Privacy Policy

This Privacy Policy ("Policy") describes how 999q ("we", "us", "our", "the Operator") collects, processes, stores, and protects the personal data of individuals ("you", "Player", "User") who register an account with or otherwise interact with the 999q platform available at 999q.cam ("the Platform").

999q is committed to handling your personal data responsibly and in accordance with the data protection obligations applicable under the laws of the jurisdiction in which the Operator holds its international operating licence. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which are incorporated by reference. In the event of any conflict between those documents and this Policy regarding data processing, this Policy shall prevail.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, email address, phone number, date of birth, payment details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, 999q.
• "Data Processor" means a third party that processes Personal Data on behalf of 999q under a contractual obligation and subject to our instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process required to operate a regulated gaming account.
• "Cookies" means small data files placed on your device by the Platform to enable functionality and analytics as described in Section 8.

The following categories of personal data may be collected and processed by 999q in the course of operating your account and delivering our services:

999q collects personal data through the following means:

• Direct Submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, completing a support request, or updating your account profile.
• Automated Technologies: Data collected automatically as you use the Platform, including device identifiers, IP addresses, browser fingerprints, session durations, pages visited, and in-game actions, primarily through cookies and server-side logging. See Section 8 for full cookie details.
• Third-Party Sources: Data received from identity verification agencies, payment processors, fraud prevention services, and credit reference agencies where we are legally permitted to receive and use such data for KYC and AML compliance purposes.
• Public Sources: In limited circumstances, we may consult publicly available databases (such as sanctions lists or politically exposed persons registers) as part of our regulatory compliance obligations.

999q processes your personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform the contract between you and 999q — including account registration, gameplay, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC verification, AML reporting, and responsible gambling requirements mandated under the Operator's licence.
• Legitimate Interests: Processing carried out for 999q's legitimate business interests — including fraud prevention, platform security, system performance monitoring, and product improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on your freely given consent — most notably for direct marketing communications. You may withdraw consent at any time via your account settings or by contacting support, without affecting the lawfulness of processing carried out before withdrawal.

Your personal data is used by 999q for the following specific purposes:

• To create, verify, and manage your player account;
• To process deposits and withdrawals and reconcile financial transactions;
• To conduct KYC and AML checks in compliance with the Operator's licence obligations;
• To monitor gameplay patterns for responsible gambling purposes, including identifying potential problem gambling behaviour and applying player protection measures where appropriate;
• To detect, investigate, and prevent fraud, money laundering, cheating, and other prohibited conduct;
• To provide customer support and resolve disputes or complaints;
• To send transactional communications relating to your account (e.g., deposit confirmations, withdrawal notifications, security alerts) — these are not marketing and cannot be opted out of while your account is active;
• To send promotional and marketing communications where you have provided consent to receive them;
• To personalise your experience on the Platform based on your gameplay preferences and history, where you have not objected to such personalisation;
• To analyse Platform performance and improve our products, games, and services;
• To comply with legal obligations, court orders, or requests from competent regulatory authorities.

999q does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances, and only to the extent necessary for the specified purpose:

• Payment Processors: To facilitate deposits and withdrawals, transaction data is shared with our payment processing partners. Payment references familiar to Pakistani players — such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, and Bank Alfalah — are listed as processing references in our cashier. Their listing does not imply endorsement of or affiliation with 999q.
• Identity Verification Providers: KYC and AML compliance requires us to share identity documents and related data with accredited third-party verification agencies.
• Game and Technology Providers: Our third-party game suppliers and platform technology providers may process limited technical and gameplay data as Data Processors under our instructions and subject to binding data processing agreements.
• Fraud Prevention Services: We may share device and behavioural data with fraud detection platforms to protect the integrity of the Platform and all players.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to competent authorities, courts, or regulators where required to do so by law, court order, or our licence obligations — without prior notice to you where legally required.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the Operator's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

999q uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings, preferred game categories, and last login details — so you do not need to re-enter them on each visit.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform, enabling us to improve performance and user experience.
• Security & Fraud Detection Cookies: Used to identify anomalous behaviour patterns, detect multiple-account activity, and support our fraud prevention obligations.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into or using core features of the Platform. 999q does not use third-party advertising cookies or cross-site behavioural tracking for ad-targeting purposes.

999q retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and KYC Data: Retained for a minimum of 5 years following account closure, in line with standard AML record-keeping requirements under applicable licensing conditions.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction.
• Gameplay History: Retained for a minimum of 3 years for dispute resolution and responsible gambling monitoring purposes.
• Customer Support Communications: Retained for a minimum of 3 years from the date of the interaction.
• Marketing Preference Records: Retained for as long as your account is active and for a period after closure sufficient to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted from our systems or, where deletion is not technically feasible in the short term, anonymised so that it can no longer be attributed to any individual.

999q implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption at rest for sensitive stored data, including identity documents and financial records;
• Role-based access controls ensuring that staff can access personal data only to the extent required by their specific job function;
• Regular third-party security audits and penetration testing of the Platform infrastructure;
• Intrusion detection and automated threat monitoring systems operating continuously;
• Secure data centre facilities with physical access restrictions for our hosting infrastructure.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, 999q will notify affected individuals without undue delay in accordance with applicable data breach notification obligations.

Subject to applicable law and any overriding regulatory obligations, you hold the following rights in respect of your personal data held by 999q:

To exercise any of these rights, please contact our Data Protection team via the details in Section 15. We will respond to all valid requests within 30 days. In complex cases, this period may be extended by a further 60 days, in which case we will inform you of the extension and the reason for it.

999q operates under an international gaming licence and, in the course of delivering its services, your personal data may be transferred to and processed in countries outside the jurisdiction in which you reside. This includes transfers to the Operator's principal place of operation, hosting infrastructure locations, and the countries where our Data Processor partners are based.

Where personal data is transferred internationally, 999q ensures that appropriate safeguards are in place to maintain an equivalent level of protection as would apply under the data protection laws of the Operator's licence jurisdiction. These safeguards may include:

• Standard contractual clauses approved by the relevant data protection authority incorporated into our Data Processor agreements;
• Binding corporate rules where transfers are made within our corporate group;
• Transfer to countries recognised as providing an adequate level of data protection.

You may request further information about the specific safeguards applicable to any international transfer of your data by contacting us using the details in Section 15.

The 999q Platform is strictly for adults aged 18 years or older — or the higher minimum age required under the laws of your jurisdiction or the Operator's licence jurisdiction, whichever is greater. 999q does not knowingly collect, process, or retain personal data belonging to individuals under the applicable minimum age.

If you are a parent or guardian and believe that a person under the minimum age has registered an account on the Platform or submitted personal data to us, please contact our support team immediately. We will investigate the matter and, where confirmed, delete the relevant data and close the associated account without delay.

As part of our KYC process, all registered players are required to confirm their date of birth and provide documentary proof of age. Accounts where age cannot be verified to our satisfaction will be suspended until verification is complete.

999q reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our operational requirements. Where changes are material — that is, where they substantively affect the way in which we process your personal data or the rights you hold — we will notify registered players via their registered email address or via a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. The version of this Policy currently published on the Platform supersedes all previous versions. We encourage you to review this Policy periodically.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or need to report a data protection concern, please contact the 999q Data Protection team through the following channels:

• Live Chat: Available 24/7 from your account dashboard — select "Data & Privacy" as the subject category for fastest routing to the appropriate team.
• Email: [email protected] — please include "Privacy Request" in your subject line and provide your registered username so we can locate your account promptly.

Support is available in both English and Urdu. We aim to acknowledge all privacy-related contacts within 5 business days and to resolve requests within 30 days, in accordance with our obligations under applicable data protection law.

If you are not satisfied with our response to a privacy concern or data rights request, you may have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction under which the Operator is licensed.