cybersecurity service providers who have access to personal data only in their capacity as data processors acting on our instructions, under strict contractual data protection agreements.
• Legal & Regulatory Authorities: We may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, safety, or property of cu999 or third parties.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of cu999's business assets, player data may be transferred to the successor entity as part of that transaction, subject to equivalent data protection obligations.

Data Retention

cu999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The following retention periods apply to different categories of data:

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with any individual player. Where anonymisation is not technically feasible, data is destroyed using industry-standard secure deletion methods.

Data Security

cu999 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• Transport Encryption: All data transmitted between your browser or app and the cu999 servers is encrypted using TLS 1.2 or higher (256-bit SSL). This protects your credentials, payment data, and personal information from interception during transit.
• Access Controls: Access to personal data within cu999 is granted on a strict need-to-know basis. Staff members are only permitted to access the specific data required to perform their job functions, and all access is logged and audited regularly.
• Password Security: Player passwords are stored using industry-standard one-way cryptographic hashing algorithms. cu999 staff cannot view your password in plaintext at any time. If you forget your password, it must be reset — it cannot be retrieved.
• Two-Factor Authentication: cu999 supports SMS OTP two-factor authentication (2FA) for all player accounts. We strongly recommend that all players enable 2FA to provide an additional layer of protection against unauthorised access.
• Intrusion Detection: Our platform employs real-time intrusion detection and prevention systems (IDS/IPS) that monitor for suspicious traffic patterns and automatically block potential threats before they can affect player accounts or data.
• Regular Security Audits: cu999 conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses in our infrastructure before they can be exploited.

In the event of a data security breach that is likely to result in a risk to the rights and freedoms of affected players, cu999 will notify affected individuals without undue delay and will take all reasonable steps to contain and remediate the breach.

Your Rights

As a cu999 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered account username and a description of your request.

• Right of Access: You have the right to request a copy of all personal data we hold about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared. We will provide this information within 30 days of receiving your request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. Most account details can be updated directly via your account settings. For data that requires manual correction (such as KYC documents), please contact our support team.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other lawful basis for processing. Please note that we may be required to retain certain data for legal or regulatory reasons even after an erasure request, as described in Section 7.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while the accuracy of the data is being contested or while you have objected to processing based on legitimate interests.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to us in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request that we transmit this data directly to another controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing based on legitimate interests, although we may continue processing if we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place before the withdrawal.

cu999 will respond to all data rights requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, and we will notify you of the extension and the reason for it within the initial 30-day period.

Children & Minors

The cu999 platform is strictly for adults aged 21 years and above. cu999 does not knowingly collect, process, or store personal data relating to any person under the age of 21. Age verification is a mandatory step in the cu999 registration process, and we employ both automated and manual checks to identify and reject registration attempts by underage individuals.

If cu999 becomes aware that personal data belonging to a person under the age of 21 has been collected — whether through a fraudulent registration or any other means — we will immediately take the following steps: suspend the affected account, return any deposits to the payment method used, void all associated bets and winnings, securely delete all personal data relating to the underage individual, and report the matter to relevant authorities where required by law.

Marketing Communications

cu999 may send you promotional messages, bonus offers, tournament announcements, and platform news via email and SMS. We will only send you marketing communications where you have given us your explicit consent to do so — either during the registration process or at a later point through your account preferences.

Every marketing email sent by cu999 includes a clearly visible unsubscribe link at the bottom of the message. SMS marketing messages include an opt-out instruction. You may also withdraw your marketing consent at any time by:

• Updating your communication preferences in your cu999 account settings panel.
• Sending an email to [email protected] with the subject line "Unsubscribe" and your registered account username.
• Replying "STOP" to any marketing SMS sent by cu999.

Once we receive your opt-out request, we will process it within 5 business days. You may continue to receive transactional communications — such as deposit confirmations, withdrawal notifications, security alerts, and KYC-related messages — regardless of your marketing preferences, as these are necessary for the operation of your account and cannot be opted out of.

cu999 does not purchase or use third-party marketing lists to contact individuals who have not registered on our platform. All marketing communications are sent exclusively to players who have created a cu999 account and provided consent.

International Data Transfers

cu999 primarily processes and stores personal data on servers located in data centres serving the South and Southeast Asian region. However, certain service providers and technology partners that we use may be based in, or operate infrastructure in, other countries. Where personal data is transferred outside of Bangladesh to a third country, cu999 ensures that appropriate safeguards are in place to protect your data.

These safeguards may include:

• Contractual clauses that impose data protection obligations on the recipient that are equivalent to those we apply ourselves.
• Transferring data only to countries that maintain an adequate level of data protection as recognised by internationally accepted standards.
• Implementing additional technical controls such as encryption and pseudonymisation to protect data in transit and at rest in the recipient jurisdiction.

If you would like further information about the specific safeguards in place for any particular international data transfer, please contact our data protection team at [email protected].

Changes to This Policy

cu999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or business operations. When we make material changes to this Policy, we will take the following steps to ensure you are properly informed:

• The revised Policy will be published on this page with an updated "Effective Date" displayed at the top of the document.
• Active players will receive an in-platform notification and, where contact details are available and verified, an email notification summarising the key changes at least 14 days before the updated Policy takes effect.
• For changes that materially affect the way we process personal data in a way that requires fresh consent, we will present a specific consent request to affected players before the changes come into force.

Your continued use of the cu999 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue your use of the platform and contact [email protected] to request account closure and data deletion in accordance with your rights under Section 9.

Minor changes — such as corrections of typographical errors, clarifications that do not alter the substance of our data practices, or updates to contact information — may be made without advance notice to players. The "Effective Date" will always reflect the date of the most recent revision, regardless of the nature of the change.

Contact & Data Requests

cu999 is the data controller responsible for the personal data collected and processed through the cu999 platform. If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact our data protection team using the details below.

All data rights requests, privacy complaints, and policy enquiries should be submitted to:

When contacting us regarding a data rights request, please include your registered cu999 account username, a clear description of your request, and any relevant reference numbers. Providing complete information upfront will allow our team to process your request as efficiently as possible.

cu999 is committed to working with you to resolve any privacy concerns fairly and transparently. We will acknowledge all data-related enquiries within 2 business days and provide a substantive response within the 30-day statutory period. In the event that we are unable to resolve your concern to your satisfaction, you retain the right to escalate the matter to the appropriate data protection authority in your jurisdiction.