Privacy Policy — How 99pkr Handles Your Data

1 Introduction

99pkr is Pakistan's dedicated online casino and sports betting platform, built specifically for Pakistani players. We understand that when you share your personal information with us — whether that is your CNIC number during identity verification, your JazzCash wallet details during a deposit, or simply your email address at registration — you are placing a significant degree of trust in us. That trust is something 99pkr takes seriously.

This Policy is written in plain, accessible English so that every player, whether based in Karachi, Lahore, Islamabad, Faisalabad, or anywhere else across Pakistan, can clearly understand their rights and our responsibilities. Where legal language is necessary, we have explained it in straightforward terms directly below each clause.

This Policy applies to all personal data processed in connection with the 99pkr website, mobile platform, customer support channels, marketing communications, and any other service offered under the 99pkr brand. It should be read alongside the 99pkr Terms & Conditions, which govern the overall use of the platform.

2 Data Controller

For the purposes of applicable data protection legislation, 99pkr acts as the data controller in respect of all personal data collected and processed through the platform. As data controller, 99pkr determines the purposes for which personal data is collected and the means by which it is processed.

All data-related enquiries, subject access requests, and complaints regarding 99pkr's data practices should be directed to our dedicated support team using the contact details provided in Section 14 of this Policy.

3 Personal Data We Collect

99pkr collects personal data in the following categories, depending on how you interact with the platform:

4 How We Collect Your Data

99pkr collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your account profile.
• Automated collection: Technical data collected automatically through cookies, log files, and analytics tools each time you access the 99pkr platform. This includes your IP address, device identifiers, and session activity.
• Payment processors: Confirmation data received from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank when processing your deposits and withdrawals. 99pkr does not receive or store your full banking credentials — only transaction confirmation references.
• Identity verification providers: Where third-party KYC verification services are used to authenticate your identity documents, a confirmation result is shared with 99pkr. The raw document images may be processed by the verification provider under their own privacy terms.
• Responsible gaming assessments: Where a Player voluntarily completes a responsible gaming questionnaire or where our system automatically flags unusual patterns, relevant data is recorded to support player wellbeing monitoring.

5 Purpose & Legal Basis for Processing

99pkr processes your personal data only where a valid legal basis exists. The table below sets out each processing purpose alongside its corresponding legal basis:

6 Data Retention

99pkr retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable gaming regulations and anti-money laundering legislation. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in compliance with AML and gaming licence requirements.
• Financial transaction records: Retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required in connection with an ongoing dispute.
• Marketing consent records: Retained for the duration of your marketing consent plus three (3) years following withdrawal of consent, as evidence of compliance.
• Technical and analytics data: Typically retained for thirteen (13) months on a rolling basis, after which it is aggregated and anonymised.

When data is no longer required, it is securely deleted or anonymised in accordance with 99pkr's internal data destruction procedures.

7 Sharing Your Personal Data

99pkr may share your personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, solely for the purpose of processing your deposits and withdrawals. These processors operate under their own regulatory frameworks and privacy obligations.
• Identity verification providers: Third-party KYC service providers used to authenticate your identity documents as required by gaming licence obligations. All such providers are contractually bound to process data only for the specified verification purpose.
• Game software providers: Licensed game suppliers whose products are available on the 99pkr platform may receive anonymised session data for the purpose of game performance monitoring and RNG auditing.
• Regulatory and law enforcement authorities: 99pkr may disclose personal data to relevant authorities where required to do so by law, court order, or in response to a formal regulatory request under applicable gaming or financial legislation.
• Responsible gaming organisations: In cases of confirmed self-exclusion or escalated responsible gaming concerns, limited account data may be shared with cross-platform exclusion registries as required by our licensing obligations.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by 99pkr, subject to strict confidentiality obligations.

8 Cookies & Tracking Technologies

The 99pkr platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your session preferences, and to analyse how players interact with different sections of the site. The following categories of cookie are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication tokens that keep you logged in during your betting session. These cookies cannot be disabled without breaking core platform functionality.
• Performance cookies: Used to collect anonymised data about how players navigate the platform, which game categories are most visited, and where technical errors occur. This data is used solely to improve the 99pkr platform experience.
• Functional cookies: Store your preferences such as language settings, preferred payment method display, and responsible gaming limit reminders, so you do not need to reconfigure them on each visit.
• Marketing cookies: Only deployed where you have provided explicit opt-in consent. These cookies allow 99pkr to personalise promotional offers based on your gaming activity. You may withdraw consent at any time via your account settings.

You may manage cookie preferences through your browser settings at any time. Disabling certain cookies may impact the functionality of some features on the 99pkr platform.

9 Security Measures

99pkr implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption across all platform sessions, transactions, and API communications.
• Two-factor authentication (2FA) available to all players as an optional but strongly recommended additional login security layer.
• Role-based access controls ensuring that 99pkr staff members can only access player data where strictly necessary for their specific job function.
• Regular penetration testing and security audits conducted by independent third-party security professionals.
• Encrypted storage of all identity documents and financial data at rest, using industry-standard encryption protocols.
• Automated fraud detection systems that monitor account activity in real time for patterns indicative of unauthorised access or financial abuse.

In the event of a data breach that is reasonably likely to affect your rights or interests, 99pkr will notify affected Players without undue delay and in accordance with our obligations under applicable data protection regulations.

10 Your Data Rights

As a 99pkr player, you have the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected] (plain text — not a clickable link) with "Data Rights Request" in the subject line:

• Right of Access: You may request a copy of all personal data 99pkr holds about you (a "subject access request"). We will respond within five (5) business days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Identity-critical fields (such as your legal name or CNIC number) may require document re-submission for correction.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations under gaming and AML regulations.
• Right to Restrict Processing: You may request that 99pkr temporarily restrict the processing of your data while a rectification or objection request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring purposes. We will assess your objection and respond within ten (10) business days.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11 Minors & Age Verification

99pkr employs automated age-estimation checks at registration and requires mandatory CNIC-based identity verification prior to processing any withdrawal. If you are a parent or guardian and believe that a minor has registered an account on 99pkr using your or their details, please contact our support team immediately. We will take prompt action to close the account and review any transactions made.

12 Third-Party Links

The 99pkr platform does not contain links to external third-party websites for commercial or advertising purposes. In the event that any informational reference to an external resource is included (for example, links to responsible gaming organisations referenced in our Responsible Gaming section), 99pkr is not responsible for the privacy practices or content of those external sites.

We recommend that you review the privacy policy of any external site you visit independently of the 99pkr platform.

13 Updates to This Privacy Policy

99pkr reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, platform services, or applicable regulatory requirements. Where changes are material — for example, where we introduce a new category of data processing or a new third-party data recipient — registered Players will be notified by email at least seven (7) days before the revised Policy takes effect.

The most current version of this Policy is always published at 99pkr.bet/privacy-policy, with the "Last Updated" date clearly displayed at the top of the document. We encourage you to review this Policy periodically. Your continued use of the 99pkr platform following publication of a revised Policy constitutes your acceptance of the updated terms.

If you do not agree with any update to this Policy, you should cease using the platform and may request account closure by contacting our support team.

14 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or would like to raise a complaint regarding 99pkr's data practices, please contact our support team through the following channels:

• Email: [email protected] — please include "Privacy Request" or "Data Complaint" in the subject line
• Live Chat: Available 24/7 on the 99pkr platform, with an average response time of 3–5 minutes
• Messenger & Viber: Available for queries requiring document exchange or detailed correspondence

99pkr will acknowledge all data-related requests within 24 hours of receipt and will provide a substantive response within five (5) business days for standard requests, or ten (10) business days for complex subject access requests. If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the relevant supervisory authority under our gaming licence jurisdiction.