999y Privacy Policy

1. Introduction

This Privacy Policy describes how 999y ("we", "us", "our") collects, uses, stores, shares, and protects the personal data of users ("you", "your") who access or register on the 999y online casino and sports betting platform, accessible at https://999y.bio.

999y is committed to protecting your privacy and handling your personal data with care, transparency, and respect. This Privacy Policy applies to all personal data processed by 999y in connection with the platform, including data collected via the website, mobile browser, customer support interactions, and payment processing channels.

By registering an account on 999y or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Privacy Policy should be read in conjunction with the 999y Terms & Conditions.

2. Data Controller

For the purposes of applicable data protection legislation, 999y acts as the data controller in respect of all personal data collected from players and website visitors. As data controller, 999y determines the purposes and means by which personal data is processed.

999y operates under an international gaming licence. All data processing activities are conducted in accordance with the conditions of that licence and applicable data protection frameworks. If you have any questions regarding our role as data controller, please contact us at [email protected].

3. Personal Data We Collect

999y collects personal data across several categories depending on how you interact with the platform. The categories of data we collect are set out below.

3.1 Registration and Identity Data

• Full legal name as it appears on your Pakistani National Identity Card (CNIC) or passport.
• Date of birth (used for age verification — you must be 21 or older to use 999y).
• Residential address, including city (e.g., Karachi, Lahore, Islamabad, Faisalabad) and postal code.
• Email address and mobile number used for account creation and communication.
• Username and encrypted password (passwords are never stored in plain text).

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (CNIC, passport, or driving licence).
• Proof of residential address (utility bill, bank statement, or similar document).
• Proof of payment method ownership where required to process withdrawals.

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers.
• Mobile wallet identifiers (e.g., JazzCash or EasyPaisa account numbers — not full credentials).
• Bank account identifiers for HBL, UBL, Meezan Bank, and other supported Pakistani banks.
• Transaction history and balance records on your 999y account.

3.4 Technical and Usage Data

• IP address and approximate geographic location at time of access.
• Device type, browser type and version, operating system.
• Pages visited, features used, session duration, and click-path data.
• Login timestamps and session identifiers.

3.5 Communications Data

• Records of communications between you and 999y's customer support team, including chat transcripts and email correspondence.
• Feedback, survey responses, and complaint records where submitted voluntarily.

4. How We Collect Your Data

999y collects personal data through the following means:

• Direct collection: Data you actively provide during registration, KYC verification, deposit or withdrawal requests, contact form submissions, or when communicating with our support team.
• Automated collection: Technical data such as IP addresses, session identifiers, and device information collected automatically when you access the 999y website via standard web server logs and session management systems.
• Cookies and similar technologies: Session cookies and performance cookies placed on your device when you browse 999y. See Section 10 for full details on our cookie usage.
• Third-party verification services: Identity verification providers and payment processors may share data with 999y as part of the KYC and payment processing workflow. Such sharing is governed by contractual agreements that bind these providers to equivalent data protection standards.
• Responsible gaming tools: Where you interact with deposit limit settings, self-exclusion tools, or cooling-off period controls, records of those interactions are retained to ensure continued enforcement of your elected restrictions.

5. How We Use Your Personal Data

999y uses the personal data it collects for the following purposes:

1. Account management: Creating, maintaining, and securing your 999y player account.
2. Identity and age verification: Confirming that you are aged 21 or above and are the legitimate owner of the account and associated payment methods.
3. Payment processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and other supported Pakistani payment channels.
4. Legal and regulatory compliance: Meeting our obligations under anti-money laundering (AML) regulations, our international gaming licence conditions, and any directions from licensing authorities or law enforcement agencies.
5. Fraud prevention and security: Detecting and preventing fraudulent activity, multiple account abuse, bonus exploitation, and unauthorised access attempts.
6. Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviours, enforcing player-elected deposit limits and self-exclusion decisions, and providing access to responsible gaming resources.
7. Customer support: Responding to your enquiries, resolving disputes, and processing account-related requests.
8. Platform improvement: Analysing aggregated, anonymised usage data to improve platform features, game offerings, and user experience.
9. Marketing communications: Sending you information about promotions, new games, and platform updates — only where you have given explicit consent to receive such communications and only via channels you have opted into.

6. Legal Basis for Processing

999y processes your personal data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing that is required to fulfil our contractual obligations to you as a registered player, including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws and our gaming licence conditions, including KYC verification, AML monitoring, and regulatory reporting.
• Legitimate interests: Processing necessary for 999y's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your explicit consent, including marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

999y does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own commercial purposes. We may share your personal data with the following categories of recipients only where strictly necessary and subject to appropriate contractual safeguards:

• Payment processors: JazzCash, EasyPaisa, Raast, and partnered Pakistani banks receive transaction data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers receive identity documents to perform age and identity verification on our behalf.
• Fraud prevention services: Risk management platforms receive technical data (such as IP addresses and device fingerprints) to assist with fraud detection.
• Gaming licence authorities: Our licensing authority may require access to certain player records as part of regulatory audits or investigations.
• Law enforcement and government bodies: Where we are legally required to disclose data in response to a court order, regulatory directive, or law enforcement request.
• Technology service providers: Platform hosting, database management, and cybersecurity providers who process data on our behalf under strict data processing agreements that prohibit further disclosure or independent use.

8. Data Retention

999y retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and our gaming licence conditions. The following general retention periods apply:

• Active account data: Retained for the duration of your active registration on 999y.
• Account closure data: Following account closure, identity, transaction, and KYC records are retained for a minimum of five (5) years in accordance with standard anti-money laundering compliance requirements under our gaming licence.
• Customer support records: Retained for a minimum of three (3) years following the resolution of the relevant enquiry or dispute.
• Technical and log data: Server logs and session records are retained for a maximum of twelve (12) months from the date of collection, after which they are deleted or anonymised.
• Marketing consent records: Retained for as long as you remain opted in, plus a reasonable period following opt-out to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data may be retained indefinitely for analytical and platform improvement purposes as it no longer constitutes personal data.

9. Data Security Measures

999y implements a comprehensive suite of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the 999y platform.
• Password hashing using industry-standard cryptographic algorithms — your password is never stored in recoverable form.
• Payment data tokenisation — full payment credentials are never stored on 999y servers; only tokenised references are retained.
• Access controls restricting internal access to personal data on a strict need-to-know basis, with all access logged and auditable.
• Regular security audits and vulnerability assessments conducted on the 999y platform infrastructure.
• Incident response procedures for detecting, containing, and notifying affected users of data security incidents in a timely manner.

While 999y takes all reasonable precautions to protect your data, no method of electronic transmission or storage is completely infallible. You are responsible for keeping your account login credentials confidential and for notifying 999y immediately at [email protected] if you suspect any unauthorised use of your account.

10. Cookies and Similar Technologies

999y uses cookies and similar browser-based technologies to ensure the platform functions correctly and securely. The following categories of cookies are used on 999y:

999y does not use third-party advertising cookies, social media tracking pixels, or cross-site behavioural targeting technologies. You may manage or delete cookies via your browser settings at any time. Please note that disabling essential cookies will affect your ability to log in and use the 999y platform.

11. Your Data Protection Rights

Subject to applicable law and the conditions of our gaming licence, you have the following rights with respect to your personal data held by 999y:

• Right of access: You may request a copy of the personal data 999y holds about you, along with information about how it is processed.
• Right of rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right of erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations under gaming licence and AML regulations.
• Right to restrict processing: You may request that 999y restricts processing of your data in certain circumstances, for example while a dispute is being resolved.
• Right to data portability: Where processing is based on your consent or a contractual relationship, you may request that your data be provided to you in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You may object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing, processing for that purpose will cease immediately.

12. Protection of Minors

999y strictly prohibits use of its platform by any person under the age of 21. The platform is designed exclusively for adult users. We do not knowingly collect personal data from individuals under the age of 21.

If we become aware that personal data has been collected from a person under 21, we will immediately suspend the relevant account, delete the associated data, and return any deposits to the verified payment method. Age verification is enforced at the point of registration and may be repeated at any stage of the account lifecycle.

13. International Data Transfers

As 999y operates under an international gaming licence, certain data processing activities — including those performed by our identity verification providers, hosting infrastructure, and security services — may involve the transfer of personal data to servers or processors located outside Pakistan.

Where such transfers occur, 999y ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applied within Pakistan. These safeguards may include contractual data processing agreements with binding data protection obligations, or transfers to service providers operating under recognised international data protection frameworks.

By registering on 999y and accepting this Privacy Policy, you acknowledge and consent to the potential transfer of your personal data to processors in other jurisdictions as described above, subject always to the protections set out in this policy.

14. Changes to This Privacy Policy

999y reserves the right to update or amend this Privacy Policy at any time. When material changes are made — such as changes to the categories of data collected, the purposes for which data is used, or the third parties with whom data is shared — we will publish the revised policy on this page with an updated effective date and will endeavour to notify registered players via the email address associated with their account.

Your continued use of the 999y platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should contact us at [email protected] to close your account. We will process your request and return your verified Real Money Balance in accordance with the Terms & Conditions.

15. Contact and Data Requests

All enquiries related to this Privacy Policy, data access requests, rectification requests, deletion requests, or privacy complaints should be directed to the 999y privacy team through the following channel:

For concerns specifically related to responsible gaming, self-exclusion, or problem gambling support, please visit our dedicated Responsible Gaming page or contact the support team directly. Responsible gaming requests are treated as a priority and actioned as quickly as possible.