Privacy Policy

This Privacy Policy (the "Policy") is published by 999zc (the "Platform", "we", "us" or "our"), the operator of the website accessible at https://999zc.cam and all associated sub-domains, mobile interfaces and applications (collectively, the "Service").

The Policy describes how we collect, receive, use, store, share, transfer and process personal data belonging to individuals ("Users", "you" or "your") who access, register with or otherwise interact with the Service. It is intended to satisfy our transparency obligations under applicable data protection law and to help you make informed decisions about your use of the Service.

The Service is operated in English and is oriented towards users located in Pakistan. Where we refer to local payment context — such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — this is for orientation purposes only and does not imply that any of these providers processes your data on our behalf or endorses the Service.

The following terms carry the meanings set out below throughout this Policy:

"Personal Data"

Any information that identifies or can reasonably be used to identify a living natural person, directly or indirectly — including name, email address, national identity number, device identifiers and transaction history.

"Processing"

Any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

"Data Controller"

The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, 999zc is the Data Controller in respect of your Personal Data.

"Data Processor"

A third party that processes Personal Data on behalf of the Data Controller in accordance with documented instructions.

"KYC"

Know Your Customer — the identity and address verification process required under the operator's licence conditions and applicable anti-money laundering obligations.

"Special Category Data"

Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data used for identification, or data concerning a person's sex life or sexual orientation. We do not intentionally collect Special Category Data except where strictly necessary for responsible-gambling assessments or where required by applicable law.

"Consent"

A freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data for a specified purpose, given by a clear affirmative action.

We collect Personal Data in the following categories, depending on how you interact with the Service:

3.1 Registration and Identity Data

• Full legal name, date of birth, residential address and nationality.
• Email address, mobile phone number and username chosen at registration.
• Account credentials (password is stored in hashed form and is never accessible to staff in plain text).

3.2 Identity Verification (KYC) Documents

• Government-issued photo identification: National Identity Card (CNIC), passport or driver's licence.
• Proof of residential address (e.g., utility bill or bank statement issued within three months).
• Proof of payment method ownership (e.g., screenshot of registered mobile wallet or bank statement header).
• In certain circumstances: source-of-funds documentation, selfie or liveness-check data used to match against identity documents.

3.3 Financial and Transaction Data

• Deposit amounts, timestamps and payment method references (e.g., last four digits of a card, or a mobile wallet account identifier).
• Withdrawal requests, amounts and processing status.
• Wager history, game session records and balance snapshots required for regulatory record-keeping and dispute resolution.

3.4 Technical and Device Data

• IP address, browser type and version, operating system and device type.
• Time zone and language settings (which may indicate your approximate location — e.g., PKT/UTC+5 consistent with use in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar).
• Session identifiers, login timestamps and access logs.
• Cookie identifiers and similar tracking technologies as described in Section 9.

3.5 Communications Data

• Content of support tickets, live chat transcripts and email correspondence with our support team.
• Records of complaints and their resolution.
• Survey responses and voluntary feedback where submitted.

3.6 Responsible Gambling Data

• Deposit limit, loss limit and session limit settings applied to your account.
• Self-exclusion status, cooling-off period records and account restriction history.
• Responsible gambling assessments conducted where the Platform has reason to believe a player may be at risk of gambling-related harm.

We process your Personal Data only where we have a valid legal basis to do so. The applicable legal bases are as follows:

We use your Personal Data for the following purposes, in accordance with the legal bases identified in Section 4:

• Account Creation and Management: Registering your account, verifying your identity, managing your profile, processing your preferences (including deposit limits and self-exclusion status) and communicating account-related notifications.
• Transaction Processing: Receiving and processing deposit instructions, executing withdrawals, maintaining an accurate transaction ledger in PKR and resolving payment queries or disputes.
• Fraud Prevention and Security: Monitoring account activity for signs of unauthorised access, money laundering, identity fraud or other financial crime. Sharing relevant data with fraud prevention agencies or law enforcement where required.
• KYC and AML Compliance: Verifying your identity before processing withdrawals, assessing source-of-funds information where required, and maintaining records required under applicable anti-money laundering obligations.
• Customer Support: Responding to enquiries, resolving complaints, processing account closure requests and maintaining records of support interactions for quality assurance.
• Responsible Gambling: Monitoring wagering patterns that may indicate problem gambling, enforcing account limits and self-exclusion requests, and proactively reaching out where the Platform has reasonable cause for concern.
• Platform Analytics: Understanding how Users interact with the Service, measuring feature performance and identifying areas for improvement. Analytics data is processed in aggregated or pseudonymised form where practicable.
• Legal and Regulatory Compliance: Meeting record-keeping obligations, responding to regulatory enquiries, complying with court orders and satisfying obligations under the operator's licence conditions.
• Marketing: Where you have opted in, sending you information about promotions, offers and platform updates. See Section 10 for how to manage your marketing preferences.

We do not sell your Personal Data to third parties for their own independent commercial purposes. We share your data only in the following circumstances:

6.1 Service Providers (Data Processors)

We engage third-party service providers who process Personal Data on our behalf, under written data-processing agreements that restrict them from using your data for any purpose other than delivering the contracted service. Categories of processor include:

• KYC and Identity Verification Providers: Services that verify the authenticity of identity documents and perform liveness checks.
• Payment Processors: Entities that facilitate the technical execution of deposit and withdrawal transactions. This may include processors connected to local payment infrastructure familiar to Pakistani users, such as mobile wallets and bank transfer networks, subject to the operator's current cashier configuration.
• Fraud Detection and AML Services: Providers that screen transactions and account behaviour against fraud databases and sanctions lists.
• Customer Support Platforms: Software providers that host our live chat and ticketing systems.
• Analytics Providers: Services that help us understand platform usage patterns, operating under data minimisation and pseudonymisation constraints.
• Cloud Infrastructure Providers: Hosting and storage providers whose infrastructure underpins the Platform.

6.2 Legal and Regulatory Disclosure

We may disclose your Personal Data to governmental authorities, law enforcement agencies, regulatory bodies or courts where required to do so by applicable law, court order, regulatory direction or in connection with legal proceedings. We will endeavour to notify you of such disclosure where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or substantially all of the operator's assets, your Personal Data may be transferred to the successor entity, which will be required to honour this Policy or provide you with a materially equivalent privacy notice and opt-out opportunity.

The Platform and its service providers may process your Personal Data in countries outside your country of residence, including countries whose data protection laws differ from those in your jurisdiction. Where such transfers occur to countries that do not provide an equivalent level of protection, we implement appropriate safeguards — such as standard contractual clauses, processor agreements incorporating binding data protection commitments, or other recognised transfer mechanisms — to ensure that your data receives a consistent level of protection.

If you wish to obtain information about the specific safeguards applicable to international transfers of your data, please contact us as set out in Section 16.

We retain Personal Data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

After the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes.

The Platform uses cookies and similar tracking technologies (including local storage and session identifiers) to operate the Service, maintain your login session, remember your preferences and collect analytics data. The categories of cookies in use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. They maintain your authentication session, remember your deposit limit settings and enable core security features. These cookies cannot be disabled without preventing you from using the Service.
• Functional Cookies: Remember your preferences such as language settings, time zone display (PKT) and interface layout choices to improve your experience across sessions.
• Analytics Cookies: Collect aggregated data about how users navigate the Platform — pages visited, session duration, error events — to help us improve the Service. Analytics data is processed in pseudonymised form where practicable.
• Marketing Cookies: Where you have consented, these cookies may be used to deliver relevant promotional content. You may withdraw consent at any time via your account preferences or your browser's cookie controls.

You may manage or delete cookies via your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Service. Browser-level cookie controls vary by browser; consult your browser's help documentation for instructions.

Where you have given consent at registration or at any subsequent point, we may contact you with information about promotions, bonuses, platform updates and sports betting offers — including content relevant to cricket, PSL/T20 and ICC tournaments — by email, push notification or in-platform messaging.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your marketing preferences in your account settings.
• Using the unsubscribe link included in any marketing email.
• Contacting our support team at [email protected] with a clear written request to cease marketing communications.

Withdrawal of marketing consent does not affect the lawfulness of any processing carried out before withdrawal, and does not affect transactional communications (such as deposit confirmations, withdrawal notifications and security alerts) which are sent as part of the contractual relationship.

Subject to applicable data protection law and the operator's legal retention obligations, you have the following rights in respect of your Personal Data:

To exercise any of these rights, please submit a written request to our support team as described in Section 16. We will acknowledge your request within 5 business days and respond within 30 days. Where a request is complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

We may request proof of identity before processing a rights request to ensure that Personal Data is not disclosed to, or altered at the instruction of, an unauthorised person.

We implement technical and organisational measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• Encryption in Transit: All data exchanged between your browser or application and our servers is encrypted using TLS (Transport Layer Security). This includes account credentials, KYC documents submitted via the Platform and payment data.
• Encryption and Access Controls at Rest: Sensitive data categories — including KYC documents and financial records — are stored with encryption and subject to role-based access controls that restrict staff access to the minimum required for each function.
• Password Hashing: Account passwords are never stored in plain text. We apply a one-way cryptographic hashing algorithm with appropriate salting.
• Security Monitoring: Platform systems are monitored for anomalous activity. Access logs are retained and reviewed in accordance with security incident procedures.
• Third-Party Security Assessments: Key service providers are assessed for security practices as part of vendor due diligence.
• Staff Training: Personnel with access to Personal Data receive data protection training and are bound by confidentiality obligations.

Notwithstanding these measures, no internet-based transmission or storage system is completely secure. If you believe your account has been compromised, please contact our support team immediately via live chat or at [email protected] and change your password without delay.

The Service is not directed at, and must not be used by, any person under the age of 18 (or the higher minimum age required by the operator's licence jurisdiction or by the laws of the user's country of residence). We do not knowingly collect Personal Data from minors.

If we become aware that Personal Data has been collected from a person who was underage at the time of collection, we will take prompt steps to delete that data and close the associated account. Any funds held in such an account will be dealt with in accordance with the operator's licence conditions and applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account or submitted Personal Data via the Platform, please contact us immediately as set out in Section 16.

The Platform may, in limited circumstances, reference third-party services or content in an informational context — for example, familiar payment method names such as Easypaisa or JazzCash — without those third parties being data processors for 999zc or processing your data on our behalf as part of the Service. In such cases, the privacy practices of those third parties are governed entirely by their own privacy policies.

We are not responsible for the privacy practices, content or security of any third-party services, even where they are referenced on the Platform. We encourage you to review the privacy notices of any third-party service you access in connection with your payment methods or otherwise.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory guidance or the structure of our services. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Publish the revised Policy at https://999zc.cam/privacy-policy.
• Where reasonably practicable, provide you with notice of material changes via email or an in-platform notification upon your next login.

Your continued use of the Service after the publication of an updated Policy constitutes your acknowledgement of the changes. If you do not accept the updated Policy, you must cease using the Service and may request account closure by contacting our support team.

To exercise your data rights, submit a privacy query or raise a complaint about how we have handled your Personal Data, please contact the 999zc data team through the following channels. As a reminder, email addresses on this Platform are displayed as plain text only and are not clickable links:

• Email: [email protected]
  For data rights requests, please use the subject line "Data Rights Request" and include your registered username or email address, a clear description of your request and a copy of a valid identity document so that we can verify your identity before processing the request.
• Live Chat: Available 24/7 via the chat widget on any page of the Platform.
  Suitable for initial queries; complex data rights requests should be followed up in writing via email to create a verifiable record.

We aim to acknowledge all data rights requests within 5 business days and to provide a substantive response within 30 days. Where a request is complex, we may extend this period by a further 30 days and will notify you accordingly.