bp999 Privacy Policy

1. Data Controller

The data controller responsible for personal data collected through the bp999 platform is the operator of bp999.bid, an internationally licensed online casino and sports betting operator. References to "bp999", "we", "us", or "our" throughout this document refer to the data controller.

For all privacy-related enquiries, you may contact us at: support@bp999.bid. Please use the subject line "Privacy Request" to ensure prompt routing to the appropriate team.

2. Scope of This Policy

This Privacy Policy applies to:

• All registered bp999 account holders, regardless of their country of access;
• Visitors to bp999.bid who browse the platform without registering an account;
• Any individual who contacts bp999 support via live chat or email;
• All bp999 mobile-optimised interfaces, including the iOS and Android web experience.

This policy does not apply to third-party websites, payment processors, or services that may be accessible via links from the bp999 platform. Each third party operates under its own privacy policy, and we encourage you to review those policies independently.

3. Personal Data We Collect

The categories of personal data that bp999 may collect about you are outlined in the table below:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than where required for identity verification), or health data, unless explicitly required for a specific regulatory purpose and with your prior consent.

4. How We Collect Personal Data

bp999 collects personal data through the following channels:

• Direct collection: Data you provide voluntarily when you register an account, complete KYC verification, submit a payment, or contact our support team.
• Automated collection: Technical and usage data collected automatically when you access bp999 through server logs, cookies, and analytics tools.
• Third-party providers: Identity verification and KYC data may be cross-referenced against data held by licensed identity verification services. Payment data may be cross-referenced with payment processors including Easypaisa, JazzCash, Raast, HBL, and USDT network providers — subject to their own privacy terms.
• Anti-fraud systems: Device fingerprinting and behavioural analysis data generated as part of our fraud prevention and responsible gaming monitoring systems.

5. Purposes & Legal Basis for Processing

bp999 processes your personal data only where there is a lawful basis to do so. The primary purposes and corresponding legal bases are:

• Account creation and management — necessary for the performance of the contract between you and bp999.
• Payment processing — necessary for the performance of the contract; PKR transactions via Easypaisa, JazzCash, HBL, and other channels require transaction data to be processed.
• KYC and age verification — necessary to comply with anti-money laundering and age restriction legal obligations (18+ enforcement).
• Fraud prevention and security — legitimate interest of bp999 to protect the platform and its users from fraudulent, abusive, or illegal activity.
• Responsible gaming monitoring — legitimate interest and legal obligation to detect and respond to problem gambling indicators.
• Customer support — necessary for the performance of the contract and legitimate interest in maintaining service quality.
• Platform analytics and improvement — legitimate interest in understanding how the platform is used to improve features and performance.
• Marketing communications — with your consent, where you have opted in to receive promotional emails or notifications about bp999 offers.
• Legal compliance — necessary to comply with applicable laws, regulatory requirements, and court or regulatory orders.

6. Data Sharing & Third Parties

6.1 Service Providers

bp999 shares personal data with a limited number of third-party service providers who process data on our behalf and under our instructions. These include: identity verification providers, payment processors (Easypaisa, JazzCash, Raast, HBL, USDT network operators), cloud hosting infrastructure providers, analytics platforms, and customer support tooling providers. All such providers are contractually bound to process your data only as directed by bp999 and to maintain appropriate security standards.

6.2 Legal and Regulatory Disclosures

bp999 may disclose personal data to law enforcement authorities, regulatory bodies, or other governmental agencies where required by law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or to protect the safety of our users or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of bp999 or a substantial part of its assets, personal data held by bp999 may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer and given an opportunity to request account deletion if they do not wish their data to be transferred.

6.4 No Commercial Data Sales

bp999 does not sell, rent, or licence your personal data to any third party for their own marketing or commercial purposes. This commitment is unconditional and applies regardless of the value of the data in question.

7. Data Retention

bp999 retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of the account's active life plus a minimum of five years after account closure, as required for anti-money laundering compliance.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• KYC documents: Retained for the duration of the account's active life plus five years post-closure.
• Technical and usage data: Typically retained for 12 months in active analytics systems, then archived or anonymised.
• Support communications: Retained for three years from the date of the last communication in a ticket thread.

When personal data is no longer required and no legal obligation to retain it exists, bp999 will securely delete or anonymise it.

8. Security Measures

bp999 implements the following technical and organisational security measures to protect your personal data:

• All data in transit is encrypted using TLS 1.3 with AES-256 cipher suites;
• Data at rest is encrypted using AES-256;
• User passwords are hashed using bcrypt with a minimum cost factor of 12 — they are never stored in plain text;
• Payment credentials are tokenised and processed through PCI-DSS compliant channels;
• Access to production systems is restricted to authorised personnel on a need-to-know basis and is protected by multi-factor authentication;
• Regular penetration testing and security audits are conducted by independent parties;
• An incident response plan is in place; in the event of a data breach affecting your personal data, you will be notified within 72 hours where required by applicable law.

9. Cookies & Tracking Technologies

bp999 uses cookies and similar tracking technologies to operate the platform, maintain your session, and analyse usage patterns. The categories of cookies we use are:

• Essential cookies: Required for the platform to function correctly, including session management, login state, and security tokens. These cannot be disabled without impairing core platform functionality.
• Performance cookies: Used to collect anonymised analytics data about how users interact with bp999, which pages are most visited, and where errors occur. This data helps us improve the platform.
• Functional cookies: Remember your preferences such as language settings, display preferences, and last-used deposit method.
• Anti-fraud cookies: Used to detect suspicious activity, multi-accounting, and automated bot behaviour.

bp999 does not use third-party advertising cookies or tracking pixels for ad targeting. You can manage cookie preferences through your browser settings; however, disabling essential cookies will affect your ability to log in and use the platform.

10. International Data Transfers

bp999 is an internationally operated platform. Your personal data may be processed in countries outside your country of residence, including countries whose data protection laws may differ from those in Pakistan. Where such transfers occur, bp999 applies appropriate safeguards, which may include standard contractual clauses, data processing agreements with adequate protections, or transfer to countries recognised as providing an adequate level of data protection.

For players in Pakistan, the primary processing locations include the jurisdiction in which bp999 holds its international gambling licence and the infrastructure regions used by our cloud hosting provider. By using bp999, you acknowledge and consent to these transfers where necessary for the operation of your account.

11. Minors

bp999 strictly prohibits the use of its platform by anyone under the age of 18. We do not knowingly collect personal data from individuals under 18. If we become aware that personal data belonging to a minor has been collected, we will take immediate steps to delete that data and close the associated account.

If you believe a minor may have accessed bp999 using false age information, please contact support@bp999.bid immediately so we can investigate and take appropriate action.

12. Your Data Rights

Subject to applicable law and our legal retention obligations, you have the following rights in relation to your personal data held by bp999: