999 DS Privacy Policy – How We Protect Your Personal Data in Pakistan

This Privacy Policy is issued by 999 DS ("we," "us," "999 DS," "the Platform"), the operator of the online gaming platform accessible at 999ds.biz. 999 DS is the data controller responsible for the personal information collected through the platform and associated services.

999 DS was built specifically for Pakistani players and operates with a Pakistan-first approach. Every decision about data collection, storage and usage is made with the interests of our Pakistani user base at the forefront. If you have any questions about how 999 DS processes your data, you can reach our team at support@999ds.biz at any time.

This policy should be read alongside the 999 DS Terms and Conditions and our Responsible Gaming policy, which together form the complete framework governing your relationship with the platform.

999 DS collects personal data through three main channels: information you provide directly, information generated automatically by your use of the platform, and information received from third-party payment processors for verification purposes.

999 DS uses your personal data for the following specific purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent:

• Account creation and management: To set up, maintain and operate your 999 DS player account, including verifying your identity at registration and at subsequent verification checkpoints.
• Transaction processing: To process deposits and withdrawals via Easypaisa, JazzCash, IBFT and other supported Pakistani payment methods accurately and securely.
• Game provision: To deliver the games and services you access on 999 DS and to record game results and account balances correctly.
• Bonus and promotion administration: To credit, track and manage bonuses, free spins and promotional rewards linked to your account, including verifying eligibility and wagering compliance.
• Customer support: To respond to your queries, resolve account issues and communicate with you about transactions or account activity.
• Fraud prevention and security: To detect and prevent fraud, money laundering, account takeover attempts and other illegal activity. This includes analysis of transaction patterns and device fingerprinting.
• Legal and regulatory compliance: To fulfil our obligations under applicable anti-money laundering (AML) and know-your-customer (KYC) requirements, and to respond to lawful requests from regulatory or law enforcement authorities.
• Responsible gaming: To monitor gaming activity for signs of problematic behaviour and to administer player-requested limits, reality checks and self-exclusion requests.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, design and game offering of 999 DS.
• Marketing communications: To send you relevant promotional offers and updates about 999 DS — but only where you have opted in to receive them. You can opt out at any time.

999 DS processes your personal data under the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: Processing required to fulfil the Terms and Conditions you agreed to when registering — including account management, payment processing and game provision.
• Legal obligation: Processing required to comply with AML, KYC and other applicable legal requirements, including responding to lawful requests from authorities.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring and platform improvement — where these interests do not override your fundamental rights.
• Consent: Processing for optional marketing communications and any non-essential data uses — with your explicit opt-in. Consent can be withdrawn at any time without affecting processing that occurred before withdrawal.

999 DS does not sell your personal data to any third party. We share your data only in the following circumstances, and only to the extent necessary for the specific purpose:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank partners and Visa/Mastercard networks — to process your deposits and withdrawals. These parties act as independent data controllers for their portion of the transaction and have their own privacy obligations.
• Identity verification providers: Third-party KYC and AML service providers who assist 999 DS in verifying player identity and monitoring for financial crime risk. All such providers are contractually bound to process data only for the specified verification purpose.
• Game software providers: The providers of the game titles available on 999 DS may receive limited technical data (such as session identifiers) necessary to operate the game. They do not receive your full identity or payment details.
• Fraud prevention and security services: Specialist fraud detection platforms that help 999 DS identify and prevent account compromise, payment fraud and coordinated abuse.
• Legal and regulatory authorities: 999 DS will disclose personal data to law enforcement agencies, regulators or courts when required to do so by a valid legal obligation or lawful request. We will not disclose data beyond what is legally required.
• Professional advisers: Lawyers, auditors and other professional service providers who are bound by confidentiality obligations and who access data only to the extent necessary for their professional engagement.

999 DS uses cookies and similar tracking technologies to provide a functional, secure and personalised experience on the platform. A cookie is a small text file placed on your device when you visit a website. Cookies do not directly identify you, but they help us recognise your device and remember your preferences.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in or using core platform functions. 999 DS does not use third-party advertising cookies or cross-site tracking cookies.

999 DS retains personal data for as long as necessary to fulfil the purposes for which it was collected, and for as long as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your active account relationship with 999 DS.
• Transaction records: Financial transaction records are retained for a minimum of five years following the date of the transaction, in line with standard AML and financial record-keeping requirements.
• Identity verification documents: Retained for a minimum of five years following account closure or the completion of the verification process, whichever is later.
• Support communications: Retained for three years after the interaction is closed, to allow for follow-up or dispute resolution if needed.
• Marketing consent records: Retained for the duration of your marketing opt-in, plus one year following any opt-out to demonstrate compliance.
• Technical and analytics data: Anonymised after 12 months and retained in aggregated form for platform improvement purposes only.

Following the expiry of the applicable retention period, 999 DS will securely delete or anonymise your personal data. Where deletion is not immediately possible due to technical constraints, the data will be isolated and protected from further processing until secure deletion can be carried out.

As a player on 999 DS, you have the following rights over your personal data. To exercise any of these rights, contact us at support@999ds.biz with your account details and a description of your request. We will respond within 30 days.

999 DS is strictly an adult platform. The minimum age of registration is 18 years. We do not knowingly collect, store or process personal data belonging to any individual under the age of 18.

If we discover or are notified that a person under 18 has provided personal data to 999 DS and created an account, we will immediately close that account, delete all associated personal data, and return any funds deposited to the payment method from which they originated.

If you are a parent or guardian and believe that a minor under your care may have registered on 999 DS, please contact us immediately at support@999ds.biz. We will investigate and take action within 24 hours of receiving your report.

999 DS takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it from unauthorised access, alteration, disclosure or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and 999 DS servers.
• Encryption at rest for all sensitive personal and financial data stored in 999 DS databases.
• Role-based access controls ensuring only authorised personnel can access personal data, and only to the extent their role requires.
• Regular penetration testing by independent security firms to identify and address potential vulnerabilities.
• Multi-factor authentication for all administrative access to systems containing player data.
• Automated threat detection systems that monitor for unusual access patterns, injection attempts and other security events in real time.

Whilst 999 DS takes every reasonable precaution to protect your data, no platform or transmission method over the internet is 100% secure. You also play an important role in data security by keeping your login credentials private and enabling two-factor authentication on your 999 DS account.

999 DS may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will notify you by email and via a prominent notice on the 999 DS platform before the changes take effect.

The "Last Updated" date at the top of this page will be revised whenever the policy is changed. We encourage you to review this policy periodically so that you remain informed about how 999 DS handles your personal data.

Continuing to use 999 DS after a change notice has been issued constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes made to this policy, please contact us to discuss your options or to close your account.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a complaint about how 999 DS has handled your personal information, please get in touch:

• Email: support@999ds.biz
• Subject line: "Privacy Request – [Your Account Username]"
• Response time: Within 30 days for data rights requests; within 3 minutes on live chat for general queries.

We take all privacy complaints seriously. When we receive a complaint, we will acknowledge it within 5 business days and aim to resolve it fully within 30 days. If your complaint is complex and requires more time, we will inform you of the expected timeline and keep you updated on progress.

If you are not satisfied with how 999 DS has handled your privacy concern after raising it with us directly, you may have the right to escalate the matter to a relevant data protection authority. We will provide guidance on the appropriate escalation route if requested.