Privacy Policy –
How 999y Protects Your Data in Pakistan

1 Who We Are

999y operates the online gaming and sports betting platform available at 999y.fun and through the 999y mobile app. In this Privacy Policy, references to "999y", "we", "us", or "our" all refer to the 999y platform and the team responsible for managing it.

We act as the data controller for the personal information collected through registration, account management, deposits, withdrawals, and general platform use. This means we decide how and why your data is processed, and we are responsible for keeping it secure.

If you have any questions about your data or this policy, you can reach our team at [email protected]. We aim to respond to all privacy-related queries within five working days.

2 What Data We Collect

We collect personal data in several ways — directly from you when you register or contact us, automatically when you use the platform, and in some cases from third-party identity verification providers. The categories of data we collect include:

We do not collect sensitive categories of personal data such as religious beliefs, political opinions, or medical history. The data we do collect is limited to what is genuinely necessary to operate your account and maintain platform security.

3 How We Use Your Data

Your personal data is used for the following purposes:

• Account management. Creating and maintaining your 999y account, verifying your identity, and managing login authentication.
• Processing transactions. Handling PKR deposits via JazzCash, Easypaisa, Raast, and bank transfer, and processing withdrawal requests to your registered payment method.
• Customer support. Responding to your queries, resolving disputes, and processing complaints.
• Platform security. Detecting and preventing fraud, identifying multiple account abuse, and protecting the integrity of games and betting markets — including cricket, PSL, and football markets.
• Responsible Gaming. Monitoring betting patterns to identify signs of problem gambling. Where necessary, and in line with our Responsible Gaming commitments, we may proactively restrict an account or make contact regarding support resources.
• Communications. Sending you account notifications, transaction confirmations, and — where you have opted in — promotional offers, bonus alerts, and cricket betting market updates.
• Legal compliance. Meeting anti-money laundering (AML) obligations, maintaining required transaction records, and responding to lawful requests from competent authorities.
• Platform improvement. Analysing aggregated, anonymised usage data to improve game offerings, payment processing speed, and overall platform performance.

4 Legal Basis for Processing

We process your personal data under one or more of the following lawful bases:

• Contractual necessity. Processing required to fulfil the agreement between you and 999y — including account creation, processing deposits and withdrawals, and providing access to games and betting markets.
• Legal obligation. Processing required to comply with applicable legal requirements, including AML obligations, fraud prevention mandates, and record-keeping requirements.
• Legitimate interests. Processing carried out for 999y's legitimate business interests — including security monitoring, fraud detection, and platform analytics — provided those interests are not overridden by your rights.
• Consent. Where you have given clear, specific consent — for example, by opting in to receive promotional communications. You may withdraw consent at any time by contacting support or updating your notification preferences in your account settings.

5 Data Sharing

999y does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors. JazzCash, Easypaisa, Raast, and our bank transfer partners receive transaction reference data as required to complete deposits and withdrawals. These providers operate under their own privacy policies and are not permitted to use your data for any purpose beyond processing the transaction.
• Identity verification providers. Third-party KYC service providers may receive copies of identity documents (such as your CNIC) to complete mandatory verification checks. These providers are contractually bound to handle your data securely and use it only for the purpose of identity verification.
• Game software providers. Providers such as Pragmatic Play, PG Soft, Evolution, and others receive anonymised session data required to deliver their games on the 999y platform. These providers do not receive your name, contact details, or payment information.
• Fraud prevention and security partners. Where we suspect fraudulent activity or security breaches, we may share relevant technical data (such as IP addresses and device fingerprints) with specialist security partners to investigate and resolve the issue.
• Legal and regulatory authorities. Where required by applicable law, court order, or lawful request from a competent authority, we may disclose personal data without prior notice to you.

All third parties with whom we share personal data are required to maintain appropriate security standards and to use that data only for the specific purpose for which it was shared.

6 Payment Data

When you make a deposit or request a withdrawal using JazzCash, Easypaisa, Raast, bank transfer, or a debit card, your payment details are handled with particular care:

• Full card numbers and mobile wallet PINs are never stored on 999y's servers. Payments are processed via secure, PCI-DSS-compliant third-party payment gateways.
• 999y retains a transaction reference, the payment method type, the PKR amount, and the timestamp of each transaction for account management and AML compliance purposes.
• All payment data transmitted between your device and our payment processors is protected by TLS encryption.
• You must only use payment accounts registered in your own name. Using another person's JazzCash, Easypaisa, or bank account to fund your 999y account is a violation of our Terms and Conditions and may result in account closure and reporting to relevant authorities.

7 Cookies & Tracking

999y uses cookies and similar tracking technologies to keep the platform running smoothly and to understand how players use it. Here is a breakdown of the types of cookies we use:

• Essential cookies. These are required for core platform functions — keeping you logged in during a session, remembering your language preference, and maintaining the security of your account. These cookies cannot be disabled without breaking core platform features.
• Performance cookies. These collect anonymised data on how players navigate the platform — which pages are visited most, where errors occur, and how long sessions last. This data is used in aggregate to improve platform speed and usability.
• Functional cookies. These remember your preferences, such as your preferred deposit method or notification settings, so you do not have to re-enter them every time.
• Analytics cookies. We use privacy-respecting analytics tools to understand overall usage trends. Individual user data is anonymised before analysis.

You can manage cookie preferences through your browser settings at any time. Disabling essential cookies may affect your ability to log in and use core platform features. For detailed instructions on managing cookies in your specific browser or mobile device, refer to your browser's help documentation.

8 Data Retention

We retain your personal data for as long as your account is active and for a defined period after closure, as required for legal and compliance purposes. Specific retention periods are as follows:

• Active account data. Retained for the full duration of your account's active status.
• Transaction records. Retained for a minimum of five years following the transaction date, in line with standard AML record-keeping practice.
• Identity verification documents. Retained for up to five years following account closure or the completion of the verification process, whichever is later.
• Support communications. Retained for three years from the date of the last communication, to allow for dispute resolution and quality review.
• Technical and session logs. Retained for up to 12 months for security monitoring purposes, then deleted or anonymised.

When data is no longer required for any of the above purposes, it is securely deleted or anonymised so that it can no longer be linked back to you as an individual.

9 Your Rights

As a 999y account holder, you have the following rights in relation to your personal data:

• Right of access. You can request a copy of the personal data we hold about you at any time. We will respond within 14 working days.
• Right to rectification. If any of the data we hold is inaccurate or out of date, you can ask us to correct it. Some changes — such as updating your registered name — may require supporting documentation.
• Right to erasure. You can request deletion of your personal data, subject to legal retention obligations. We cannot delete transaction records that we are legally required to retain, but we can anonymise data where deletion is not possible.
• Right to restrict processing. You can ask us to restrict how we use your data in certain circumstances — for example, while a dispute is being investigated.
• Right to object. You can object to processing based on legitimate interests or for direct marketing purposes. If you object to marketing, we will stop sending promotional communications immediately.
• Right to withdraw consent. Where processing is based on your consent — such as receiving promotional emails — you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact our support team at [email protected]. Please include your registered name and account details to help us locate your data promptly. All requests are handled confidentially.

10 Children's Privacy

999y is strictly an adult platform. Users must be at least 18 years of age to register. We do not knowingly collect personal data from anyone under the age of 18.

If we become aware that personal data has been collected from a minor, that data will be deleted immediately and the associated account will be closed. If you believe a minor has registered on the platform, please contact support at [email protected] with details so we can investigate and take immediate action.

Parents and guardians are encouraged to use device parental controls and internet filtering tools to prevent underage access to online gaming platforms. For further guidance, visit our Responsible Gaming page.

11 Security Measures

Protecting your personal data is a core operational priority at 999y. We apply the following technical and organisational security measures:

• Encryption. All data transmitted between your device and 999y servers is encrypted using TLS. Stored personal data and payment references are encrypted at rest.
• Access controls. Access to personal data within 999y is restricted on a strict need-to-know basis. Staff members do not have blanket access to player data — access is role-specific and logged.
• Two-factor authentication. Players are encouraged to enable two-factor authentication (2FA) on their accounts for an additional layer of login security.
• Fraud monitoring. Automated systems monitor account activity for anomalies that may indicate unauthorised access or fraudulent behaviour, triggering alerts for manual review where necessary.
• Regular reviews. Our security practices are reviewed and updated regularly to address evolving threats and vulnerabilities.

While we take all reasonable precautions, no online platform can guarantee absolute security. You also have a responsibility to protect your account by using a strong, unique password and not sharing your credentials with anyone.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in how we operate, changes to applicable legal requirements, or improvements to our data practices. When we make changes, the "Last Updated" date at the top of this page will be revised.

For significant changes that affect your rights or how we use your data in a meaningful way, we will notify registered players via their account notification centre or registered contact details before the changes take effect. Minor clarifications or formatting updates may be made without prior notice.

We encourage you to review this policy periodically. Continued use of the 999y platform after any changes have been published constitutes acceptance of the updated Privacy Policy.

13 Contact & Complaints

If you have questions, concerns, or a complaint about how 999y handles your personal data, please get in touch with our support team:

We take all privacy complaints seriously and aim to resolve them within 14 working days. If you feel your concern has not been adequately addressed after contacting us, you retain the right to escalate the matter through appropriate channels available to you under applicable law.

For issues related to your account's security settings, data preferences, or notification opt-outs, many options can be managed directly within your account dashboard without needing to contact support.