b399 Privacy Policy

b399 is a licensed online casino and sports betting platform operating at b399.ws. For the purposes of this Privacy Policy, b399 and its affiliated operating entities (collectively "b399", "we", "us", "our") are the data controller responsible for the personal data collected through the b399 platform.

b399 is regulated by an international gaming authority that imposes mandatory data protection standards as part of its licensing conditions. These standards form the minimum baseline for all data handling activities described in this Privacy Policy.

b399 serves Pakistani players, and while Pakistani data protection regulations continue to develop, we apply the data protection principles commonly recognised under internationally accepted frameworks — including purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability — to all personal data we process.

b399 collects personal data through several channels: directly from you when you register an account or interact with the platform, automatically through your use of the platform, and from third parties such as payment processors and identity verification services. The categories of data we collect include:

b399 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose not listed here without first seeking your consent or being required to do so by law:

• Account registration and management: To create and maintain your b399 account, verify your identity, and provide you with access to all platform services.
• Age and identity verification (KYC): To fulfil our mandatory obligations under our international gaming licence to verify that all players are aged 21 or above and to confirm the identity of account holders before processing withdrawals.
• Payment processing: To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT. Financial data is shared with payment processors solely for transaction fulfilment.
• Platform operation and game delivery: To deliver casino games, sports betting markets including PSL cricket, live dealer tables, slot games, and instant games to your device.
• Fraud prevention and anti-money laundering (AML): To monitor transactions and gaming activity for patterns indicative of fraud, bonus abuse, collusion, or money laundering, in compliance with our AML obligations under our gaming licence.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling and to facilitate your use of responsible gaming tools including deposit limits, session limits, cool-off periods, and self-exclusion.
• Customer support: To respond to your queries, complaints, and requests via live chat and email, and to maintain records of support interactions for quality assurance.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates by email or on-platform notification, where you have opted in to receive such communications. You may withdraw your marketing consent at any time via your account settings.
• Legal compliance and regulatory reporting: To comply with applicable laws, regulations, court orders, and directions from regulatory and law enforcement authorities, including the reporting of suspicious transactions.
• Platform improvement and analytics: To analyse aggregated usage data to improve the b399 platform, optimise the user experience, and develop new features and products.

b399 processes your personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: The majority of data processing at b399 is necessary for the performance of the contract between you and b399 — namely, the Terms & Conditions that govern your use of the b399 platform. Without processing your identity, financial, and gaming activity data, b399 cannot provide you with the services you have contracted for.
• Legal obligation: Certain processing activities — including KYC age verification, AML transaction monitoring, and regulatory reporting — are required by the legal and licensing obligations to which b399 is subject. b399 cannot waive these processing activities even at your request, as doing so would put b399 in breach of its regulatory obligations.
• Legitimate interests: b399 processes certain technical and usage data on the basis of its legitimate interests in operating, securing, and improving the b399 platform, provided those interests are not overridden by your fundamental privacy rights. This includes fraud detection analytics, platform performance monitoring, and security logging.
• Consent: Where b399 processes your personal data for marketing communications or for optional platform personalisation features, this processing is based on your prior consent. You may withdraw your consent at any time without affecting the lawfulness of prior processing or your access to b399 platform services.

b399 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited and controlled circumstances:

• Payment processors: b399 shares transaction-relevant financial data with payment service providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT processing partners solely for the purpose of completing your deposit and withdrawal transactions. These providers are bound by their own data protection obligations and are not permitted to use your data for any other purpose.
• Identity verification services: b399 uses third-party KYC and identity verification services to validate CNIC documents and verify player ages. These services process identity data strictly for verification purposes under contractual data processing agreements with b399.
• Game software providers: The casino games available on the b399 platform are provided by third-party game developers and aggregators. These providers may receive limited technical data (such as session tokens and anonymised game result data) necessary for game delivery and RNG certification. Game providers do not receive your identity or financial data.
• Regulatory and law enforcement authorities: b399 will disclose personal data to regulators, licensing authorities, financial intelligence units, or law enforcement agencies where required to do so by law, court order, or our licensing conditions. b399 will not notify you of such disclosures where doing so would be unlawful or would prejudice an investigation.
• Platform service providers: b399 uses third-party service providers for platform hosting, cloud infrastructure, email delivery, analytics, and customer support tooling. These providers act as data processors under contractual agreements and are prohibited from using your data for any purpose other than providing their services to b399.

b399 uses cookies and similar tracking technologies on the b399.ws website and platform. Cookies are small text files stored on your device that help us deliver, personalise, and improve your platform experience. The following categories of cookies are used by b399:

• Strictly necessary cookies: These cookies are essential for the b399 platform to function. They enable core functionality including secure login sessions, account authentication, game loading, and fraud prevention. These cookies cannot be disabled without severely impairing your ability to use the b399 platform.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming tool configurations — so that you do not need to re-enter them on each visit.
• Analytics cookies: b399 uses analytics tools to collect anonymised data about how players navigate and interact with the platform. This data helps us identify usability issues, popular features, and areas for improvement. Analytics data is aggregated and does not identify individual players.
• Session cookies: Temporary cookies that exist only for the duration of your browser session. They are deleted automatically when you close your browser and are used to maintain the continuity of your gaming session.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the availability or performance of some b399 platform features. b399 does not use third-party advertising cookies or behavioural tracking cookies that track your activity across other websites.

b399 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following retention periods apply:

• Account and identity data: Retained for the duration of your b399 account and for a minimum of five (5) years following account closure, in order to meet our obligations under anti-money laundering regulations and gaming licence requirements.
• Financial transaction records: Retained for a minimum of five (5) years following each transaction date, in accordance with financial record-keeping requirements applicable under our gaming licence.
• KYC documentation: Retained for a minimum of five (5) years following the date of verification or account closure, whichever is later.
• Gaming activity logs: Retained for a minimum of three (3) years following the date of each gaming session, for dispute resolution and responsible gaming monitoring purposes.
• Support communications: Retained for two (2) years following the close of the relevant support interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until you withdraw your consent, and for one (1) year following withdrawal of consent as evidence of the prior lawfulness of our marketing communications.

Upon expiry of the relevant retention period, your personal data is securely and irreversibly deleted from b399's systems, or anonymised such that it can no longer be attributed to you as an individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

b399 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security programme includes:

• Transport Layer Security (TLS): All data transmitted between your device and b399 servers is encrypted using current-generation TLS protocols. b399 enforces HTTPS across all platform pages and does not permit unencrypted HTTP connections.
• Encryption at rest: Sensitive personal data — including CNIC details, financial account identifiers, and password hashes — is stored in encrypted form in b399's databases. Encryption keys are managed through a dedicated key management system with access restricted to authorised personnel only.
• Access controls: b399 operates a strict role-based access control policy. Access to player personal data is limited to b399 staff members who have a documented, legitimate business need to access it. All internal data access is logged and audited.
• Penetration testing: b399 engages independent cybersecurity firms to conduct regular penetration testing of the b399 platform infrastructure. Identified vulnerabilities are remediated according to a risk-based priority schedule.
• Two-factor authentication: b399 strongly encourages all players to enable two-factor authentication on their accounts. 2FA is available from your account security settings and significantly reduces the risk of unauthorised account access.
• Incident response: b399 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, b399 will notify affected players and the relevant regulatory authority within the timeframes required by our licensing obligations.

b399 respects your rights over your personal data. The following rights are available to you as a b399 player, subject to applicable legal and regulatory limitations:

• Right of access: You have the right to request a copy of the personal data b399 holds about you. b399 will provide this information within a reasonable timeframe and free of charge for reasonable requests.
• Right to rectification: If any personal data b399 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many account details directly from your b399 account settings without needing to contact support.
• Right to erasure: You may request that b399 delete your personal data in certain circumstances — for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent and there is no other legal basis for processing. Note that b399 may be unable to fulfil erasure requests where retention is required by law or licensing obligation (for example, AML record-keeping requirements).
• Right to restrict processing: In certain circumstances, you may request that b399 suspend the processing of your personal data while a dispute over its accuracy or the lawfulness of its processing is resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that b399 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You have the right to object to the processing of your personal data where b399 relies on legitimate interests as its legal basis. b399 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw marketing consent: Where b399 processes your personal data for marketing purposes on the basis of your consent, you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal does not affect your continued access to b399 platform services.

To exercise any of the above rights, contact b399's data team at [email protected] with the subject line "Data Rights Request". b399 will acknowledge your request within 3 business days and aim to resolve it within 30 days.

The b399 platform is strictly intended for adults aged 21 years and above. b399 does not knowingly collect, use, or retain personal data from any person under the age of 21. Age verification using a valid Pakistani CNIC is a mandatory step in the b399 account registration process.

If b399 discovers or has reason to believe that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended, all personal data associated with that account will be securely deleted, and the matter will be referred to b399's compliance department. Any deposits made by an underage account will be subject to review in accordance with b399's regulatory obligations before any refund determination is made.

b399 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal and regulatory requirements. When material changes are made to this Privacy Policy, b399 will notify registered players by:

• Sending a notification to your registered email address summarising the key changes;
• Displaying a prominent notice on the b399 platform upon your next login; and
• Updating the "Last Reviewed" date at the top of this Privacy Policy document.

Your continued use of the b399 platform following notification of a material change to this Privacy Policy constitutes your acknowledgement of the updated policy. If you do not accept the revised Privacy Policy, you must discontinue use of the b399 platform and may request account closure by contacting support.

The current version of this Privacy Policy is always available at b399.ws/privacy-policy. b399 recommends that you review this page periodically to stay informed of any updates.

If you have any questions, concerns, or requests relating to this Privacy Policy or b399's handling of your personal data, please contact our data team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" so your message is routed directly to the appropriate team.
• Live Chat: Available 24/7 from your b399 account dashboard. Our live chat agents can handle general privacy questions and can escalate data rights requests to the data team on your behalf.

b399 support is available in both English and Urdu to ensure all Pakistani players can communicate their privacy concerns comfortably. b399 aims to acknowledge all privacy-related enquiries within 3 business days and to resolve them within 30 days. Complex data rights requests involving large volumes of data may take up to 60 days to fully resolve; b399 will inform you in advance if this is the case.