999cb Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") describes how 999cb ("the Platform", "we", "us", "our") collects, processes, stores, discloses and protects the personal data of individuals ("you", "Player", "User") who register for or use the services available at 999cb.app and any associated mobile interfaces or sub-domains (collectively, "the Services").

By registering a 999cb account, depositing funds or otherwise using the Services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use 999cb Services.

This Policy applies to all personal data collected through the 999cb platform regardless of the device or method used to access it, including desktop browsers, mobile browsers and any future 999cb applications. It should be read together with the 999cb Terms & Conditions and Responsible Gaming Policy.

2. Data Controller

For the purposes of applicable data protection legislation, 999cb is the data controller responsible for your personal data processed in connection with the Services. References to "999cb" throughout this Policy refer to the operating entity responsible for the 999cb.app platform and all associated services.

If you have any questions about how 999cb processes your personal data, or if you wish to exercise any of your data rights, you may contact us at the email address provided in Section 14 of this Policy.

3. Data We Collect

999cb collects personal data from Pakistani players and other users through several channels. The categories of data we collect are described in the table below.

3.1 Sensitive Data

999cb may collect CNIC details and facial photograph data for KYC purposes as required by our compliance obligations. This data is treated with the highest level of security and is processed solely for identity verification and anti-money laundering compliance. We do not process sensitive personal data for any other purpose without your explicit consent.

4. How We Use Your Data

999cb uses the personal data collected for the following purposes:

• Account Management: To register and maintain your 999cb account, verify your identity, process login requests and manage account security.
• Service Delivery: To provide access to casino games, sports betting markets, live casino, jackpots and all other 999cb Services.
• Payment Processing: To process PKR deposits via JazzCash, Easypaisa and other supported methods, and to process withdrawal requests to your verified payment accounts.
• Legal Compliance: To comply with anti-money laundering (AML), counter-terrorism financing (CTF), age verification and other applicable legal and regulatory obligations.
• Responsible Gaming: To monitor account activity for signs of problem gambling behaviour and to apply responsible gaming tools, limits and restrictions as set by you or as required by our responsible gaming obligations.
• Fraud Prevention: To detect, investigate and prevent fraudulent activity, bonus abuse, money laundering, collusion and any other activities prohibited under the 999cb Terms & Conditions.
• Customer Support: To respond to your queries, complaints and support requests, and to improve the quality of our support services.
• Marketing (Opt-In Only): To send you promotional offers, bonus notifications, game launch announcements and relevant 999cb news where you have given your explicit consent. You may opt out at any time.
• Platform Improvement: To analyse usage patterns, improve the 999cb platform, personalise your experience and develop new features and services.

5. Legal Bases for Processing

999cb processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and 999cb — including account management, game delivery and payment processing.
• Legal Obligation: Processing required to comply with applicable law — including AML, CTF, age verification and responsible gaming regulations.
• Legitimate Interests: Processing necessary for 999cb's legitimate business interests — including fraud detection, platform security, analytics and customer support — where these interests are not overridden by your rights.
• Consent: Processing based on your freely given, informed and specific consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting any prior processing.

6. Cookies & Tracking Technologies

The 999cb platform uses cookies and similar tracking technologies to operate, secure and improve the Services. The categories of cookies used by 999cb are as follows:

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your login state and security tokens. These cannot be disabled.
• Functional Cookies: Enable enhanced functionality such as remembering your game preferences, language settings and responsible gaming tool configurations.
• Analytics Cookies: Help 999cb understand how players navigate and use the platform — pages visited, features used, session duration. This data is anonymised and used solely to improve the Services.
• Marketing Cookies: Used only with your consent to deliver relevant promotional content and to measure the effectiveness of marketing communications. You may opt out via your account settings or browser controls.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the 999cb platform.

7. Sharing Your Data

999cb does not sell, rent or trade your personal data. We may share your data with the following categories of third parties only where necessary and under appropriate data protection safeguards:

• Game Providers: Certified game studios (such as PG Soft, Pragmatic Play, Evolution Gaming) receive limited technical data necessary to deliver their games within the 999cb platform. They do not receive your financial or identity data.
• Payment Processors: JazzCash, Easypaisa, banks and other payment service providers receive financial data necessary to process your PKR transactions. These entities are regulated financial institutions with their own data protection obligations.
• KYC / AML Providers: Third-party identity verification and screening services may receive identity data for the purpose of performing required compliance checks.
• Regulatory Authorities: We may be required to disclose personal data to regulatory bodies, law enforcement agencies or courts as required by applicable law.
• Technology Service Providers: Cloud hosting providers, cybersecurity partners and platform infrastructure providers who process data on our behalf under contractual data processing agreements.

8. International Data Transfers

Some of the third-party service providers used by 999cb may be located outside Pakistan. Where personal data is transferred internationally, 999cb ensures that appropriate safeguards are in place — including standard contractual clauses, data processing agreements and, where applicable, adequacy decisions — to ensure your data receives an equivalent level of protection to that required under applicable data protection law.

9. Data Retention

999cb retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

• Active Account Data: Retained for the duration of your 999cb account and for a period of five (5) years following account closure.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction in accordance with AML legal obligations.
• KYC / Identity Verification Data: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Communications & Support Records: Retained for two (2) years from the date of the communication.
• Marketing Consent Records: Retained for three (3) years from the date of consent or withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

10. Your Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by 999cb:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of any inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where we no longer have a lawful basis to retain it.
• Right to Restriction: To request that we restrict processing of your data in certain circumstances.
• Right to Portability: To receive a structured, machine-readable copy of the data you provided to us.
• Right to Object: To object to processing based on legitimate interests, including profiling for direct marketing purposes.
• Right to Withdraw Consent: To withdraw consent for any processing based solely on your consent, at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the 999cb data team at support@999cb.app. We will respond to verified requests within thirty (30) calendar days. Please note that some rights are subject to legal exceptions — for example, we cannot delete data we are legally required to retain for AML compliance purposes.

11. Children's Privacy

The 999cb platform is strictly intended for individuals aged 18 years and above. 999cb does not knowingly collect or process personal data from anyone under the age of 18. If we become aware that a registered account belongs to a person under 18, that account will be closed immediately, all associated data will be deleted in accordance with our retention policy, and any funds will be handled in accordance with applicable procedures.

If you are a parent or guardian and believe your child has created a 999cb account, please contact us immediately at support@999cb.app and we will act without delay.

12. Security Measures

999cb implements a multi-layered security programme to protect your personal data from unauthorised access, accidental loss, alteration or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and 999cb servers.
• AES-256 encryption for sensitive data stored at rest, including identity and financial records.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Multi-factor authentication required for all administrative access to systems holding personal data.
• Continuous automated monitoring for suspicious activity, data breaches and intrusion attempts.
• Regular third-party security audits and penetration testing of the 999cb platform infrastructure.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, 999cb will notify affected players without undue delay in accordance with applicable obligations.

13. Changes to This Privacy Policy

999cb may update this Privacy Policy from time to time to reflect changes in our practices, services or applicable law. When material changes are made, we will notify registered account holders via the email address on file or via an in-account notification prior to the changes taking effect. The updated Policy will always be available at 999cb.app/privacy-policy with the "Last updated" date clearly shown at the top. Continued use of the Services following the effective date of any amendment constitutes acceptance of the revised Policy.

14. Contact & Complaints

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by 999cb, please contact our data team:

If you are dissatisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. 999cb is committed to resolving any privacy complaint fairly and transparently, and we encourage you to contact us in the first instance so that we can address your concern directly.