Privacy Policy — y 999 Data Protection for Pakistani Players

1Who We Are — About y 999

This Privacy Policy applies to y 999, the online betting and gaming platform accessible at y999.cash. When this Policy refers to "y 999", "we", "us" or "our", it means the platform and the team operating it. When it refers to "you", "your" or "the player", it means any registered or visiting user of y999.cash.

y 999 is Pakistan's dedicated online betting and gaming platform, offering cricket betting, Ludo games, slots, virtual sports and related services to players across Pakistan. All services on y 999 are delivered exclusively through y999.cash and no other website or application unless explicitly communicated to you through your registered account.

Understanding who controls your data is the starting point of any honest privacy policy. At y 999, the platform itself is the data controller — meaning we decide why and how your personal data is processed, and we are directly responsible for ensuring that processing is lawful, fair and transparent. We do not outsource that responsibility.

2What Personal Data y 999 Collects

y 999 collects personal data in two broad categories: data you provide directly to us and data generated automatically when you use the platform. Here is a detailed breakdown of what we collect and why each category matters for the operation of the platform.

2.1 Data You Provide Directly

2.2 Data Generated by Your Activity

3How y 999 Collects Your Data

y 999 collects your personal data through the following channels:

• Account Registration: When you create your y 999 account, you provide your mobile number, chosen username, password and date of birth directly through the registration form.
• Account Verification: When you submit identity documents to verify your y 999 account before withdrawals, you provide CNIC details and documents through the secure verification portal.
• Deposits and Withdrawals: When you initiate a transaction, payment method details are provided to enable the transaction. y 999 does not store full card numbers — card data is processed directly by our payment processor.
• Platform Usage: Technical and session data is collected automatically when you browse y999.cash, log in to your account or place bets and play games. This is standard for any web-based platform and happens through server logs, session cookies and analytics tools.
• Customer Support: When you contact y 999 support, the content of your communications is recorded and associated with your account for case management purposes.
• Responsible Gaming Tools: If you use self-exclusion, deposit limits or other responsible gaming tools on y 999, your preferences and the dates those tools were activated are recorded to ensure they are properly enforced.

4Why y 999 Uses Your Personal Data

y 999 processes your personal data only for legitimate, specific purposes. Here is a complete account of every reason we use your data:

4.1 Delivering the Platform Services

The core reason y 999 holds your data is to provide the services you registered for — creating and maintaining your account, processing your deposits and withdrawals in Pakistani Rupees, settling your bets, recording your game entries and results, and providing access to all products on y999.cash. Without this processing, y 999 simply cannot function for you.

4.2 Identity Verification and Fraud Prevention

y 999 verifies player identities to protect both you and the platform from fraud, money laundering and account takeover. CNIC verification before withdrawals ensures that only the genuine account holder can access funds. Our fraud monitoring systems analyse transactional data in real time to flag unusual patterns that may indicate account compromise or financial crime.

4.3 Customer Support

When you contact y 999, we use your account data and communication history to resolve your issue as quickly as possible. We do not make you re-explain your situation from scratch every time — support staff have access to your account history, relevant bets and previous communications so they can help you effectively.

4.4 Responsible Gaming Compliance

y 999 uses session and transactional data to monitor for indicators of problem gambling behaviour — for example, increasing session duration, significant changes in deposit frequency or patterns consistent with chasing losses. This analysis is used to trigger responsible gaming outreach and to enforce any limits or exclusions you have set for your y 999 account.

4.5 Platform Improvement

Aggregated, anonymised usage data — how pages are navigated, where users drop off in a flow, which features get the most use — helps y 999 understand what is working well and what needs improvement. This analysis never involves identifying individual players; it is statistical in nature and used purely for product development.

4.6 Marketing Communications

If you have opted in to marketing communications from y 999, we use your contact details to send you information about promotions, new features and upcoming events relevant to your interests on the platform. You can opt out of marketing communications at any time by contacting support@y999.cash or following the unsubscribe instruction in any message we send. Opting out of marketing does not affect your ability to use y 999.

5Legal Basis for Processing Your Data

y 999 processes your personal data on the following legal bases:

• Contractual Necessity: Processing your account data, transactions and game records is necessary to fulfil the contract between you and y 999 when you register and use the platform.
• Legitimate Interests: Fraud detection, security monitoring, platform analytics and responsible gaming monitoring are carried out on the basis of y 999's legitimate interest in operating a safe, fair and sustainable platform. These interests are balanced against your rights and do not override them.
• Legal Obligation: Identity verification, anti-money-laundering checks and record-keeping obligations are carried out because they are required by applicable standards and regulations.
• Consent: Marketing communications are sent only where you have given explicit consent. You can withdraw that consent at any time without consequence to your account.

6Sharing Your Personal Data — Who Sees It

y 999 does not sell your personal data to any third party under any circumstances. Full stop. However, running a platform of this nature does require working with certain service providers, and your data may be shared with them in limited, controlled ways. Here is every category of third party that may receive your data:

6.1 Payment Processors

When you deposit or withdraw funds, transaction data is shared with the relevant payment processor — Easypaisa, JazzCash, NayaPay, SadaPay, your bank or your card network. These processors receive only the minimum data required to complete your transaction. They operate under their own privacy policies and data protection obligations and are not permitted to use your data for any purpose beyond processing your payment.

6.2 Identity Verification Providers

y 999 uses a secure identity verification service to validate CNIC documents. Your identity documents are transmitted to this service via an encrypted connection solely for the purpose of verification. The provider does not retain your documents beyond the verification process.

6.3 Technology Infrastructure Providers

y 999 operates on cloud hosting and uses content delivery services to ensure the platform is fast and stable for Pakistani players. These providers host data on our behalf under strict data processing agreements and have no independent right to access or use your personal data.

6.4 Legal and Regulatory Disclosure

y 999 may be required to disclose your personal data to law enforcement or regulatory authorities in response to a lawful request, court order or to investigate suspected fraud or financial crime. We will notify you of any such disclosure where we are legally permitted to do so.

7How y 999 Protects Your Data

Data security at y 999 is taken seriously because we understand that the data we hold — financial details, identity documents, betting history — is sensitive and its compromise could cause you real harm. Here is what we do to protect it:

• TLS Encryption in Transit: All data transmitted between your device and y999.cash is encrypted using TLS (Transport Layer Security). This means that data cannot be intercepted or read by third parties while it is in transit.
• Encrypted Storage: Sensitive data — including identity documents and payment details — is stored in encrypted form. Passwords are never stored in plain text; they are hashed using an industry-standard one-way hashing algorithm.
• Access Controls: Access to player personal data within y 999 is strictly limited to staff who need it to perform their role. All access is logged and reviewed. No employee can access your data without a legitimate operational reason.
• Two-Factor Authentication: y 999 offers two-factor authentication (2FA) for player accounts. We strongly recommend enabling 2FA in your account settings to add an additional layer of protection.
• Fraud Monitoring: Automated systems monitor login activity and transactions on y 999 for patterns consistent with account compromise. Suspicious activity triggers security flags and, where appropriate, temporary account suspension pending your review.
• Regular Security Reviews: y 999 conducts periodic reviews of its data security practices and infrastructure to identify and address vulnerabilities before they can be exploited.

8How Long y 999 Retains Your Data

y 999 retains personal data only for as long as it is necessary for the purposes described in this Policy. Here is the specific retention approach for different categories of data:

• Account Data: Retained for the lifetime of your y 999 account and for 5 years following account closure. This period is required for legal compliance and to resolve any disputes that may arise after closure.
• Transaction Records: Bet records, deposit and withdrawal history are retained for 7 years from the date of the transaction. This reflects standard financial record-keeping requirements.
• Identity Verification Documents: CNIC scans and verification records are retained for the duration of your account plus 5 years. Copies of physical identity documents are not retained beyond the verification process.
• Support Communications: Records of your interactions with y 999 support are retained for 3 years from the date of the last communication in a case.
• Marketing Consent Records: Records of your consent to receive marketing communications are retained for the period during which you are subscribed plus 2 years after opt-out, to demonstrate compliance.
• Technical/Session Logs: Server logs and session data are retained for 90 days for security analysis purposes and then deleted.

When data is no longer required, y 999 deletes or irreversibly anonymises it. Data that is anonymised — where it is no longer possible to identify you from it — may be retained indefinitely for statistical and product development purposes.

9Cookies & Tracking Technologies on y 999

y 999 uses cookies and similar tracking technologies to operate the platform effectively and to understand how it is being used. Here is a clear breakdown of what we use and why:

9.1 Strictly Necessary Cookies

These cookies are essential for y 999 to function. They maintain your login session, ensure security tokens are properly managed and remember your account preferences. Without these cookies, you cannot log in or use y 999. These cookies cannot be disabled.

9.2 Performance and Analytics Cookies

y 999 uses analytics tools to understand aggregate usage patterns — which pages get the most traffic, where users encounter problems, how the mobile experience compares to desktop. This data is aggregated and anonymised; it does not identify individual players. You can opt out of analytics cookies via your browser settings or by contacting support@y999.cash.

9.3 Functional Cookies

Functional cookies remember your preferences — for example, your preferred language, notification settings and responsible gaming tool configurations. They make your experience on y 999 more consistent and convenient across sessions.

9.4 Managing Cookies

Most mobile and desktop browsers allow you to view, manage and delete cookies stored by websites. Deleting strictly necessary cookies will require you to log in again. Deleting or blocking analytics and functional cookies will not affect your ability to use y 999 but may reduce the convenience of the experience.

10Your Privacy Rights as a y 999 Player

You have meaningful rights over your personal data held by y 999. These rights are real and exercisable — not theoretical. Here is each right and how to use it:

11Children's Privacy — Under 18s and y 999

y 999 is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not attempt to register for or use y 999.

If y 999 becomes aware that a player is under 18, or that personal data has been submitted by or on behalf of a minor, we will immediately suspend the relevant account, delete the data associated with it and void any bets or game entries. Parents or guardians who believe their child may have registered on y 999 should contact us immediately at support@y999.cash so we can take prompt action.

We encourage parents and guardians to use parental control tools and to have open conversations with young people about responsible online activity. y 999 supports the use of third-party parental control software to restrict access to betting and gaming websites.

12Changes to This Privacy Policy

y 999 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer or applicable standards. When we make changes, we will update the "Last Updated" date at the top of this page.

For material changes — those that significantly affect how we collect, use or share your personal data — we will notify you directly via your registered mobile number or email address at least 7 days before the changes take effect. Continued use of y 999 after the effective date of updated policy terms constitutes your acknowledgement of those changes.

We recommend bookmarking this page and reviewing it periodically. If you have questions about any updates, our support team is available 24/7 and your privacy rights as described in Section 10 remain exercisable at all times regardless of policy updates.

13Contact y 999 About Privacy

If you have any questions, concerns or requests regarding this Privacy Policy or the personal data y 999 holds about you, please get in touch. Our privacy team and support staff are here to help.

• Privacy Requests: privacy@y999.cash
• General Support: support@y999.cash
• FAQ: y999.cash/faq
• Terms and Conditions: y999.cash/terms-conditions
• Responsible Gaming: y999.cash/responsible-gaming

For data access, correction, deletion or portability requests, please email privacy@y999.cash from your registered contact address and include "Privacy Request" in the subject line. Include your y 999 username and a brief description of your request. We will acknowledge within 5 business days.