999pkr Privacy Policy

This Privacy Policy describes how 999pkr ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal information of registered players and visitors to https://999pkr.org. 999pkr is an internationally licensed online gaming platform serving English-speaking Pakistani players aged 21 and above.

We understand that privacy is a serious matter, particularly in the context of online gaming where financial and identity information is involved. This policy has been written in plain language wherever possible so that every player — whether they are based in Karachi, Lahore, Islamabad, Faisalabad, or anywhere else across Pakistan — can clearly understand how their data is handled.

This Privacy Policy is incorporated by reference into the 999pkr Terms and Conditions. In the event of any conflict between this policy and the Terms and Conditions, the Terms and Conditions shall take precedence. Capitalised terms not defined in this policy carry the meanings assigned to them in the Terms and Conditions.

999pkr collects personal data in three primary ways: information you provide directly during registration and account use, information generated automatically through your interaction with the platform, and information received from authorised third-party partners such as KYC verification providers and payment processors.

The specific categories of personal data collected by 999pkr are set out in the table below:

999pkr does not collect or process any special category data as defined under applicable data protection frameworks — including health data, religious beliefs, political opinions, or biometric data — except where CNIC photograph review is strictly required for age and identity verification purposes, in which case such data is handled with heightened security controls and deleted from active systems once verification is complete.

999pkr uses the personal data it collects for the following clearly defined purposes. We do not use your data for any purpose that is not listed here without first obtaining your explicit consent or updating this Privacy Policy accordingly.

• Account Creation & Management: Identity and contact data are used to create and maintain your 999pkr player account, process login requests, and manage account settings including responsible gaming tools.
• Age & Identity Verification (KYC): CNIC and selfie data are used to confirm that you are 21 years of age or above and that you are who you claim to be, in compliance with our licensing obligations.
• Payment Processing: Payment data is used to process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and other accepted methods. Withdrawal data is cross-referenced against your identity data to prevent third-party withdrawals.
• Gaming Services Delivery: Gaming session data and account data are used to operate, personalise, and improve the games, sports betting markets, and casino features available on the 999pkr platform.
• Fraud Detection & Prevention: Technical data and gaming data are analysed to detect suspicious activity, multi-accounting, bonus abuse, money laundering patterns, and other prohibited behaviours described in the Terms and Conditions.
• Responsible Gaming Monitoring: Gaming data and account data are monitored to identify potential indicators of problem gambling behaviour, enabling 999pkr to proactively offer responsible gaming resources and tools to at-risk players.
• Customer Support: Communications data is used to respond to your queries, complaints, and requests submitted via live chat or email.
• Regulatory Compliance: Identity, payment, and gaming data are retained and made available to regulatory authorities as required by 999pkr's international operating licence.
• Marketing Communications: Contact data may be used to send you promotional emails and SMS notifications about bonuses, new games, and PSL/cricket betting opportunities — but only where you have given explicit consent at registration or opted in subsequently. You may opt out at any time.
• Platform Analytics & Improvement: Aggregated, anonymised technical and gaming data is used to analyse platform performance, identify bugs, and improve the user experience across all devices used by Pakistani players.

999pkr processes personal data only where a valid legal basis exists. The legal bases on which 999pkr relies are as follows:

• Contractual Necessity: Processing required to perform the contract between 999pkr and the player — including account management, payment processing, and gaming services delivery — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with KYC, anti-money laundering (AML), and counter-terrorism financing (CTF) obligations imposed by 999pkr's international gaming licence is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, responsible gaming monitoring, platform security, and analytics is carried out on the basis of 999pkr's legitimate interests, provided those interests are not overridden by the individual player's rights and freedoms.
• Consent: Processing for direct marketing communications is carried out on the basis of the player's explicit, freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

As a licensed online gaming platform, 999pkr is required to verify the identity and age of all players before withdrawal privileges are activated. This process is known as Know Your Customer (KYC) verification. KYC is not optional — it is a regulatory requirement that protects both the player and the integrity of the platform.

The KYC verification process at 999pkr requires the following documents:

• A clear photograph of the front and back of your valid Pakistani CNIC (Computerised National Identity Card).
• A recent selfie photograph holding your CNIC next to your face, taken in good lighting, with your face and CNIC details clearly visible.
• Proof of payment method ownership — for example, a screenshot of your JazzCash or EasyPaisa account showing your registered mobile number matching the number on your 999pkr account.

KYC documents submitted to 999pkr are processed by our authorised KYC verification partner under strict data processing agreements. CNIC image files are stored in encrypted form for the duration required by our regulatory obligations and then securely deleted. At no point are CNIC images shared with any party other than the KYC verification partner and, where legally required, regulatory authorities.

All financial transactions on 999pkr are denominated in Pakistani Rupees (PKR). When you make a deposit or withdrawal using JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, 1LINK, USDT TRC20, or any other accepted payment method, certain payment data is necessarily collected and processed to complete the transaction.

• 999pkr does not store full bank account numbers or card numbers on its own servers. Full payment credentials are handled exclusively by our PCI-DSS compliant payment processing partners.
• Mobile wallet numbers (JazzCash, EasyPaisa, SadaPay) registered to your account are stored in encrypted form and used exclusively for the purpose of processing your deposits and withdrawals.
• Transaction records — including deposit and withdrawal amounts, timestamps, and payment method references — are retained as part of your account history for a minimum of 5 years from the date of the transaction for regulatory compliance purposes.
• 999pkr applies transaction monitoring systems to identify patterns consistent with money laundering or suspicious financial activity. Where such activity is detected, 999pkr is legally obligated to file a report with the relevant financial intelligence authority under its licensing obligations, regardless of the amounts involved.

999pkr uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and analyse how players interact with different sections of the site. A cookie is a small text file placed on your device when you visit a website.

The types of cookies used on 999pkr are as follows:

Strictly necessary cookies cannot be disabled as they are essential for the platform to function. Functional and analytics cookies may be disabled through your browser settings or by contacting 999pkr support. Note that disabling functional cookies may affect your platform experience.

999pkr does not use third-party advertising cookies and does not participate in cross-site advertising networks that would allow other websites to track your activity after you leave 999pkr.

999pkr shares personal data with third parties only in the limited circumstances described below. All third-party data processors engaged by 999pkr are bound by strict data processing agreements requiring them to handle personal data securely, use it only for the specified purpose, and comply with applicable data protection standards.

• KYC Verification Partners: Identity documents (CNIC images and selfie photographs) are shared with our authorised KYC partner solely for the purpose of age and identity verification. The KYC partner is prohibited from using this data for any other purpose.
• Payment Processors: Payment data is shared with licensed payment gateway providers (covering JazzCash, EasyPaisa, bank transfer networks, and crypto rails) to process deposits and withdrawals. Payment processors are prohibited from using your data beyond the specific transaction being processed.
• Game Software Providers: Certain game providers (including Evolution Gaming, Pragmatic Play, and similar licensed studios) receive session identifiers and bet data necessary to run their games within the 999pkr platform environment. No additional personal data beyond what is required for game operation is shared.
• Regulatory Authorities: 999pkr may be required to disclose identity, financial, and gaming data to its licensing authority, financial intelligence units, or law enforcement agencies upon receipt of a lawful request. 999pkr will comply with all such lawful requests and will notify the affected player where legally permitted to do so.
• Fraud Prevention Services: Technical data including IP addresses and device fingerprints may be shared with fraud prevention platforms to identify multi-accounting, bonus abuse, or other prohibited activities.

999pkr implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security posture is reviewed and updated on a regular basis in response to emerging threats.

• Encryption: All data stored on 999pkr servers is encrypted at rest using AES-256 encryption. All data transmitted between your device and the platform is encrypted in transit using TLS 1.3.
• Password Security: Player passwords are stored exclusively as salted cryptographic hashes. 999pkr staff cannot view your plain-text password and will never ask you for it.
• Access Controls: Access to personal data within 999pkr's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and security training.
• Two-Factor Authentication: 999pkr offers SMS-based two-factor authentication (2FA) for player accounts. Players are strongly encouraged to enable 2FA to protect their account from unauthorised access.
• Intrusion Detection: 999pkr operates automated intrusion detection systems that monitor platform traffic in real time for signs of unauthorised access attempts, DDoS attacks, and other security threats.
• Security Audits: 999pkr's platform and data handling practices are subject to periodic independent security audits. Identified vulnerabilities are remediated according to a risk-prioritised schedule.

999pkr retains personal data for no longer than is necessary for the purposes for which it was collected. The specific retention periods applicable to each data category are set out below:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identifiable individual. Anonymised, aggregated data (which cannot identify any individual player) may be retained indefinitely for statistical and platform improvement purposes.

As a registered player on 999pkr, you hold the following rights in respect of your personal data. These rights are subject to applicable legal limitations and may in some cases be balanced against 999pkr's regulatory obligations.

• Right of Access: You have the right to request a copy of the personal data held about you by 999pkr, together with information about how it is being used and with whom it has been shared.
• Right to Rectification: If personal data held about you is inaccurate or incomplete, you have the right to request that it be corrected. Contact information can be updated directly within your account settings; identity data corrections require re-verification.
• Right to Erasure: You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. This right is subject to 999pkr's obligation to retain certain data for regulatory compliance periods as set out in §10 above.
• Right to Restrict Processing: You may request that 999pkr restricts processing of your data — for example, while the accuracy of the data is being contested — rather than deleting it outright.
• Right to Data Portability: You have the right to receive your account data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests. 999pkr will cease such processing unless compelling legitimate grounds can be demonstrated that override your rights.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights above, please send a written request to [email protected] with the subject line "Data Rights Request" and your registered account email address. 999pkr will respond to all verified data rights requests within 30 calendar days.

If 999pkr discovers or is notified that personal data belonging to a person under the age of 21 has been collected — whether through a fraudulent registration or any other means — the following actions will be taken immediately:

• The account will be suspended and all gaming activity halted pending investigation.
• Any real-money funds deposited by or on behalf of the minor will be refunded to the originating payment method after identity verification.
• All personal data collected in connection with the account will be securely deleted from 999pkr systems within 72 hours of the account being identified as belonging to a minor.
• The incident will be logged and, where required by our licensing obligations, reported to the relevant regulatory authority.

Parents and guardians in Pakistan who believe their child may have accessed or registered on 999pkr are urged to contact us immediately at [email protected] so that the matter can be investigated and resolved without delay. We take underage access extremely seriously and have KYC verification controls specifically designed to prevent it.

999pkr reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or operational procedures. When material changes are made to this policy, 999pkr will notify registered players via the email address associated with their account at least 14 days before the changes take effect.

The updated Privacy Policy will be published at https://999pkr.org/privacy-policy with a revised "Last Updated" date clearly indicated at the top of the page. Minor clarifications and corrections that do not materially affect your rights or our data practices may be made without prior notice.

We encourage all players to review this Privacy Policy periodically to stay informed about how 999pkr protects their personal data. Previous versions of this Privacy Policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 999pkr handles your personal data, please contact our Data Protection team using the details below. We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a full response within 30 calendar days.