Privacy Policy
How 999d Protects Your Data

1.1  999d collects personal data that you provide directly, data generated automatically through your use of the platform, and data obtained from authorised third parties for verification and fraud prevention purposes. The categories of personal data we collect include:

1.2  999d does not collect sensitive personal data such as health information, religious beliefs, or political opinions unless you voluntarily disclose such information in the context of a responsible gaming self-assessment or support communication. Any such information is handled with enhanced confidentiality and is not used for marketing purposes.

2.1  999d collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when registering an account on 999d, completing KYC verification, submitting a deposit or withdrawal request, contacting 999d support, or participating in promotional surveys or competitions.
• Automated Collection: Data generated automatically through your interaction with the 999d platform, including log data, IP addresses, device identifiers, cookies, session recordings, and game activity metadata.
• Third-Party Verification Partners: Data received from identity verification service providers, credit reference agencies, and fraud prevention databases in connection with KYC checks and AML screening.
• Payment Processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, Mastercard, and cryptocurrency payment gateways in connection with deposit and withdrawal processing.
• Game Providers: Gameplay data received from 999d's licensed game studio partners, including game round results, RTP statistics, and session metadata required for dispute resolution.

2.2  999d does not purchase personal data from data brokers or any other commercial data aggregators for the purpose of targeting, profiling, or marketing to players.

3.1  999d processes personal data only for lawful, specified, and legitimate purposes. The specific purposes for which we use your personal data are set out below, together with the legal basis for each processing activity:

• Account Registration & Management: To create and maintain your 999d account, verify your eligibility, process login sessions, and administer account settings. (Basis: Contract)
• Age & Identity Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with our regulatory KYC obligations. (Basis: Legal Obligation)
• Payment Processing: To process PKR deposits via JazzCash, EasyPaisa, and bank transfers, and to process withdrawal requests to your verified payment method. (Basis: Contract)
• Anti-Money Laundering (AML) Compliance: To monitor transaction patterns, screen against sanctions lists, and report suspicious financial activity to relevant authorities as required by applicable AML regulations. (Basis: Legal Obligation)
• Responsible Gaming: To monitor gaming behaviour, enforce self-exclusion and deposit limits, identify players who may be experiencing problem gambling, and fulfil our responsible gaming obligations. (Basis: Legal Obligation / Legitimate Interest)
• Fraud Prevention & Platform Security: To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, collusion, and other prohibited conduct. (Basis: Legitimate Interest)
• Customer Support: To respond to your queries, resolve disputes, process complaints, and maintain records of support interactions for quality assurance. (Basis: Contract)
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates via email or SMS, where you have consented to receive such communications. (Basis: Consent — withdrawable at any time)
• Platform Improvement: To analyse usage patterns, measure game performance, and improve the overall 999d player experience. (Basis: Legitimate Interest)

3.2  999d will not use your personal data for any purpose that is incompatible with the purposes listed in this section without first obtaining your explicit consent.

4.1  999d does not sell, rent, trade, or otherwise commercially transfer your personal data to any third party. Data sharing is strictly limited to the following categories of recipients, all of whom are contractually bound to process your data only for the specified purpose and to apply equivalent data protection standards:

• Identity Verification & KYC Providers: Third-party providers engaged to conduct document verification, biometric matching, and sanctions screening as part of the mandatory KYC process.
• Payment Processing Partners: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, Mastercard, and cryptocurrency payment gateway providers, to facilitate deposit and withdrawal transactions.
• Licensed Game Studio Partners: Providers of casino games, live dealer tables, and sports betting software, who receive gaming session data necessary to operate their services.
• Fraud Prevention & Security Services: Specialist fraud detection and cybersecurity providers engaged to monitor for suspicious activity and protect the integrity of the 999d platform.
• Regulatory Authorities: Government bodies, licensing regulators, financial intelligence units, and law enforcement agencies, where disclosure is required by applicable law, court order, or regulatory demand.
• IT Infrastructure & Cloud Providers: Hosting, database, and cloud infrastructure providers who store and process data on behalf of 999d under strict data processing agreements.

4.2  In the event of a merger, acquisition, or sale of substantially all of 999d's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer via the registered email address prior to the transfer taking effect, and the acquiring entity will be required to honour the commitments made in this Policy.

5.1  999d uses cookies and similar technologies (local storage, session tokens, device fingerprinting) to enable platform functionality, maintain your login session, detect fraudulent activity, and analyse platform performance. The cookies used by 999d fall into the following categories:

• Strictly Necessary Cookies: Essential for the 999d platform to function correctly. These include session authentication tokens, CSRF protection cookies, and load balancing cookies. These cookies cannot be disabled without breaking platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data on how players interact with the 999d platform, which pages are visited most frequently, and where errors occur. This data helps us continuously improve platform performance and user experience.
• Fraud Detection Cookies: Used to identify and flag suspicious activity, including multiple account detection, bot traffic identification, and unusual login patterns.
• Preference Cookies: Used to remember your platform preferences, such as language settings, display preferences, and responsible gaming limits you have set.

5.2  999d does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the 999d platform. Players will not see 999d ads served to them on third-party websites based on their 999d gaming activity.

5.3  You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to log in and use the 999d platform. Disabling performance or preference cookies will not prevent access but may result in a degraded platform experience.

6.1  999d retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory, legal, or accounting obligations. The following retention periods apply as general guidelines:

• Account Data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification or the date of account closure, whichever is later, in accordance with anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Gaming History: Retained for a minimum of three (3) years from the date of the activity, for dispute resolution and responsible gaming monitoring purposes.
• Support & Communication Records: Retained for two (2) years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Technical & Log Data: Retained for ninety (90) days on rolling logs, with anonymised aggregated data retained for longer-term performance analysis.

6.2  Following the expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with 999d's data disposal procedures.

7.1  999d implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include but are not limited to:

• Encryption in Transit: All data transmitted between your device and 999d's servers is encrypted using TLS 1.3 with 256-bit AES encryption.
• Encryption at Rest: Sensitive data stored in 999d's databases, including financial information and identity documents, is encrypted at rest using AES-256.
• Password Security: Account passwords are hashed using bcrypt with a high work factor. 999d never stores plaintext passwords and cannot retrieve your password — only reset it.
• Two-Factor Authentication: 999d offers optional two-factor authentication via SMS OTP to all players. We strongly recommend enabling 2FA on your 999d account.
• Access Controls: Access to personal data within 999d is restricted on a strict need-to-know basis. All staff with access to personal data are trained in data protection obligations and subject to confidentiality agreements.
• Regular Security Audits: 999d engages independent cybersecurity specialists to conduct regular penetration testing and security audits of the platform infrastructure.
• Incident Response: 999d maintains a documented data breach response plan. In the event of a confirmed data breach affecting your personal information, you will be notified without undue delay in accordance with applicable regulatory requirements.

7.2  While 999d employs industry-standard security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own 999d account credentials and should notify 999d support immediately if you suspect unauthorised access to your account.

8.1  As a 999d player, you hold the following rights in respect of your personal data. To exercise any of these rights, contact 999d support via live chat or email. We aim to respond to all data rights requests within thirty (30) days.

• Right of Access: You have the right to request a copy of the personal data 999d holds about you, along with information about how it is processed.
• Right to Rectification: If any personal data 999d holds about you is inaccurate or incomplete, you have the right to request its correction. You can update most account information directly via Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request that 999d delete your personal data. This right is subject to 999d's legal obligations to retain certain data under AML and gaming regulations. Where erasure is not possible for legal reasons, 999d will explain why and detail what data must be retained.
• Right to Restrict Processing: You have the right to request that 999d restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is contested.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to 999d processing your personal data for direct marketing purposes. You also have the right to object to processing based on legitimate interests, though this is subject to 999d demonstrating compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where 999d processes your personal data based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time via Account Settings or by contacting support.

9.1  The 999d platform is strictly prohibited to individuals under the age of 21 years. 999d does not knowingly collect, process, or retain personal data from any person who is under 21 years of age.

9.2  999d implements age verification procedures as part of the mandatory KYC process. All players are required to provide valid government-issued identity documentation (CNIC) to verify their age prior to making a withdrawal or, at 999d's discretion, prior to account activation.

9.3  If 999d becomes aware that an individual under the age of 21 has registered an account on the platform or provided personal data to 999d, that account will be immediately suspended, all bets placed voided, and any deposits made returned to the source payment method. The personal data collected from the minor will be deleted without undue delay.

9.4  If you are a parent or guardian and believe that a minor has registered an account on 999d using your identity documents or payment methods, please contact 999d support immediately so that appropriate action can be taken.

10.1  999d operates as an international online gaming platform. Your personal data may be transferred to, stored at, or accessed from destinations outside of Pakistan, including data centres and cloud infrastructure located in jurisdictions where 999d's IT infrastructure and third-party service providers are based.

10.2  Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to that afforded under Pakistani law, 999d will implement appropriate safeguards to ensure that your data remains protected, including:

• Entering into Standard Contractual Clauses (SCCs) with third-party processors located outside Pakistan;
• Ensuring that data is only transferred to jurisdictions recognised as providing adequate data protection standards;
• Implementing technical security measures such as encryption, access controls, and secure data transmission protocols to protect data in transit and at rest.

10.3  By using the 999d platform, you acknowledge that your personal data may be transferred internationally as described in this section and consent to such transfers where they are necessary for the provision of the 999d gaming services.

If you have any questions, concerns, or complaints regarding this Privacy Policy, how 999d processes your personal data, or how to exercise your data protection rights, please contact us using the following channels:

• Live Chat: Available 24/7 from the 999d platform — fastest response channel for urgent privacy queries.
• Email: [email protected] (plain text, not clickable) — please include "Privacy Query" in the subject line for priority routing to our data protection team. We aim to respond within 24 hours.

999d is committed to resolving all privacy-related concerns fairly, promptly, and transparently. If you are not satisfied with 999d's response to your data protection query, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.