b399 Privacy Policy

This Privacy Policy ("Policy") sets out the manner in which b399 ("b399", "we", "us" or "our"), operator of the online betting and live casino platform accessible at https://b399.cam, collects, processes, stores, shares and protects personal data relating to individuals ("Data Subjects", "Users", "you" or "your") who access or use the Platform.

b399 is committed to handling personal data responsibly, transparently and in accordance with applicable data protection principles. We collect only the personal data that is genuinely necessary for the purposes described in this Policy. We do not sell, rent or trade your personal data to third parties for marketing purposes.

By accessing the Platform, creating an Account, or submitting your personal data to us in any other way, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, telephone number, IP address, device identifiers and account activity data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, b399 acts as Data Controller in respect of all personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller pursuant to a data processing agreement.
• "KYC Data" means identity verification documents submitted by Users as part of the Know Your Customer process, including government-issued identification (e.g., CNIC, passport), selfie verification images and proof of address.
• "Cookies" means small text files or similar tracking technologies placed on a User's device by the Platform for session management, analytics and personalisation purposes.
• "Account" means a registered user profile on the Platform through which betting and casino activity is conducted.

b399 acts as Data Controller in respect of all personal data collected and processed through the Platform at https://b399.cam. The Data Controller is responsible for determining the purposes and means of processing your personal data and for ensuring that processing is conducted lawfully, fairly and transparently.

Where b399 engages third-party service providers (for example, payment processors, identity verification providers, fraud detection tools or customer support platforms) to process data on its behalf, such providers operate as Data Processors and are bound by data processing agreements that require them to implement appropriate safeguards and to process data only on b399's instructions.

Contact details for all data protection enquiries, subject access requests and consent withdrawals are provided in Section 15 of this Policy.

b399 collects personal data in the following categories, depending on the nature of the User's interaction with the Platform:

b399 does not knowingly collect sensitive personal data (such as health information, religious affiliation or biometric data) except where required for identity verification (e.g., facial recognition as part of a KYC process operated by a third-party provider). In such cases, the minimum necessary data is collected and handled with appropriate safeguards.

b399 processes personal data for the following purposes:

• Account Management: To create, maintain and administer your Account on the Platform, including authenticating your identity at login and processing Account-level actions (password resets, preference updates, responsible gambling tool activations).
• KYC & AML Compliance: To verify your identity and age, satisfy our Know Your Customer obligations, and conduct Anti-Money Laundering checks as required under our licensing and legal obligations. This may involve sharing data with regulated third-party identity verification providers.
• Transaction Processing: To process deposits, withdrawals and any bonus credits to and from your Account, and to maintain an accurate record of your financial activity on the Platform.
• Fraud Detection & Platform Integrity: To detect, investigate and prevent fraudulent activity, multi-accounting, abuse of promotional offers, collusion and other prohibited conduct that would breach our Terms & Conditions.
• Responsible Gambling: To implement and enforce your chosen responsible gambling settings (deposit limits, loss limits, self-exclusion), and to identify patterns of potentially problematic gambling behaviour that may warrant a proactive intervention or support referral.
• Customer Support: To respond to your enquiries, process complaints and maintain records of your interactions with our support team for quality assurance purposes.
• Platform Improvement & Analytics: To analyse aggregated usage data and improve the performance, features and user experience of the Platform. Where analytics tools are used, data is processed in accordance with this Policy.
• Legal & Regulatory Obligations: To comply with applicable laws, court orders, regulatory requests, licensing conditions and any other legally binding obligations requiring the retention or disclosure of personal data.
• Marketing & Communications (where consented): To send promotional emails, bonus notifications and Platform updates. You may withdraw your marketing consent at any time by contacting us at [email protected]. Withdrawal of marketing consent does not affect other processing of your data.

Where applicable data protection frameworks require a lawful basis for processing, b399 relies on the following bases:

b399 does not sell, rent or trade your personal data. We may share personal data with the following categories of third parties strictly for the purposes described in this Policy:

• Identity Verification Providers: Third-party KYC service providers engaged to perform age verification, identity checks and document authentication as required for Account registration and ongoing compliance. These providers are bound by data processing agreements and applicable data protection law.
• Payment Processing Partners: Financial technology companies and payment gateway operators engaged to process deposits and withdrawals. These partners receive only the minimum payment-related data necessary to execute the transaction. References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah in this context refer to payment rails familiar to Pakistani users; data sharing with any such provider is limited to what is necessary to complete a transaction and does not imply endorsement of online gambling by any such entity.
• Fraud Detection & Security Services: Providers of fraud detection tools, risk scoring systems and platform security services. These processors handle data only on our instructions and under appropriate contractual safeguards.
• Customer Support Platforms: Where third-party live chat or ticketing software is used to manage support communications, limited account and interaction data may be processed by those platforms as Data Processors.
• Regulatory and Law Enforcement Authorities: b399 may disclose personal data to regulators, law enforcement agencies, courts or other public authorities where required to do so by law, court order, or in connection with the investigation of suspected criminal activity. b399 will not disclose more information than is required by the applicable legal obligation.
• Corporate Transactions: In the event of a merger, acquisition, restructuring or sale of assets, personal data held by b399 may be transferred to a successor entity, subject to that entity assuming equivalent privacy obligations as described in this Policy.

b399 operates internationally and your personal data may be transferred to, and processed in, countries other than Pakistan or your country of residence. Such transfers may occur when data is processed by third-party service providers based in other jurisdictions, including KYC providers, payment processors and cloud infrastructure partners.

Where personal data is transferred internationally, b399 takes steps to ensure that appropriate safeguards are in place, including:

• Relying on standard contractual clauses or equivalent data transfer mechanisms approved by applicable regulatory authorities;
• Conducting due diligence on the data protection standards of third-party processors before engaging them;
• Requiring all Data Processors to contractually commit to processing data only for the specified purposes and to implement appropriate technical and organisational security measures.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan and that the data protection laws of those jurisdictions may differ from those in Pakistan. b399 seeks to ensure that your data receives an equivalent level of protection wherever it is processed.

b399 uses cookies and similar tracking technologies to operate the Platform, remember your preferences and improve your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without affecting core Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gambling limit choices. These improve personalisation of your experience.
• Analytics Cookies: Used to collect aggregated information about how users interact with the Platform, including page views, session durations and error events. This information is used to improve Platform performance and does not identify individual users.
• Fraud Detection Cookies: Used to identify suspicious activity patterns, such as unusual login behaviour or bot-like interactions. These are necessary to protect the integrity of the Platform and user Accounts.

b399 does not use third-party advertising cookies or permit third-party advertisers to set cookies on the Platform for the purpose of tracking your behaviour across other websites.

b399 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following general retention principles apply:

• Account Data: Retained for the duration of your Account and for a period of at least five years following Account closure, as required for AML, KYC and licensing compliance purposes.
• KYC Documents: Retained for the minimum period required by the applicable licensing jurisdiction's AML regulations, typically five years from the date of the last transaction or Account closure, whichever is later.
• Transaction Records: Financial transaction data is retained for at least five years to satisfy AML record-keeping requirements.
• Support Communications: Email and live chat records are retained for up to three years from the date of the interaction for quality assurance and dispute resolution purposes.
• Cookies and Analytics Data: Aggregated analytics data is typically retained for up to two years. Session cookies are deleted at the end of each browser session. Persistent functional cookies expire according to their individual settings, generally within 12 months.
• Marketing Consent Records: Records of marketing opt-in and opt-out are retained for the lifetime of the Account to evidence consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where anonymisation is technically impracticable, data is retained in a restricted state until deletion is feasible.

b399 implements a range of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration or destruction. These measures include:

• TLS Encryption: All data transmitted between your browser and the Platform is encrypted using current Transport Layer Security (TLS) standards. The padlock icon in your browser confirms an encrypted connection is in place.
• Password Hashing: Passwords are stored as cryptographic hashes and are never held in plain text. b399 staff cannot retrieve your password — only a reset is possible.
• Access Controls: Personal data is accessible only to b399 personnel who have a legitimate operational need for such access, governed by role-based access controls and internal data handling policies.
• KYC Document Security: Identity verification documents are stored with restricted access and are used solely for identity verification and AML compliance. They are not accessible to staff unless specifically required for a compliance review.
• Fraud Detection Systems: Automated systems monitor for unusual account behaviour, login anomalies and potentially fraudulent transaction patterns. Alerts are reviewed by qualified staff.
• Data Processor Vetting: Third-party processors are assessed for their data security standards before engagement and are required to maintain appropriate security measures by contract.

Subject to applicable data protection law and the specific processing basis involved, you may have the following rights with respect to your personal data held by b399. To exercise any of these rights, please contact us at the details set out in Section 15.

The b399 Platform is strictly intended for adults aged 18 years or older, or such higher minimum age as is required by the operator's applicable licensing jurisdiction. b399 does not knowingly collect personal data from individuals under the applicable minimum age.

Age verification is conducted as part of the KYC process for all Account registrations. If b399 becomes aware or has reasonable grounds to believe that a User is below the applicable minimum age, the Account will be suspended immediately and any personal data held will be reviewed and, where appropriate, deleted in accordance with this Policy and applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an Account with b399, please contact us immediately at [email protected] (plain text — not a link) so that appropriate action can be taken.

b399 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or the Platform's functionality. The "Last Reviewed" date at the top of this Policy will be updated each time a material change is made.

Where changes are material — for example, changes to the categories of data we collect, new categories of third-party recipients, or changes to the legal basis for processing — b399 will provide notice to registered Users by email and/or by a prominent notice on the Platform, where reasonably practicable, prior to the effective date of the amendment.

Continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgement of and agreement to the updated terms. If you object to any changes, you should cease using the Platform and, if applicable, close your Account before the effective date of the amendments.

If you have any questions, concerns or complaints regarding this Privacy Policy, or if you wish to exercise any of your data protection rights, please contact the b399 Data Protection team using the details below. All enquiries will be acknowledged promptly and responded to within a reasonable timeframe in accordance with applicable law.