Privacy Policy — 2299

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" means the 2299 website accessible at https://2299.vu and all associated services, games, betting markets, account tools, and support channels operated by 2299.
• "Player" or "You" means any individual who accesses, registers on, or otherwise interacts with the 2299 Platform.
• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, directly or indirectly — including but not limited to name, date of birth, mobile number, email address, payment account identifiers, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, analysis, disclosure, transfer, or deletion.
• "Third-Party Service Provider" means any external company or individual engaged by 2299 to perform specific functions in connection with the operation of the Platform — such as payment processors, game software providers, fraud prevention services, and customer support tools — who processes Personal Data on 2299's behalf under a contractual data processing agreement.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawal processing and during account review.
• "Cookie" means a small text file stored on your device by the Platform's web server for the purposes described in Section 6 of this Policy.

2299 collects Personal Data in the following categories, depending on how you interact with the Platform:

When you make deposits or request withdrawals through the Platform, 2299 collects transaction records including: the payment method used (bKash, Nagad, Rocket, Upay, or bank transfer), the mobile financial service account number or bank account identifier associated with the transaction, transaction amounts in BDT, timestamps, and transaction reference numbers. 2299 does not store full card numbers, mobile banking PINs, or online banking passwords — such credentials are handled exclusively by the relevant payment service provider.

When you access the Platform, our servers automatically record certain technical information, including: your IP address, browser type and version, device type and operating system, the pages and games you access within the Platform, session duration, referring URLs, and game wagering activity logs. This data is used for platform security, fraud prevention, and service improvement purposes.

If you contact the 2299 support team — whether through the platform's messaging system, or by emailing [email protected] — we retain records of that correspondence, including the content of messages and any attachments provided, for the purposes of resolving your enquiry and maintaining a service history.

2299 collects Personal Data through the following channels:

• Directly from you: Information you provide when completing the registration form, submitting KYC documents, making deposits or withdrawal requests, setting responsible gaming limits, or contacting customer support.
• Automatically through the Platform: Technical and usage data collected via server logs, session tracking, and platform analytics tools when you browse the site, play games, or place bets.
• Through cookies and similar technologies: Session cookies, preference cookies, and analytics cookies stored on your device as described in Section 6 of this Policy.
• From payment service providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and Bangladeshi banking partners when a deposit or withdrawal is processed. This data is limited to what is necessary to reconcile the transaction in your account.
• From identity verification services: Where a third-party KYC verification tool is used to confirm the authenticity of identity documents submitted by a Player, that service may return a verification result to 2299. 2299 does not receive or retain raw biometric data from such services.

2299 processes your Personal Data only where a legitimate purpose and appropriate legal basis exists. The table below sets out the primary purposes for which we process your data and the corresponding legal basis for each:

Where processing is based on your consent — such as the sending of promotional emails or bonus notifications — you have the right to withdraw that consent at any time by contacting [email protected] or updating your notification preferences within your Account settings. Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.

Your Personal Data may be shared with the following categories of third parties in connection with the operation of the 2299 Platform:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and partner Bangladeshi banks (including Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank) receive the minimum transaction data necessary to process your deposit or withdrawal request.
• Game Software Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token or anonymised player identifier to facilitate game loading and fair-play auditing. These providers do not receive your name, contact details, or financial information.
• KYC and Identity Verification Services: Where a third-party verification tool is used to authenticate identity documents, the relevant document images and verification result are processed by that service under a strict data processing agreement with 2299.
• Fraud Prevention and Security Services: IP address data and device fingerprint information may be shared with fraud prevention tools to detect and prevent account takeovers, multi-accounting, and money laundering.
• Legal and Regulatory Authorities: 2299 will disclose Personal Data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by a lawful order, warrant, or regulatory obligation. 2299 will notify the affected Player of such a disclosure where legally permitted to do so.
• Business Successors: In the event of a merger, acquisition, or transfer of substantially all assets of 2299 to a successor entity, Player data may be transferred as part of that transaction. Affected Players will be notified in advance of any such transfer and will be given the opportunity to request account closure before the transfer takes effect.

All Third-Party Service Providers engaged by 2299 are required to process your Personal Data only for the specific purposes for which it was shared, to maintain appropriate technical and organisational security measures, and to delete or return the data upon termination of their service agreement with 2299.

The 2299 Platform uses cookies and similar technologies to provide a functional, secure, and personalised experience. The following categories of cookies are used:

Strictly necessary cookies cannot be disabled as they are essential for the Platform to function correctly. You may disable functional and analytics cookies through your browser settings; however, doing so may affect the quality of your experience on the Platform. Instructions for managing cookie settings are available in the help documentation of your specific browser.

2299 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform. No cross-site tracking of your browsing behaviour outside of 2299.vu is performed.

2299 applies a layered approach to data security, combining technical controls, organisational procedures, and staff training to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Transport Layer Security: All data in transit between your device and 2299 servers is encrypted using TLS 1.3. HTTP connections are automatically redirected to HTTPS.
• Password Security: Passwords are hashed using a bcrypt algorithm with individual salts. 2299 staff cannot retrieve your password in plain text — only a password reset via your registered mobile number is possible.
• Two-Factor Authentication (2FA): OTP-based authentication is applied at login and at the point of withdrawal request submission to verify that the account holder is the person performing the action.
• Access Controls: Internal access to Player Personal Data is restricted on a strict need-to-know basis. Staff roles are granted the minimum level of data access necessary to perform their specific function. Access logs are audited regularly.
• Infrastructure Security: 2299 servers are hosted in facilities with physical access controls, fire suppression, and redundant power supply. Network security includes firewall rules, intrusion detection systems, and regular vulnerability scanning.
• Incident Response: In the event of a data breach that poses a risk to Players' rights or interests, 2299 will notify affected Players without undue delay after becoming aware of the breach, providing information about the nature of the incident, the categories of data affected, and the steps being taken to address it.

2299 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected or to comply with applicable legal and regulatory obligations. The retention periods below apply as a general guide:

At the end of the applicable retention period, Personal Data is either securely deleted or anonymised such that it can no longer be linked to any identifiable individual. Where data has been anonymised, it may be retained in aggregate form for statistical or research purposes without restriction.

As a Player on the 2299 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request" and your registered account username.

• Right of Access: You have the right to request a copy of the Personal Data that 2299 holds about you, along with information about the purposes for which it is processed and the categories of third parties with whom it has been shared.
• Right to Rectification: If any Personal Data held by 2299 is inaccurate or incomplete, you have the right to request that it be corrected. Basic account details such as your email address and mobile number can be updated directly within your Account settings.
• Right to Erasure: You may request that 2299 delete your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent (and no other legal basis applies), or where the data has been processed unlawfully. This right is subject to 2299's obligation to retain certain data under applicable anti-money-laundering and financial record-keeping requirements.
• Right to Restriction: You may request that 2299 restrict the processing of your Personal Data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, and processing is carried out by automated means, you have the right to receive a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interest, including profiling. You may also object at any time to the use of your Personal Data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

2299 will respond to all data rights requests within thirty (30) days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by a further thirty (30) days, and you will be notified of the extension and the reason for it within the initial thirty-day period.

2299 will not charge a fee for processing a data rights request unless the request is manifestly unfounded, repetitive, or excessive — in which case a reasonable administrative fee may be applied.

If you are a parent or guardian and have reason to believe that a person under the age of 18 has registered an account on the 2299 Platform or has provided their personal information, please contact us immediately at [email protected]. We will investigate and act on all such reports as a matter of priority.

2299 employs age-gate measures during the registration process, including date-of-birth verification and KYC identity document checks at the withdrawal stage, to prevent underage access to the Platform. Accounts where the registered date of birth cannot be verified as 18 or older through the KYC process will be suspended pending verification.

The 2299 Platform is operated primarily for the Bangladesh market and processes the majority of Player data within server infrastructure serving the region. However, some of the Third-Party Service Providers engaged by 2299 — including game software providers such as Pragmatic Play, Evolution Gaming, and Microgaming — may process certain limited, non-financial Player data (such as anonymised session tokens) on infrastructure located outside of Bangladesh.

Where Personal Data is transferred to a third party operating infrastructure outside Bangladesh, 2299 ensures that appropriate contractual safeguards are in place to protect the data to a standard at least equivalent to that which applies under this Privacy Policy. These safeguards include data processing agreements that restrict the third party's use of the data to the specific purposes for which it was shared and require deletion of the data upon termination of the service relationship.

2299 does not transfer your full identity data, KYC documents, financial records, or payment account details to any party operating outside Bangladesh except where required to do so by a lawful order from a competent authority.

2299 reserves the right to update or amend this Privacy Policy at any time to reflect changes in platform functionality, applicable law, or data processing practices. Where a material change is made to this Policy, 2299 will notify all registered Players via their registered email address no fewer than seven (7) days before the amended Policy takes effect.

The effective date at the top of this page will be updated each time a new version of the Policy is published. The version currently displayed at https://2299.vu/privacy-policy is always the version in force. We recommend bookmarking this page and reviewing it periodically, particularly following any email notification of an update.

Your continued use of the 2299 Platform after an amended Privacy Policy has taken effect constitutes your acknowledgement of and agreement to the revised terms. If you do not agree with a material change to this Policy, you have the right to close your account before the change takes effect by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 2299 processes your Personal Data, please contact us using the details below. Our support team is available around the clock and will direct your query to the appropriate team member.

All formal privacy complaints should be submitted in writing to [email protected] with the subject line "Privacy Concern". Please include your registered username, a clear description of your concern, the dates on which any relevant events occurred, and any supporting information. 2299 will acknowledge receipt within 24 hours and provide a substantive written response within five (5) business days.