Privacy Policy – x999 Pakistan Online Gaming Platform

x999 is an online gaming and sports betting platform operated under a valid gaming licence. The platform is designed and operated for players in Pakistan, with all transactions conducted in Pakistani Rupees (PKR). x999 is accessible at x999-bangla.com and through any associated mobile applications or platforms.

x999 is the data controller for all personal information collected from players using the platform. This means x999 determines the purposes and means of processing your personal data and is responsible for ensuring it is handled in accordance with the commitments in this policy.

For all data-related enquiries, including requests to access, correct, or delete your data, you can contact x999 through our official support channels listed at the end of this policy.

x999 collects only the data that is necessary to provide our services, comply with legal obligations, and maintain the security of our platform and player community. Below is a full breakdown of what we collect:

x999 does not collect sensitive personal data as defined above unless there is a specific legal obligation to do so — for example, in the context of responsible gaming interventions where health-related information may be relevant to protecting a player's wellbeing.

x999 collects data through several routes during your use of the platform. Understanding where data comes from helps you see exactly what information x999 holds about you.

• Registration: When you create your x999 account, you provide your name, date of birth, mobile number, and email address directly.
• Deposits and withdrawals: When you transact on x999 using Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card, payment details and transaction records are captured.
• Identity verification: Where x999 requires KYC documentation, any documents submitted (such as a CNIC) are collected and stored securely for the verification process.
• Platform activity: As you use x999 — browsing games, placing bets, using the live betting interface — your activity data is logged automatically.
• Cookies and tracking technologies: x999 uses cookies and similar technologies to collect technical and usage data. See Section 7 for full details.
• Communications: When you contact x999 support via live chat or email, the content of that communication is collected and stored as part of your account record.
• Third parties: In limited circumstances, x999 may receive data about you from payment processors, fraud prevention services, or identity verification providers as part of our anti-fraud and compliance processes.

x999 uses your personal data for specific, legitimate purposes. We do not use data for any purpose other than those listed below, and we do not collect data speculatively "just in case" it might be useful later.

• Account creation and management: To set up and maintain your x999 player account, manage your PKR wallet, and ensure you can access all features of the platform.
• Processing deposits and withdrawals: To verify payment details, process your transactions via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card, and maintain accurate financial records.
• Identity and age verification: To confirm that you meet x999's eligibility requirements — in particular the minimum age of 18 — and to fulfil our KYC obligations under our licensing terms.
• Delivering and improving the platform: To operate the x999 betting and gaming services, fix technical issues, improve page performance, and develop new features that better serve Pakistani players.
• Fraud prevention and security: To monitor accounts and transactions for suspicious activity, protect against money laundering, and maintain the integrity of x999's betting and gaming environment.
• Responsible gaming: To monitor betting patterns and identify players who may be showing signs of problem gambling, enabling x999 to provide appropriate interventions and tools in line with our responsible gaming commitments.
• Customer support: To respond to your queries, resolve complaints, and maintain a record of communications for quality assurance.
• Marketing communications: Where you have opted in, to send you information about x999 promotions, bonuses, and new features that may be of interest. You can opt out at any time.
• Legal and regulatory compliance: To meet the obligations x999 has under its gaming licence and any applicable laws, including record-keeping and reporting requirements.

x999 processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contract performance: Processing that is necessary to provide the x999 service to you — including account management, payment processing, and game delivery — is carried out because it is required to fulfil our agreement with you as a registered player.
• Legal obligation: Certain data processing — such as identity verification, anti-money laundering checks, and financial record-keeping — is required by our licensing obligations and applicable laws.
• Legitimate interests: x999 processes data for fraud prevention, platform security, and service improvement based on our legitimate interest in operating a safe and functional gaming platform. We balance these interests against your privacy rights.
• Consent: For marketing communications, x999 relies on your explicit consent. You can withdraw this consent at any time by contacting support or updating your communication preferences in your x999 account settings.

x999 does not share your personal data with third parties except in the specific, limited circumstances described below. In all cases, data is shared only to the extent necessary for the stated purpose.

• Payment processors: Your financial data is shared with the payment providers you use — Easypaisa, JazzCash, NayaPay, SadaPay, your bank (for IBFT), and card networks — solely to process your deposit or withdrawal transaction.
• Identity verification providers: Where KYC checks are required, x999 may use a third-party identity verification service to validate your documents. These providers process your data under strict confidentiality agreements and data protection standards.
• Game software providers: The casino and crash game providers in the x999 lobby receive minimal technical data (such as session identifiers) necessary to deliver the game. They do not receive your personal profile or financial data.
• Fraud and security services: x999 uses specialist fraud detection and platform security services. These may process technical and transactional data to flag suspicious activity. No personal details are shared beyond what is necessary for this function.
• Legal and regulatory authorities: Where x999 is legally required to share data — for example, in response to a court order, regulatory request, or law enforcement enquiry — we will comply with that obligation. We will notify you of such requests where we are legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of x999's business assets, player data may form part of the transferred assets. You would be notified in advance of any such transfer affecting your data.

All third parties with whom x999 shares data are contractually required to protect that data to the same standard as x999 and to use it only for the specific purpose for which it was shared.

x999 uses cookies and similar technologies to make the platform work correctly and to improve your experience. A cookie is a small file stored on your device that allows x999 to recognise your browser across sessions.

x999 uses the following types of cookies:

• Essential cookies: These are required for x999 to function. They handle things like maintaining your login session, keeping your bet slip active during a session, and remembering your language preferences. You cannot opt out of essential cookies without affecting your ability to use x999.
• Analytics cookies: x999 uses analytics tools to understand how players navigate the platform — which pages are visited most, where users encounter issues, and how long they engage with different features. This data is aggregated and anonymised where possible.
• Functional cookies: These remember your preferences on x999, such as your preferred sport or game category, so the platform can show you relevant content on future visits.
• Marketing cookies: Where you have consented to marketing communications, x999 may use tracking technologies to measure the effectiveness of promotions and to deliver relevant offers.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of x999. For essential cookies, no opt-out is available because they are necessary for the platform to operate.

x999 keeps your personal data only for as long as it is needed for the purpose for which it was collected, or as long as required by law or our licensing obligations.

• Active account data: While your x999 account is active, your profile, transaction history, and betting records are retained to provide the service and to comply with our licence obligations.
• Closed account data: After you close your x999 account, we retain your data for a minimum of five years in accordance with anti-money laundering record-keeping requirements. Some data may be retained longer if required by specific legal or regulatory obligations.
• Financial transaction records: Payment records are retained for a minimum of seven years in line with financial record-keeping standards applicable under x999's licensing framework.
• Support communications: Chat logs and email correspondence with x999 support are retained for up to three years from the date of the interaction.
• Marketing data: Where you have opted in to marketing, your preference and associated data is retained until you opt out, at which point we remove you from marketing lists within a reasonable processing window.

Once the relevant retention period expires, x999 securely deletes or anonymises your data so it can no longer be linked to you as an individual.

x999 employs a layered approach to data security. No system is entirely immune to risk, but the measures x999 puts in place are designed to make unauthorised access extremely difficult and to limit any damage in the event of a security incident.

• SSL/TLS encryption: All data transmitted between your device and x999's servers is encrypted using 256-bit SSL/TLS encryption. This protects your login credentials, personal data, and financial information while it is in transit.
• Data at rest encryption: Personal and financial data stored in x999's databases is encrypted at rest, meaning that even if a server were accessed without authorisation, the data would be unreadable without the encryption key.
• Access controls: Access to player data within x999's internal systems is restricted on a strict need-to-know basis. Not all x999 staff have access to personal or financial player data — only those who need it to perform their specific role.
• Two-factor authentication: x999 strongly encourages players to enable two-factor authentication (2FA) on their accounts. Internally, administrative access to sensitive systems requires 2FA as standard.
• Regular security audits: x999's systems are subject to regular independent security reviews and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: x999 maintains a formal data breach response process. In the event of a security incident affecting your personal data, we will notify affected players and relevant authorities within the timeframes required under applicable law.

As a player on x999, you have meaningful rights over the personal data we hold about you. x999 respects these rights and will respond to all requests promptly and without charge.

x999 is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that a minor has registered on x999 or provided us with personal information, please contact us immediately at support@x999-bangla.com. We will investigate and, where confirmed, promptly close the account and delete all associated data.

x999 applies age verification checks during registration and may require documentary proof of age at any point. Any account found to belong to a person under 18 will be closed immediately and all funds will be handled in accordance with our legal obligations under our gaming licence.

The x999 platform does not include links to third-party websites as a general rule. However, in the unlikely event that any link or reference to an external website appears on x999, please be aware that x999 has no control over and takes no responsibility for the content or privacy practices of those external sites.

This Privacy Policy applies only to x999 and the data collected through our platform. If you follow a link to another website, we recommend reading that site's own privacy policy before providing any personal information.

x999 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or our platform's functionality. When material changes are made, we will publish the updated policy on this page with a revised effective date.

Where changes are significant — particularly those that affect how your personal data is used or shared — x999 will notify registered players by email or through a notice on the platform before the changes take effect. Your continued use of x999 after a policy update constitutes acceptance of the updated terms.

We encourage you to review this page periodically so you are always aware of how x999 handles your data.

If you want to exercise any of your data rights, have questions about this Privacy Policy, or want to report a potential data security issue, please contact the x999 privacy team through the following channels:

• Email: support@x999-bangla.com
• Live Chat: Available 24/7 when logged in to your x999 account.

Please include your registered account username and a clear description of your request. x999 will acknowledge data subject requests within 48 hours and fulfil them within the timeframes required under applicable law — typically 30 days, extendable where the request is complex or numerous.

All privacy-related correspondence is handled with strict confidentiality and is not shared with any third party unless legally required to do so.