rc999 Privacy Policy — How We Protect Your Personal Data

1. Introduction

1.1 rc999 ("rc999", "we", "us", "our") is committed to protecting the privacy and personal data of all players who access and use the rc999 platform. This Privacy Policy sets out in clear and formal terms how we collect, use, store, disclose, and protect personal information obtained from users of rc999.io.

1.2 The rc999 platform serves the Bangladesh online gaming market. All services are denominated in Bangladeshi Taka (BDT) and are designed for adult players (21+) residing in or accessing the platform from Bangladesh. This policy is written in English in accordance with the platform's language of operation.

1.3 This Privacy Policy should be read in conjunction with the rc999 Terms & Conditions, which are available at /terms-conditions, and the Responsible Gaming Policy at /responsible-gaming. Together, these documents form the complete framework governing the player relationship with rc999.

1.4 We take our privacy obligations seriously. We do not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances. Data sharing is limited strictly to what is necessary to deliver the platform's services and comply with applicable legal obligations.

2. Data Controller

2.1 For the purposes of this Privacy Policy, rc999 acts as the data controller in respect of personal data collected from registered players and platform visitors. As data controller, rc999 determines the purposes and means of processing personal data in connection with the platform's operations.

2.2 Third-party service providers engaged by rc999 — including KYC verification partners, payment processors, and game studios — act as data processors where they handle personal data on rc999's behalf under written agreements that require them to protect such data in accordance with applicable privacy standards.

2.3 For all data-related enquiries, please contact rc999 using the contact details provided in Section 16 of this Policy.

3. Data We Collect

3.1 rc999 collects personal data in the following categories:

3.1 Identity Data

• Full legal name as it appears on a government-issued identity document;
• Date of birth (to verify that you are 21 years of age or older);
• National ID number, passport number, or driving licence number (collected during KYC verification);
• Gender (optional, used only for account personalisation where applicable).

3.2 Contact Data

• Email address registered to the account;
• Mobile telephone number (including for bKash, Nagad, and Rocket payment verification);
• Residential address (collected as part of KYC for certain verification tiers).

3.3 Financial Data

• Mobile financial service account reference (bKash, Nagad, Rocket, Upay wallet numbers — used for payment verification only, not stored on rc999 servers post-transaction);
• Bank account identifiers where bank transfer deposits or withdrawals are used;
• Transaction history: deposit amounts, withdrawal requests, bonus credits, and BDT balance history;
• Card type and last four digits (where Visa or Mastercard is used — full card numbers are never stored by rc999).

3.4 Technical and Usage Data

• IP address at the time of account registration and each login session;
• Device type, operating system, and browser version;
• Session timestamps, login history, and geographic location derived from IP address;
• Game session data: games played, bet amounts, win/loss outcomes, session duration;
• Platform interaction logs used for fraud detection and responsible gaming monitoring.

3.5 Communications Data

• Records of correspondence submitted via the live chat support channel;
• Email communications between you and the rc999 support team;
• Complaint and dispute records maintained for regulatory and audit purposes.

3.6 Responsible Gaming Data

• Self-imposed deposit limits, time-out periods, and self-exclusion requests;
• Responsible gaming assessments and any referrals to support resources submitted through the platform.

4. How We Collect Data

4.1 Direct collection: The majority of personal data is provided directly by you during account registration, KYC verification, deposit and withdrawal requests, and communications with our support team.

4.2 Automated collection: Technical and usage data is collected automatically when you access and interact with the rc999 platform. This includes session cookies, server logs, and device fingerprinting data used for fraud prevention and platform analytics.

4.3 Third-party collection: Where you connect to rc999 via a third-party payment provider (bKash, Nagad, Rocket, Upay, or a bank), that provider may share transaction confirmation data with rc999 to facilitate deposit and withdrawal processing. rc999 does not receive full payment credentials from these providers.

4.4 KYC partners: When you submit identity documents for verification, those documents may be processed by a third-party KYC verification service acting as a data processor on rc999's behalf. The results of verification (approved / declined / pending) are shared with rc999; raw document images are handled in accordance with the KYC provider's own data security standards.

5. Legal Basis for Processing

5.1 rc999 processes personal data under the following legal bases:

Processing Activity	Legal Basis
Account registration and management	Performance of a contract (the player agreement)
Processing deposits and withdrawals in BDT	Performance of a contract
KYC identity verification	Legal obligation and legitimate interests (fraud prevention)
Responsible gaming monitoring	Legal obligation and legitimate interests (player protection)
Fraud detection and security monitoring	Legitimate interests (protecting the platform and players)
Customer support communications	Performance of a contract and legitimate interests
Platform analytics and improvement	Legitimate interests (improving service quality)
Direct marketing communications	Consent (where separately obtained)

6. How We Use Your Data

6.1 rc999 uses the personal data we collect for the following purposes:

• Account creation and operation: To register your account, verify your identity, maintain your account balance in BDT, and deliver the gaming services you have requested.
• Payment processing: To process your deposits via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard, and to fulfil withdrawal requests to your designated payment method.
• Age verification: To confirm that you meet the minimum age requirement of 21 years before allowing access to real-money gaming services.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited conduct.
• Responsible gaming: To monitor gameplay patterns that may indicate problematic gambling behaviour, to apply self-imposed limits requested by players, and to enforce self-exclusion requests.
• Customer support: To respond to your enquiries, resolve account disputes, and process complaints in a timely manner.
• Platform improvement: To analyse aggregated usage data to improve the performance, layout, and game selection of the rc999 platform.
• Legal compliance: To fulfil any reporting or disclosure obligations required by applicable law or in response to lawful requests from competent authorities.
• Promotional communications: Where you have separately consented, to send you information about promotions, bonuses, and special events relevant to your account. You may withdraw this consent at any time by contacting support.

7. Data Sharing and Disclosure

7.1 rc999 does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared only where strictly necessary for the purposes described in this Policy and only with the categories of recipient set out below.

7.2 KYC and identity verification partners: We share identity documents and personal details submitted during account verification with certified third-party KYC providers. These providers act as data processors under binding agreements and are prohibited from using your data for any purpose other than identity verification on rc999's behalf.

7.3 Payment processors: Transaction data is shared with the payment processors necessary to facilitate your chosen deposit or withdrawal method (bKash, Nagad, Rocket, Upay, and bank or card processing partners). rc999 shares only the minimum data required to process each transaction.

7.4 Game providers: Where you play games hosted by third-party studios (such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, or Spribe), session data including your player ID and bet activity may be transmitted to those providers' game servers to facilitate gameplay. Game providers do not receive your full personal profile or payment details.

7.5 Legal and regulatory authorities: rc999 may disclose personal data to competent authorities, law enforcement, or regulatory bodies where required to do so by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other serious harm.

7.6 Business transfers: In the event that rc999 undergoes a merger, acquisition, or asset sale, personal data held by rc999 may be transferred to the successor entity. Affected players will be notified of any such transfer and the continued application of this Privacy Policy.

8. Payment Data and Financial Information

8.1 rc999 places particular emphasis on the security of financial data. All deposit and withdrawal transactions are processed through certified, encrypted payment channels. rc999 does not store full payment card numbers, mobile banking PINs, or complete bank account credentials on its own servers at any point.

8.2 When you make a deposit via bKash, Nagad, Rocket, or Upay, the transaction is authenticated directly through the respective mobile financial service provider's platform. rc999 receives only a transaction reference and confirmation status — not your mobile banking credentials or PIN.

8.3 Transaction records (deposit amounts, withdrawal amounts, dates, and payment method types) are retained by rc999 as part of your account financial history for the purposes of account management, dispute resolution, and compliance with applicable financial record-keeping requirements.

8.4 If you believe that a fraudulent transaction has been made on your rc999 account, you must notify rc999 support and your payment provider immediately. rc999 will conduct a prompt investigation and take appropriate action in accordance with its fraud prevention procedures.

9. Cookies and Tracking Technologies

9.1 rc999 uses cookies and similar tracking technologies to support platform functionality, improve user experience, and conduct anonymised analytics. Cookies are small text files stored on your device when you access the platform.

9.2 The cookies used by rc999 fall into the following categories:

• Strictly necessary cookies: Required for core platform functionality, including maintaining your login session, storing your account preferences, and enabling secure page navigation. These cannot be disabled without impairing platform functionality.
• Analytics cookies: Used to collect anonymised data about how players interact with the platform — including pages visited, session durations, and device types — to help rc999 identify areas for improvement. Analytics data is aggregated and does not identify individual players.
• Preference cookies: Used to remember your settings and preferences across sessions, such as language settings and last-viewed game categories.

9.3 You can manage cookie settings through your browser's privacy controls. Disabling analytics or preference cookies will not affect your ability to access and play on the rc999 platform, but may result in reduced personalisation and the loss of saved preferences between sessions.

9.4 rc999 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the platform.

10. Data Retention

10.1 rc999 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including the duration of the active account relationship and any applicable legal retention periods thereafter.

10.2 The following general retention periods apply:

• Account and identity data: Retained for the duration of the active account and for a minimum of five years following permanent account closure, in accordance with financial record-keeping requirements.
• Transaction records: Retained for a minimum of five years from the date of each transaction for audit and compliance purposes.
• Responsible gaming records: Retained for the duration of the active account and for three years following account closure, to support re-activation checks and self-exclusion enforcement.
• Customer support communications: Retained for three years from the date of the last communication, unless a longer period is required in connection with an ongoing dispute or legal matter.
• Technical and usage logs: Retained for 12 months from the date of collection, after which they are anonymised or deleted.

10.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

11. Your Rights Over Your Personal Data

11.1 As a player whose personal data is processed by rc999, you hold the following rights, which may be exercised by contacting our support team using the details in Section 16:

• Right of access: You may request a copy of all personal data rc999 holds about you. rc999 will respond to verified access requests within a reasonable timeframe.
• Right to rectification: You may request that any inaccurate or outdated personal data held by rc999 be corrected without undue delay. Some corrections (e.g., name changes) may require supporting documentation.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data. This right is subject to legal obligations that require certain data to be retained (e.g., financial transaction records). Where deletion cannot be completed in full, rc999 will inform you of what data must be retained and why.
• Right to restriction of processing: In certain circumstances (e.g., where you contest the accuracy of your data or have objected to processing), you may request that rc999 restrict further processing of your data pending resolution.
• Right to data portability: Where processing is based on consent or a contract and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests (e.g., direct marketing or certain analytics activities). rc999 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., direct marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11.2 rc999 will not discriminate against you for exercising any of these rights. Exercising your right to erasure or objection will not affect your ability to use the rc999 platform, except where the data in question is strictly required to maintain your account.

12. Children's Privacy

12.1 The rc999 platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any individual under the age of 21, and we do not permit minors to register accounts or access real-money gaming services.

12.2 If rc999 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted promptly and the associated account will be permanently closed in accordance with the age restriction provisions of the rc999 Terms & Conditions.

12.3 If you are a parent or guardian and believe that a minor has registered on the rc999 platform using false age information, please contact rc999 support immediately using the details in Section 16. We will investigate and take appropriate action without delay.

13. Security Measures

13.1 rc999 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or alteration:

• Encryption in transit: All data transmitted between your device and the rc999 platform is protected using 256-bit SSL/TLS encryption. This applies to all page requests, login sessions, and financial transactions.
• Encryption at rest: Sensitive personal and financial data stored on rc999 servers is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within rc999's internal systems is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations.
• Two-factor authentication: Players are encouraged to enable two-factor authentication (2FA) on their accounts to add an additional layer of protection against unauthorised access.
• Fraud monitoring: Automated and manual monitoring systems are in place to detect suspicious account activity, unusual transaction patterns, and potential account compromise.
• Third-party security requirements: All third-party processors engaged by rc999 are required to maintain security standards at least equivalent to those applied by rc999 in connection with personal data processed on rc999's behalf.

13.2 While rc999 takes all reasonable precautions to protect personal data, no internet-based platform can guarantee absolute security. In the event of a data security incident that affects player personal data, rc999 will notify affected players without undue delay and take all appropriate remediation steps.

14. Third-Party Links

14.1 The rc999 platform does not contain links to third-party websites, social media platforms, or external services. All navigation within the platform remains on rc999.io domain pages. This policy applies solely to personal data collected in connection with rc999.io.

14.2 When you initiate a payment via a mobile financial service (bKash, Nagad, Rocket, Upay) or a banking partner, you will interact with that provider's own platform or application. Those interactions are governed by the respective provider's own privacy policy, which rc999 does not control. Players are encouraged to review the privacy policies of their chosen payment providers before initiating transactions.

15. Changes to This Privacy Policy

15.1 rc999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform operations. The version number and effective date at the top of this page indicate the current revision in force.

15.2 Where changes are material — meaning they significantly affect the way in which your personal data is collected, used, or shared — rc999 will make reasonable efforts to notify registered players via the platform or via the email address associated with their account before the changes take effect.

15.3 Your continued use of the rc999 platform following notification of a revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not accept the revised Policy, please discontinue use of the platform and contact support to close your account.

15.4 Archived versions of previous Privacy Policy revisions are available upon request by contacting rc999 support.

16. Contact Us

16.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data rc999 holds about you, please contact our support team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the rc999 platform
• Response time: rc999 aims to acknowledge all privacy-related requests within one Bangladesh Standard Time (BST, UTC+6) business day and to resolve requests within a reasonable timeframe depending on complexity.