999y Privacy Policy — How We Protect Your Data

1. Introduction

Welcome to 999y. We take your privacy seriously — not because we have to, but because it is the right way to run a platform that Pakistani players can genuinely trust. This Privacy Policy explains how 999y (operating at 999y.onl) collects, uses, stores, shares and protects your personal information when you use our platform, whether you are placing bets on cricket and PSL, playing Live Casino tables, spinning slots, depositing in PKR or simply browsing the site.

By creating a 999y account or continuing to use the platform, you confirm that you have read and understood this Privacy Policy. It should be read alongside our Terms and Conditions and Responsible Gaming policy, all of which together govern the relationship between you and 999y.

If you have any questions about how your data is handled at any point, you can reach out to 999y support — contact details are in Section 13 of this policy.

2. Data We Collect

999y collects personal information in three main ways: information you provide directly, information generated through your use of the platform, and information from third-party services like payment providers.

We do not collect your physical address unless it is required for a specific verification step. We do not collect payment card numbers directly — card processing, where applicable, is handled by the payment processor.

3. How We Use Your Data

Every piece of data 999y holds about you has a specific, legitimate purpose. We do not collect data speculatively. The primary purposes are:

• Account Management: Creating and maintaining your 999y account, enabling login, managing your balance in PKR and processing deposits and withdrawals via JazzCash, Easypaisa, Raast and bank transfer.
• Identity Verification: Confirming that you are who you say you are, that you are aged 18 or older, and that your account is used only by you. This protects both you and the integrity of the platform.
• Platform Delivery: Enabling you to place sports bets on cricket, PSL, T20 and other markets, play casino games, live casino tables, slots and fish games — and recording those sessions accurately.
• Bonus & Promotions: Tracking wagering activity to correctly apply and manage bonus offers, cashback through the VIP programme and any time-limited PSL or cricket promotions.
• Fraud Prevention & Security: Monitoring for suspicious activity, multiple accounts, bonus abuse, unauthorised access attempts and other conduct that could harm the platform or other players.
• Customer Support: Using your account and communication history to resolve queries, investigate complaints and improve the support experience.
• Responsible Gaming: Identifying patterns that may indicate a player is experiencing difficulties with their gaming habits, and enabling self-assessment and limit-setting features.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve site performance, fix bugs and develop new features — your individual data is not used for this in an identifiable form.
• Marketing Communications (opt-in only): Sending promotional offers, bonus announcements and platform updates to players who have explicitly opted in. You can withdraw consent at any time.

4. Legal Basis for Processing

999y processes your personal data on the following legal grounds:

• Contract Performance: Processing necessary to provide you with the 999y account and platform services you signed up for — account management, transactions, game delivery and support.
• Legal Obligations: Processing required to comply with applicable obligations, including identity verification (KYC), anti-money laundering checks and record-keeping requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring and improving services — where these interests do not override your rights.
• Consent: Processing for optional purposes such as marketing emails and push notifications, where you have given explicit consent. You may withdraw consent at any time without affecting your use of the platform.

5. Data Sharing and Third Parties

999y does not sell your personal data. We share it only in the following limited circumstances, and only to the extent necessary for the specific purpose:

• Payment Processors: When you make a deposit or withdrawal via JazzCash, Easypaisa, Raast or bank transfer, the relevant payment provider receives the transaction data necessary to process that payment. These providers operate under their own privacy policies and security standards.
• Identity Verification Services: Third-party KYC service providers may process your identity documents to assist with verification. They are bound by strict data processing agreements and may not use your data for any other purpose.
• Game Providers: Some games on the 999y platform are delivered by third-party game studios or live casino providers. These providers may receive your session identifier and game activity data to deliver the game. They do not receive your full personal profile.
• Technology and Infrastructure: Hosting providers, cloud infrastructure and security services that support the operation of 999y may process data as part of delivering those services. All such providers are contractually bound to handle data securely and only for agreed purposes.
• Legal and Regulatory Requirements: If required by applicable law or in response to a legitimate legal request, 999y may disclose personal data to relevant authorities. We will only do so to the extent legally required.
• Business Transfers: In the event of a merger, acquisition or sale of assets, personal data held by 999y may be transferred as part of that transaction. Affected players would be notified in advance.

All third parties with whom 999y shares data are required to maintain appropriate security standards and to use your data only for the specific, agreed purpose. We do not permit third parties to use your data for their own marketing or profiling.

6. Payments and KYC Data

Because 999y handles real-money transactions in PKR, financial data and identity verification records are subject to specific handling requirements beyond standard personal data.

• Payment Method Data: 999y records the type of payment method used (e.g., JazzCash wallet, Easypaisa mobile account, Raast transfer, bank account), the transaction amount in PKR and the transaction reference. We do not store full JazzCash or Easypaisa account credentials, nor full bank account numbers, on our systems.
• KYC Documents: Identity documents submitted for verification — such as CNIC copies — are stored securely in encrypted form. Access is restricted to authorised personnel involved in the verification process. Documents are retained for the period required to meet our obligations, as described in Section 8.
• Transaction History: A complete record of your PKR deposits, withdrawals and any reversals is maintained within your account. You can view this history at any time from within the platform.
• Anti-Money Laundering (AML): As part of standard AML practice, 999y monitors transaction patterns. Where activity requires enhanced review, additional information may be requested. This is a legal obligation, not optional.

7. Cookies and Tracking Technologies

999y uses cookies and similar technologies to make the platform function correctly and to improve your experience. Here is a plain breakdown of what we use and why:

• Essential Cookies: These are required for the platform to work at all — they maintain your login session, remember your preferences within a session and keep your account secure. You cannot opt out of essential cookies while using the platform.
• Functional Cookies: These remember settings you have chosen — such as preferred language or display preferences — so you do not have to reset them each visit.
• Analytics Cookies: Anonymised and aggregated usage data helps us understand which parts of the platform are performing well and where improvements are needed. This data does not identify you personally.
• No Advertising Cookies: 999y does not use third-party advertising networks or retargeting cookies. You will not be tracked across the web for advertising purposes based on your 999y activity.

You can manage or clear cookies through your browser settings at any time. Note that disabling essential cookies will prevent you from logging into your 999y account.

8. Data Retention

999y retains your personal data only for as long as it is needed for the purposes it was collected, or as required by applicable obligations. The general retention schedule is as follows:

• Active Account Data: Retained for the duration of your active 999y account plus a minimum period after account closure to meet record-keeping requirements.
• KYC and Identity Documents: Retained for the period required following account closure or last transaction, in line with standard financial record-keeping practice.
• Transaction Records: PKR deposit and withdrawal records are retained for a minimum of five years following the transaction date.
• Support Communications: Support tickets and chat logs are retained for up to two years from the date of the last interaction, or longer where an ongoing matter requires it.
• Marketing Opt-in Records: Records of your consent (or withdrawal of consent) for marketing communications are retained for the life of the account to demonstrate compliance.

After retention periods expire, data is securely deleted or anonymised. Anonymised data — which cannot be linked back to you — may be retained indefinitely for aggregated analytics purposes.

9. Data Security

Keeping your data safe is one of 999y's core operational responsibilities. The security measures we have in place include:

• Encryption in Transit: All communication between your device and the 999y platform is encrypted using TLS (Transport Layer Security). This covers your login, deposits, withdrawals and all account activity.
• Encrypted Storage: Sensitive data — including identity documents and financial records — is stored in encrypted form on secure infrastructure with restricted access controls.
• Password Hashing: Your account password is never stored in readable form. It is processed using a one-way cryptographic hash, meaning that even 999y personnel cannot retrieve your password.
• Access Controls: Access to personal data within 999y's internal systems is restricted on a need-to-know basis. Staff access is logged and audited.
• Fraud Monitoring: Automated systems monitor for suspicious login attempts, unusual transaction patterns and other signals of account compromise or fraudulent activity.
• Incident Response: In the event of a data security incident that affects your personal data, 999y will assess the incident promptly and notify affected players if required.

10. Your Rights Over Your Data

You have meaningful rights over the personal data that 999y holds about you. Here is what you can ask for and how:

To exercise any of these rights, contact 999y support using the email address in the footer. We aim to respond to all data rights requests within 30 days. Some requests may take longer for complex cases — we will keep you informed throughout.

Please note that certain rights are subject to limitations where retention is required by applicable obligations — for example, we cannot delete KYC records within the mandatory retention period. Where a limitation applies, we will explain the reason clearly.

11. Children and Underage Users

999y is strictly an adult platform. The minimum age to register and use any part of the 999y platform is 18 years. We do not knowingly collect personal data from anyone under the age of 18.

If you are a parent or guardian and believe that a minor has registered a 999y account or provided personal data to the platform, please contact support immediately. Any account confirmed as belonging to a person under 18 will be closed, any balance will be reviewed in line with our Terms and Conditions, and all associated data will be handled in accordance with our obligations.

Age verification is part of the KYC process. Players who cannot confirm they meet the minimum age requirement will not have their account approved for real-money play.

12. Changes to This Privacy Policy

999y may update this Privacy Policy from time to time to reflect changes in how we operate, changes in the services we offer or changes in applicable requirements. When we make material changes, we will notify registered players by email or through a notice displayed upon login, with reasonable advance notice before the updated policy takes effect.

The "Last updated" date at the top of this page always reflects the date of the most recent revision. We recommend reviewing the Privacy Policy periodically so you stay informed about how your data is being handled.

Continued use of the 999y platform after an updated Privacy Policy takes effect constitutes acceptance of the revised terms. If you disagree with any changes, you should stop using the platform and contact support to arrange account closure.

13. Contact and Data Enquiries

If you have any questions, concerns or requests relating to this Privacy Policy or the way 999y handles your personal data, the support team is here to help. You can reach us using the contact details shown in the footer of this page.

When submitting a data-related request, please include your registered mobile number or username so we can locate your account quickly and respond accurately. All privacy-related enquiries are treated with priority and handled confidentially.

For questions about responsible gaming, self-exclusion or account limits, visit the Responsible Gaming page or mention it in your support message. For general platform rules, see the Terms and Conditions.