Privacy Policy — sona999

This Privacy Policy ("Policy") describes how sona999 ("the Company", "we", "us", "our") collects, processes, stores, and protects personal information provided by users ("you", "your", "the Player") when accessing or using the sona999 website, mobile platform, sportsbook, casino, and all associated services (collectively, "the Platform"). By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy should be read alongside the Terms & Conditions and the Responsible Gaming page.

sona999 is committed to safeguarding the privacy and personal data of all players across Bangladesh, including those accessing the Platform from Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. We handle all personal data responsibly and in accordance with applicable data protection principles.

1. Data We Collect

1.1 Information You Provide Directly

When you register an account on sona999, you provide us with personal information that is necessary to create and manage your account. This includes:

• Identity Data: Full legal name, date of birth, gender, and nationality.
• Contact Data: Email address, mobile phone number, and residential address including city, district, and postal code.
• Identity Verification Documents: Copies of your National Identity Card (NID), passport, or driving licence submitted for KYC (Know Your Customer) verification.
• Financial Data: Payment method details including bKash mobile number, Nagad account number, Rocket account number, bank account details, or card details (Visa, Mastercard) used for deposits and withdrawals. Full card numbers are never stored on our servers — only masked identifiers are retained.
• Account Credentials: Username and a hashed (encrypted) version of your password. Your plain-text password is never stored or accessible by sona999 staff.
• Communications Data: The content of any messages you send to our support team via live chat, email, or our ticketing system.

1.2 Information Collected Automatically

When you access the Platform, certain technical data is collected automatically by our servers and analytics systems. This includes:

• Device & Technical Data: IP address, device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, time spent on each page, games played, bet history, deposit and withdrawal history, session start and end times, and click-path data.
• Location Data: Approximate geographic location derived from your IP address (country and city level only — we do not use GPS-level location data).
• Cookie & Tracking Data: Session cookies, authentication tokens, and analytics identifiers as described in the Cookies section below.

1.3 Information from Third Parties

In certain circumstances, sona999 may receive personal data about you from third parties, including:

• Identity Verification Providers: Third-party KYC service providers may return identity verification results, document authenticity scores, and PEP (Politically Exposed Person) or sanctions screening outcomes.
• Payment Processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, and banking partners, including transaction IDs and timestamps.
• Fraud Prevention Services: Risk scores, device fingerprint assessments, and fraud flags from integrated third-party fraud prevention tools.

Data Category	Examples	Source
Identity	Name, date of birth, NID number	You / KYC provider
Contact	Email, phone, address	You
Financial	bKash number, masked card details, transaction IDs	You / Payment processors
Technical	IP address, browser, device type	Automatically collected
Usage	Bet history, pages visited, session duration	Automatically collected
Communications	Support chat logs, emails	You
Verification	KYC result, fraud score, sanctions check	Third-party providers

2. How We Use Your Data

sona999 processes personal data only for specific, legitimate purposes. We do not use personal data for any purpose that is incompatible with the reasons for which it was originally collected. The primary purposes for which we process your data are:

• Account Management: Creating, maintaining, and administering your sona999 account, including processing login requests, account updates, and password resets.
• Service Delivery: Enabling you to place bets, play casino games, participate in promotions, and access all Platform features.
• Payment Processing: Facilitating deposits via bKash, Nagad, Rocket, Upay, and other supported methods, and processing withdrawal requests to your registered payment instruments.
• Identity Verification (KYC/AML): Verifying your identity and age (18+), screening against sanctions and PEP lists, and fulfilling anti-money laundering obligations as required by applicable law.
• Responsible Gaming: Monitoring account activity to identify potential signs of problem gambling, enforcing self-exclusion requests, and applying deposit limits set by the player.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, multiple account creation, bonus abuse, and unauthorised access to accounts.
• Customer Support: Responding to your enquiries, resolving disputes, and improving the quality of our support services based on interaction history.
• Platform Improvement: Analysing usage patterns and technical performance data in aggregate to improve Platform stability, game selection, and user experience.
• Legal Compliance: Meeting obligations under applicable Bangladeshi law and any other regulations that apply to the operation of the Platform.
• Direct Marketing (with consent): Sending you information about promotions, bonuses, and new games on sona999 where you have opted in to receive such communications. You may withdraw consent at any time by contacting support or using the unsubscribe link in any marketing email.

3. Cookies & Tracking

3.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to recognise your device on subsequent visits, maintain session state, and collect usage information. sona999 uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to operate the Platform securely and efficiently.

3.2 Types of Cookies Used

Cookie Type	Purpose	Duration
Essential / Session	Maintain login state, load balancing, security tokens	Session (deleted on browser close)
Authentication	Remember logged-in status across page loads	Up to 30 days (if "Remember Me" selected)
Analytics	Aggregate page view and navigation data for platform improvement	Up to 12 months
Preference	Store language, game layout, and display preferences	Up to 12 months
Fraud Prevention	Device fingerprinting to detect duplicate accounts and bots	Up to 24 months

3.3 Managing Cookies

You may manage or disable cookies through your browser settings at any time. Please note that disabling essential or authentication cookies will prevent you from logging in to your sona999 account and will impair the Platform's ability to function correctly. Disabling analytics or preference cookies will not affect your ability to play but may result in a less personalised experience. Instructions for managing cookies are available through your browser's help documentation.

4. Data Sharing & Third Parties

sona999 does not sell your personal data to any third party. We share personal data with third parties only in the following controlled circumstances:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive only the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and security standards.
• Identity Verification (KYC) Providers: Your identity documents and personal details may be shared with authorised third-party KYC providers to verify your age, identity, and compliance with AML regulations. These providers are contractually bound to process your data solely for verification purposes.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and relevant session data to deliver their games within the Platform. These providers do not receive your full identity or financial data.
• Fraud Prevention & Security: Aggregated or pseudonymised technical data may be shared with fraud detection service providers to identify patterns associated with account abuse or money laundering.
• Legal Authorities: sona999 may disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law, a valid court order, or where we believe disclosure is necessary to protect the rights, property, or safety of the Company, its players, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of the Company's assets, personal data held about players may be transferred to the acquiring entity, subject to the same privacy obligations described in this Policy.

5. Data Retention

sona999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to any legal or regulatory obligations that require a longer retention period. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, to satisfy AML record-keeping obligations.
• Transaction Records: Financial transaction records (deposits, withdrawals, bet history) are retained for a minimum of five (5) years from the date of the transaction.
• KYC Documents: Identity verification documents are retained for five (5) years following account closure or the last transaction, whichever is later.
• Support Communications: Chat logs and email correspondence with the support team are retained for three (3) years from the date of the interaction.
• Marketing Consent Records: Records of your marketing preferences and consent history are retained for the duration of your account plus three (3) years, to demonstrate compliance in the event of a complaint.
• Technical & Log Data: Server logs and session data are retained for a maximum of thirteen (13) months and then deleted or fully anonymised.

When personal data is no longer required, sona999 will securely delete or anonymise it so that it can no longer be associated with you as an individual. Anonymised aggregate data (for example, statistical analysis of game popularity or deposit trends) may be retained indefinitely as it no longer constitutes personal data.

6. Data Security

sona999 employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or mobile application and the sona999 servers is encrypted using 256-bit SSL/TLS encryption.
• Password Hashing: User passwords are stored only as salted cryptographic hashes using industry-standard algorithms. Plain-text passwords are never stored or logged.
• Access Controls: Access to personal data is restricted to authorised sona999 personnel on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Firewalls & Intrusion Detection: The Platform's server infrastructure is protected by enterprise-grade firewalls and continuous intrusion detection monitoring.
• Two-Factor Authentication (2FA): Players are encouraged to enable two-factor authentication on their sona999 accounts for an additional layer of login security.
• Regular Security Audits: sona999 conducts periodic security assessments and penetration testing of the Platform to identify and remediate vulnerabilities proactively.

Despite these measures, no system is completely immune to security breaches. In the event of a data breach that is likely to result in a risk to your rights and freedoms, sona999 will notify affected players promptly and take all necessary steps to contain and remediate the incident.

7. Your Privacy Rights

As a player on the sona999 Platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team at support@sona999. We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) calendar days. In complex cases, this period may be extended by up to a further thirty (30) days, with prior notification.

• Right of Access: You may request a copy of the personal data that sona999 holds about you, along with information about how it is being processed. This is sometimes referred to as a Subject Access Request (SAR).
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update some information directly within your account settings panel.
• Right to Erasure: In certain circumstances, you have the right to request that sona999 delete the personal data we hold about you. This right is subject to legal exceptions — for example, we are required to retain financial transaction records for a minimum period regardless of an erasure request.
• Right to Restrict Processing: You may request that we limit the way we process your personal data in certain circumstances, for example while a dispute is being resolved or while you exercise another right.
• Right to Data Portability: Where personal data was collected on the basis of your consent or for the performance of a contract, you may request that we provide it to you in a structured, machine-readable format, or transfer it directly to another service provider where technically feasible.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing. Where you object to direct marketing, we will cease that processing immediately upon receipt of your objection.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

8. Contact & DPO

If you have any questions, concerns, or complaints about this Privacy Policy or about how sona999 handles your personal data, please contact us using the details below. We take all privacy enquiries seriously and will respond within five (5) business days.

• Email: support@sona999 (plain text — not a clickable link)
• Live Chat: Available 24/7 directly within the Platform after logging in to your account
• Response Language: English, 24 hours a day, 7 days a week

sona999 has appointed an internal Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. The DPO may be contacted via the support email address above with "DPO Enquiry" in the subject line. All formal data subject rights requests should also be directed to this address.