499ba Privacy & Data Protection Policy

This Privacy Policy ("Policy") describes how 499ba ("499ba", "the Platform", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("Players", "Users", "you") who access or use the 499ba website, mobile platform, and all associated services available at 499ba.io.

499ba is Bangladesh's premier online betting and casino platform, offering cricket sportsbook, live casino games, slots, crash games, and related entertainment products to adults aged 21 and above. As a platform that processes financial transactions and identity verification data, we take our data protection obligations with the utmost seriousness.

This Policy should be read in conjunction with our Terms & Conditions, which are available at /terms-conditions, and our Responsible Gaming Policy, available at /responsible-gaming. Together these documents form the complete legal framework governing your use of 499ba.

For the purposes of this Privacy Policy, 499ba acts as the data controller in respect of all personal data collected from players and users of the platform. As data controller, 499ba determines the purposes for which and the means by which your personal data is processed.

If you have any questions, concerns, or requests regarding the processing of your personal data, you may contact our dedicated data protection point of contact using the details provided in Section 15 of this Policy. All data-related correspondence should be submitted in writing to [email protected] with the subject line "Data Protection Request — Account [your username]".

499ba collects several categories of personal data from players during registration, account operation, and platform use. The categories and specific data points collected are outlined in the table below.

499ba collects personal data through the following channels:

• Direct registration: Data you provide when creating an account, completing identity verification, updating your profile, or contacting our support team.
• Transaction processing: Data generated when you make deposits or withdrawal requests via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, including transaction identifiers passed to us by your payment provider.
• Platform usage: Data automatically collected when you navigate the 499ba website or application, including technical logs, cookies, and analytics data.
• Third-party verification partners: Identity and fraud-screening data received from KYC service providers when we submit your identity documents for verification.
• Game providers: Gameplay data (bet amounts, game round IDs, outcomes) passed to us by our licensed game studio partners, including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe.
• Support interactions: Records of live chat sessions, email correspondence, and any other communications you initiate with the 499ba support team.

499ba processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual necessity: Processing required to create and manage your account, process your financial transactions, and deliver the services you have requested from 499ba.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, age verification mandates, and fraud prevention obligations.
• Legitimate interests: Processing carried out in the legitimate interests of 499ba, such as platform security monitoring, fraud detection, customer service improvement, and responsible gaming programme administration, where these interests are not overridden by your rights and interests.
• Consent: Processing based on your specific, informed consent, such as the delivery of optional marketing communications or the use of non-essential cookies. Where consent is the legal basis, you retain the right to withdraw it at any time without affecting the lawfulness of prior processing.

6.1 Account Management

Your identity and contact data are used to create, maintain, and secure your 499ba account. This includes verifying your age and identity at registration, authenticating your login sessions, communicating important account notifications (such as security alerts, withdrawal confirmations, and account status updates), and enabling our support team to assist you effectively.

6.2 Payment Processing

Financial data — including your registered mobile financial service numbers and card details — is used solely to process deposit and withdrawal transactions. Payment data is transmitted directly to our PCI-DSS compliant payment gateway partners and is not stored in its entirety on 499ba systems. 499ba retains transaction records (amount, date, payment method type, and partial identifiers) for accounting, fraud monitoring, and regulatory compliance purposes.

6.3 Fraud Prevention and Security

Technical data, including your IP address, device fingerprint, and session information, is used to detect and prevent unauthorised account access, identify multiple accounts registered by the same individual, flag suspicious betting patterns associated with match-fixing or bonus abuse, and comply with AML screening obligations. 499ba employs automated fraud detection systems that analyse this data in real time.

6.4 Responsible Gaming

Usage data, including your deposit frequency, session duration, and betting patterns, is monitored as part of 499ba's responsible gaming programme. This monitoring is carried out to identify players who may be displaying signs of problem gambling and to proactively offer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion. This processing is in both your interest and our legitimate interest as a responsible gaming operator.

6.5 Marketing Communications

With your consent, 499ba may send you promotional communications about new games, seasonal offers (such as Eid or Pohela Boishakh promotions), BPL and IPL cricket betting specials, and other platform updates. You may withdraw your consent to marketing communications at any time by contacting support or updating your communication preferences in your account settings. Withdrawal of marketing consent does not affect the delivery of essential account communications.

499ba does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is shared only in the following strictly defined circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, and card processing partners receive the minimum data necessary to execute your requested transaction. Each payment partner operates under its own privacy policy and data security obligations.
• Identity verification providers: KYC and age verification partners receive copies of your identity documents to confirm your eligibility to use the platform. These partners are contractually bound to process your data only for the purposes specified by 499ba.
• Game studio providers: Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe, and other licensed game providers receive a unique player identifier (not your personal details) to facilitate game sessions and maintain game history records.
• Fraud and AML screening services: Transaction data may be passed to anti-fraud and anti-money laundering screening tools to flag patterns associated with financial crime.
• Legal and regulatory authorities: 499ba will disclose personal data to law enforcement, regulatory bodies, or other competent authorities when required to do so by applicable law, court order, or binding regulatory directive. 499ba will comply with such requests promptly and as required by law.
• Business transfers: In the event of a merger, acquisition, or transfer of all or part of 499ba's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

499ba retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

When personal data is no longer required and its retention period has expired, 499ba will securely delete or anonymise it in a manner that prevents reconstruction or re-identification.

499ba employs a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data from unauthorised access, accidental loss, disclosure, or destruction. Our security infrastructure includes:

• SSL/TLS encryption: All data transmitted between your browser or mobile device and 499ba servers is encrypted using industry-standard TLS 1.2 or higher protocols. This protects your personal and financial data in transit from interception or tampering.
• PCI-DSS compliant payment processing: Card and mobile financial service payment data is processed exclusively through payment gateways that meet Payment Card Industry Data Security Standards. Full card numbers and mobile wallet credentials are never stored on 499ba infrastructure.
• Access controls: Access to personal data within 499ba's systems is restricted on a strict need-to-know basis. All staff with access to player data receive regular data protection training and are bound by confidentiality obligations.
• Two-factor authentication: 499ba supports two-factor authentication (2FA) for player accounts and enforces it for administrative access to platform systems. Players are strongly encouraged to enable 2FA on their accounts.
• Intrusion detection and monitoring: 499ba's platform is monitored continuously for anomalous activity, unauthorised access attempts, and security threats. Automated alerts are reviewed by our security team around the clock.
• Data breach response: In the event of a confirmed data breach that poses a risk to player rights and freedoms, 499ba will notify affected players and relevant authorities in accordance with applicable data protection law without undue delay.

499ba uses cookies and similar tracking technologies to operate the platform, maintain session security, and understand how players interact with our services. A cookie is a small text file stored on your device by your browser when you visit a website.

10.1 Types of Cookies We Use

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, remember your account preferences, and protect against cross-site request forgery. These cookies cannot be disabled without preventing you from using the platform.
• Analytics cookies: We use anonymised analytics tools to understand which pages are visited most frequently, how players navigate the platform, and where technical errors occur. This data helps us improve the 499ba experience. Analytics cookies are only set with your consent.
• Functional cookies: These cookies remember your platform preferences, such as your preferred language setting and notification options, to provide a more personalised experience between sessions.
• Security cookies: Short-lived cookies used to identify and prevent fraudulent access attempts, including bot traffic and credential stuffing attacks.

10.2 Managing Cookies

You can manage non-essential cookie preferences at any time through your account settings on the 499ba platform. You may also control cookies through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in to your account. Most modern browsers offer the ability to block third-party cookies and to delete existing cookies stored on your device.

499ba does not use advertising or retargeting cookies that track your behaviour across third-party websites.

As a player on the 499ba platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and fulfil it within 10 business days, or inform you of any legitimate reasons why the request cannot be fulfilled within that timeframe.

• Right of access: You have the right to request a copy of the personal data we hold about you, together with information about how it is used, the legal basis for processing, and who it has been shared with.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update basic contact information directly through your account settings, or submit a correction request to our support team for data that cannot be self-edited.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing and there are no overriding legitimate grounds. Note that certain data must be retained to comply with legal obligations (see Section 8) and cannot be deleted on request during the mandatory retention period.
• Right to restriction: You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or while an objection to processing is being assessed.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another data controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data based on legitimate interests, including profiling. You also have an unconditional right to object to the use of your data for direct marketing purposes, which will be actioned immediately upon receipt of your request.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

499ba is strictly an adult platform. Access to and use of the 499ba platform is permitted only to individuals who are aged 21 years or older at the time of registration. This age restriction is enforced as a firm policy and reflects both our commitment to responsible gaming and the legal requirements applicable to online gambling services in the markets we serve.

499ba does not knowingly collect, process, or retain personal data relating to any individual under the age of 21. As part of our KYC process, all players are required to verify their date of birth and submit a valid government-issued identity document confirming they meet the minimum age requirement before their account is fully activated and deposits are permitted.

• If 499ba discovers — through KYC review, self-declaration, or any other means — that an account has been created by or for an individual under the age of 21, that account will be immediately suspended and any balance held will be handled in accordance with our Terms & Conditions.
• Any personal data collected in connection with an underage account will be securely deleted as soon as the account is identified and closed, except where retention is required by applicable law.
• Parents and guardians who believe a minor may have accessed or registered on the 499ba platform are encouraged to contact our support team immediately at [email protected]. We will investigate and act promptly.

499ba operates a platform that serves players in Bangladesh and processes data using technology infrastructure and service providers that may be located in other countries. As a result, your personal data may be transferred to, stored in, or processed in countries outside of Bangladesh.

When personal data is transferred internationally, 499ba ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy. These safeguards may include:

• Contractual clauses in agreements with our service providers that require them to protect personal data to the same standard as 499ba.
• Data processing agreements with third-party vendors that specify the permitted purposes for processing, data retention obligations, and security requirements.
• Transfers only to service providers located in countries or operating under frameworks that provide an adequate level of data protection as assessed by 499ba.

All international transfers of Bangladeshi player data are conducted with appropriate due diligence and contractual protections. If you would like more information about the specific safeguards in place for any particular transfer, please contact us using the details in Section 15.

499ba reserves the right to update, amend, or replace this Privacy Policy at any time in response to changes in applicable law, updates to our services, or improvements to our data protection practices. The most current version of this Policy will always be available at 499ba.io/privacy-policy.

When we make material changes to this Privacy Policy — such as changes to the categories of data we collect, new purposes for processing, or significant changes to your rights — we will notify you through one or more of the following channels:

• A prominent notice on the 499ba platform homepage or within your account dashboard.
• An email notification to the address registered to your 499ba account.
• An in-platform notification displayed when you next log in after a material policy update.

The date at the top of this page marked "Last Updated" reflects when the most recent revision was made. Where required by applicable law, we will seek fresh consent for any new or materially changed processing activities before they take effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 499ba handles your personal data, please contact our support and data protection team using the details below. All contact details are displayed as plain text — they are not clickable links.

• Email: [email protected] — please include "Privacy Policy Query" or "Data Rights Request" in your subject line.
• Live Chat: Available 24 hours a day, 7 days a week, directly from the 499ba platform. Our support agents can handle general privacy queries and escalate formal data rights requests to the appropriate team.
• Response Time: Acknowledgement within 2 hours for live chat; formal data rights requests actioned within 10 business days of identity verification.
• Operating Timezone: Bangladesh Standard Time (BST, UTC+6).

When submitting a formal data rights request, please include your registered email address, your account username, the specific right you wish to exercise (e.g., access, erasure, rectification), and any supporting details that will help our team process your request efficiently. Requests that do not include sufficient identifying information may experience delays while we conduct additional identity verification.