99y Privacy Policy — How We Keep Your Data Safe

99y is an online entertainment platform available at 99y.onl, offering sports betting, Live Casino, Slots, Bingo, and Esports markets to adult players in Pakistan. When this Privacy Policy refers to "99y", "we", "us", or "our", it means the platform operating at 99y.onl and responsible for processing your personal data.

This Privacy Policy applies to all users who access 99y — whether through the website or the 99y mobile app. It covers data collected during registration, during active use of the platform, during payment processing, and after account closure for as long as retention obligations require.

By registering on 99y and using the platform, you confirm that you have read and understood this Privacy Policy. It should be read alongside the Terms and Conditions, which also form part of your agreement with 99y.

99y collects two broad categories of data: information you provide directly when you register and use the platform, and information collected automatically through your device and browsing behaviour on the site.

Information you provide directly:

• Full name and date of birth (required for age verification)
• Email address and account password
• Mobile number (used for account security and notifications)
• Identity documents submitted during KYC — such as your CNIC — where verification is required
• Payment account details, including JazzCash or Easypaisa mobile numbers, bank account details, or card numbers used for PKR deposits and withdrawals
• Communications you send to 99y support, including chat logs and emails

Information collected automatically:

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Login timestamps and session duration
• Pages visited, bets placed, games played, and betting history
• Cookie and session data as described in Section 6

Every piece of data 99y collects has a specific, legitimate purpose. We do not collect data speculatively or "just in case". The table below maps the main data types to the reason they are collected and processed.

99y does not use your personal data to build advertising profiles, does not share it with marketing agencies, and does not use it for purposes beyond those listed here without first obtaining your consent or being required to do so by law.

All financial transactions on 99y are processed in Pakistani Rupees (PKR). When you make a deposit or request a withdrawal using JazzCash, Easypaisa, Raast, bank transfer, or a debit/credit card, your payment details are handled with strict security controls in place.

Payment data is shared only with the payment processor needed to complete your specific transaction. For example, if you deposit via JazzCash, your mobile number and transaction reference are shared with JazzCash to confirm the payment. No broader financial profile is built using this data, and payment processors are contractually bound to use your data solely for processing the transaction.

Transaction records — the amounts, dates, and methods of deposits and withdrawals — are retained in your account history for your reference and for 99y's internal records. These records may also be required in the event of a dispute or audit. If you close your account, transaction records are retained for a period consistent with legal obligations before being deleted.

99y does not sell, rent, or trade your personal data to any third party. Data is shared externally only in the limited circumstances described below, and only with parties that are contractually bound to handle it responsibly.

• Payment processors: JazzCash, Easypaisa, Raast, banking partners, and card networks receive only the data needed to process your PKR transactions.
• Identity verification providers: Where third-party KYC tools are used to verify documents, your identity data is shared solely for the purpose of that verification check.
• Fraud prevention services: Device and behavioural data may be shared with fraud detection systems to protect the platform and all its players from malicious activity.
• Legal obligations: If required by a valid legal process or authority, 99y may disclose data as legally obligated. We will not volunteer data beyond what is specifically requested and required.
• Game providers: Some casino and Bingo games are provided by third-party studios. Basic account identifiers may be shared with game providers to enable gameplay — no sensitive financial or identity data is included in this sharing.

99y uses cookies — small text files stored on your device — to make the platform work properly and to improve your experience over time. Below is a plain-English explanation of the types of cookies used.

• Essential cookies: These are necessary for the platform to function. They keep you logged in during your session, maintain your language and currency preferences, and remember items in your bet slip. You cannot opt out of essential cookies without affecting core platform functionality.
• Analytics cookies: These help 99y understand which pages are most visited, how players navigate the platform, and where performance can be improved. This data is aggregated and anonymised — it does not identify you personally.
• Security cookies: Used to detect unusual login patterns, repeated failed login attempts, and other signals that may indicate unauthorised access to your account.

99y does not use third-party advertising cookies or tracking pixels that follow you across other websites. The cookies used are limited to those that serve a genuine platform purpose. You can manage cookie preferences through your browser settings, though disabling essential cookies will affect your ability to use the platform normally.

Protecting your data is a core part of how 99y operates. The platform applies a range of technical and organisational measures to keep your personal and financial information secure at all times.

• All data in transit between your device and 99y's servers is encrypted using TLS (Transport Layer Security).
• Passwords are stored in hashed form — your actual password is never stored in readable text anywhere on our systems.
• Payment card data is handled via a PCI-DSS compliant gateway; full card numbers are never stored on 99y servers.
• Access to player data within 99y is restricted on a need-to-know basis — support and operations staff see only what is necessary to do their job.
• Systems are monitored for suspicious activity and potential intrusions around the clock.

Despite all measures in place, no system connected to the internet can be guaranteed to be completely impenetrable. In the unlikely event of a data breach that affects your personal information, 99y will notify affected users promptly and take all reasonable steps to limit the impact.

99y does not hold on to your data longer than necessary. The period for which data is retained depends on the type of data and the reason it was collected.

• Active account data: Retained for the entire duration your account remains open and active on the platform.
• Transaction and betting records: Retained for a minimum of five years after account closure to meet financial record-keeping obligations and to allow for dispute resolution within a reasonable window.
• KYC documents: Retained for the period required by applicable anti-money laundering obligations, typically five years from the date of verification or account closure, whichever is later.
• Support correspondence: Retained for up to three years from the date of the last interaction to allow for follow-up on ongoing matters.
• Analytics data: Anonymised analytics data may be retained indefinitely as it cannot be used to identify individual players.

Once the relevant retention period has elapsed, data is either permanently deleted from 99y's systems or anonymised in a way that makes it impossible to link back to your identity.

You have meaningful rights over the personal data 99y holds about you. These rights can be exercised by contacting 99y support with your request. We aim to respond within a reasonable timeframe — typically within 30 days of receiving a valid request.

99y is strictly an adult platform. No person under the age of 18 is permitted to register, deposit, or use any feature of the 99y platform. We do not knowingly collect personal data from anyone under 18 years of age.

If it comes to our attention that a person under 18 has registered an account or provided personal data, the account will be closed immediately, any deposited funds will be returned where practicable, and all data associated with the minor will be deleted as quickly as possible.

99y encourages adults in households with young people to use device-level controls and parental management tools to prevent minors from accessing online gaming platforms. The Responsible Gaming page contains further guidance on keeping gaming safe and age-appropriate within the household.

99y may update this Privacy Policy from time to time as the platform evolves, as new payment methods are added, or as applicable legal requirements change. When material changes are made, players will be informed via an in-platform notification or an email to the address registered on their account.

The "Last Updated" date at the top of this page reflects when the current version was published. We recommend reviewing this policy periodically, especially if you have been inactive on the platform for a while and are returning to your account. Continued use of 99y after changes are published constitutes acceptance of the revised Privacy Policy.

If a planned change would require us to use your existing data in a fundamentally different way, we will seek your consent before making that change rather than relying solely on a policy update notification.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or need to report a privacy concern, you can reach the 99y team through the following channels:

• Email: [email protected] — please copy this address manually into your email client.
• FAQ: Visit the FAQ page for answers to common questions about accounts, payments, and data.
• Responsible Gaming: For concerns about gaming habits, deposit limits, or self-exclusion, visit the Responsible Gaming page.
• Terms and Conditions: This policy should be read alongside the Terms and Conditions, which cover account rules, betting, and payments in full.

We aim to respond to all privacy-related queries within a reasonable timeframe. For urgent matters involving suspected unauthorised access to your account, please mark your message clearly so the support team can prioritise it accordingly.