Privacy Policy —
dv999 Data Protection

This Privacy Policy ("Policy") is published by dv999 ("we", "us", "our", or the "Platform") and applies to all personal data collected from individuals ("you", "your", or "User") who access or use the dv999 website at dv999.io and all associated services, including sports betting, live casino, slots, crash games, and any other gaming or promotional products offered on the platform (collectively, the "Services").

dv999 is committed to protecting the privacy and security of all personal data it handles. This Policy has been prepared in accordance with internationally recognised data protection principles and is intended to give you a clear and transparent picture of:

• What categories of personal data dv999 collects from you.
• The purposes for which that data is collected and processed.
• The legal bases on which we rely to process your data.
• The circumstances, if any, under which your data may be shared with third parties.
• How long we retain your data and the security measures we apply to protect it.
• Your rights in relation to your personal data and how to exercise them.

By registering an account with dv999, making a deposit, placing a bet, or otherwise using the Services, you confirm that you have read and understood this Privacy Policy and consent to the collection, processing, and use of your personal data as described herein. This Policy forms an integral part of and must be read together with the dv999 Terms & Conditions.

dv999 collects personal data only to the extent necessary to deliver the Services and fulfil our legal and regulatory obligations. The categories of personal data we may collect include, but are not limited to:

2.1 Account Registration Data

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (used to verify that you are at least 21 years of age)
• Email address
• Mobile phone number
• Residential address (city, district, and Bangladesh postal code)
• Username and encrypted password

2.2 Identity Verification Data

• Copies of government-issued identity documents: National Identity Card (NID), passport, or driver's licence issued by the Government of Bangladesh
• Proof of address documents (utility bills, bank statements issued within 90 days)
• Selfie or live photo for biometric matching where required during enhanced verification

2.3 Financial Transaction Data

• bKash, Nagad, Rocket, and Upay mobile wallet account numbers (last four digits only stored on dv999 servers post-verification)
• Transaction reference numbers, timestamps, amounts in Bangladeshi Taka (BDT), and payment method identifiers
• Deposit history, withdrawal requests, and balance records
• Bank account details where bank transfer is used (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank)

2.4 Gameplay and Betting Data

• Betting history: markets selected, stake amounts, odds, settlement results
• Casino game session data: game titles played, bet sizes, session durations, win/loss records
• Bonus usage, wagering progress, and promotional participation records

2.5 Technical and Device Data

• IP address and approximate geographic location (city/region level)
• Device type, operating system, browser type and version
• Session cookies, session tokens, and login timestamps
• Referring URL and on-site navigation path

2.6 Communications Data

• Records of all communications between you and dv999 support (live chat transcripts, email correspondence)
• Your preferences regarding marketing communications
• Responsible gaming self-assessment responses and limit-setting instructions

dv999 processes your personal data for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with those listed below without first seeking your consent or establishing a new legal basis:

Where dv999 uses your data for marketing communications, you will always be given a clear and easy mechanism to opt out of receiving such communications. You may update your marketing preferences at any time through your account settings or by contacting [email protected].

For each category of processing activity described in Section 3, dv999 relies on one or more of the following legal bases:

• Contractual Necessity: Processing that is necessary to perform the contract we have with you — including account management, payment processing, service delivery, and identity verification — is carried out on the basis of contractual necessity. Without this processing, we cannot provide you with access to the Services.
• Legal Obligation: Certain processing activities — particularly those related to anti-money laundering (AML) compliance, know-your-customer (KYC) verification, and fraud reporting — are required by applicable law. dv999 processes data for these purposes on the basis of legal obligation.
• Legitimate Interests: Processing activities related to platform security, fraud prevention, abuse detection, and internal analytics are carried out on the basis of dv999's legitimate interests in operating a safe and commercially sustainable platform, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where dv999 sends you direct marketing communications — including promotional emails, bonus alerts, and seasonal campaign notifications — we do so only on the basis of your prior, freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.

dv999 does not sell, rent, or trade your personal data to third parties for their own commercial purposes under any circumstances. Your personal data may be shared only in the limited circumstances set out below:

• Payment Processors: We share transaction data with our payment processing partners — including bKash, Nagad, Rocket, Upay, Visa, and Mastercard — strictly to the extent necessary to execute deposit and withdrawal instructions. These partners are contractually bound to process your data only for that specified purpose and in accordance with applicable data protection standards.
• Identity Verification Providers: Where dv999 uses a third-party KYC service to assist with identity document verification, your verification data (NID copy, selfie) may be shared with that provider. All such providers are required to maintain data in encrypted storage and to delete it upon completion of the verification process.
• Game Software Providers: Aggregated, non-personally identifiable gameplay metadata may be shared with game providers such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming for the purpose of game performance analytics and fair-play auditing. Personally identifiable information is not shared with game providers.
• Legal and Regulatory Authorities: dv999 may disclose your personal data to law enforcement, regulatory authorities, or courts of competent jurisdiction where required to do so by law, court order, or in response to a formal legal process. In such cases, dv999 will disclose only the minimum data strictly required to satisfy the legal obligation.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of dv999's business assets, your personal data may be transferred to the successor entity as part of that transaction, subject to equivalent privacy protections being maintained. You will be notified of any such transfer in advance.

dv999 uses cookies and similar tracking technologies to operate the platform, enhance your user experience, and gather anonymised analytics data. A cookie is a small text file placed on your device by your browser when you access the dv999 website. Cookies do not contain executable code and cannot access files stored on your device.

The following categories of cookies are used on dv999.io:

• Essential Cookies: These are strictly necessary for the operation of the platform. They maintain your authenticated session, remember your login state, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without preventing you from using the Services.
• Functional Cookies: These cookies remember your preferences — such as your preferred language setting, stake denomination, and responsible gaming limit configurations — so that you do not need to re-enter them on each visit.
• Analytics Cookies: dv999 uses anonymised analytics to understand how players navigate the platform, which game categories are most visited, and where usability improvements can be made. Analytics data is aggregated and does not identify individual players.
• Security Cookies: Short-lived session tokens that allow our fraud prevention systems to detect unusual login patterns, multiple simultaneous sessions from different geographic locations, and other indicators of potential account compromise.

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will prevent you from logging into your dv999 account and accessing the Services. For most modern browsers, cookie management instructions can be found under Settings > Privacy or Settings > Security.

dv999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data destruction protocols. Data that is anonymised beyond the point of re-identification may be retained indefinitely for aggregate statistical purposes.

dv999 implements a comprehensive, multi-layered security framework to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures in place include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser and the dv999 servers is encrypted using 256-bit SSL/TLS protocols. The padlock icon in your browser's address bar confirms that your connection to dv999.io is always encrypted.
• Password Hashing: User passwords are never stored in plaintext. They are hashed using a modern one-way cryptographic algorithm (bcrypt with salting) so that even dv999 staff cannot read your password.
• Access Controls: Access to systems that contain personal data is restricted to dv999 personnel who require that access to perform their specific job function. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Two-Factor Authentication (2FA): dv999 strongly recommends that all players enable 2FA on their accounts. When enabled, a one-time passcode is required in addition to your password at every login, significantly reducing the risk of unauthorised account access.
• Intrusion Detection: dv999 operates continuous automated intrusion detection and anomaly monitoring across its infrastructure. Any unusual access pattern triggers an immediate security alert for investigation.
• Penetration Testing: dv999's platform undergoes periodic third-party penetration testing to identify and remediate potential vulnerabilities before they can be exploited.

As a data subject whose personal data is processed by dv999, you hold the following rights. These rights may be subject to certain exceptions and limitations under applicable law, but dv999 will always seek to accommodate your requests to the fullest extent permissible:

• Right of Access: You have the right to request a copy of all personal data that dv999 holds about you, along with information about how it is processed. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data that dv999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update basic account details directly through your account dashboard, or contact support for assistance with more complex corrections.
• Right to Erasure: You may request that dv999 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. Please note that this right is subject to our legal obligations to retain certain data — particularly financial transaction records and KYC documentation — for the periods specified in Section 7.
• Right to Restriction of Processing: You may request that dv999 restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved, or where you have objected to processing based on legitimate interests and we are assessing whether those interests override your rights.
• Right to Data Portability: Where processing is carried out by automated means on the basis of your consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to transmit that data to another controller.
• Right to Object: You have the right to object at any time to the processing of your personal data where that processing is carried out on the basis of dv999's legitimate interests. You also have an unconditional right to object to the processing of your data for direct marketing purposes, which will be honoured immediately upon receipt of your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent for marketing communications can be effected by clicking "unsubscribe" in any marketing email or by contacting support.

To exercise any of the rights listed above, please contact dv999 using the details provided in Section 13. We may ask you to verify your identity before processing your request in order to protect against unauthorised data access. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request is particularly complex, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

dv999 operates an online gambling platform and, as such, the Services are intended exclusively for adults. dv999 strictly enforces a minimum age requirement of 21 years of age for all registered players. This age threshold applies regardless of the legal gambling age in any other jurisdiction.

dv999 does not knowingly collect, process, or retain personal data from any individual under the age of 21. All accounts are subject to age verification during the registration and KYC process, and any account found to belong to a person under 21 will be immediately suspended, all funds will be returned to the original payment source, and all associated data will be deleted in accordance with our data retention policies.

If you are a parent or guardian and have reason to believe that a minor under 21 has registered an account with dv999 or has accessed the platform, please contact us immediately at [email protected]. We will investigate the matter promptly and take all necessary action to remove the account and associated data.

The dv999 platform may, from time to time, contain references to or links to third-party websites, payment processors, or game software providers. These third-party services operate under their own independent privacy policies, which may differ materially from this Policy. dv999 has no control over, and assumes no responsibility for, the content, privacy practices, or data handling of any third-party website or service.

When you click a link to a third-party website or initiate a payment through a third-party processor such as bKash or Nagad, you are leaving the dv999 platform and your interaction with that third party is governed exclusively by the third party's own terms and privacy policy. We encourage you to review the privacy policy of every external service you interact with before providing any personal data.

The inclusion of any third-party link or integration on the dv999 platform does not constitute an endorsement by dv999 of that third party's privacy practices or data handling standards.

dv999 reserves the right to amend, update, or replace this Privacy Policy at any time. Reasons for updating this Policy may include changes in applicable data protection law, changes in our data processing practices, the introduction of new Services or features, or changes in our third-party processor relationships.

When a material change is made to this Policy, dv999 will provide reasonable advance notice to registered players by posting a prominent notice on the dv999.io homepage and, where reasonably practicable, by sending an email notification to the address registered to your account. The updated Policy will be published at dv999.io/privacy-policy and will include a revised "Last Reviewed" date at the top of the document.

Your continued use of the Services after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should stop using the Services and may request account closure by contacting support. We recommend that you review this Policy periodically to stay informed of how we handle your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which dv999 processes your personal data, please contact our Data Protection team using the details below. We aim to respond to all privacy-related enquiries within 5 business days.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please include "Privacy Policy Enquiry" or "Data Subject Request" in the subject line of your email to ensure your message is routed to the correct team.
• Support Hours: 24 hours a day, 7 days a week — Bangladesh Standard Time (BST, UTC+6)
• Response Time: Acknowledgement within 5 business days; substantive response within 30 calendar days.
• Language: All privacy enquiries are handled in English.

When submitting a data subject request, please include your registered account username and a clear description of the right you wish to exercise or the concern you wish to raise. This will help us locate your records and process your request efficiently. We may require you to verify your identity before acting on any request to protect against unauthorised data access.