999win Privacy Policy — How We Keep Your Data Safe in Pakistan

999win ("the Company," "we," "us" or "our") operates the online gaming platform accessible at https://999win-bangla.com and any associated mobile applications or sub-domains (collectively, "the Platform"). The Company acts as the data controller in respect of all personal data collected from Pakistani players and users of the Platform.

This Privacy Policy applies to all current and former players, registered members, visitors and any other individuals whose personal data the Company processes in connection with the Platform. By registering an account or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

999win collects the minimum personal information necessary to operate your account securely, process financial transactions in PKR and comply with our legal obligations. Below is a complete breakdown of every category of data we collect, why we collect it and on what legal basis.

2.1 Data You Provide Directly

Most of the personal data we hold is information you provide directly during registration, KYC verification, deposit/withdrawal requests or communications with our support team. We never ask for more than what is strictly necessary for the activity in question.

2.2 Data Collected Automatically

When you use the 999win Platform, certain technical data is collected automatically by our servers and analytics systems. This includes your IP address, device identifiers, browser type and session activity. This data is used primarily for security purposes — detecting unusual login patterns, preventing account takeovers and identifying fraudulent activity — rather than for commercial profiling.

999win uses your personal data only for purposes that are directly connected to providing and improving the Platform, protecting our players and complying with applicable law. We do not use your data for purposes that would surprise you or that you would reasonably object to.

• Account management: Creating and maintaining your 999win account, authenticating logins and processing account changes.
• Payment processing: Handling deposits and withdrawals in PKR through your chosen payment method, reconciling transactions and investigating payment queries.
• Identity verification: Performing age and identity checks at registration and before first withdrawal to comply with KYC requirements.
• Fraud and security: Monitoring for suspicious activity, detecting and preventing fraud, account takeovers and bonus abuse.
• Legal compliance: Meeting our anti-money laundering (AML) obligations, responding to legally valid requests from authorities and maintaining required records.
• Responsible gaming: Monitoring player behaviour for signs of problematic gambling and delivering interventions, limit reminders and support to players who may need them.
• Customer support: Responding to queries, resolving complaints and maintaining records of communications for quality assurance.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players use 999win and to prioritise improvements.
• Direct marketing (opted-in only): Sending promotional emails and notifications to players who have actively opted in to marketing communications. You may withdraw this consent at any time.

Every data processing activity at 999win rests on one of the following legal bases. We have mapped each activity to a specific basis and documented these internally. If you wish to understand the specific legal basis applied to any particular processing activity, please contact our Data Protection Officer.

• Contract performance: Processing necessary to register your account, process payments and provide the gaming services you have signed up for.
• Legal obligation: Processing required to comply with KYC, AML and other regulatory obligations — including identity verification and transaction monitoring.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement and responsible gaming monitoring — where these interests do not override your privacy rights.
• Consent: Processing for optional activities such as marketing communications, where you have given explicit, freely withdrawable consent.

999win does not sell, rent or trade your personal data to any third party. We share personal data only in the following specific, limited circumstances:

5.1 Service Providers

We engage vetted third-party service providers who assist with specific operational functions — including payment processing (Easypaisa, JazzCash, NayaPay, SadaPay, Visa/Mastercard networks), identity verification services, cloud infrastructure and customer support tools. These providers process your data solely under our instructions and are bound by strict contractual data protection obligations. They may not use your data for any other purpose.

5.2 Legal and Regulatory Disclosure

We may disclose personal data to law enforcement agencies, regulatory authorities or courts when we are legally required to do so, or when disclosure is necessary to prevent fraud, money laundering or other serious criminal activity. We will notify affected players of such disclosures where legally permissible.

5.3 Business Transfers

In the event of a merger, acquisition or sale of all or part of 999win's business, player data may be transferred to the acquiring entity. Any such transfer will be subject to data protection obligations equivalent to those described in this Policy, and affected players will be notified before any transfer takes effect.

Financial data requires the highest level of protection. When you make a deposit or request a withdrawal on 999win using Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or a Visa/Mastercard debit or credit card, we apply the following specific protections:

• Full card numbers and full mobile wallet account numbers are never stored on 999win servers — only tokenised references provided by the payment processor.
• All payment API calls are made over TLS-encrypted connections with certificate pinning on our mobile clients.
• Transaction anomaly detection monitors all PKR deposits and withdrawals for patterns inconsistent with normal player behaviour.
• All financial records are retained in encrypted form for the legally required period and then securely deleted.

Withdrawals are always directed to the same payment method used for the player's most recent deposit, in keeping with anti-money-laundering requirements. This ensures that funds always return to a verified source.

999win uses cookies and similar technologies to provide essential Platform functionality, maintain your logged-in session, remember your preferences and analyse Platform performance. We do not use third-party advertising cookies or tracking pixels.

7.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These maintain your session, handle authentication tokens and protect against cross-site request forgery. They cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as language settings, display options and game lobby filters. These can be disabled, but doing so will result in loss of those preferences between sessions.
• Analytics cookies: Used to understand aggregate usage patterns — which features are used most, where players encounter friction and how the Platform performs. Analytics data is anonymised before analysis and is never linked to individual player accounts.

7.2 Managing Cookies

You can control cookie settings through the 999win cookie preference centre (accessible via the notice at the bottom of this page) or through your browser settings. Blocking strictly necessary cookies will prevent you from using the Platform. Blocking analytics cookies will reduce our ability to identify and fix usability issues but will not affect your gaming experience.

999win retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of your account and for 5 years after account closure, in compliance with AML record-keeping requirements.
• Transaction records: Retained for 7 years from the date of the transaction, as required by financial regulations.
• Support communications: Retained for 2 years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical logs: Retained for 90 days for security monitoring, then automatically deleted.
• Marketing preferences and opt-in records: Retained for the duration of your account, and for 3 years after you opt out, to demonstrate your prior consent and subsequent withdrawal.

When data is no longer needed and retention periods have expired, it is securely deleted or anonymised using industry-standard destruction methods. Anonymised data (which cannot be linked back to any individual) may be retained indefinitely for statistical and research purposes.

The 999win Platform is strictly intended for persons aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If during identity verification or any other process we discover that an account holder is under 18, the account is immediately closed, all data is deleted and any deposited funds are returned to their source payment method.

Every 999win player has the following rights in relation to their personal data. These rights apply regardless of your account status and can be exercised at no cost:

• Right of Access: You may request a complete copy of all personal data we hold about you. We will provide this within 30 days of your request.
• Right to Rectification: You may ask us to correct any inaccurate personal data. We will update records within 5 business days of a verified correction request.
• Right to Erasure: You may request deletion of your personal data where there is no compelling reason for us to continue holding it. Note that legally required records (AML, KYC) cannot be deleted before their mandatory retention period expires.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format (CSV or JSON) to transfer to another service.
• Right to Restrict Processing: You may ask us to limit how we use your data in certain circumstances — for example, while a correction request is being verified.
• Right to Object: You may object to processing based on legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (such as marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@999win-bangla.com with the subject line "Data Rights Request" and your registered account email. We will verify your identity and respond within 30 days.

999win implements a layered security architecture to protect the personal data of all Pakistani players. Our technical and organisational measures include:

• TLS 1.3 encryption for all data in transit between your device and our servers.
• AES-256 encryption for all personal and financial data stored in our databases.
• Role-based access controls ensuring staff can only access data necessary for their specific function.
• Multi-factor authentication enforced for all internal staff accounts with access to player data.
• Continuous 24/7 security monitoring with automated alerts for anomalous data access patterns.
• Regular penetration testing and vulnerability assessments by independent third-party security firms.
• Formal incident response plan with defined escalation paths, containment procedures and player notification protocols.
• Annual security training for all staff with access to personal data.

Despite these measures, no online system is completely immune to security threats. In the event of a breach, 999win will act immediately to contain the incident, assess the impact and notify affected players within 72 hours with clear information about what occurred and what steps we are taking.

999win may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements or Platform developments. When we make material changes — those that meaningfully affect your rights or how we use your data — we will notify all registered Pakistani players via their registered email address at least 14 days before the changes take effect.

Minor updates that do not affect the substance of your rights (such as formatting improvements or clarifications) may be made without advance notice, but the "last updated" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically.

Your continued use of the 999win Platform after the effective date of any material Policy update constitutes acceptance of the revised Privacy Policy. If you do not agree with any change, you may close your account before the changes take effect.

If you have any questions, concerns or complaints about how 999win handles your personal data, please contact our Data Protection Officer directly. Our DPO is responsible for overseeing compliance with this Privacy Policy and all applicable data protection obligations.

• Privacy and Data Rights Queries: privacy@999win-bangla.com
• General Support: support@999win-bangla.com
• Live Chat: Available in your 999win account dashboard 24/7.
• FAQ: Visit the FAQ page for common privacy questions.

Privacy data rights requests will receive an acknowledgement within 24 hours and a full response within 30 days. If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.