f299 Privacy Policy — How We Protect Your Data

01 Introduction and Scope

This Privacy Policy ("Policy") describes how f299 ("f299", "we", "us", "our") collects, uses, stores, and discloses personal data when you access and use the f299 platform, including the website at f299.io, any associated mobile web experience, and all betting, casino, and account-management services offered through those channels.

This Policy applies to all individuals who interact with the f299 platform, including registered players, users browsing without an account, and individuals who contact f299 support. By accessing the f299 platform or creating an account, you acknowledge that you have read this Policy and that you consent to the data practices described herein.

This Policy should be read in conjunction with the f299 Terms & Conditions, which form a binding part of the agreement between you and f299. Defined terms used in this Policy have the same meanings as in the Terms & Conditions unless otherwise stated.

02 Data Controller Information

f299 acts as the data controller in respect of the personal data collected through the f299 platform. As data controller, f299 determines the purposes and means by which your personal data is processed.

All data-related enquiries, access requests, correction requests, and deletion requests should be directed to the f299 data team at the contact details provided in Section 13 of this Policy. f299 will respond to all written data requests within 30 calendar days of receipt.

03 Personal Data We Collect

f299 collects personal data through several channels: directly from you when you register or use the platform, automatically through your use of the platform (device and usage data), and in limited cases from third parties such as payment processors and identity verification services.

Registration and Account Data

When you create a f299 account, we collect the following mandatory information:

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Residential address (including city, district, and postal area)
• Mobile phone number
• Email address
• Chosen username
• Encrypted password (f299 does not store your password in plaintext)

Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process — required for regulatory compliance and responsible gaming — f299 may request and collect the following additional documentation:

• National Identity Card (NID) number and scan or photograph
• Passport data page scan (if NID is unavailable)
• Proof of residential address (recent utility bill or bank statement)
• Selfie or live-photo for identity confirmation

Financial Transaction Data

f299 records details of all deposits and withdrawals processed through your account. This includes transaction amounts in BDT, timestamps, payment method identifiers (such as the last four digits of a card or a masked bKash/Nagad number), and transaction reference numbers. f299 does not store full card numbers or mobile banking PINs.

Device and Usage Data

When you access the f299 platform, we automatically collect certain technical data, including:

04 How We Use Your Personal Data

f299 uses the personal data it collects exclusively for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your explicit consent.

• Account creation and management: To register your f299 account, maintain its operational integrity, and provide you with access to all platform features.
• Identity and age verification: To confirm that you meet the 21+ age requirement and to verify that your account details match your government-issued identity documents as part of KYC compliance.
• Payment processing: To process deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard, and to maintain accurate financial records of all transactions associated with your account.
• Platform operation and improvement: To deliver the f299 sportsbook, live casino, slots, and all other product features; to diagnose technical issues; and to improve platform performance and user experience based on aggregated usage analytics.
• Fraud prevention and security: To detect and prevent fraudulent activity, money laundering, duplicate accounts, unauthorised access, collusion, and the misuse of promotional offers.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling behaviour and to apply any self-imposed limits, cooling-off periods, or self-exclusion instructions you have provided.
• Legal and regulatory compliance: To fulfil f299's obligations under applicable anti-money laundering (AML) and counter-terrorist financing (CTF) regulations, and to respond to lawful requests from relevant authorities.
• Customer support: To respond to your queries, investigate complaints, and resolve disputes arising from your use of the f299 platform.
• Marketing communications (consent-based only): To send you promotional offers, bonus notifications, and platform news via email or SMS, but only where you have explicitly opted in to receiving such communications.

05 Legal Basis for Processing

f299 processes your personal data on the following legal grounds depending on the specific processing activity involved:

• Contractual necessity: Processing required to perform the contract between you and f299 — including account registration, bet settlement, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws, including KYC verification, AML record-keeping, and responses to lawful authority requests.
• Legitimate interests: Processing carried out for f299's legitimate business interests, including fraud prevention, platform security, and aggregate analytics, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your explicit, freely given consent — specifically for marketing communications and optional profiling features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

06 Data Sharing and Disclosure

f299 does not sell your personal data to third parties. f299 shares personal data only in the specific, limited circumstances described below, and only to the minimum extent necessary for each purpose.

Payment Processors

f299 shares relevant transaction data with payment service providers — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — strictly to process your deposits and withdrawals. These providers process your payment data under their own privacy policies and are bound by applicable financial data protection standards.

Identity Verification Services

f299 may share identity document data with third-party KYC verification providers engaged to assist with the identity and age verification process. These providers act as data processors on f299's behalf and are contractually bound to process your data only for the purpose of verification and in accordance with this Policy.

Game Providers

Third-party game studios (including Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt, and Microgaming) receive session tokens and account identifiers necessary to deliver their games within the f299 platform. These providers do not receive your full personal profile; they receive only the minimum technical data needed to operate the game session.

Legal and Regulatory Disclosure

f299 may disclose personal data to law enforcement agencies, financial intelligence units, courts, or other government authorities where required to do so by applicable law, court order, or lawful regulatory direction. f299 will, where legally permitted, notify you of any such disclosure.

07 Cookies and Tracking Technologies

f299 uses cookies — small text files stored on your device — and similar tracking technologies (such as web beacons and local storage) to operate and improve the platform. The cookies used by f299 fall into the following categories:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, security tokens, and load-balancing cookies. These cannot be disabled without preventing you from using f299.
• Functional cookies: Used to remember your preferences, such as your preferred language or display settings. Disabling these cookies may affect your experience but will not prevent basic platform access.
• Analytics cookies: Used to collect aggregated, anonymised data about how players interact with the f299 platform — such as which pages are most visited and where users encounter errors. This data helps f299 improve the platform. Analytics data is not used to identify individual players.

f299 does not use advertising cookies, retargeting cookies, or third-party tracking cookies that follow your browsing activity across unrelated websites. You may manage cookie preferences through your browser settings. Note that blocking strictly necessary cookies will prevent you from logging in to your f299 account.

08 Data Security

f299 applies industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between your device and f299 servers
• Encryption of sensitive data at rest, including identity document files and financial records
• Password hashing using a modern one-way cryptographic algorithm — f299 does not store passwords in readable form
• Role-based access controls that restrict internal staff access to personal data on a strict need-to-know basis
• Regular security audits and penetration testing of the f299 platform infrastructure
• Automated systems that detect and flag unusual login activity or access patterns for human review

In the event of a data breach that is likely to result in a high risk to your rights and interests, f299 will notify affected individuals without undue delay in accordance with applicable data protection requirements.

09 Data Retention

f299 retains personal data for the minimum period necessary to fulfil each of the purposes for which it was collected, after which it is securely deleted or anonymised. The following general retention periods apply:

• Active account data: Retained for the duration of your active account relationship with f299 plus a minimum of five years following account closure, to comply with AML record-keeping requirements.
• KYC identity documents: Retained for a minimum of five years from the date of verification or account closure, whichever is later, as required by applicable AML regulations.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Support communications: Retained for a minimum of two years from the date of the last interaction, or longer where a formal dispute or legal proceeding is open.
• Marketing consent records: Retained for as long as your consent is active plus three years thereafter as evidence of your consent decision.
• Session and analytics data: Aggregated analytics data is retained for up to two years; raw session logs are retained for up to 90 days.

Where a legal obligation, regulatory direction, or active legal dispute requires retention beyond these periods, f299 will retain the relevant data until that obligation, direction, or dispute is resolved.

10 Your Rights

Subject to applicable law, you have the following rights in relation to the personal data that f299 holds about you. To exercise any of these rights, please contact f299 in writing as described in Section 13. f299 will respond within 30 calendar days of receiving a verifiable written request.

• Right of access: You have the right to request a copy of the personal data f299 holds about you and to receive information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. For certain data fields (such as your registered name), f299 may require supporting documentation before making a correction.
• Right to erasure: You have the right to request deletion of your personal data where f299 no longer has a lawful basis for retaining it. Note that f299 may be required by law to retain certain data (such as KYC and transaction records) even after account closure, and those records cannot be deleted until the mandatory retention period has expired.
• Right to restrict processing: You have the right to request that f299 limits the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful.
• Right to data portability: Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing of your personal data where that processing is based on f299's legitimate interests. f299 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

11 Children and Minors

The f299 platform is strictly restricted to individuals aged 21 and above. f299 does not knowingly collect, process, or retain personal data relating to individuals under the age of 21. If f299 becomes aware that personal data has been collected from a person who was under the age of 21 at the time of collection, that data will be deleted and the associated account will be closed immediately.

If you believe that a minor has created an f299 account or that f299 may hold personal data relating to a person under the age of 21, please contact f299 immediately at [email protected] with details of your concern so that the matter can be investigated and resolved without delay.

12 Changes to This Policy

f299 may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, applicable laws, or regulatory guidance. When material changes are made, f299 will update the effective date displayed at the top of this page and, where reasonably practicable, will notify active players via a notification in their account dashboard or via email to the address registered on their account.

Your continued use of the f299 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this page periodically to stay informed about how f299 protects your personal data. Archived versions of prior policies are available upon request by contacting support.

13 Contact and Data Requests

All privacy-related enquiries, data access requests, correction requests, deletion requests, and data rights objections should be submitted in writing to the f299 data team. f299 does not accept data rights requests made verbally via live chat; all formal requests must be submitted in writing to create a proper record.

Email: [email protected]

Please include the following details in your written request to help f299 process it efficiently:

• Your registered f299 username
• The email address associated with your f299 account
• A clear description of your request and the specific data or processing activity it relates to
• Your preferred contact method for f299's response

f299 aims to acknowledge all data requests within 5 business days and to provide a full response within 30 calendar days. Where a request is particularly complex or relates to a large volume of data, f299 may extend the response period by an additional 30 days and will notify you of this extension within the initial 30-day period.