999r Privacy Policy – How We Handle Your Personal Data in Pakistan

This Privacy Policy is issued by 999r, the online gaming platform accessible at https://999r.click. When this policy refers to "999r", "we", "us", or "our", it means the operating entity behind the 999r platform. When it refers to "you" or "your player", it means any individual who registers an account on 999r or interacts with any part of our platform, website, or mobile application.

For the purposes of data protection, 999r acts as the data controller – meaning we are the party responsible for deciding how and why your personal data is collected and processed. We take that responsibility seriously. Our goal is to be transparent about every aspect of how data flows through our platform so that you can make informed choices about your information.

This policy covers all personal data collected through the 999r website, the 999r mobile application, customer support interactions, and any other touchpoint where you share information with us. It does not cover third-party websites that may be linked from our platform – though as a rule 999r does not include external links on its pages.

We only collect personal data that is necessary for us to provide and improve the 999r service, comply with legal obligations, and keep the platform safe for all players. The table below summarises the categories of data we collect and how we obtain them.

We do not collect sensitive personal data such as biometric data, health information, or religious beliefs. We do not collect full payment card numbers – card payment processing is handled by our PCI-DSS compliant payment gateway providers and 999r never holds your full card details.

Every piece of data we collect is used for a specific, documented purpose. We do not use your data in ways that go beyond what is described in this policy without first obtaining your consent. The main purposes for which 999r processes your personal data are:

• Account creation and management: We use your registration data to create and maintain your 999r account, verify your identity, and provide you access to the platform's features.
• Processing transactions: We use your financial data to process PKR deposits and withdrawals accurately and to maintain a complete transaction history in your account.
• Platform delivery and improvement: We use device and usage data to ensure the 999r platform performs correctly on your device, to diagnose technical problems, and to identify areas for improvement based on how players actually use the platform.
• Customer support: We use your contact and communication data to respond to your queries, resolve disputes, and improve our support processes.
• Legal and regulatory compliance: We use identity and financial data to comply with anti-money laundering (AML) and know-your-customer (KYC) obligations. This includes verifying player identity before processing large withdrawals and monitoring account activity for suspicious patterns.
• Responsible gaming: We use account and gameplay data to monitor for signs of problem gambling behaviour and, where appropriate, to contact players with information about responsible gaming tools available on 999r.
• Security: We use device and usage data to detect and prevent fraud, unauthorised account access, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions.
• Marketing communications (with consent only): Where you have opted in, we use your contact data to send you information about 999r promotions, new games, and relevant offers. You can withdraw marketing consent at any time.

Because 999r operates exclusively in Pakistani Rupees and integrates directly with local payment services, we want to be especially clear about how payment-related data is handled.

When you make a deposit or request a withdrawal via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank transfer, or Visa/Mastercard, the following applies:

• Your full payment credentials – such as your Easypaisa PIN, JazzCash login, or full card number – are never transmitted to or stored by 999r. These are handled entirely within the respective payment provider's secure environment.
• 999r receives only a transaction reference number, the transaction amount in PKR, the payment method type, and a success or failure status. This is sufficient for us to credit your account and maintain your transaction history.
• Transaction data is retained as required to comply with financial record-keeping obligations and to support dispute resolution. See Section 7 for data retention periods.
• Where you have requested a withdrawal, 999r verifies that the destination payment method is registered in your own name before processing. This protects you from unauthorised withdrawals and complies with AML obligations.

999r does not sell your personal data to any third party. We never have and we never will. However, running a gaming platform requires working with a limited set of trusted partners, and some sharing of data with those partners is unavoidable. Every third party that receives data about 999r players is contractually required to protect that data and use it only for the specific purpose for which it was shared.

The categories of third parties that may receive your data are:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and card processing networks. They receive the minimum data necessary to process your PKR transaction. Each operates under their own privacy policy and applicable Pakistani financial regulation.
• Identity verification services: Third-party KYC providers that assist 999r in verifying player identity for AML compliance purposes. These providers operate under strict data security standards.
• Game content providers: Live casino studio operators and virtual sports providers whose games are featured on 999r. These providers may receive anonymised session data necessary to deliver the game stream or virtual event. They do not receive your name, mobile number, or payment data.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and analytics services that support the technical operation of 999r. These providers act as data processors under our instruction and are bound by strict data processing agreements.
• Legal and regulatory authorities: Where required by law, court order, or regulatory request, 999r may disclose player data to relevant Pakistani authorities. This includes disclosures required under AML legislation. Where permitted, we will notify you of any such disclosure.

We do not share your personal data with any advertising networks, social media platforms, or data brokers. Your 999r account activity is not used to build advertising profiles or shared for marketing purposes by any third party.

999r uses cookies and similar technologies on our website and mobile platform. Cookies are small text files stored on your device that help us deliver a better, more personalised experience. Here is exactly what we use and why.

You can manage preference and analytics cookies through your browser settings or the 999r cookie preference tool available in your account settings. Essential and security cookies cannot be disabled. Blocking these will affect platform functionality.

We do not keep your personal data indefinitely. Retention periods are set based on the purpose for which data was collected and any applicable legal obligations. Here is a summary of our key retention periods:

• Active account data (identity, contact, account, financial): Retained for the lifetime of your 999r account plus a minimum of five years after account closure, as required by financial services record-keeping standards.
• Bet and transaction history: Retained for a minimum of five years from the date of each transaction to support dispute resolution and regulatory compliance.
• KYC verification documents: Retained for five years from submission or from the date of account closure, whichever is later.
• Support communications: Live chat transcripts and email correspondence are retained for two years after the date of the interaction.
• Device and usage logs: Retained for 12 months from the date of collection, then aggregated and anonymised for longer-term analytics.
• Marketing preferences: Retained until you withdraw consent, at which point marketing data is deleted within 30 days.

When a retention period expires, data is securely deleted or permanently anonymised so that it can no longer be associated with any individual player.

Data security is not an afterthought at 999r – it is built into the platform from the ground up. The following technical and organisational measures are in place to protect your personal information:

• TLS/SSL encryption: All data transmitted between your device and the 999r platform is encrypted using industry-standard TLS 1.2 or higher. The padlock icon in your browser confirms this connection is active at all times on 999r.
• Encrypted data at rest: Sensitive data stored in 999r databases – including identity documents and financial records – is encrypted using AES-256 encryption. Even in the unlikely event of a server compromise, this data would be unreadable without the decryption keys, which are stored separately.
• Access controls: Player personal data is accessible only to 999r staff members who need it to perform their specific job function. Access is logged and audited. No staff member has blanket access to all player data.
• Regular security audits: 999r engages independent third-party cybersecurity firms to conduct penetration testing and security audits on a regular basis. Any vulnerabilities identified are remediated before they can be exploited.
• Two-factor authentication: Available to all 999r players for their account login. We strongly encourage all Pakistani players to enable two-factor authentication as an additional layer of account protection.
• Incident response: 999r maintains a documented data breach response plan. In the event of a security incident that compromises player data, affected players will be notified promptly with details of what happened and what steps are being taken.

You have a number of rights regarding your personal data held by 999r. We have built straightforward processes for exercising each of these rights and aim to respond to all requests within 30 days.

To exercise any of these rights, contact 999r at support@999r.click with the subject line "Data Rights Request". Include your registered mobile number and a description of your request. We will verify your identity before processing the request and respond within 30 days.

999r is an adult gaming platform. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. Account registration requires players to confirm they are at least 18 years old, and 999r operates age verification checks as part of its KYC processes.

If we become aware that a person under 18 has registered an account or that personal data of a minor has been collected, we will immediately close the account, void any associated balances, and permanently delete the minor's personal data from our systems.

If you are a parent or guardian and believe your child may have registered on 999r, please contact us immediately at support@999r.click. We will investigate and act without delay.

999r may send you promotional communications about new games, bonuses, special events, and platform updates. These communications are sent only when you have actively opted in to receive them – either during registration or subsequently through your account notification preferences.

Marketing communications from 999r are delivered via SMS to your registered mobile number and, where provided, via email. We do not make marketing calls. We do not share your contact details with any third-party marketers.

You can opt out of all marketing communications at any time by:

• Updating your notification preferences in the 999r account settings panel.
• Replying "STOP" to any marketing SMS from 999r.
• Contacting our support team via live chat and requesting removal from marketing lists.

Opting out of marketing does not affect service communications – you will still receive important notifications about your account, transactions, security alerts, and responsible gaming messages regardless of your marketing preference.

999r may update this Privacy Policy from time to time as our platform evolves, as data protection best practices change, or as applicable laws and regulations require. The "Last Updated" date at the top of this document indicates when the current version was published.

Where changes are material – for example, if we begin processing your data for a new purpose or sharing it with a new category of third party – we will notify you by SMS or in-platform notification at least 14 days before the change takes effect. This gives you time to review the updated policy and, if you disagree, to close your account and request deletion of your data before the new terms apply.

For minor clarifications and corrections that do not change how your data is actually used, we may update the policy without prior notification. The current version is always available at https://999r.click/privacy-policy.

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how 999r has handled your personal information, please reach out to us. We treat all privacy queries seriously and aim to resolve them as quickly as possible.

• Email: support@999r.click – use the subject line "Privacy Query" or "Data Rights Request" for faster routing.
• Live Chat: Available 24/7 through the 999r platform. Best for urgent matters or quick clarifications.
• Response Time: We acknowledge all privacy queries within 48 hours and aim to provide a full response within 30 days. For straightforward requests such as opting out of marketing or updating contact details, we typically respond within 24 hours.

We communicate about privacy matters in both English and Urdu. If you are more comfortable in Urdu, please say so in your message and we will respond accordingly.