Privacy at a Glance
All personal data transmitted to and from the 99y platform is protected by 256-bit TLS encryption. This applies to login credentials, payment details, identity documents, and all account communications — nothing travels unencrypted across the 99y network.
99y does not sell, rent, or commercially exchange your personal data with any third party for their own marketing or commercial purposes. Your data is used solely to operate the 99y platform, fulfil regulatory obligations, and improve your experience as a user.
99y recognises your rights to access, correct, restrict, and in certain circumstances request deletion of your personal data. Requests are handled by the 99y support team within 30 days. Full details of your rights and how to exercise them are set out in this Privacy Policy.
99y collects only the personal data necessary to operate the platform, verify your identity and age, process your PKR transactions, and fulfil its obligations under its international gaming licence. We do not collect data beyond what is needed for these purposes.
99y's data handling practices are governed by its international gaming licence requirements, which include mandatory data security standards, breach notification procedures, and player data retention limits. Compliance with these requirements is audited periodically by the licensing authority.
Your 99y login password is never stored in readable form. It is cryptographically hashed using industry-standard one-way algorithms, meaning 99y staff cannot view or retrieve your password — only reset it through a verified identity confirmation process upon your request.
Important Notice. This Privacy Policy is issued by 99y ("we," "us," or "our") and describes the personal data processing activities conducted in connection with the 99y gaming platform at 99y.biz. By registering an account or using any 99y service, you acknowledge that you have read this Privacy Policy and consent to the data processing described herein. This policy should be read alongside the Terms & Conditions.
99y is an internationally licensed online gaming and sports betting platform serving Pakistani users. As a licensed operator, 99y is subject to data protection obligations imposed by its licensing authority as a condition of maintaining its gaming licence. These obligations include, but are not limited to, requirements around the lawful basis for data processing, data minimisation, storage security, data retention limits, and individual rights.
This Privacy Policy applies to:
This Privacy Policy does not apply to third-party websites, payment processors, or services accessible via links on the 99y platform. Those services are governed by their own independent privacy policies, and 99y is not responsible for their data handling practices.
Our Commitment: 99y processes your personal data only for the purposes described in this Privacy Policy, only for as long as necessary, and only where a lawful basis exists. We do not process data in ways that are incompatible with the purposes for which it was originally collected.
For the purposes of this Privacy Policy, the data controller responsible for your personal information is the 99y platform operator, operating under an international gaming licence. The data controller determines the purposes and means of processing your personal data collected through the 99y platform and website.
Queries regarding the identity of the data controller, data processing activities, or any aspect of this Privacy Policy may be directed to the 99y support team using the contact details provided in Section 15 of this document.
99y collects the following categories of personal data in connection with platform registration and use:
| Data Category | Primary Purpose | Mandatory? |
|---|---|---|
| Identity & Registration | Account creation, age & identity verification | Yes — required by licence |
| Financial & Transaction | Processing PKR deposits & withdrawals, AML compliance | Yes — required for transactions |
| Gameplay & Betting | Platform operation, responsible gaming monitoring | Yes — inherent to service |
| Technical & Usage | Security monitoring, fraud prevention, platform improvement | Partly automatic on access |
| Communications | Support delivery, account notifications | When you contact us |
99y collects personal data through the following channels:
The majority of data 99y holds about you is provided directly by you during registration, identity verification, payment setup, and customer support interactions. This includes your CNIC details, mobile number, payment method information, and any documents submitted for KYC (Know Your Customer) verification.
When you access the 99y platform — whether through a browser or any other access method — certain technical data is automatically collected by the platform's servers. This includes your IP address, device identifiers, session timestamps, and navigation data. This collection is necessary for platform security, fraud prevention, and regulatory compliance, and occurs whether or not you are logged into an account.
99y uses cookies and similar browser-based technologies to maintain session state, remember your login preferences, and collect aggregate analytics data about platform usage. Cookies do not collect your personal financial or identity data. Further details are set out in Section 10 of this Policy.
When you complete a deposit or withdrawal through JazzCash, EasyPaisa, or a banking institution, 99y may receive confirmation data from the relevant payment provider confirming the transaction details, amount, and timestamp. 99y does not receive your full payment credentials from these providers — confirmation data is used solely to reconcile your account balance and transaction history.
99y uses collected personal data for the following purposes:
Marketing Communications: 99y may send you relevant platform notifications and promotional information where you have provided consent to receive such communications. You may opt out of marketing communications at any time through your account notification settings or by contacting support.
99y processes your personal data on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account registration and service delivery | Performance of contract — necessary to provide the services you have registered for |
| Age and identity verification | Legal obligation — required by international gaming licence conditions |
| AML / KYC compliance | Legal obligation — required under applicable financial crime prevention frameworks |
| Payment processing | Performance of contract — necessary to process deposits and withdrawals |
| Security and fraud monitoring | Legitimate interests — protecting the platform and users from unauthorised access and fraud |
| Responsible gaming monitoring | Legal obligation and legitimate interests — required by licence and in the interest of player welfare |
| Marketing communications | Consent — where you have opted in to receive promotional communications |
| Platform analytics and improvement | Legitimate interests — improving service quality using anonymised aggregate data |
99y shares personal data only in the following circumstances and only to the extent necessary for the relevant purpose:
To process your PKR deposits and withdrawals, 99y shares relevant transaction data with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard as applicable. These providers receive only the data necessary to execute the specific transaction requested. All payment partners engaged by 99y are required to maintain appropriate data security standards.
Where third-party identity verification services are used to support CNIC-based age verification, the minimum necessary identity data is shared with those providers under contractual data protection obligations. 99y does not retain CNIC document images beyond the period required for verification purposes.
99y may be required by its licensing authority or applicable law to disclose player data in connection with regulatory audits, compliance reviews, or investigations. 99y will comply with such requests to the extent required by applicable law and will notify affected users where permitted to do so.
99y may disclose personal data to law enforcement agencies, courts, or government authorities where required by a valid legal order, warrant, or applicable legislation. 99y will not disclose personal data to law enforcement on a voluntary basis beyond what is legally required.
In the event of a merger, acquisition, or transfer of all or part of 99y's business operations, personal data held by 99y may be transferred to the successor entity as part of that transaction. Users will be notified of any such transfer and their rights in relation to the transferred data prior to the change taking effect.
No Data Sale: 99y does not and will not sell, rent, or commercially share your personal data with any third party for that party's own marketing, advertising, or commercial purposes. This prohibition is absolute and is not subject to any commercial override.
99y retains personal data for the periods set out below, after which data is securely deleted or anonymised:
| Data Type | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Licence obligation & legal compliance |
| Transaction records | 7 years from transaction date | AML / financial crime prevention requirements |
| Identity verification documents | Duration of account + 5 years post-closure | Licence obligation |
| Gameplay / betting history | Duration of account + 3 years post-closure | Responsible gaming monitoring & dispute resolution |
| Support communications | 3 years from last interaction | Dispute resolution & service continuity |
| Technical / security logs | 12 months from collection | Fraud prevention & security monitoring |
| Marketing consent records | Until consent withdrawn + 3 years | Demonstrating lawful basis for marketing |
Where 99y is required by a regulatory investigation, legal proceeding, or court order to retain data beyond the standard retention periods above, data will be held until the relevant matter is concluded and the obligation to retain is discharged.
99y implements the following technical and organisational security measures to protect your personal data:
Your Responsibility: 99y's security measures protect data on the platform side. You are responsible for maintaining the security of your login credentials, not sharing your password, and reporting any suspected unauthorised account access to 99y support immediately. Enabling 2FA significantly reduces the risk of account compromise.
The 99y platform uses cookies and similar browser-based technologies for the following purposes:
These cookies are essential for the 99y platform to function correctly. They maintain your login session, store your language preference, and enable core features such as the bet slip and account balance display. Strictly necessary cookies cannot be disabled without causing the platform to function incorrectly.
Functional cookies remember your platform preferences — such as your preferred sports or game categories — so that the platform displays relevant content on subsequent visits. These cookies store only preference information and do not track your behaviour across external websites.
99y uses anonymised analytics data to understand how users navigate the platform — which pages are most visited, where users encounter friction, and how platform performance varies across device types. Analytics data is aggregated and does not identify individual users. You may opt out of analytics cookies through the cookie preferences tool accessible on the 99y platform.
You may manage cookie preferences through your browser settings. Note that disabling cookies beyond strictly necessary cookies may affect certain platform features. Clearing browser cookies will log you out of any active 99y session.
Subject to applicable data protection law and the terms of 99y's gaming licence, you have the following rights in relation to your personal data:
Request a copy of the personal data 99y holds about you. We will respond within 30 days of a valid request.
Request correction of inaccurate or incomplete personal data held by 99y. Certain corrections require re-verification.
Request deletion of your data in certain circumstances. Note that regulatory retention obligations may limit full erasure.
Request that 99y restrict processing of your data in specific circumstances, such as while the accuracy of data is contested.
Where processing is based on consent or contract, request your data in a structured, machine-readable format for transfer.
Object to processing based on legitimate interests, including processing for direct marketing purposes, which 99y will honour immediately.
Where processing is based on consent — including marketing communications — you may withdraw consent at any time through your account settings.
Lodge a complaint with 99y's support team or, if unsatisfied with our response, with the supervisory authority of 99y's licensing jurisdiction.
To exercise any of the above rights, please contact the 99y support team using the details provided in Section 15. Requests will be responded to within 30 days. Identity verification will be required before any data access, correction, or deletion request is processed.
Strict 21+ Policy: 99y's services are exclusively for individuals aged 21 years and above. 99y does not knowingly collect or process personal data from individuals under the age of 21. Age verification using a valid CNIC is a mandatory step in the 99y registration process, and accounts found to belong to underage individuals are closed immediately with data handled in accordance with applicable legal requirements.
If 99y becomes aware that personal data has been collected from an individual under the age of 21 — whether through misrepresentation at registration or any other means — the affected account will be immediately suspended, all collected data will be reviewed and handled in accordance with 99y's data protection obligations, and the matter will be escalated to 99y's compliance team. Parents or guardians who become aware that a minor has registered on 99y should contact support immediately at the details provided in Section 15.
As an internationally licensed gaming platform, 99y may process and store personal data on servers and infrastructure located outside Pakistan. Where personal data is transferred to a jurisdiction outside the country in which it was collected, 99y ensures that appropriate safeguards are in place to protect the data to an equivalent standard as required in the originating jurisdiction.
Safeguards used by 99y for international data transfers may include contractual clauses approved by the relevant licensing authority, adequacy decisions where applicable, and equivalent technical and organisational security measures. Users may request information about the specific safeguards applicable to their data by contacting 99y support.
99y reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, regulatory requirements, or platform features. When material changes are made, 99y will notify registered users via email to the registered address on file and/or via a prominent notice displayed on the platform for a minimum of 30 days before the changes take effect.
The "Last Updated" date at the top of this document indicates when the current version was adopted. Your continued use of the 99y platform after the effective date of any revised Privacy Policy constitutes your acceptance of the revised terms. We recommend reviewing this Privacy Policy periodically. The current version is always accessible at 99y.biz/privacy-policy.
For any privacy-related queries, data subject rights requests, or complaints regarding 99y's data handling practices, please contact the 99y support team through the following channels:
99y aims to respond to all privacy-related requests within 30 calendar days of receipt. Where a request is complex or 99y is handling a large volume of requests, this period may be extended by a further 30 days with appropriate notice to the requester.
If you are not satisfied with 99y's response to a privacy complaint, you may escalate your complaint to the supervisory authority or dispute resolution body of 99y's licensing jurisdiction. Details of the applicable supervisory authority are available from 99y support upon request.
For queries related to 99y's gaming rules or account terms, please refer to our Terms & Conditions. For responsible gaming support and tools, please visit our Responsible Gaming page.
Your Rights Are Protected: Submitting a data subject rights request to 99y will not affect your ability to use the platform or the quality of service you receive. 99y prohibits any form of retaliation against users who exercise their legitimate privacy rights.
Contact 99y's bilingual support team in Urdu or English to exercise your data rights, ask privacy questions, or get help with your account — anytime, day or night.