Privacy Policy — How 999bk Handles Your Data

999bk is committed to protecting the privacy and personal data of all users who access the platform. This Policy has been prepared to inform you — whether you are registering from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar or any other location — about the personal data we process, the reasons we process it and the rights available to you.

This Policy applies to all data collected through the 999bk website, any mobile application versions of the platform, customer support interactions, promotional communications and any other point at which you provide data to 999bk.

999bk is not affiliated with, endorsed by, or licensed under any Pakistani government authority, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan or any provincial authority. This Policy does not constitute legal advice regarding Pakistani data protection law. Users are encouraged to seek independent guidance regarding their rights under applicable local law.

The following terms have the meanings assigned below throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, date of birth, contact details, financial data and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For the 999bk platform, the Data Controller is the operating entity behind 999bk.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, under a binding data processing agreement.
• "KYC Data" — identity and age verification documentation collected to comply with Know Your Customer obligations, including government-issued identification, proof of address and source-of-funds documents.
• "Cookies" — small text files placed on your device by the platform to enable session management, analytics and preference storage.
• "Consent" — a freely given, specific, informed and unambiguous indication of agreement to the processing of your Personal Data for a stated purpose.
• "Applicable Law" — data protection and privacy laws applicable in the operator's licence jurisdiction, together with any mandatory requirements of your country of residence.

999bk collects the following categories of personal data, depending on the nature of your interaction with the platform:

We do not collect special category data (such as health, biometric or political data) except where directly relevant to responsible gambling self-exclusion requests or where legally required.

Personal data is collected through the following means:

• Direct submission — when you register an account, complete the KYC process, make a deposit or withdrawal, contact support, or respond to a promotional communication;
• Automated technologies — cookies, server logs, analytics tools and fraud detection systems that record your interaction with the platform in real time;
• Third-party verification services — identity verification and age-check providers used as part of the KYC process. These processors act under binding data processing agreements;
• Payment processing partners — transaction data associated with deposit and withdrawal requests processed through payment rails referenced on the platform (e.g., bank transfers via HBL, UBL, Meezan Bank, Bank Alfalah or mobile wallet channels). Such partners process data under their own privacy policies and applicable financial regulations;
• Public sources — publicly available information used in fraud prevention and AML screening, such as sanctions lists and politically exposed persons (PEP) databases.

We process your personal data only where we have a valid legal basis to do so. The table below sets out the primary purposes of processing and the corresponding legal basis for each:

• Account Registration & Management — Necessary for performance of the contract between you and 999bk. We cannot operate your account without processing identity and contact data.
• KYC & Age Verification — Legal obligation arising from the operator's licence conditions and AML regulatory requirements.
• Transaction Processing — Necessary for contract performance. Deposit and withdrawal processing requires financial data.
• Fraud Prevention & AML — Legitimate interest of 999bk and legal obligation under applicable licensing and financial crime regulations.
• Responsible Gambling Monitoring — Legitimate interest and, where applicable, legal obligation to detect and respond to problem gambling indicators.
• Customer Support — Necessary for contract performance and legitimate interest in providing effective user assistance.
• Promotional Communications — Consent only. We will not send marketing emails or push notifications without your opt-in consent.
• Platform Analytics & Improvement — Legitimate interest in improving platform performance, user experience and service quality.

999bk does not sell your personal data to third parties for commercial or marketing purposes. We may share your personal data with the following categories of recipients, only where necessary and under appropriate legal or contractual safeguards:

• Identity Verification Providers — KYC and age-check processors engaged to satisfy licensing requirements. These processors act solely on our instructions.
• Payment Processing Partners — Entities facilitating deposit and withdrawal transactions. Note that payment providers such as Easypaisa, JazzCash, Raast and bank transfer institutions process data under their own applicable policies and Pakistani financial regulations.
• Regulatory & Law Enforcement Authorities — Where legally compelled by court order, regulator request, AML reporting obligation or law enforcement authority.
• Fraud Prevention Networks — Shared blacklist and risk-scoring services used to identify fraudulent accounts, prevent money laundering and protect the integrity of the platform.
• IT Infrastructure & Hosting Providers — Cloud storage and server infrastructure providers engaged under binding data processing agreements with appropriate security standards.
• Professional Advisers — Legal, compliance and audit professionals bound by confidentiality obligations, where necessary to obtain professional advice.

The 999bk platform may process and store personal data in countries other than your country of residence, including the jurisdiction in which the operator holds its gaming licence and the location of our IT infrastructure providers. Such transfers may mean your personal data is processed in a jurisdiction with different data protection laws to those applicable in Pakistan or your country of residence.

Where personal data is transferred internationally, 999bk takes reasonable steps to ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved under the data protection laws of the operator's licence jurisdiction;
• Data processing agreements with third-party processors specifying security standards, data use restrictions and breach notification obligations;
• Transfer impact assessments where required by applicable law.

999bk retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy, or as required by applicable law, licensing conditions or legitimate business need. The following indicative retention periods apply:

• Account and KYC records: Retained for the duration of the account relationship plus a minimum period following account closure as required by the operator's licence (typically five years, but subject to applicable AML regulations);
• Transaction records: Retained for a minimum of five years following the transaction date, in accordance with AML and financial record-keeping obligations;
• Support communications: Retained for up to three years following resolution of the interaction, or longer if the subject matter relates to a formal complaint or regulatory inquiry;
• Marketing and consent records: Retained until consent is withdrawn or, where no withdrawal occurs, for a period not exceeding five years from the date of last interaction;
• Technical logs: Retained for up to twelve months for fraud detection and platform security purposes.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in accordance with 999bk's data disposal procedures, unless a legal obligation requires continued retention.

999bk uses cookies and similar tracking technologies to operate the platform, maintain sessions, prevent fraud and understand how users interact with the service. The following categories of cookies are used:

You may manage your browser's cookie settings at any time. Disabling strictly necessary cookies will impair platform functionality and may prevent login. Instructions for managing cookies are available in the help documentation of your browser. Please note that third-party payment processors you interact with independently (e.g., Easypaisa, JazzCash) operate their own cookie policies, which are outside 999bk's control.

Depending on your jurisdiction and applicable data protection law, you may have the following rights in relation to the personal data we hold about you. To exercise any right, contact us via the support channel detailed in Section 15:

The 999bk platform is strictly for adults aged 18 years or older — or the higher minimum age required by the laws of the user's jurisdiction or the operator's licence conditions. We do not knowingly collect or process personal data from persons below the applicable minimum age.

If we become aware that personal data has been collected from an underage individual, we will take immediate steps to delete that data and close the associated account. KYC verification procedures are in place specifically to prevent underage access.

999bk implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include, but are not limited to:

• Encryption of data in transit using TLS (Transport Layer Security) protocols;
• Encryption of sensitive personal data and financial records at rest;
• Role-based access controls limiting internal data access to authorised personnel with a legitimate need;
• Regular security testing, vulnerability assessments and penetration testing of platform infrastructure;
• Multi-factor authentication for administrative access to systems processing personal data;
• Data breach detection and notification procedures compliant with the operator's licence obligations.

Notwithstanding these measures, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your 999bk account credentials and for notifying us immediately if you suspect unauthorised access to your account. Do not share your password with anyone.

The 999bk platform does not intentionally include links to external third-party websites or services. Where references are made to payment providers, game software suppliers or support organisations, these are contextual references only and do not constitute endorsements.

Where you independently access payment platforms referenced in the platform context — such as Easypaisa, JazzCash, Raast or internet banking portals for HBL, UBL, Meezan Bank or Bank Alfalah — those services operate entirely under their own privacy policies and data protection frameworks. 999bk has no visibility into or control over how those third parties collect or process your data when you interact with them directly.

999bk reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, licensing requirements, platform features or data processing practices. The effective date at the top of this document will be updated to reflect the date of any revision.

Where material changes are made to this Policy — particularly changes that affect your rights or significantly alter how we use your data — we will provide notice through the platform (e.g., on-site notification or registered email address). Your continued use of the platform following the publication of an updated Policy constitutes acceptance of the revised terms.

We recommend that you review this Policy periodically, particularly before making significant deposits or submitting additional personal documentation.

If you have any questions about this Privacy Policy, wish to exercise a data right, or have a complaint regarding how your personal data has been handled, please contact the 999bk Data Team through the following channels:

When submitting a privacy request, please include your registered account username or email address, a clear description of the request or complaint, and any relevant transaction or communication references. This helps us locate and process your request efficiently and accurately.