999m Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") applies to all users ("you", "User") of the 999m online gaming platform accessible at 999m.onl (the "Platform"), operated by the 999m entity as described in Section 2 below. It covers all personal data collected, processed, and stored in connection with your use of the 999m Platform, including account registration, identity verification, deposits and withdrawals, gameplay, customer support interactions, and marketing communications.

By registering a 999m account and using the Platform, you acknowledge that you have read, understood, and agree to the collection and processing of your personal data as described in this Policy. If you do not agree with any part of this Policy, you must not use the 999m Platform.

This Policy should be read alongside the 999m Terms and Conditions. Where this Policy uses terms defined in the Terms and Conditions, those definitions apply here as well.

For the purposes of this Privacy Policy, 999m (the operating entity behind the 999m Platform, licensed under the applicable international gaming license) is the data controller responsible for the personal data collected through the Platform.

The data controller is responsible for determining the purposes and means by which your personal data is processed. Questions about data controllership, data processing practices, or the exercise of your data rights should be directed to the 999m support team via the contact details in Section 16 of this Policy.

999m collects the following categories of personal data in the course of platform operation:

999m collects personal data through the following channels:

• Direct submission: Data you provide when registering your account, completing identity verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated technical collection: Data automatically collected when you access the Platform, including IP address, device identifiers, session activity, and browser fingerprint via cookies and similar technologies.
• Payment processor data: Transaction confirmation and reference data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT TRC20 processors when you make deposits or request withdrawals.
• Identity verification providers: Data received from third-party KYC verification service providers as part of the identity and age verification process.
• Fraud prevention services: Device reputation, IP reputation, and behavioural data received from fraud detection service providers for the purpose of account security and AML compliance.

999m processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and 999m — i.e., to operate your account, process your deposits and withdrawals, and provide access to games and betting markets.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC obligations, AML obligations, and requirements imposed by the gaming license authority.
• Legitimate interests: Processing carried out for 999m's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your data protection rights.
• Consent: Processing carried out on the basis of your explicit consent, such as sending you marketing communications about 999m promotions, bonuses, and new games. You may withdraw marketing consent at any time.

999m uses the personal data it collects for the following specific purposes:

• Creating, verifying, and maintaining your 999m account.
• Performing identity verification and age verification as required by the gaming license and responsible gaming obligations.
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT TRC20.
• Detecting and preventing fraud, money laundering, and other financial crime in compliance with applicable AML obligations.
• Monitoring gameplay and financial activity for signs of problem gambling and implementing responsible gaming interventions where necessary.
• Sending account-related communications including security alerts, verification requests, and transaction confirmations.
• Sending promotional communications about 999m bonuses, new games, and special offers — only to users who have provided consent for marketing communications.
• Responding to customer support enquiries, complaints, and dispute resolution requests.
• Improving and maintaining the technical performance of the 999m Platform.
• Complying with legal obligations imposed by the gaming license authority, including audit and reporting requirements.

999m does not sell your personal data to any third party. Personal data is shared only in the following limited circumstances:

• Payment processors: Your financial transaction data is shared with the relevant payment processor (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, USDT TRC20 network) to the extent necessary to process your deposits and withdrawals.
• Identity verification providers: Your identity documentation may be shared with authorised third-party KYC verification providers for the purpose of verifying your identity and age as required by the gaming license.
• Gaming license regulator: Personal data may be disclosed to the applicable gaming license regulatory authority upon lawful request, as a condition of maintaining the 999m gaming license.
• Fraud prevention and AML service providers: Transaction and behavioural data may be shared with fraud detection and anti-money laundering compliance service providers for the purpose of protecting the Platform and its users from financial crime.
• Law enforcement and legal process: Personal data may be disclosed to law enforcement agencies, courts, or government authorities where 999m is legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of 999m, its users, or third parties.
• Game providers: Pseudonymised gameplay data (not directly identifiable personal data) is shared with certified game providers to facilitate game delivery, RNG auditing, and payout verification.

The 999m Platform uses cookies and similar tracking technologies to provide a functional, secure, and personalised gaming experience. Cookies are small text files stored on your device by your browser when you access the Platform.

999m uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These enable core features such as session management, login state, and security features. These cookies cannot be disabled without breaking Platform functionality.
• Analytical cookies: Used to understand how users interact with the Platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is used in aggregate and is not linked to individual identifiable users.
• Functional cookies: Used to remember your preferences, such as language settings and responsible gaming limit configurations, so these do not need to be re-entered on each visit.
• Security cookies: Used to detect and prevent fraudulent activity, identify suspicious login patterns, and enforce one-session-per-device restrictions.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. Disabling analytical and functional cookies will not prevent you from accessing 999m but may reduce the quality of your experience.

999m retains personal data for the period necessary to fulfil the purposes described in this Policy, subject to the following minimum retention obligations:

• Account data and transaction records: Retained for a minimum of five (5) years from the date of account closure, as required by AML regulations and gaming license obligations.
• Identity verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the communication, or longer where the communication relates to an unresolved dispute.
• Marketing consent records: Retained for as long as the consent remains active plus one (1) year following withdrawal of consent, for compliance documentation purposes.
• Technical and log data: Retained for twelve (12) months from the date of collection, unless longer retention is required for security investigation purposes.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual user.

999m implements technical and organisational security measures designed to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the 999m Platform.
• Encryption of sensitive personal data and financial data stored in 999m databases.
• Role-based access controls limiting staff access to personal data to those with a specific operational need.
• Automated anomaly detection and suspicious-login alerting systems.
• Optional two-factor authentication (2FA) for all 999m account holders.
• Regular internal security reviews and penetration testing of Platform infrastructure.

Despite these measures, no security system is entirely impenetrable. In the event of a data breach that creates a material risk to your rights, 999m will notify affected account holders and relevant regulatory authorities within the timeframes required by applicable obligations.

As a 999m account holder, you have the following rights in relation to the personal data 999m holds about you. To exercise any of these rights, contact our support team using the details in Section 16.

999m will respond to all verified data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, and you will be informed of the extension. Identity verification will be required before any request is actioned to ensure we do not disclose or delete data in response to fraudulent requests.

Please note that certain data rights are qualified — for example, the right to erasure does not apply where 999m is required to retain data by applicable AML regulations or gaming license obligations.

999m may send you promotional communications about platform bonuses, new game launches, PSL cricket betting offers, and other 999m promotions. Marketing communications are sent only where you have provided explicit consent at the time of account registration or subsequently via your Account Settings.

You may withdraw consent for marketing communications at any time by:

• Updating your communication preferences in your Account Settings under "Notifications".
• Clicking the unsubscribe link included in any marketing email received from 999m.
• Contacting 999m support directly via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to continue using the 999m Platform. You will continue to receive non-promotional communications that are necessary for the operation of your account — such as security alerts, withdrawal confirmations, and KYC verification requests — regardless of your marketing communication preferences.

The 999m Platform is strictly for adults aged 21 years and above. 999m does not knowingly collect, process, or retain the personal data of individuals under the age of 21. Account registration includes age declaration and mandatory identity verification to enforce this restriction.

If 999m becomes aware that personal data has been collected from an individual who is under 21 years of age, that data will be deleted and the account will be closed immediately. No winnings or bonus amounts accumulated on such an account will be paid out.

Parents and guardians who share devices with individuals under 21 are encouraged to use parental control software and browser-level content filtering to prevent underage access to the 999m Platform. If you believe a minor may have accessed 999m using your device or credentials, contact support immediately.

999m operates under an international gaming license. As a result, some personal data may be processed and stored on infrastructure located outside Pakistan. This may include data processed by identity verification providers, fraud detection services, and the gaming license regulatory authority in the jurisdiction of 999m's license.

Where personal data is transferred to or processed in countries outside Pakistan, 999m ensures that appropriate safeguards are in place to protect that data. These safeguards may include contractual clauses with data processors that impose data protection obligations equivalent to those described in this Policy, and verification that receiving entities maintain adequate security standards.

999m reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or operational circumstances. The effective date shown at the top of this page will be updated whenever a new version is published.

Where changes are material — meaning they significantly affect your rights or how your personal data is used — 999m will notify active account holders via in-platform notification or email at least seven (7) days before the changes take effect. Non-material changes such as typographical corrections or clarification of existing practices may be made without advance notice.

Continued use of the 999m Platform following the publication of a revised Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept any changes, you must discontinue use of the Platform and request account closure.

For all privacy-related enquiries, data rights requests, or concerns about how 999m handles your personal data, please contact the 999m Data Protection team via the following channels: