999zc Privacy Policy

This Privacy Policy describes how 999zc (referred to throughout as "999zc", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals ("you", "the Player", "the User") who access or use the 999zc online gaming platform available at https://999zc.org.

999zc operates as an internationally licensed online gaming platform serving players across Pakistan. We are fully committed to handling your personal information in a transparent, lawful, and responsible manner. This policy has been drafted to give you a clear, complete understanding of our data practices so that you can make informed decisions about your use of the platform.

This Privacy Policy should be read alongside our Terms & Conditions, which together form the complete legal framework governing your relationship with 999zc. By registering for an account or using any 999zc service, you acknowledge that you have read and understood this Privacy Policy and consent to the processing activities described herein.

For the purposes of applicable data protection law, 999zc is the data controller responsible for your personal information. As data controller, 999zc determines the purposes for which and the means by which your personal data is processed.

All questions, requests, or concerns relating to your personal data and your rights under this Privacy Policy should be directed to the 999zc Data Protection team. Contact details are provided in Section 15 of this document.

Where 999zc engages third-party service providers to process data on its behalf — such as payment processors or KYC verification platforms — those parties act as data processors under contractual obligations that bind them to the same data protection standards applied by 999zc.

999zc collects the following categories of personal data from players in the course of account registration, KYC verification, gaming activity, and financial transactions:

999zc does not intentionally collect sensitive personal data beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive data — such as copies of national identity documents — is collected, it is handled with heightened security measures and retained only for the legally required period.

999zc collects personal data through the following channels:

• Direct Collection: Information you provide when registering your 999zc account, completing KYC verification, submitting deposit or withdrawal requests, contacting customer support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you access the 999zc platform, including IP addresses, session data, cookie identifiers, and device fingerprints gathered through our security and analytics infrastructure.
• Third-Party Sources: Identity verification data cross-referenced from licensed KYC and AML screening providers. Payment confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT processing services.
• Public Sources: In cases of fraud investigation, 999zc may reference publicly available information where permitted under applicable law.

999zc processes personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and 999zc — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing is required to comply with anti-money laundering (AML) regulations, age verification mandates (21+), gaming licence conditions, and tax reporting obligations.
• Legitimate Interests: Processing is necessary for 999zc's legitimate business interests, including fraud prevention, platform security, and improving service quality, provided these interests are not overridden by your own rights and interests.
• Consent: For certain non-essential processing activities — such as marketing communications and optional analytics — 999zc relies on your freely given, specific, and informed consent, which you may withdraw at any time.

999zc uses the personal data we collect for the following purposes:

• Creating, verifying, and managing your 999zc player account throughout its lifecycle.
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, bank transfer, and USDT TRC20, and maintaining accurate transaction records.
• Conducting identity and age verification (21+) as required under our gaming licence and AML compliance obligations.
• Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, and other prohibited conduct on the platform.
• Providing responsive 24/7 customer support via live chat and email.
• Administering bonuses, promotions, loyalty programmes, and tournament entries where applicable.
• Monitoring gaming behaviour to identify signs of problem gambling and applying responsible gaming tools in accordance with our duty of care to players.
• Sending transactional notifications relating to your account, such as deposit confirmations, withdrawal status updates, and security alerts.
• Sending marketing communications about 999zc promotions and new products, where you have provided explicit consent to receive such communications.
• Improving and developing the 999zc platform through aggregated analytics and user feedback.
• Complying with requests from regulatory authorities, law enforcement agencies, and courts of competent jurisdiction.

999zc does not sell your personal data. We share your information only in the limited circumstances described below, and only to the extent necessary for each purpose:

• Payment Processors: Financial data is shared with licensed payment service providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT processing partners solely to execute your transactions.
• KYC & AML Providers: Identity documents and personal details are shared with licensed identity verification and AML screening services to fulfil our regulatory obligations.
• Game Software Suppliers: Certain gameplay data may be processed by our licensed game providers — including live casino and slot studios — for the purpose of game delivery and RNG certification.
• Technology Infrastructure: Hosting, security, and platform infrastructure providers may process technical and account data under strict data processing agreements as sub-processors.
• Regulatory & Legal Authorities: 999zc will disclose personal data to gaming regulators, law enforcement agencies, financial intelligence units, and courts where required by applicable law or a valid legal order.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, player data may be transferred to the successor entity subject to the same privacy protections. Players will be notified of any such transfer.

999zc retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard data retention periods are as follows:

• Account Data: Retained for the duration of your active account relationship with 999zc, plus a minimum of five (5) years following account closure to comply with AML record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction in accordance with financial regulatory obligations.
• KYC Documents: Retained for the duration of the account relationship plus five (5) years following closure. Original document copies are securely destroyed upon expiry of the retention period.
• Support Communications: Chat and email records retained for three (3) years to facilitate dispute resolution and service quality review.
• Technical & Log Data: Server logs and session data retained for up to twelve (12) months for security and fraud prevention purposes.
• Marketing Consent Records: Retained for the duration of consent plus three (3) years as evidence of the lawful basis for any marketing communications sent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual player.

999zc implements robust technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption: All data transmitted between your device and 999zc servers is protected by 256-bit SSL/TLS encryption. Sensitive data at rest — including KYC documents and financial records — is encrypted using AES-256.
• Access Controls: Access to player personal data is restricted to authorised 999zc personnel and third-party processors on a strict need-to-know basis, enforced through role-based access control (RBAC) systems.
• Two-Factor Authentication: 999zc supports two-factor authentication (2FA) on player accounts to reduce the risk of unauthorised account access.
• Security Monitoring: Our platform is continuously monitored for suspicious activity, intrusion attempts, and anomalous access patterns by our dedicated security team.
• Penetration Testing: 999zc conducts regular independent security assessments and penetration tests to identify and remediate vulnerabilities in the platform infrastructure.

While 999zc employs industry-standard security measures, no online platform can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for reporting any suspected unauthorised access to your 999zc account immediately.

The 999zc platform uses cookies and similar tracking technologies to provide core platform functionality, enhance security, and improve the user experience. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the 999zc platform. These cookies enable session management, login authentication, and security features. They cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings and game lobby display options — so that you do not have to reconfigure them on each visit.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and interact with the 999zc platform, helping us identify areas for improvement. These cookies do not identify individual users.
• Security Cookies: Used to detect fraudulent activity, bot traffic, and suspicious session behaviour to protect player accounts and platform integrity.

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality or performance of the 999zc platform. 999zc does not use third-party advertising or behavioural tracking cookies.

Subject to applicable data protection law and the limitations imposed by our regulatory obligations, you have the following rights in relation to your personal data held by 999zc:

• Right of Access: You have the right to request a copy of the personal data 999zc holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data. You may update certain account details directly through your account settings panel.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal retention obligations — in particular, AML record-keeping requirements mean we cannot delete certain financial and identity records for the mandatory retention period.
• Right to Restriction: You have the right to request that 999zc restricts the processing of your personal data in certain circumstances, such as while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including direct marketing. Where you object to marketing, we will cease sending promotional communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact 999zc support in writing. We will respond to all valid data rights requests within thirty (30) calendar days. We may need to verify your identity before processing a request to protect against unauthorised access to your data.

The 999zc platform is strictly intended for adults aged 21 years and above. 999zc does not knowingly collect, process, or store personal data belonging to individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If 999zc becomes aware that personal data has been collected from a minor — through fraud, misrepresentation of age, or any other means — the account will be closed immediately, all associated data will be deleted as soon as permissible under applicable law, and any deposits held will be handled in accordance with our regulatory obligations and responsible gaming policies.

As an internationally licensed gaming platform, 999zc may transfer your personal data to countries outside Pakistan for processing by our licensed service providers — including KYC verification platforms, game software suppliers, and cloud infrastructure providers headquartered in other jurisdictions.

Where such international transfers occur, 999zc ensures that adequate safeguards are in place to protect your personal data to a standard equivalent to that applied within Pakistan. These safeguards include:

• Contractual data processing agreements incorporating appropriate data protection clauses binding third-party processors to 999zc's privacy standards.
• Transfer only to service providers operating in jurisdictions recognised as providing an adequate level of data protection.
• Regular review and audit of third-party processors to verify ongoing compliance with agreed data protection standards.

999zc reserves the right to update or amend this Privacy Policy at any time. Where material changes are made — changes that affect your rights or how we process your data in a substantively different way — we will notify registered players via the email address associated with their account and display a prominent notice on the 999zc platform.

The "Last Updated" date at the top of this document indicates when the policy was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how 999zc handles your personal data. Continued use of the platform following notification of material changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a data protection concern, please contact the 999zc Data Protection team through the following channel:

Please include "Privacy Request" in the subject line of your email along with your registered account username so that we can locate your records and respond to your request promptly. We aim to acknowledge all privacy enquiries within forty-eight (48) hours and resolve them within thirty (30) calendar days.

This Privacy Policy was last reviewed and updated on 1 January 2026. All previous versions are superseded by this current document.