Data Protection — 999y
This Privacy Policy explains what personal information 999y collects from Pakistani players, why we collect it, how it is used and stored, who it may be shared with, and what rights you hold over your own data. We have written this document in plain, readable English so that every player — whether you are logging in from Karachi, Lahore, or Islamabad — understands precisely how 999y treats the information you entrust to us.
Our Six Privacy Commitments
These six commitments summarise how 999y approaches data protection. The full legal detail is in the policy sections below — please read them carefully.
999y operates a strict data minimisation principle. We collect only the personal information that is necessary to operate your account, process your transactions, verify your identity, and comply with our obligations under international gaming licence standards.
999y does not sell, rent, or trade your personal information to third-party marketing companies or data brokers. Your data is used exclusively to operate your 999y account and improve your experience on the platform — never to generate revenue from external parties.
All personal data held by 999y is encrypted using industry-standard AES-256 encryption at rest. All data transmitted between your device and the 999y platform travels over TLS 1.2 or higher, preventing interception or tampering in transit.
You have the right to access, correct, or request deletion of the personal data 999y holds about you. These requests can be submitted by contacting our support team, and we will respond within the timeframes specified in Section 10 of this policy.
We share personal data with third parties only where it is strictly necessary — for example, payment processors such as JazzCash and EasyPaisa to complete your transactions, or KYC verification providers to meet our regulatory obligations. All third parties are contractually bound to data protection standards.
Personal data is retained for no longer than is required for the purpose for which it was collected, subject to applicable legal retention requirements. Account data for closed accounts is typically held for a period of five years in accordance with standard gaming licence obligations, after which it is securely deleted.
For the purposes of this Privacy Policy, the data controller responsible for your personal information is 999y ("we", "us", "our", "the Company"), operating the online gaming platform accessible at https://999y.ws (the "Platform"). 999y operates under international gaming licence standards and is committed to processing personal data in a manner that is lawful, fair, and transparent.
This Privacy Policy applies to all registered players and visitors to the 999y Platform, including users accessing the site from Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, and all other locations in Pakistan. If you have any questions about how your data is handled, please refer to Section 13 of this policy for contact details.
999y collects personal information in three primary ways: information you provide directly, information generated automatically by your use of the Platform, and information we receive from third parties such as payment processors and identity verification providers.
| Data Category | Examples | Source |
|---|---|---|
| Identity Data | Name, DOB, CNIC, passport | You / KYC provider |
| Contact Data | Email, mobile number, address | You |
| Financial Data | Wallet numbers, bank details, transaction history | You / Payment processors |
| Technical Data | IP address, device ID, browser info | Automatic collection |
| Usage Data | Game history, bet records, session data | Automatic collection |
| Communications Data | Support chat logs, email records | You |
999y uses the personal information we collect for the following purposes. We only process your data where a clear lawful basis exists, as described in Section 4.
999y processes your personal data on the following legal bases:
999y does not sell, rent, or trade your personal data. We share personal information with third parties only in the following limited circumstances:
We engage carefully selected third-party service providers to assist in operating the Platform. These include payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank), KYC and identity verification partners, fraud detection services, customer support platform providers, and cloud infrastructure providers. All service providers are contractually bound to process data only on our instructions and to maintain appropriate data security standards.
To deliver casino games, certain technical gameplay data — such as bet amounts and game round results — may be transmitted to our licensed game software providers for the purpose of running the game. These providers do not receive your name, contact details, or payment information.
We may disclose personal data to relevant regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law or a valid legal order. In such cases, we will disclose only the minimum information necessary to satisfy the legal requirement.
In the event of a merger, acquisition, restructuring, or sale of assets involving 999y, personal data held by the Platform may be transferred to the successor entity, subject to the same privacy protections described in this policy. Registered players would be notified of any such transfer.
When you make a deposit or request a withdrawal on 999y using JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, the financial data required to complete the transaction is transmitted directly to the relevant payment provider over an encrypted connection. 999y does not store full bank account credentials or complete payment card details on our own servers.
Transaction records — including deposit amounts, withdrawal requests, dates, and reference numbers — are retained by 999y as part of your account history for the purposes of account management, dispute resolution, and compliance with our record-keeping obligations. These records are accessible to you through your account transaction history at any time.
999y uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and — where you have consented — deliver relevant promotional content. Below is a summary of the types of cookies we use:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security tokens | Session / up to 24 hrs |
| Functional | Language preferences, responsible gaming settings, UI customisation | Up to 12 months |
| Analytics | Aggregate usage statistics, page performance monitoring (pseudonymised) | Up to 24 months |
| Marketing | Promotion personalisation, bonus offer targeting (consent-based only) | Up to 12 months |
Strictly necessary cookies cannot be disabled as they are essential to the functioning of the Platform. For all other cookie categories, you may manage your preferences through the cookie settings panel accessible from the footer of any page. Please note that disabling functional or analytics cookies may affect certain features of your 999y experience.
999y implements a multi-layered security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:
In the event of a personal data breach that poses a risk to your rights and freedoms, 999y will notify affected players and relevant authorities within the timeframes required by applicable regulations. We will provide clear information on the nature of the breach, the data involved, and the steps we are taking to mitigate any impact.
999y retains personal data for no longer than is necessary for the purpose for which it was originally collected, subject to overriding legal, regulatory, or contractual obligations. Our standard retention periods are as follows:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data | 5 years after account closure | Gaming licence compliance, AML obligations |
| Transaction records | 5 years after each transaction | Financial record-keeping, dispute resolution |
| KYC documents | 5 years after account closure | Regulatory verification obligations |
| Support communications | 2 years after case resolution | Quality assurance, dispute evidence |
| Marketing consent records | Until consent withdrawn + 1 year | Proof of lawful marketing basis |
| Analytics data (pseudonymised) | 24 months on a rolling basis | Platform performance improvement |
On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not technically possible in the immediate term (for example, data held in backup archives), the data is isolated and protected from further processing until deletion can be completed.
As a 999y player, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact our support team as described in Section 13.
We will respond to all valid privacy rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.
The 999y Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store personal data relating to persons under the age of 21. Age verification is a mandatory step in our account registration and KYC process, and we employ automated age-checking tools to detect and prevent underage registrations.
If 999y becomes aware that personal data has been collected from an individual under the age of 21 — whether through a fraudulent registration or any other means — we will immediately suspend the relevant account, delete the associated personal data as far as legally permissible, and report the matter to our compliance team for further investigation.
999y reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, Platform features, or applicable legal and regulatory requirements. When material changes are made, we will notify registered players via email and by posting a prominent notice on the Platform, with a minimum of 14 days' notice before the updated policy takes effect.
The updated Privacy Policy will be published on this page with a revised "Last Updated" date at the top. We encourage you to review this page periodically to stay informed about how 999y protects your personal data. Your continued use of the Platform after the revised policy takes effect constitutes your acceptance of the updated terms.
If you have any questions, concerns, or complaints about this Privacy Policy or the way 999y processes your personal data, or if you wish to exercise any of your privacy rights as described in Section 10, please contact our Data Protection team through any of the following channels:
For formal data subject access requests or requests to exercise any other privacy right, please include your registered 999y username, the email address associated with your account, and a clear description of the data or action requested. We may ask you to verify your identity before processing the request to protect the security of your account.
Your Data Is Safe With Us
Now that you know exactly how 999y protects your personal data, join Pakistan's most trusted PKR gaming platform — cricket betting, live casino, Mini Baccarat, Teen Patti Joker, and 1,000+ slots. Fully encrypted. 21+ only. Play responsibly.