999y Privacy Policy – How We Protect Your Data

1 Introduction

999y ("999y", "we", "us", "our") is committed to protecting the privacy of all individuals who use the 999y Platform, including Pakistani players who access the platform via mobile browser, desktop, or any other device. This Privacy Policy describes how 999y collects, processes, stores, and protects personal data in connection with your use of the 999y website and all associated services, including sports betting, online casino, slots, crash games, and account management features.

This Privacy Policy applies to all registered 999y account holders and to any visitor who accesses the 999y Platform without registering. By using the 999y Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read together with 999y's Terms & Conditions and Responsible Gaming Policy.

If you have any questions about how 999y handles your personal data, please contact us at the details provided in Section 15 of this Policy before using the Platform.

2 Data Controller

999y acts as the data controller in respect of personal data collected from users of the Platform. As data controller, 999y determines the purposes and means by which personal data is processed, and is responsible for ensuring that processing is carried out in accordance with applicable data protection legislation and international best practices.

999y operates under an international online gaming licence and is subject to associated regulatory requirements regarding the collection, processing, and retention of player data. These regulatory requirements may in certain circumstances supersede the data minimisation preferences of individual players, particularly in relation to KYC (Know Your Customer) and anti-money laundering obligations.

3 Personal Data We Collect

999y collects personal data in three primary ways: data you provide directly, data generated through your use of the Platform, and data obtained from third parties as part of the verification process.

Data you provide directly to 999y:

• Full legal name
• Date of birth (for 18+ age verification purposes)
• Pakistani mobile number (CNIC-linked, typically JazzCash or Easypaisa registered)
• Email address
• Residential address
• CNIC number or passport number (for KYC identity verification)
• Username and encrypted password
• Communications you send to 999y support
• Responsible gaming preferences and limit settings

Data generated by your use of the Platform:

• Betting and gaming transaction history, including stakes, odds, game selections, outcomes, and timestamps
• Deposit and withdrawal transaction records
• Device information including device type, operating system, browser type, and screen resolution
• IP address and approximate geolocation data
• Session activity logs including login times, session duration, and pages visited
• Cookie and similar tracking data as described in Section 7

Data received from third parties:

• Identity verification data from KYC document verification service providers
• Transaction confirmation data from JazzCash, Easypaisa, and banking partners
• Fraud and sanctions screening data from compliance service providers

4 How 999y Uses Your Personal Data

999y processes your personal data only for specified, lawful purposes. The table below summarises the primary purposes for which 999y uses player data:

5 Legal Basis for Processing

999y processes your personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the 999y services you have contracted for, including account management, betting, payments, and customer support.
• Legal obligation: Processing required to comply with anti-money laundering laws, KYC regulations, gaming licence conditions, and other applicable legal requirements.
• Legitimate interests: Processing carried out in the legitimate interests of 999y or its players, including fraud prevention, platform security, responsible gambling monitoring, and service improvement, where these interests are not overridden by your privacy rights.
• Consent: Processing for optional purposes, such as sending promotional communications, where you have provided explicit consent. You may withdraw consent at any time by contacting 999y support or updating your account communication preferences.

6 Data Sharing & Third Parties

999y does not sell your personal data to any third party. 999y shares personal data only in the following limited circumstances:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, and Bank Alfalah receive only the transactional data necessary to process your deposit or withdrawal. 999y does not share your full profile with payment providers, and payment providers do not share your wallet credentials with 999y.
• KYC and compliance service providers: Identity verification and sanctions screening providers may receive your KYC document data for the purpose of identity and age verification. These providers are contractually bound to process data solely for the specified purpose.
• Game technology providers: Casino and sports betting platform providers may receive the minimum data necessary to operate games and settle bets, such as account identifiers and stake/outcome data. Full personal data is not shared.
• Regulatory and law enforcement authorities: 999y will disclose personal data to competent regulatory authorities, law enforcement bodies, or courts when required to do so by law, valid legal process, or our gaming licence conditions.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 999y's business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified in advance of any such transfer that materially affects the handling of their data.

7 Cookies & Tracking Technologies

The 999y Platform uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device when you visit the 999y website. 999y uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged into your 999y account and security cookies. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, default bet amounts, and responsible gaming tool configurations to improve your experience on the 999y Platform.
• Analytics cookies: Collect aggregated, anonymised data about how Pakistani players use the 999y Platform to help us understand page performance and improve user flows. No personally identifiable information is collected via analytics cookies.
• Fraud prevention cookies: Used to detect and prevent fraudulent activity, multi-accounting, and bot access on the Platform.

You may manage cookie preferences via your browser settings. Disabling strictly necessary cookies will impair your ability to log into and use your 999y account. 999y does not use third-party advertising or social media tracking cookies.

8 Data Security

999y implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• SSL/TLS encryption: All data transmitted between your device and 999y servers is encrypted using industry-standard SSL/TLS protocols. This applies to all Platform pages including the 999y login page, account pages, and cashier.
• Password hashing: Account passwords are never stored in plain text. 999y uses one-way cryptographic hashing algorithms to store passwords, meaning that even 999y staff cannot access your actual password.
• Two-factor authentication (2FA): Available as an optional additional security layer for all 999y accounts. Players are encouraged to enable 2FA to protect their account from unauthorised access.
• Access controls: Access to player data within 999y's systems is restricted on a need-to-know basis. Staff who process player data are subject to confidentiality obligations and regular data protection training.
• Regular security audits: 999y engages independent third-party security specialists to conduct periodic penetration testing and security reviews of the Platform infrastructure.
• Incident response: 999y maintains a data breach incident response plan. In the event of a breach that is likely to result in risk to player rights or freedoms, affected players and relevant authorities will be notified in accordance with applicable requirements.

No security system is entirely infallible. 999y strongly recommends that all Pakistani players use a strong, unique password for their 999y account and enable two-factor authentication. Do not share your 999y login credentials with any third party.

9 Data Retention

999y retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and as required by applicable legal and regulatory obligations. Specific retention periods include:

• Account data: Retained for the duration of your 999y account and for a minimum of five (5) years following permanent account closure, as required by anti-money laundering regulations applicable to 999y's gaming licence.
• Transaction records: Betting history, deposit records, and withdrawal records are retained for a minimum of five (5) years from the date of each transaction.
• KYC documents: Identity verification documents are retained for the duration of the account and for five (5) years following account closure.
• Customer support communications: Correspondence with the 999y support team is retained for three (3) years from the date of the most recent communication in a given thread.
• Technical logs: Server access and security logs are retained for up to twelve (12) months and then deleted or anonymised.

When the applicable retention period expires, 999y will securely delete or irreversibly anonymise your personal data.

10 Your Privacy Rights

Subject to applicable law and the regulatory requirements governing 999y's gaming licence, you have the following rights in respect of your personal data held by 999y. To exercise any of these rights, contact 999y support at the details in Section 15.

11 Minors & Children's Privacy

The 999y Platform is strictly for individuals aged 18 years and over. 999y does not knowingly collect personal data from persons under the age of 18. Age verification is a mandatory step in the 999y registration process and is enforced through KYC identity verification before any withdrawal can be processed.

If 999y becomes aware that personal data has been collected from a person under 18 years of age, the relevant account will be immediately closed, all data associated with that account will be deleted as soon as legally permissible, and the matter will be investigated in accordance with 999y's responsible gaming obligations. Parents or guardians who believe a minor has registered a 999y account should contact 999y support immediately.

12 Payment Data & Financial Privacy

999y takes the security of your financial data extremely seriously. The following practices govern how payment data is handled on the 999y Platform:

• 999y does not store your JazzCash PIN, Easypaisa PIN, online banking password, or any other payment authentication credentials. All payment authentication is handled directly by JazzCash, Easypaisa, or your bank on their own secure infrastructure.
• 999y stores only the minimum transactional data necessary to reconcile your deposit and withdrawal history – namely transaction reference numbers, amounts in PKR, timestamps, and payment method type. Full payment account numbers and card details are not stored by 999y.
• Financial transaction records are subject to the five-year retention obligation described in Section 9 and cannot be deleted on request during this period due to regulatory requirements.
• In the event that 999y suspects a financial transaction may be connected to money laundering or financial crime, we are legally required to retain relevant records and may be required to report to competent authorities without notifying the account holder.

13 International Data Transfers

999y's platform infrastructure and certain service providers may be located outside of Pakistan. When your personal data is transferred to a jurisdiction outside Pakistan, 999y takes steps to ensure that appropriate safeguards are in place to protect your data, including contractual protections with data processors and ensuring that receiving jurisdictions maintain adequate data protection standards.

By using the 999y Platform, you consent to the transfer of your personal data to 999y's servers and authorised processors in jurisdictions outside Pakistan where necessary to deliver the services described in these Terms. 999y will not transfer your data to any jurisdiction that does not provide an adequate level of protection without implementing appropriate safeguards.

14 Changes to This Privacy Policy

999y reserves the right to update this Privacy Policy at any time. When material changes are made, 999y will notify registered players via email to the address on file or via a prominent notice on the 999y Platform prior to the changes taking effect. The "Last Updated" date at the top of this page will be updated to reflect the date of the most recent revision.

Continued use of the 999y Platform following notification of changes constitutes acceptance of the revised Privacy Policy. If you do not agree with any revision, you must cease using the Platform and may request account closure by contacting 999y support.

15 Contact & Data Subject Requests

For any privacy-related queries, to exercise your data rights as described in Section 10, or to raise a concern about how 999y handles your personal data, please contact the 999y Data Protection team. All requests will be acknowledged within 48 hours and resolved within 30 days where reasonably practicable.

999y is committed to resolving all privacy concerns directly. If you believe your privacy rights have not been respected after raising the matter with 999y, you may have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.