999ad Privacy Policy

999ad ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every user who accesses our online casino and sports betting platform at https://999ad.net. This Privacy Policy ("Policy") sets out, in clear and straightforward terms, how 999ad collects, uses, stores, discloses, and protects your personal information when you use our services.

This Policy applies to all registered and guest users of the 999ad Platform, including players accessing our services from Karachi, Lahore, Islamabad, Faisalabad, and all other regions of Pakistan. It covers all personal data processed in connection with account registration, KYC verification, deposits and withdrawals via JazzCash, EasyPaisa, and other Pakistani payment methods, gameplay activity, customer support interactions, and marketing communications.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which contain additional information relevant to your use of 999ad.

999ad collects personal data in several categories depending on the nature of your interaction with the Platform. The following table summarises the main categories of personal data we process:

999ad collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, or contacting our customer support team.
• Automated technical collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser type, operating system, and session activity logs generated by our servers.
• Cookies and similar technologies: Data gathered through cookies, web beacons, and similar tracking technologies placed on your device when you visit the 999ad website. See Section 7 for full details of our cookie usage.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and other payment partners when you make a deposit or request a withdrawal.
• KYC verification partners: Where 999ad uses a third-party KYC service provider to assist with identity verification, that provider may supply us with a verification outcome and associated risk score based on the documents you submitted.
• Fraud prevention services: Device fingerprint data and behavioural analytics signals from fraud detection partners used to identify and prevent fraudulent account activity.

999ad does not purchase personal data lists from any broker or third-party data vendor, and does not collect personal data from social media platforms without your explicit consent.

999ad processes your personal data only for specific, legitimate purposes. We do not process your data in a manner that is incompatible with the purposes listed below:

• Account creation and management: To register, maintain, and administer your 999ad player account, including authentication and profile management.
• KYC and age verification: To verify your identity, confirm you are 21 years of age or older, and comply with anti-money laundering (AML) regulations applicable to online gaming platforms.
• Payment processing: To process PKR deposits and withdrawals via your chosen payment method, including reconciliation, fraud checks, and tax reporting where required.
• Gaming service delivery: To provide access to casino games, live dealer tables, cricket betting, PSL markets, and all other Platform features, and to record the outcomes of your gaming activity accurately.
• Customer support: To respond to your queries, complaints, and disputes, and to maintain records of communications for quality assurance purposes.
• Responsible gaming: To monitor gaming patterns that may indicate problem gambling behaviour, to apply self-exclusion requests, and to enforce deposit and loss limits you have set.
• Marketing and promotions: To send you promotional offers, seasonal bonuses, and PSL/cricket betting promotions where you have opted in to receive such communications.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, account takeover attempts, bonus abuse, and other prohibited conduct.
• Legal and regulatory compliance: To comply with applicable laws, regulatory requirements, court orders, and requests from competent authorities.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, design, and content of the 999ad Platform.

999ad processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our contractual obligations to you as a registered user — including account management, payment processing, and gaming service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations, age verification requirements, and responses to lawful authority requests.
• Legitimate interests: Processing necessary for 999ad's legitimate business interests, including fraud prevention, security monitoring, responsible gaming enforcement, and Platform analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit, freely given, and informed consent — primarily for marketing communications and optional analytics cookies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

999ad does not sell or rent your personal data to any third party. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK receive the transaction data necessary to process your deposit or withdrawal. These partners are contractually bound to process your data only for payment execution purposes.
• KYC / identity verification providers: Third-party KYC service providers receive your identity documents and return a verification outcome to 999ad. These providers operate under strict data processing agreements and applicable regulations.
• Fraud prevention and security vendors: Anonymised device and behavioural data may be shared with security partners to detect and prevent fraudulent activity. No identifiable information is shared beyond what is necessary for a specific fraud investigation.
• Customer support platforms: Where 999ad uses a third-party helpdesk or live chat platform, your support interaction data may be processed on that platform under a data processing agreement with 999ad.
• Legal and regulatory authorities: 999ad will disclose personal data to law enforcement agencies, financial intelligence units, regulators, or courts where required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of 999ad's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in advance.

999ad uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. The cookies used by 999ad fall into the following categories:

You can manage your cookie preferences at any time by adjusting your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the 999ad Platform, including the ability to log in and maintain a session.

999ad retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by a specific regulatory directive applicable to 999ad.
• Financial transaction records: Retained for a minimum of seven (7) years for tax and AML compliance purposes.
• Gaming activity logs: Retained for three (3) years for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• Customer support communications: Retained for two (2) years from the date of the final communication in a support thread.
• Marketing preferences: Retained until you update your preferences or request deletion of your account.
• Technical / access logs: Retained for ninety (90) days for security monitoring and fraud detection purposes, then anonymised or deleted.

When data is no longer required, 999ad securely deletes or anonymises it in a manner that prevents reconstruction or identification of any individual.

999ad implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and 999ad's servers.
• AES-256 encryption for sensitive data at rest, including KYC documents and financial records.
• Multi-factor authentication (MFA) for all 999ad administrative and operational system access.
• Role-based access controls (RBAC) ensuring that 999ad staff can only access the personal data categories required for their specific role.
• Continuous intrusion detection and prevention systems (IDS/IPS) monitoring all network traffic for anomalous activity.
• Regular third-party penetration testing of the Platform's infrastructure, conducted at least annually.
• Comprehensive audit logging of all access events involving personal data, reviewed regularly by our security team.
• Strict vendor due diligence — all third-party data processors are assessed for security compliance before engagement and contractually required to maintain equivalent security standards.

As a 999ad user, you have the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address:

• Right of Access: You may request a copy of all personal data 999ad holds about you, along with information about how it is processed and for what purposes.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your 999ad account. Note that changes to identity data (name, CNIC number, date of birth) require supporting documentation and are subject to KYC re-verification.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Note that this right is subject to 999ad's legal obligation to retain certain data for AML and tax compliance purposes — in such cases, we will delete all data not required for legal retention.
• Right to Restrict Processing: You may request that 999ad restrict the processing of your personal data in certain circumstances, for example while a rectification request is being processed.
• Right to Data Portability: You may request a machine-readable export of the personal data you have provided to 999ad, in a commonly used format such as JSON or CSV.
• Right to Object: You may object to processing of your personal data based on legitimate interests, including profiling for responsible gaming monitoring purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

999ad will respond to all valid data rights requests within 48 business hours of receipt, and will complete the requested action within thirty (30) calendar days. If an extension is required, we will notify you within the initial 48-hour window.

The 999ad Platform is strictly intended for adults aged 21 years and above. 999ad does not knowingly collect, process, or retain personal data from any individual under the age of 21. Our registration process includes mandatory age verification, and our KYC process confirms the age of all users before withdrawals are processed.

If 999ad becomes aware that personal data has been collected from an individual under 21 years of age, the following actions will be taken immediately:

• The account will be suspended pending investigation.
• All gameplay activity and wagers will be voided.
• Any deposited funds will be returned to the payment method used, subject to verification of ownership.
• All personal data associated with the underage account will be securely deleted from 999ad's systems, except where retention is required by law.
• The incident will be reported to relevant authorities where legally required.

As an online platform, 999ad may process or store certain data on servers or through service providers located outside of Pakistan. Where such international transfers occur, 999ad ensures that adequate safeguards are in place to protect your personal data, including:

• Contractual data protection clauses requiring the recipient to apply data protection standards equivalent to those described in this Policy.
• Selection of service providers in jurisdictions recognised as providing an adequate level of data protection.
• Regular review and audit of international data transfer arrangements to ensure ongoing compliance.

In all cases, the protections described in this Privacy Policy apply to your personal data regardless of where it is processed. If you have concerns about a specific international data transfer, please contact our Data Protection Officer at [email protected].

The 999ad Platform integrates with a number of third-party service providers to deliver a complete gaming experience. These integrations are limited to services essential to Platform operation and are governed by strict data processing agreements. Third-party categories include:

• Game content providers: Software studios supplying casino games and live dealer tables to the 999ad Platform. These providers may receive anonymised session data necessary to load and run their game software correctly.
• Payment gateway providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK. Transaction data is shared with these providers solely to facilitate your requested payment instruction.
• Customer support tools: Live chat and helpdesk platforms used by 999ad's 24/7 support team. Conversation data is processed on these platforms under data processing agreements with 999ad.
• Analytics services: Aggregated, anonymised Platform usage analytics tools used to measure performance and identify areas for improvement. No individually identifiable data is shared with analytics providers.
• Security and fraud detection: Cybersecurity vendors providing DDoS protection, bot detection, and fraud risk scoring. These vendors process technical identifiers only and are contractually prohibited from using 999ad user data for any purpose other than the specific security service contracted.

999ad does not permit any third-party service provider to use your personal data for their own marketing or commercial purposes. All third-party data processors are assessed and contracted before being given any access to 999ad user data.

999ad reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform features. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page.
• Display a prominent notice on the 999ad homepage and within your account dashboard for a minimum of fourteen (14) days following the change.
• Send an email notification to your registered email address summarising the key changes, where the change materially affects your rights or our processing of your personal data.

Your continued use of the 999ad Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must discontinue use of the Platform and submit a data deletion request to [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 999ad processes your personal data, you may contact us through the following channels:

• Email (Data Protection Enquiries): [email protected] — please include "Privacy Policy" or "Data Request" in your subject line for faster routing to our Data Protection team.
• Live Chat: Available 24/7 via the 999ad Platform. Our support agents can handle general privacy queries and escalate data rights requests to the DPO team.
• Response Time: All privacy-related enquiries will receive an initial response within 48 business hours. Complex data rights requests will be fully resolved within 30 calendar days.

999ad takes all privacy complaints seriously. If you submit a complaint and are not satisfied with our response, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction governing your use of the Platform.