999y Privacy Policy – How We Handle Your Personal Data

1. Introduction

999y ("we," "us," "our," "the Platform") is committed to protecting the privacy and personal data of all users, including players based in Pakistan. This Privacy Policy explains in plain English how 999y collects, uses, discloses, and safeguards your personal information when you visit the Platform, create an account, make deposits, place bets, or otherwise interact with our services.

By registering on 999y or using any part of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with this Policy, you should not use the Platform.

This Policy applies to all personal data processed in connection with 999y accounts, including data collected during registration, identity verification, financial transactions, gameplay, customer support interactions, and marketing communications.

2. Data Controller

For the purposes of data protection law, 999y acts as the data controller in respect of personal data collected through the Platform. As data controller, 999y determines the purposes and means by which your personal data is processed.

Where 999y engages third-party service providers to process data on its behalf (for example, payment processors, identity verification services, or IT infrastructure providers), those parties act as data processors under 999y's instruction and are bound by contractual data processing agreements consistent with applicable data protection standards.

Any questions regarding data controllership or this Privacy Policy should be directed to the 999y support team via live chat or by email at [email protected].

3. Data We Collect

999y collects the following categories of personal data:

We do not collect or store sensitive biometric data. We do not collect full payment card numbers or mobile wallet PINs – these are processed directly by the respective payment gateway providers.

4. How We Use Your Data

999y uses the personal data collected for the following purposes:

• Account administration: Creating, maintaining, and securing your 999y account; enabling login and session management;
• Identity verification: Confirming that you are who you claim to be, that you meet the 18+ age requirement, and that you are not on any self-exclusion or fraud watchlist;
• Payment processing: Facilitating PKR deposits via JazzCash, Easypaisa, and bank transfer, and processing withdrawals to your registered payment method;
• Service delivery: Enabling access to cricket betting markets, casino games, slots, and other 999y gaming services;
• Fraud prevention and security: Detecting and investigating suspicious account activity, multiple account creation, and payment fraud;
• Regulatory compliance: Meeting anti-money-laundering (AML) obligations, maintaining transaction records as required by law;
• Responsible gaming: Monitoring for indicators of problem gambling behaviour; administering self-exclusion requests;
• Customer support: Responding to queries, resolving disputes, and providing account assistance;
• Platform improvement: Analysing aggregated, anonymised usage data to improve game offerings and site performance;
• Marketing: Sending promotional communications where you have consented to receive them (subject to the right to opt out at any time).

5. Legal Basis for Processing

999y processes personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil your account agreement with 999y, including payment processing and service delivery;
• Legal obligation: Processing required to comply with applicable laws, including AML regulations and age verification requirements;
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where these interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw this consent at any time.

6. Data Sharing

999y does not sell your personal data. We share data only in the following limited circumstances:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa/Mastercard networks, USDT processors, Skrill, and Neteller receive transaction data necessary to process your deposits and withdrawals;
• Identity verification providers: Third-party KYC/AML service providers receive identity documents and data to perform regulatory verification checks;
• IT and hosting providers: Cloud infrastructure and security service providers who process data on 999y's behalf under contractual data processing agreements;
• Legal authorities: Where required by law, court order, or regulatory authority, 999y will disclose data to competent authorities. Where legally permitted, we will notify you of such disclosure;
• Fraud prevention networks: Aggregated fraud indicators (not full personal profiles) may be shared with industry fraud prevention services;
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.

All third-party data processors engaged by 999y are required to process data only as instructed and to maintain appropriate security measures.

7. International Data Transfers

As an online platform, 999y may process or store data on servers located outside Pakistan. Where data is transferred internationally, 999y takes appropriate measures to ensure that your data receives a level of protection consistent with the principles set out in this Privacy Policy, including through contractual data transfer mechanisms where applicable.

By using 999y, you acknowledge and consent to the potential transfer of your data outside Pakistan as described in this section.

8. Data Retention

999y retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data: Retained for the duration of your account plus a minimum of 5 years following account closure, to satisfy regulatory and AML record-keeping requirements;
• Transaction records: Retained for a minimum of 5 years from the date of the transaction;
• Identity verification documents: Retained for the duration required by applicable AML regulations, typically 5 years post-relationship end;
• Support communications: Retained for 2 years from the date of the last communication, or longer if related to an unresolved dispute;
• Technical/log data: Typically retained for 12 months, unless required longer for security investigation purposes.

Where data is no longer required, it is securely deleted or anonymised so that it can no longer be attributed to an individual.

9. Cookies & Tracking Technologies

999y uses cookies and similar tracking technologies when you access the Platform. The main categories of cookies used are:

• Essential cookies: Required for login session management, security, and basic site functionality. These cannot be disabled without affecting your ability to use the Platform;
• Analytics cookies: Used to understand how Pakistani players interact with 999y – pages visited, session duration, navigation patterns. Data is aggregated and anonymised;
• Fraud prevention cookies: Used to detect anomalous access patterns and bot activity;
• Preference cookies: Store your language and display preferences across sessions.

You can manage or disable non-essential cookies through your browser settings (Chrome, Firefox, or your Android browser's privacy settings). Note that disabling cookies may affect login persistence and some site features.

10. Your Data Rights

Subject to applicable law, you have the following rights regarding your personal data held by 999y:

• Right of access: You may request a copy of the personal data 999y holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete data;
• Right to erasure: You may request deletion of your data, subject to our legal retention obligations. We cannot delete data we are legally required to retain;
• Right to restrict processing: You may request that we limit processing of your data in certain circumstances;
• Right to data portability: Where technically feasible, you may request your data in a structured, machine-readable format;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing emails), you may withdraw that consent at any time without affecting prior processing;
• Right to object: You may object to processing based on legitimate interests in certain circumstances.

To exercise any of these rights, contact 999y support via live chat or at [email protected]. We will respond within a reasonable timeframe (typically 30 days). Identity verification may be required before we action a data rights request.

11. Children's Privacy

999y is strictly an 18+ platform. We do not knowingly collect or process personal data from individuals under the age of 18. If we discover that a user is under 18, the account will be immediately suspended, all transactions reviewed, and data handled in accordance with our minor protection procedures.

If you believe a minor has registered on 999y, please contact our support team immediately so we can take appropriate action.

12. Security Measures

999y implements technical and organisational security measures appropriate to the nature of the data we hold, including:

• Encryption of data in transit (TLS/HTTPS) across all Platform connections;
• Access controls restricting personal data access to authorised personnel only;
• Regular security assessments and vulnerability testing;
• Two-factor authentication options for user accounts;
• Monitoring and alerting systems for suspicious account activity.

No data transmission over the internet is guaranteed to be 100% secure. While 999y takes all reasonable precautions, you acknowledge that data transmission carries inherent risk. You are responsible for maintaining the security of your own login credentials.

13. Marketing Communications

With your consent, 999y may send you promotional emails, SMS notifications, or in-platform messages about bonuses, new games, cricket betting markets (including PSL specials), or other 999y offers.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email;
• Updating your communication preferences in your account settings;
• Contacting 999y support with an explicit opt-out request.

Opting out of marketing does not affect transactional communications such as deposit confirmations, withdrawal notifications, or account security alerts – these will continue to be sent as they are necessary for service delivery.

14. Changes to This Privacy Policy

999y reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or Platform services. Material changes will be communicated to registered users via email or prominent notice on the Platform at least 7 days before taking effect where practicable.

The "Last updated" date at the top of this page indicates when the Policy was most recently revised. Your continued use of 999y following any update constitutes acceptance of the revised Policy. We encourage you to review this page periodically.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how 999y handles your personal data, please contact us:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the 999y website

For data subject rights requests (access, erasure, correction, etc.), please include "Data Rights Request" in your message subject so it can be routed to the appropriate team member for handling within the required timeframe.