Six Commitments 999y Makes About Your Privacy
Before the full policy, here's what matters most — in plain terms
We Never Sell Your Data
999y does not sell, rent, or trade your personal information to any third party for marketing purposes. Your data stays within our platform ecosystem.
Encryption End-to-End
All data transmitted between your device and 999y is protected with TLS encryption. Payment data is handled by PCI-DSS compliant processors and never stored on our servers in full.
Minimal Data Collection
We only collect what is genuinely needed to operate your 999y account, process payments, comply with legal obligations, and improve your experience. Nothing more.
You Control Your Data
You can access, correct, export, or request deletion of your personal data at any time by contacting support@999y.click. We respond within 30 days.
Clear Retention Limits
We don't keep your data forever. Retention periods are defined by legal requirements and genuine business need. Once those periods pass, data is securely deleted or anonymised.
You'll Know About Changes
If we make a material change to this Privacy Policy, we will notify you by email and via an in-platform notice before the change takes effect.
This Privacy Policy applies to 999y ("we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://999y.click (the "Platform"). 999y is the data controller in respect of all personal data collected through the Platform and this Policy explains our practices in relation to that data.
999y is a platform built specifically for players in Pakistan. All processing described in this Policy relates to Pakistani players and the Pakistani regulatory context. If you have questions about who is responsible for your personal data, or about any aspect of this Policy, you can contact our Data Protection contact at support@999y.click.
This Policy is written in straightforward English so that every 999y player understands exactly what they are agreeing to. Where legal terms are unavoidable, we explain them. If anything is still unclear, email support@999y.click and we will explain it personally.
999y collects the categories of personal data described below. We only collect data that is necessary for the specific purposes outlined in Section 4 of this Policy.
2.1 Registration Data
When you create a 999y account we collect: your full legal name, date of birth, gender, email address, and mobile phone number. This information is required to create your account and verify your identity.
2.2 Identity Verification (KYC) Data
For accounts requesting large withdrawals (above Rs 50,000) or flagged for identity verification, we collect copies of your CNIC (Computerised National Identity Card), a selfie for liveness verification, and proof of payment method ownership. KYC documents are processed by our verified identity partner and stored encrypted.
2.3 Financial Data
We record your deposit and withdrawal transactions, including the payment method used (e.g., Easypaisa, JazzCash, IBFT), transaction amounts in PKR, timestamps, and reference numbers. We do not store full card numbers or complete mobile wallet credentials on our servers — those are handled by our PCI-DSS compliant payment processors.
2.4 Betting and Gaming Activity Data
We record every bet placed, game round played, sport selected, odds accepted, win or loss outcome, and bonus interaction on your 999y account. This data is essential for account integrity, dispute resolution, responsible gaming monitoring, and improving the platform.
2.5 Technical and Device Data
We collect IP addresses, device type and model, operating system and version, browser type, time zone, and session timestamps. This data is used for security monitoring, fraud detection, and improving platform performance on the devices Pakistani players actually use.
2.6 Communication Data
If you contact 999y support via email, live chat, or any other channel, we retain records of that communication including the content of messages and any attachments provided. This enables us to maintain service quality and refer back to previous interactions.
2.7 Marketing Preferences
We record your marketing communication preferences — whether you have opted in or out of promotional emails, SMS notifications, and in-platform offers. You can update these preferences at any time in your account settings.
| Data Category | Examples | Collected At |
|---|---|---|
| Registration | Name, DOB, email, mobile | Account sign-up |
| KYC / Identity | CNIC copy, selfie | Verification request |
| Financial | Transactions, method, amounts | Deposits & withdrawals |
| Betting Activity | Bets, game rounds, outcomes | Ongoing platform use |
| Device / Technical | IP, device model, browser | Each login / session |
| Communications | Support messages | Customer support contacts |
| Marketing Prefs | Opt-in / opt-out status | Account settings |
999y collects personal data through the following channels:
- Directly from you: when you register, complete KYC, make deposits or withdrawals, place bets or play games, contact support, or update your account settings.
- Automatically: through cookies, session tracking, server logs, and analytics tools operating on the 999y platform when you visit or use the site.
- From third-party partners: identity verification providers who confirm KYC document authenticity; payment processors who confirm transaction status; fraud prevention partners who share signals about suspicious activity associated with device fingerprints or IP addresses.
We do not purchase personal data from data brokers, social media platforms, or any other third-party commercial data source for use in targeting or profiling 999y players.
999y uses your personal data only for the specific purposes described below. We do not process your data for any purpose that is incompatible with these stated purposes.
4.1 Providing and Operating the Platform
The primary use of your data is to operate your 999y account — processing your deposits, crediting your winnings, recording your bets, giving you access to games, and enabling withdrawals. Without this processing, 999y simply cannot function for you as a player.
4.2 Identity Verification and Fraud Prevention
We use your registration and KYC data to verify that you are who you say you are, that you meet the 18+ age requirement, and that the payment methods you use belong to you. Device and IP data is used to detect and prevent fraudulent activity, multi-accounting, and prohibited conduct as described in our Terms and Conditions.
4.3 Responsible Gaming Monitoring
Your betting activity data, session patterns, and deposit frequency are analysed by 999y's responsible gaming systems to identify potential signs of problematic gambling behaviour. If patterns consistent with harm are detected, 999y may reach out to you proactively or apply account restrictions as outlined in our Responsible Gaming policy. This processing is genuinely protective — not commercial.
4.4 Customer Support
Your communication data and account history are used by 999y support agents when you contact us. Having access to your transaction history, bet records, and previous support interactions allows our team to resolve queries accurately and quickly without making you repeat yourself every time.
4.5 Legal and Regulatory Compliance
We are required to retain certain data — particularly financial transaction records and KYC documents — for defined periods in compliance with applicable anti-money laundering (AML) and record-keeping obligations. We also process data when required to respond to lawful requests from law enforcement or regulatory authorities.
4.6 Platform Improvement and Analytics
Aggregated and anonymised data about how players use 999y — which games are most popular, where players encounter friction in the deposit flow, how the platform performs on different device types — is used to improve the product for all players. This analytics processing operates on anonymised data and cannot identify individual players.
4.7 Marketing Communications
If you have opted in to receive marketing communications, 999y may send you emails or SMS messages about new promotions, bonus offers, and platform features. You can unsubscribe at any time via the unsubscribe link in any email, by updating your preferences in account settings, or by contacting support.
999y processes your personal data on the following legal grounds:
- Contract performance: Processing necessary to provide your 999y account and the services you have requested (Sections 4.1, 4.4).
- Legal obligation: Processing required to comply with AML regulations, identity verification obligations, and lawful authority requests (Sections 4.2, 4.5).
- Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and product improvement where our interests do not override your fundamental rights (Sections 4.2, 4.3, 4.6).
- Consent: Marketing communications are sent only where you have given your explicit consent (Section 4.7). You may withdraw consent at any time.
999y shares your personal data only with the following categories of recipients, and only to the extent necessary for the purpose stated:
6.1 Payment Processors
Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT processors, and Visa/Mastercard gateway providers receive the transaction data necessary to process your deposits and withdrawals. These partners are contractually required to process your data only for payment purposes and to maintain appropriate security standards.
6.2 Identity Verification Partners
Our KYC verification partner receives copies of identity documents you submit for verification. They process these documents to confirm authenticity and return a verification result to 999y. Your documents are not stored by the verification partner beyond the period required to complete the verification.
6.3 Game Technology Providers
Third-party game providers whose titles are hosted within the 999y platform (for example, crash game providers) receive your player ID and relevant session data necessary to operate the game and record the outcome. They do not receive your full personal profile or financial details.
6.4 Fraud Prevention and Security Partners
Anonymised or pseudonymised device and behavioural signals may be shared with fraud detection partners to identify patterns associated with prohibited conduct. This sharing is done without exposing your full identity to those partners.
6.5 Legal Authorities
999y will disclose personal data to law enforcement, regulators, or courts when required to do so by a lawful order, legal process, or to protect the legal rights of 999y or other players. We will inform you of such disclosures where legally permitted to do so.
999y does not sell your personal data to any third party. We do not share your data with advertising networks for targeted advertising. We do not share your data with data brokers. We do not transfer your data to parties outside this Policy without your explicit consent.
999y uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small data file stored on your browser or device when you visit a website.
7.1 Essential Cookies
These cookies are necessary for the 999y platform to function. They maintain your login session, remember your language preferences, and enable secure navigation between pages. You cannot opt out of essential cookies and continue to use 999y — they are required for the platform to work.
7.2 Analytics Cookies
We use analytics cookies to understand how players use 999y — which pages are visited most, where players drop out of a deposit flow, how long sessions last. This data is aggregated and anonymised. It helps us make the platform faster and easier to use for Pakistani players.
7.3 Security Cookies
Security cookies record session identifiers and device fingerprints to detect and prevent session hijacking, account takeover attempts, and other security threats. These cookies are part of our commitment to keeping your account safe.
7.4 Managing Cookies
You can manage or delete cookies through your browser settings. Note that disabling non-essential cookies will not affect your ability to use 999y's core betting and gaming features. Most modern browsers provide straightforward cookie management options in their privacy settings.
999y does not use third-party advertising cookies or cross-site tracking cookies. We do not participate in any ad network that tracks your activity across websites beyond 999y.
Data security at 999y is not an afterthought — it is infrastructure. The following measures are in place to protect your personal data from unauthorised access, disclosure, alteration, or destruction:
- TLS Encryption in Transit: All data transmitted between your device and 999y's servers is encrypted using TLS (Transport Layer Security). This protects your login credentials, financial transactions, and account activity from interception.
- Encryption at Rest: Sensitive data stored on 999y's servers — including KYC documents, hashed passwords, and financial records — is encrypted at rest using AES-256 encryption standards.
- Password Hashing: Your 999y password is never stored in plain text. We use strong cryptographic hashing with unique salts so that even in the event of a data breach, your actual password cannot be recovered from stored data.
- Access Controls: Internal access to player data is restricted on a strict need-to-know basis. Support agents, for example, can see your account history but cannot see your hashed password, your full payment instrument details, or your KYC documents unless they have specific authorisation for a specific verified purpose.
- Two-Factor Authentication: 999y offers two-factor authentication (2FA) on account login and withdrawal requests. We strongly encourage all players to enable 2FA in account settings.
- Security Monitoring: Automated systems monitor 999y's infrastructure 24/7 for unusual access patterns, login anomalies, and potential data breach indicators. The security team reviews alerts in real time.
- Third-Party Security Assessments: 999y conducts periodic security assessments of its platform and key third-party partners to identify and address vulnerabilities before they can be exploited.
In the event of a personal data breach that poses a risk to your rights, 999y will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach. We maintain an incident response plan specifically for data security events.
999y does not retain your personal data indefinitely. We apply the following retention periods based on the nature of the data and the purpose for which it was collected:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account Registration Data | Account lifetime + 5 years | Legal compliance, AML obligations |
| KYC / Identity Documents | Account lifetime + 5 years | Regulatory retention requirements |
| Financial Transaction Records | 7 years from transaction date | Financial record-keeping obligations |
| Betting & Gaming History | Account lifetime + 5 years | Dispute resolution, regulatory |
| Support Communications | 3 years from last interaction | Service quality, dispute evidence |
| Device / Technical Logs | 12 months | Security and fraud monitoring |
| Marketing Preferences | Until withdrawn or account closed | Consent management |
After the applicable retention period, data is securely deleted or irreversibly anonymised. Anonymised aggregate data (e.g., platform usage statistics with no individual identification) may be retained indefinitely for product development purposes.
As a 999y player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at support@999y.click with your registered email address and a clear description of your request. We will respond within 30 days.
We may need to verify your identity before fulfilling a data rights request to ensure we do not disclose data to an unauthorised person. In such cases we will ask for your registered mobile number, email address, and potentially a photo ID.
999y is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you have reason to believe that a minor has registered a 999y account or provided us with personal data, please contact support@999y.click immediately so we can investigate and take appropriate action.
Where we discover that a 999y account belongs to a person under 18, we will immediately close the account, delete all associated personal data (except where legally required to retain it), and return any deposits to the originating payment source where technically possible.
If you are a parent or guardian and are concerned that your child may be using 999y, please contact us at support@999y.click. We take such reports seriously and investigate them with priority. We also recommend using parental control software to restrict access to gaming platforms on shared devices.
999y reviews and updates this Privacy Policy periodically to reflect changes in our data practices, legal requirements, and platform features. The date at the top of this page reflects when the current version was last updated.
When we make material changes — changes that meaningfully affect how we collect or use your personal data — we will:
- Send a notification email to your registered email address at least 14 days before the change takes effect.
- Display a prominent notice on the 999y platform explaining what has changed and why.
- Where required by applicable law, seek your renewed consent before the change takes effect.
Your continued use of 999y after a policy change takes effect constitutes your acceptance of the updated Privacy Policy. If you do not agree with the updated Policy, you should stop using 999y and may request account closure as described in our Terms and Conditions.
Previous versions of this Privacy Policy are available on request by emailing support@999y.click.
If you have any questions, concerns, or requests relating to this Privacy Policy or the way 999y handles your personal data, please get in touch:
Email: support@999y.click
Subject Line: "Privacy Request – [Your Name]"
Response Time: We aim to respond to all privacy requests within 30 calendar days. Complex requests may take up to 60 days, in which case we will acknowledge receipt and explain the delay.
Data Rights Requests: Include your registered email address and the specific right you wish to exercise. We will verify your identity before processing the request.
Responsible Gaming: For responsible gaming concerns, visit /responsible-gaming or contact us directly.
How to Make a Complaint
If you are not satisfied with how 999y has handled your personal data or responded to a data rights request, you have the right to escalate your complaint. We ask that you contact us first at support@999y.click so we have the opportunity to resolve the issue directly. We take all privacy complaints seriously and will investigate them thoroughly.
This Privacy Policy was last updated on 1 June 2025 and is effective for all 999y accounts as of that date.