99pak Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how 99pak ("we", "us", "our") collects, processes, uses, stores, and protects the personal data of individuals ("you", "Player", "User") who access, register with, or use the 99pak online casino and sports betting platform accessible at 99pak.biz ("Platform").

We recognise that Pakistani players — whether based in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, or elsewhere across the country — have a legitimate interest in understanding exactly how their personal information is handled when they entrust it to 99pak. This Policy is written to be as clear and accessible as possible while meeting the legal obligations imposed by our international gaming licence.

By registering an Account with 99pak, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to the terms of this Policy, you must not register an Account or use the 99pak Platform.

For the purposes of applicable data protection law, 99pak is the data controller in respect of personal data processed in connection with the operation of the Platform. As data controller, 99pak is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out in compliance with applicable law and our regulatory obligations under our international gaming licence.

If you have any questions about this Policy or wish to exercise any of your data rights as described in Section 11, please contact our Data Protection team using the contact details provided in Section 17 of this Policy.

99pak collects several categories of personal data in the course of providing the Platform and its associated services. The table below summarises the main categories of data we collect, with examples of the specific data types within each category.

We do not collect any special category personal data (such as health data, biometric data, or political opinions) unless you voluntarily provide such information in the context of a responsible gaming request or support interaction, in which case it is processed solely for the purpose for which it was provided.

99pak collects personal data through the following primary channels:

• Direct provision by you: When you register an Account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion, you provide us with personal data directly.
• Automated collection: When you use the Platform, we automatically collect Technical Data and Usage Data through server logs, cookies, and similar tracking technologies. See Section 8 for full details of our use of cookies.
• Payment processors: When you deposit or withdraw via JazzCash, EasyPaisa, or a Pakistani bank, the relevant payment processor may share transaction data with us for the purpose of crediting your Account or processing your withdrawal.
• Identity verification services: During the KYC process, we may use third-party identity verification services to validate the authenticity of documents you submit. These services return a verification result to 99pak but do not retain your documents on our behalf.
• Fraud prevention services: 99pak subscribes to industry fraud prevention databases to identify patterns of fraudulent account creation or payment activity. Where a match is identified, we receive information sufficient to investigate the concern.

99pak processes your personal data on the following legal bases, which we identify in relation to each purpose for which data is processed:

99pak uses the personal data we collect for the following specific purposes:

• Account creation and management: To register your 99pak Account, verify your identity (age and identity verification), and maintain your Account throughout its lifecycle including any dormancy or closure procedures.
• Transaction processing: To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other accepted payment methods; to maintain accurate financial records; and to investigate and resolve transaction disputes.
• Gaming and betting services: To provide access to casino games, sports betting markets (including PSL cricket, international cricket, and other sports), lottery products, and all other gaming services available on the Platform; to record game outcomes; and to calculate and settle winnings.
• Regulatory compliance: To comply with all obligations under our international gaming licence, including KYC verification, AML transaction monitoring, responsible gaming interventions, and age verification.
• Customer support: To respond to your queries, investigate complaints, resolve account issues, and maintain records of support interactions for quality assurance and regulatory purposes.
• Fraud prevention and platform security: To detect and prevent fraudulent account creation, payment fraud, bonus abuse, cheating, and other forms of platform misuse; to investigate suspicious activity; and to enforce our Terms & Conditions.
• Platform improvement: To analyse usage patterns, identify popular features and pain points, and inform decisions about new features, game additions, and user experience improvements.
• Marketing communications: To send you promotional offers, bonus notifications, and product updates where you have opted in to receive such communications. See Section 12 for details of how to manage your marketing preferences.

99pak does not sell, rent, or trade your personal data to third parties. We share personal data with third parties only in the circumstances described below, and only to the extent necessary for the specified purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment service providers receive the transaction data necessary to process your deposits and withdrawals. These entities operate under their own privacy policies and are regulated by the State Bank of Pakistan.
• Game software providers: Suppliers of casino games and sports betting software integrated into the 99pak Platform may receive Technical Data (such as device type and session identifiers) required for game delivery. They do not receive your identity or payment data.
• Identity verification providers: Third-party KYC and identity verification services receive the documents and data necessary to verify your identity and age. These providers are contractually bound to handle your data securely and to use it only for verification purposes.
• Fraud prevention databases: We may share limited data with industry fraud prevention services to identify and investigate fraudulent activity, in the legitimate interest of protecting 99pak and our player community.
• Regulatory and law enforcement authorities: Where required by our international gaming licence, applicable law, or a valid order of a court or competent authority, we may disclose personal data to regulators, law enforcement agencies, or tax authorities. We will notify you of such disclosure where legally permitted to do so.
• Professional advisers: Our lawyers, auditors, accountants, and insurers may access personal data to the extent necessary to provide their professional services, subject to professional confidentiality obligations.

99pak uses cookies and similar tracking technologies (including local storage, session storage, and web beacons) on the Platform. The following categories of cookies are used:

99pak does not use third-party advertising or retargeting cookies. We do not participate in cross-site behavioural advertising networks. Your gaming activity on 99pak is not shared with or used to target advertising on other websites.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your 99pak Account. Instructions for managing cookies are available in the help documentation of your preferred browser (Chrome, Firefox, Safari, etc.).

99pak implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. Key security measures include:

• Encryption in transit: All data transmitted between your device and 99pak's servers is encrypted using 256-bit SSL/TLS protocols. This applies to login credentials, payment information, gaming data, and customer support communications.
• Encryption at rest: Sensitive personal data stored on 99pak's servers — including KYC documents, CNIC copies, and financial data — is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within 99pak is restricted on a strict need-to-know basis. All staff with access to personal data undergo data protection training and are bound by confidentiality obligations. Access rights are reviewed periodically and revoked immediately upon role change or departure.
• Security monitoring: 99pak's infrastructure is subject to continuous security monitoring, including intrusion detection systems, anomaly detection, and regular penetration testing by independent security professionals.
• Incident response: 99pak maintains a data breach response plan. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected Players and the relevant supervisory authority within the timeframes required by applicable law.

While we implement robust security measures, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their 99pak Account and to enable two-factor authentication (2FA), which provides an additional layer of protection against unauthorised access.

99pak retains personal data only for as long as is necessary to fulfil the purposes for which it was collected or as required by our regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Where data is anonymised rather than deleted, the anonymised data may be retained for statistical and analytical purposes without time limit.

Subject to the legal bases under which we process your data and any applicable regulatory retention requirements, you have the following rights in relation to your personal data held by 99pak:

To exercise any of the rights above, please contact our Data Protection team via live chat or at the email address in Section 17. We will acknowledge your request within 72 hours and respond substantively within 30 days. We may ask you to verify your identity before processing a data rights request.

We will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request.

99pak will only send you promotional and marketing communications — including bonus offers, new game announcements, PSL betting promotions, and seasonal offers — where you have explicitly opted in to receive such communications during Account registration or subsequently through your Account Settings.

Marketing communications from 99pak may be sent via email, SMS to your registered Pakistani mobile number, or browser push notification (if you have enabled push notifications for the Platform). You can manage your preferences for each channel independently from the Notifications section of your Account Settings.

If you no longer wish to receive marketing communications from 99pak, you may:

• Disable communications from your Account Settings at any time (takes effect within 72 hours);
• Contact our support team via live chat or the contact email in Section 17, and request removal from our marketing lists.

Please note that opting out of marketing communications does not affect the delivery of transactional communications necessary for the operation of your Account, including deposit confirmations, withdrawal notifications, security alerts, and important account notices.

Players who have self-excluded from 99pak will be removed from all marketing lists immediately and will not receive any promotional communications for the duration of their self-exclusion period.

The 99pak Platform is strictly for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. If 99pak becomes aware that an Account has been registered by or on behalf of a person under 21 years of age, the Account will be closed immediately, and all funds will be handled in accordance with our Terms & Conditions and regulatory requirements.

Any personal data belonging to a person under 21 that has been collected inadvertently will be deleted from our systems as promptly as practicable upon discovery.

99pak operates under an international gaming licence and is subject to comprehensive Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations. The collection and processing of personal data for KYC and AML purposes is a legal obligation — without it, we cannot lawfully permit you to withdraw funds from your Account.

For KYC and AML purposes, 99pak collects and processes:

• Government-issued photo identification (CNIC — front and back) to verify your identity, date of birth, and nationality;
• Proof of address (recent utility bill or bank statement) dated within three months;
• Source of funds documentation where the volume or pattern of transactions requires enhanced due diligence under our licence obligations;
• Transaction monitoring data, including deposit and withdrawal history, betting patterns, and payment method usage.

Data collected for KYC and AML purposes is subject to the extended retention periods described in Section 10 and may be shared with regulatory authorities or law enforcement as described in Section 7. This processing is not subject to your right to erasure while the applicable regulatory retention obligation is in force.

99pak operates internationally and some of the third-party service providers with whom we share personal data (as described in Section 7) may process data outside of Pakistan. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable under our gaming licence, 99pak takes steps to ensure an adequate level of protection is in place.

These steps may include:

• Entering into standard contractual clauses approved by the relevant supervisory authority;
• Transferring only to recipients that operate under binding corporate rules or equivalent internal data protection frameworks;
• Relying on the necessity of the transfer for the performance of a contract with you (for example, processing a payment through an international payment network).

You may request further information about the safeguards in place for any specific international data transfer by contacting our Data Protection team using the details in Section 17.

99pak reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the Policy — for example, if we introduce a new category of data processing or share data with a new category of third party — we will provide you with advance notice by email to your registered Account address and/or by displaying a prominent notification at login.

The effective date of any updated Policy will be clearly stated at the top of the document. Your continued use of the 99pak Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any change to this Policy, you must stop using the Platform and close your Account.

We recommend that you review this Privacy Policy periodically to remain informed of how 99pak is protecting and using your personal data. The most current version of this Policy is always available from the footer navigation of the 99pak Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data 99pak holds about you, please contact our Data Protection team. We aim to respond to all data-related enquiries within 72 hours and to resolve substantive requests within 30 days.

You may contact us through the following channels:

• Live Chat: Available 24/7 via the 99pak Platform. This is the fastest route to a response — our support team has an average response time of 3–5 minutes.
• Email: [email protected] — please use the subject line "Data Protection Request" so your enquiry is directed to the appropriate team member without delay.

Please note that data rights requests submitted by email will require identity verification before we process your request. We will ask you to confirm your registered Account email address and, in some cases, provide a copy of the CNIC already on file with us, to ensure we are responding to the genuine Account holder.

If you are not satisfied with 99pak's response to a data-related complaint, you may escalate the matter to the relevant supervisory authority identified under our international gaming licence. Details of the applicable supervisory authority will be provided upon request.

99pak is committed to resolving all privacy and data protection concerns promptly and in good faith. We take our data stewardship responsibilities seriously and welcome feedback on how we can improve our privacy practices for the benefit of our Pakistani player community.