sh999 Privacy Policy

Who We Are

sh999 operates the online casino and sports betting platform accessible at sh999.io and all associated subdomains and mobile-optimised interfaces. In this Privacy Policy, references to "sh999", "we", "us", or "our" refer to the operator of the sh999 platform.

sh999 acts as the data controller in respect of all personal data collected from players and visitors to the platform. This means sh999 determines the purposes and means by which your personal data is processed. Where sh999 engages third-party service providers to process data on its behalf, those providers act as data processors under sh999's instruction and are bound by appropriate data processing agreements.

The sh999 platform is designed and operated for the Bangladeshi online gambling market. Our registered player base is drawn from players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. All data handling operations described in this policy are conducted with the security and interests of our Bangladeshi player community as the primary consideration.

For privacy-related queries, players may contact sh999 directly by email at [email protected]. All privacy enquiries are handled by our compliance team and receive a response within five (5) Bangladesh Standard Time (BST) business days.

Data We Collect

sh999 collects personal data through several channels — directly from players during registration and account management, automatically through platform usage, and in limited cases from third-party payment service providers. The categories of data we collect are set out below.

2.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Residential address, including city and division within Bangladesh
• Mobile phone number registered to your bKash, Nagad, Rocket, or Upay account
• Email address (where provided during registration)
• Username and hashed account password

2.2 Identity Verification (KYC) Data

• Copy of National Identity Card (NID), passport, or driving licence
• Selfie or live photograph submitted for facial verification purposes
• Proof of address documentation where requested
• Source-of-funds documentation where requested in connection with large deposits

2.3 Financial Transaction Data

• Deposit transaction references and amounts from bKash, Nagad, Rocket, Upay, and card providers
• Withdrawal request amounts, timestamps, and destination wallet identifiers
• Account wallet balance history and bonus credit/debit records
• Payment method identifiers (mobile wallet numbers masked to the last four digits for storage)

2.4 Gameplay and Betting Data

• Wager history, bet amounts, game selections, and outcomes
• Live betting activity across cricket, football, and other sports markets
• Casino game session durations, spin counts, and RNG game results
• Bonus campaign participation and wagering requirement progress

2.5 Technical and Device Data

• IP address at time of login and during active sessions
• Device type, operating system, and browser version
• Session start and end timestamps
• Pages visited, features accessed, and navigation patterns within the platform
• One-time password (OTP) delivery and verification logs

2.6 Communications Data

• Support ticket content and chat transcripts between you and sh999's customer support team
• Email correspondence records where you contact us via [email protected]
• Promotional communication preferences (opt-in and opt-out records)
• Responsible gaming tool activation logs and self-exclusion requests

How We Use Your Data

sh999 uses the personal data it collects exclusively for legitimate, defined purposes. We do not sell your personal data to third parties for their own marketing purposes. The table below summarises the primary purposes for which your data is used and the corresponding data categories involved.

3.1 Platform Operation. The primary purpose for which sh999 collects and processes your personal data is to operate the platform — including registering your account, verifying your identity, processing your deposits and withdrawals via bKash, Nagad, Rocket, and Upay, delivering game content from our licensed studio partners, and managing your bonus entitlements.

3.2 Fraud and Security. sh999 uses technical and behavioural data, including IP address history and login patterns, to detect and prevent account takeover, fraud, collusion, and bonus abuse. This processing is essential to protect both individual players and the integrity of the sh999 platform.

3.3 Responsible Gaming. Gameplay and account activity data is used to monitor player behaviour for signs of problem gambling and to administer responsible gaming tools including deposit limits, session controls, and self-exclusion. This processing is a core obligation of sh999 as a responsible operator.

3.4 Marketing Communications. Where you have opted in to receive promotional messages, sh999 will use your contact details to send information about bonus offers, seasonal promotions (including Eid, Pohela Boishakh, and Victory Day specials), and new game announcements. You may withdraw your consent to marketing communications at any time by contacting [email protected] or updating your account notification preferences.

Legal Basis for Processing

sh999 processes your personal data on one or more of the following legal grounds, depending on the purpose of the processing:

• Contractual necessity: Processing required to fulfil our obligations to you under the sh999 Terms & Conditions — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable legal requirements, including anti-money laundering (AML) checks, KYC obligations, and record-keeping requirements.
• Legitimate interests: Processing conducted for sh999's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests do not override your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — principally in respect of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of any processing that took place prior to withdrawal.

Data Sharing & Disclosure

sh999 does not sell, rent, or trade your personal data to third parties. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

5.1 Payment Service Providers. When you make a deposit or request a withdrawal, necessary transaction data is shared with the relevant payment provider — bKash, Nagad, Rocket, Upay, or the applicable card network (Visa, Mastercard) and issuing bank (including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank). These providers are independent data controllers in respect of their own transaction processing activities and are governed by their own privacy policies.

5.2 Game Studio Partners. When you access games powered by third-party studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi, a session token and anonymised player identifier are transmitted to the relevant studio's game server to load and operate the game. No personally identifiable registration data is shared with game studios beyond the session token required for game delivery.

5.3 Identity Verification Partners. KYC documentation submitted for account verification may be processed by third-party identity verification service providers acting as data processors under sh999's instruction. These providers are contractually bound to process your data solely for the purpose of identity verification and may not use it for any other purpose.

5.4 Legal Disclosures. sh999 may disclose personal data to law enforcement authorities, regulatory bodies, or other third parties where we are required to do so by applicable law, court order, or lawful regulatory directive. In such cases, sh999 will disclose only the minimum data necessary to comply with the relevant obligation.

5.5 Business Transfers. In the event of a merger, acquisition, or sale of assets involving sh999, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy terms applicable to your data under the new entity prior to any material change in how your data is handled.

Cookies & Tracking Technologies

sh999 uses cookies and similar tracking technologies to operate and improve the platform experience. A cookie is a small text file placed on your device by the sh999 platform when you visit. Cookies allow sh999 to recognise your browser on return visits, maintain your session state, and analyse how the platform is used.

6.1 Essential Cookies. These cookies are strictly necessary for the sh999 platform to function. They manage your login session, maintain your Wallet state during a session, and enable security features such as CSRF protection. Essential cookies cannot be disabled without preventing core platform functionality.

6.2 Analytics Cookies. sh999 uses first-party analytics cookies to understand how players navigate the platform — including which game categories are most visited, how long sessions last, and where players encounter errors. This data is used exclusively to improve platform performance and user experience. Analytics data is aggregated and does not identify individual players.

6.3 Preference Cookies. These cookies store your platform preferences, such as your preferred language setting and responsible gaming tool configurations, so that your settings are preserved across sessions.

6.4 Managing Cookies. You may adjust your browser settings to block or delete cookies. Please note that disabling essential cookies will prevent you from logging in or using the sh999 platform. Disabling analytics or preference cookies will not affect your ability to access games or process transactions, but may result in a less personalised platform experience.

Data Retention

sh999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your registered account's existence on the sh999 platform.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with anti-money laundering record-keeping requirements.
• KYC verification documents: Retained for a minimum of five (5) years from the date of account closure or the date of verification, whichever is later.
• Communications and support records: Retained for a minimum of two (2) years from the date of the most recent communication.
• Self-exclusion records: Retained for the full duration of the self-exclusion period plus a minimum of two (2) years after the exclusion period expires, to prevent re-registration during exclusion.
• Gameplay logs: Retained for a minimum of two (2) years for dispute resolution and responsible gaming purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with sh999's internal data disposal procedures. Anonymised data (from which no individual can be identified) may be retained indefinitely for analytical and platform improvement purposes.

Data Security

sh999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption on all connections between your browser or device and the sh999 platform, ensuring that data transmitted during login, transactions, and gameplay is protected in transit.
• Encrypted storage of sensitive data fields, including hashed passwords, payment method identifiers, and KYC document files, within access-controlled database environments.
• OTP (One-Time Password) verification for all sensitive account actions, including withdrawals, password changes, and email address updates, delivered to your registered mobile number.
• Continuous session monitoring to detect anomalous login behaviour, including logins from new devices or unusual geographic locations, which may trigger additional verification steps.
• Role-based access controls within sh999's internal systems, ensuring that staff members can access only the data required to perform their specific job functions.
• Regular security assessments of platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

While sh999 takes all reasonable precautions to secure your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for logging out of your account after each session, particularly on shared or public devices. If you suspect that your account has been compromised, contact [email protected] immediately.

Your Privacy Rights

As a data subject, you have the following rights in respect of the personal data that sh999 holds about you. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request" and a description of the right you wish to exercise. sh999 will respond within ten (10) BST business days.

• Right of access: You have the right to request a copy of the personal data sh999 holds about you, along with information about how that data is used and with whom it is shared.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Minor corrections (such as updating your contact mobile number) can also be made directly within your Account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to sh999's legal retention obligations (see Section 7). Note that transaction records and KYC data must be retained for the minimum periods described in Section 7 regardless of an erasure request.
• Right to restrict processing: You may request that sh999 suspend processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or on a contractual obligation, you may request that sh999 provide your data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on sh999's legitimate interests, and to withdraw consent for marketing communications at any time.
• Right to withdraw consent: Where sh999 relies on your consent as the legal basis for processing (principally marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Children's Privacy

The sh999 platform is strictly intended for use by adults aged 21 years and above. sh999 does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account or use the sh999 platform in any way.

If sh999 becomes aware that personal data has been collected from an individual under the age of 21 — whether through a false date of birth provided during registration or through any other means — we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by our legal retention obligations, and return any deposited funds to the original payment source.

Parents and guardians who believe that a minor in their care may have registered an account on sh999 are encouraged to contact our support team at [email protected] immediately so that the matter can be investigated and resolved promptly.

Third-Party Links

The sh999 platform may, in certain contexts, reference or display the names and logos of third-party payment providers and game studio partners for informational purposes. sh999 does not include clickable hyperlinks to external websites within its platform content, and this Privacy Policy does not apply to any third-party websites, apps, or services that you may access independently.

If you choose to access the platform of a third-party payment provider (such as bKash, Nagad, or Rocket) in order to fund your sh999 account, your use of that provider's platform is governed entirely by that provider's own terms of service and privacy policy. sh999 has no responsibility or liability for the data practices of third-party services, even where those services are used in connection with sh999 account activity.

Updates to This Privacy Policy

12.1 Right to Update. sh999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data handling practices, the services we offer, or applicable legal and regulatory requirements. The date of the most recent revision is displayed at the top of this page as the effective date.

12.2 Notification of Material Changes. Where sh999 makes a material change to this Privacy Policy — meaning a change that significantly affects the way in which your personal data is collected, used, or shared — we will notify registered players via a notice in their Account dashboard and/or an email to their registered address, at least seven (7) days before the change takes effect.

12.3 Continued Use. Your continued use of the sh999 platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not accept the revised policy, you must cease using the platform and may request withdrawal of any remaining account balance prior to the effective date.

12.4 Contact Us. For any questions, concerns, or requests relating to this Privacy Policy or to the personal data sh999 holds about you, please contact our compliance team directly. All privacy correspondence should be sent by email to [email protected] with the subject line "Privacy Enquiry". We are committed to responding to all legitimate privacy enquiries within five (5) BST business days.