Privacy Policy – How 99y Collects, Uses & Protects Your Data

Personal Data We Collect

When you register, use, or interact with the 99y platform, we collect the following categories of personal data:

Registration and Identity Data:

• Full legal name, date of birth, and gender
• Pakistani mobile number (03xx format) used as primary account identifier
• Email address (if provided)
• Residential address in Pakistan
• Government-issued identity document number (CNIC, Passport, or NICOP) collected during KYC

Financial and Transaction Data:

• Deposit and withdrawal transaction records in PKR, including amounts, dates, and payment methods used (JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa, Mastercard, UnionPay, USDT TRC20)
• Payment method identifiers (mobile wallet number registered to your account, bank account details where applicable) — full card numbers and wallet PINs are never stored by 99y
• Account balance history and bonus transaction records

Gaming and Betting Activity Data:

• Bets placed, game sessions, wager amounts, winnings, and losses across all 99y products (cricket betting, live casino, slots, Tongits Go, Hi-Lo)
• PSL and cricket betting market selections and settlement records
• Responsible gaming tool usage (deposit limits set, self-exclusion requests, session time alerts configured)

Technical and Device Data:

• IP address and approximate geolocation at the time of login and betting activity
• Device type, operating system, browser type, and version
• 99y session timestamps, login history, and logout records
• Cookie identifiers and analytics data as described in Section 5

Communications Data:

• Records of your communications with 99y customer support, including support ticket content and response history
• Preferences you have expressed regarding marketing communications

How We Use Your Personal Data

99y uses your personal data for the following purposes:

• Account management: To create, maintain, and secure your 99y account, process your 99y login sessions, and provide you with access to all platform features
• Transaction processing: To process deposits and withdrawals in PKR via your chosen payment method, and to maintain accurate financial records for your account
• KYC and identity verification: To verify your identity and age (18+), comply with AML obligations, and prevent fraud and multiple account registration
• Service delivery: To deliver cricket betting odds, live casino game results, slots gameplay, and all other 99y gaming products to you in real time
• Responsible gaming: To administer deposit limits, self-exclusion requests, session alerts, and other responsible gaming tools you activate within your 99y account
• Customer support: To respond to your queries, resolve disputes, and provide technical assistance via the 99y support team
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the performance, design, and game selection of the 99y platform
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, and other illegal or prohibited activities on 99y
• Legal and regulatory compliance: To meet obligations under applicable anti-money laundering, gaming regulation, and data protection laws
• Marketing communications: To send you promotional offers, PSL season betting promotions, and 99y Casino bonus offers where you have consented to receive them

Legal Basis for Processing

99y processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and 99y — including account registration, transaction processing, and service delivery — is carried out on the basis that it is necessary to fulfil our obligations to you
• Legal obligation: Processing required to comply with AML regulations, age verification requirements, gaming licensing obligations, and other applicable legal requirements
• Legitimate interests: Processing for fraud detection, platform security, abuse prevention, and service improvement, where these interests are not overridden by your data protection rights
• Consent: Processing for marketing communications (promotional SMS, email), where we rely on your explicit opt-in consent at registration or a subsequent point. You may withdraw consent at any time by contacting [email protected]

Data Sharing & Third Parties

99y does not sell your personal data. We share personal data with third parties only in the following circumstances and to the minimum extent necessary:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa, Mastercard, UnionPay, and USDT TRC20 network processors receive transaction data necessary to process your deposits and withdrawals. These processors operate under their own privacy policies and applicable financial regulation.
• KYC and identity verification providers: Third-party identity verification services may receive your identity document data and biometric information solely for the purpose of verifying your identity and age in compliance with KYC obligations.
• Game software providers: Licensed game providers whose software powers 99y Casino, slots, Tongits Go, Hi-Lo, and other products may receive session and game outcome data necessary to operate their games. These providers are contractually bound to data protection standards.
• Regulatory and law enforcement authorities: 99y may disclose personal data to gaming regulators, financial intelligence units, or law enforcement agencies where legally required or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Professional advisors: Lawyers, accountants, and auditors engaged by 99y may access personal data in the course of providing professional services, subject to professional confidentiality obligations.

Cookies & Tracking Technologies

The 99y Platform uses cookies and similar tracking technologies to operate correctly and improve your experience. The categories of cookies used by 99y include:

• Strictly necessary cookies: Required for the Platform to function, including maintaining your 99y login session, remembering your language preferences, and securing your account. These cannot be disabled.
• Performance and analytics cookies: Used to understand how players navigate and use the Platform, identify performance issues, and measure the effectiveness of platform features. Data collected through these cookies is aggregated and anonymised.
• Functional cookies: Store preferences such as game lobby layout settings and notification preferences to improve your 99y experience across sessions.

You can manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality, including the 99y login process and game session continuity.

Data Retention

99y retains personal data for the following periods, after which data is securely deleted or irreversibly anonymised:

• Active account data is retained for the duration of your 99y account and for a period of at least five (5) years following account closure, as required by AML and gaming regulations.
• KYC and identity documents are retained for a minimum of five (5) years following the end of the customer relationship, in compliance with applicable AML legislation.
• Transaction records (deposits, withdrawals, bets) are retained for a minimum of five (5) years following the transaction date.
• Customer support records are retained for three (3) years following resolution of the relevant support interaction.
• Marketing consent records are retained for the duration of the consent and for one (1) year following withdrawal of consent.
• Technical and session logs are retained for ninety (90) days for security and debugging purposes, unless a longer retention period is required for an ongoing investigation.

Data Security

99y implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your device and the 99y Platform
• Encryption of sensitive data at rest, including identity document data and payment credentials
• Two-factor authentication (OTP via Pakistani mobile number) for 99y account login
• Automatic session timeout after periods of inactivity on the Platform
• Access controls limiting internal staff access to personal data on a need-to-know basis
• Regular security assessments and penetration testing of the Platform infrastructure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 99y will notify affected players in accordance with applicable data breach notification obligations.

Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by 99y:

• Right of access: You may request a copy of the personal data 99y holds about you, including your account data, KYC records, and transaction history.
• Right to rectification: If personal data held by 99y is inaccurate or incomplete, you may request that it be corrected. Basic account details (name, address, mobile number) can be updated via your 99y account settings or by contacting support.
• Right to erasure: In certain circumstances you may request that 99y delete your personal data. Note that we may be unable to delete data that we are legally required to retain under AML or gaming regulations.
• Right to restrict processing: You may request that 99y restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to other processing based on 99y's legitimate interests where you have grounds relating to your particular situation.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing SMS), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact 99y at [email protected] with your registered mobile number and a description of your request. We will respond within 30 days.

Children's Privacy

The 99y Platform is strictly for persons aged 18 and above. 99y does not knowingly collect personal data from individuals under 18 years of age. If we become aware that personal data has been collected from a person under 18, we will immediately delete that data and close the associated account.

Marketing Communications

With your consent, 99y may send you promotional communications via SMS to your registered Pakistani mobile number and/or email, including:

• Deposit bonus and welcome offer notifications
• PSL season betting promotions and live odds alerts
• New game launch announcements for 99y Casino, slots, and other categories
• Account-specific promotions based on your gaming activity

You may withdraw consent for marketing communications at any time by contacting [email protected] or via the communication preferences section of your 99y account settings. Withdrawal of consent does not affect transactional messages (e.g., deposit confirmations, withdrawal status updates, OTP for 99y login) which are operationally necessary and cannot be opted out from.

Cross-Border Data Transfers

To operate the 99y Platform, your personal data may be transferred to and processed in countries other than Pakistan, including countries where 99y's servers, game providers, or payment processors are located. Where such transfers occur, 99y takes steps to ensure that your personal data receives an adequate level of protection through contractual safeguards (such as standard data protection clauses) or other appropriate transfer mechanisms.

Specifically, payment data transferred to JazzCash and Easypaisa processors remains within Pakistan's financial infrastructure. Game provider data transfers are subject to the data protection terms of 99y's agreements with licensed game software suppliers.

Changes to This Privacy Policy

99y reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or the services we offer. Material changes will be communicated to registered players via SMS to the registered Pakistani mobile number and/or by notice on the Platform, with reasonable advance notice before changes take effect.

The "Last updated" date at the top of this Policy reflects the most recent revision. Your continued use of 99y following the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or 99y's data processing practices, please contact the 99y data team:

• Email: [email protected]
• Subject line: "Privacy Request – [your registered mobile number]"
• Response time: Within 30 days for formal data subject rights requests; general privacy queries typically within 5 business days

For responsible gaming matters specifically, please visit the Responsible Gaming page. For general platform terms, see our Terms & Conditions.