99pak Privacy Policy

01 Introduction

99pak ("we", "us", "our") operates the online gaming platform accessible at https://99pak.bio (the "Platform"). This Privacy Policy governs the collection, processing, storage, and disclosure of personal data provided by or collected from users ("you", "your") who register for, access, or use the Platform in any capacity.

99pak is committed to handling personal data responsibly and transparently. This Privacy Policy has been prepared in accordance with internationally recognised data protection principles and the requirements applicable to online gaming operators. By registering an account with 99pak or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

This Policy should be read together with the 99pak Terms & Conditions, which are incorporated by reference. Where any term in this Policy is inconsistent with the Terms & Conditions, this Policy shall prevail with respect to data protection matters.

02 Data We Collect

99pak collects personal data across several categories depending on how you interact with the Platform. The table below provides a comprehensive overview of the data categories, specific data types, and the purpose for which each is collected:

You are not obligated to provide all categories of data; however, failure to provide mandatory data — particularly identity and KYC documents — will prevent account registration and withdrawal processing. We will always indicate at the point of collection whether a field is mandatory or optional.

03 How We Collect Data

99pak collects personal data through the following channels and methods:

• Direct registration: When you create a 99pak account, you voluntarily provide identity, contact, and financial data through our registration form.
• KYC submissions: When you complete identity verification, you upload document images and selfie photographs directly to our secure verification portal.
• Transaction processing: When you make deposits or request withdrawals via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, relevant financial reference data is captured automatically as part of the payment flow.
• Platform usage: Technical and behavioural data is collected automatically as you navigate the Platform, play games, or interact with features. This includes data collected via cookies and similar tracking technologies (see Section 7).
• Customer support interactions: When you contact us via Live Chat, Messenger, or email, the content and metadata of those communications are recorded for quality assurance and dispute resolution purposes.
• Third-party identity verification providers: In some cases, KYC verification is conducted through a third-party identity verification service that processes document images on our behalf under a strict data processing agreement.

04 How We Use Your Data

99pak uses the personal data we collect for the following purposes:

• Account management: To create, maintain, and administer your 99pak player account, including processing deposits and withdrawals in PKR via your chosen payment method.
• Identity and age verification: To confirm that you are at least 21 years of age and are who you say you are, in compliance with our responsible gaming obligations and international regulatory requirements.
• Service delivery: To provide access to all 99pak games, cricket betting markets, PSL wagering, live casino tables, slot games, and crash games available on the Platform.
• Fraud and AML compliance: To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct on the Platform.
• Responsible gaming: To monitor gameplay patterns for indicators of problem gambling and to enforce deposit limits, cooling-off periods, or self-exclusion measures where activated or required.
• Communications: To send you account-related notifications, transaction confirmations, security alerts, and — where you have opted in — promotional communications about 99pak bonuses and offers.
• Legal compliance: To comply with applicable laws, regulations, court orders, and requests from competent regulatory or law enforcement authorities.
• Platform improvement: To analyse Platform usage data in aggregate form to improve the user experience, fix technical issues, and develop new features for Pakistani players.
• Dispute resolution: To investigate and resolve complaints, disputed bets, or transaction errors using gameplay logs and communication records as evidence.

05 Legal Basis for Processing

99pak processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our contract with you — i.e., to operate your player account, process transactions, and deliver the Platform's services. Without this processing, the contractual relationship cannot exist.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and identity verification regulations, as well as any lawful requests from regulatory authorities or law enforcement agencies.
• Legitimate interests: Processing carried out in the legitimate interests of 99pak and its user base — including fraud prevention, information security, responsible gaming monitoring, and improving Platform performance — where those interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where we rely on legitimate interests as our legal basis, we conduct a balancing test to ensure those interests do not unduly impact your privacy. Records of those assessments are maintained internally and are available upon request.

06 Data Sharing & Disclosure

99pak does not sell, rent, or trade your personal data to unaffiliated third parties for their own commercial or marketing purposes. We may share your personal data only in the following circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the transaction data strictly necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable financial services regulations.
• Identity verification providers: Third-party KYC providers process your identity documents on our behalf to complete verification. All such providers are bound by data processing agreements consistent with this Privacy Policy.
• Game software providers: Third-party game developers whose titles are hosted on the 99pak Platform may receive gameplay session data (but not financial or identity data) for the purpose of game performance monitoring and certification compliance.
• Regulatory and law enforcement authorities: We will disclose personal data to competent government authorities, regulatory bodies, or law enforcement agencies when required by law, court order, or regulatory directive — including in the context of AML or CTF investigations.
• Professional advisers: Our legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis and are bound by professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of 99pak's business assets, personal data held by us may be transferred to the successor entity. We will notify affected users via email in advance of any such transfer where reasonably practicable.

07 Cookies & Tracking Technologies

The 99pak Platform uses cookies and similar tracking technologies (collectively "cookies") to enhance functionality, measure performance, and improve your experience. The following types of cookies are deployed:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and cookies that remember your login state. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional cookies: Enable enhanced features such as remembering your preferred language, currency display (PKR), and game settings across sessions.
• Analytics cookies: Collect anonymised data about how users navigate the Platform — pages visited, features used, session duration. This data is aggregated and used solely to improve the Platform experience for Pakistani users.
• Security cookies: Assist with fraud detection by identifying unusual patterns in browser behaviour or device characteristics that may indicate account compromise or automated bot activity.

Upon your first visit to the Platform, you will be presented with a cookie consent banner that allows you to accept or customise your cookie preferences. You may also manage or delete cookies at any time via your browser settings. Disabling strictly necessary cookies may affect your ability to log in and use certain Platform features.

99pak does not use third-party advertising cookies or deploy retargeting pixels for the benefit of unaffiliated advertisers.

08 Data Retention

99pak retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your active account relationship with 99pak, plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years following the date of each transaction, in line with financial regulatory obligations applicable to internationally licensed gaming operators.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant KYC review, whichever is later.
• Gameplay logs: Retained for five (5) years following the relevant gaming session, primarily to support dispute resolution and regulatory audit requirements.
• Customer support communications: Retained for three (3) years following the resolution of the relevant support interaction or dispute.
• Marketing consent records: Retained from the date consent is granted until withdrawal, plus an additional two (2) years as evidence of the consent record.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is technically feasible, anonymised data may be retained indefinitely for aggregate analytics purposes.

09 Data Security

99pak implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• 256-bit TLS/SSL encryption: All data transmitted between your device and the 99pak Platform is encrypted using industry-standard Transport Layer Security protocols. The padlock icon in your browser confirms that your connection is secure at all times.
• Data encryption at rest: Sensitive personal data — including CNIC information, financial account references, and KYC documents — is encrypted within our databases using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged and monitored.
• Two-factor authentication (2FA): Available to all 99pak account holders and mandatory for staff accessing internal systems containing personal data.
• Continuous security monitoring: Our security operations team monitors the Platform infrastructure continuously for anomalies, intrusion attempts, and data exfiltration indicators.
• Regular penetration testing: The Platform undergoes scheduled third-party penetration tests and vulnerability assessments to identify and remediate security weaknesses proactively.

Notwithstanding these measures, no internet-based system can be guaranteed to be entirely secure at all times. In the event of a data breach that poses a material risk to your rights and interests, 99pak will notify affected users by email within 72 hours of becoming aware of the breach, in accordance with applicable notification obligations.

10 Your Data Rights

As a 99pak user, you hold the following rights with respect to your personal data. These rights are subject to applicable legal limitations, including our AML and regulatory record-keeping obligations, which may prevent us from fulfilling certain requests in full:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. In complex cases, this period may be extended by an additional 30 days with prior notice to you.

11 Children's Privacy

The 99pak Platform is strictly an adult service. Access is limited to individuals who are 21 years of age or older. We do not knowingly collect, process, or store personal data from individuals under the age of 21.

Our registration process includes mandatory age verification steps, and our KYC procedures require submission of a valid CNIC or government-issued identification document confirming date of birth. Accounts found to belong to individuals under 21 years of age will be closed immediately, all balances will be forfeited, and any personal data associated with the underage account will be deleted as soon as legally permissible.

If you are a parent or guardian and believe that your child has registered for a 99pak account or provided us with personal data without your knowledge or consent, please contact us immediately at [email protected] so that we may take appropriate action without delay.

We strongly encourage parents and guardians in households across Pakistan — including in Karachi, Lahore, Faisalabad, and Islamabad — to use parental control software to restrict access to online gaming and gambling platforms on devices used by minors.

12 Changes to This Privacy Policy

99pak reserves the right to update or revise this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, Platform features, or our internal data practices. All amendments will be reflected in the "Effective Date" at the top of this page.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will notify you by sending an email to the address registered on your 99pak account at least seven (7) days before the amended Policy takes effect. For minor or clarificatory amendments, we may update the Policy without advance notice.

Your continued use of the 99pak Platform after the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

13 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about the way 99pak handles your personal data, please contact our Data Protection team using the details below. All communications regarding privacy matters are treated with strict confidentiality:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: Use "Privacy Enquiry" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 via the chat widget on the Platform — ask to be connected to the Data Protection team
• Response time: We aim to acknowledge all privacy-related enquiries within 2 business days and resolve them within 30 calendar days

If you are not satisfied with our response to your complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to our operating licence. We will provide you with the appropriate contact details upon request.