Privacy Policy — y99com Platform

This Privacy Policy ("Policy") applies to all personal data processed by y99com in connection with the operation of the y99com platform accessible at y99com.net, including the casino lobby, sportsbook, live betting markets, account management portal, promotional communications, and customer support services.

The Policy applies to all registered users and visitors of the y99com platform, including players based in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, and all other locations across Pakistan. By creating an account or continuing to use the y99com platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside y99com's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions on a privacy matter, this Policy takes precedence.

y99com reserves the right to update this Policy from time to time. Material changes will be communicated to registered users via their registered email address prior to the changes taking effect. The effective date at the top of this page indicates when the current version came into force.

y99com collects personal data through several channels: directly from you during registration and account use, automatically through platform interaction, and in limited circumstances from third-party verification services. The categories of data collected are described below.

Registration & Identity Data:

• Full legal name as it appears on your CNIC
• Date of birth (for age verification — must be 21+)
• Pakistani mobile number (primary contact and 2FA)
• Email address
• Residential address in Pakistan
• CNIC number and scanned document image (submitted during KYC verification)
• Selfie or live photo for biometric identity matching (where required)

Financial Data:

• JazzCash or EasyPaisa mobile wallet number
• Bank account details (HBL, UBL, Meezan Bank, or other linked account) where used for deposits or withdrawals
• Transaction history including deposit amounts, withdrawal amounts, and timestamps
• Payment method type used per transaction

Transactional & Gaming Data:

• All bets placed, odds accepted, game sessions initiated, and results recorded
• Bonus offers activated, wagering progress, and promotional participation history
• Net gaming revenue, win/loss records, and session duration data

Technical & Device Data:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session timestamps, login history, and authentication events
• Cookie identifiers and similar tracking technologies (see Section 8)

Communications Data:

• Records of all customer support interactions via live chat and email
• Responses to surveys, feedback forms, and promotional campaigns
• Marketing preference settings and opt-in/opt-out records

y99com uses collected personal data for the following defined purposes. Data is never used for purposes incompatible with those stated here without your prior consent or a legal obligation requiring otherwise.

y99com does not use your personal data for automated decision-making that produces solely automated legal or similarly significant effects without a human review mechanism available to you. Where automated systems flag an account for review (e.g., responsible gaming triggers or fraud detection alerts), a human analyst is involved in any material decision affecting your account.

Every processing activity conducted by y99com is supported by one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform the contract between you and y99com — i.e., to provide the gaming and sportsbook services you have registered to use, process your deposits and withdrawals, and manage your account.
• Legal Obligation: Processing required to comply with anti-money laundering laws, gaming regulatory requirements, know-your-customer obligations, and obligations to cooperate with competent authorities when lawfully required.
• Legitimate Interests: Processing carried out in pursuit of y99com's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improvement of our services — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications and for the placement of non-essential cookies. You may withdraw consent at any time without detriment to your account.

y99com does not sell or rent your personal data. We share personal data only with the categories of recipients described below, and only to the extent necessary for the stated purpose.

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard processing partners receive financial transaction data necessary to process your deposits and withdrawals. Each payment partner is bound by their own regulatory obligations and data protection standards.
• Identity Verification Providers: Third-party KYC and AML screening services receive CNIC data and document images solely for the purpose of verifying your identity and screening against regulatory watchlists. These providers process data only on y99com's instructions.
• Game Content Providers: Casino game studios and sportsbook data providers receive pseudonymised session and wagering data necessary to deliver, certify, and audit game outcomes and odds. No directly identifiable personal data (such as your name or CNIC) is shared with game providers.
• Customer Support Platforms: Live chat and ticketing system providers process communications data on behalf of y99com under strict data processing agreements. These providers do not use your data for their own commercial purposes.
• Regulatory & Law Enforcement Authorities: y99com will disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where required by a lawful request, court order, or applicable regulation. Where legally permissible, y99com will notify affected users of such disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or sale of business assets involving y99com, personal data held by y99com may be transferred to the acquiring entity, subject to the same protections described in this Policy.

All third-party data processors engaged by y99com are required to enter into data processing agreements that bind them to handle your data only on documented instructions, to implement appropriate security measures, and to delete or return data upon termination of the processing relationship.

y99com retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, taking into account regulatory retention mandates applicable under our gaming licence. The general retention schedule is as follows:

Upon expiry of the applicable retention period, personal data is either securely deleted from y99com's systems or irreversibly anonymised so that it can no longer be linked to you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

y99com implements a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• TLS 1.3 Encryption in Transit: All data exchanged between your browser or app and y99com servers is encrypted using TLS 1.3, the current industry standard for transport layer security.
• AES-256 Encryption at Rest: Sensitive data fields including passwords (stored as salted hashes), CNIC numbers, payment details, and identity document images are encrypted at rest using AES-256.
• Two-Factor Authentication: y99com supports and encourages two-factor authentication via OTP sent to your registered Pakistani mobile number as an additional layer of protection on your y99com login.
• Role-Based Access Controls: Internal access to personal data is restricted on a need-to-know basis. Only staff with a legitimate operational requirement have access to personal data, and all access is logged and auditable.
• Penetration Testing: y99com's platform undergoes regular independent penetration testing and vulnerability assessments. Identified vulnerabilities are triaged and remediated according to a documented risk-based process.
• Fraud Detection Systems: Automated fraud detection systems monitor transactions, login events, and wagering patterns in real time to identify and respond to suspicious activity that may indicate unauthorised account access.

While y99com takes all reasonable technical and organisational measures to protect your data, no internet transmission or electronic storage system is completely secure. You remain responsible for maintaining the confidentiality of your y99com login credentials and for reporting any suspected unauthorised account access to support immediately.

y99com uses cookies and similar tracking technologies on its platform. A cookie is a small text file placed on your device when you visit a website. Cookies allow the platform to recognise your device across sessions and support a range of functional and analytical purposes.

The categories of cookies used by y99com are as follows:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and cookies that preserve your language and currency preferences. These cookies cannot be disabled as the platform cannot operate without them.
• Functional Cookies: Enhance your experience by remembering your preferences such as game lobby layout, sports betting market preferences, and notification settings. These are placed with your consent.
• Analytics Cookies: Used to collect anonymised data about how users interact with the y99com platform — pages visited, time spent, error events, and navigation flows. This data is used to improve the platform. Analytics cookies are placed with your consent.
• Marketing Cookies: Used to deliver relevant promotional content to you based on your gaming activity and preferences. y99com does not share marketing cookie data with external advertising networks. These cookies are placed only with your explicit consent.

You can manage your cookie preferences at any time through the Cookie Preferences panel accessible from the footer of the y99com platform. You may also control cookies through your browser settings; however, disabling strictly necessary cookies may impair platform functionality including your ability to complete the y99com login process.

As a y99com user, you hold the following rights over your personal data. These rights are not absolute and are subject to applicable legal limitations, but y99com is committed to facilitating their exercise without unnecessary delay.

• Right to Access: You may request a copy of all personal data y99com holds about you. Requests will be fulfilled within 30 days of receipt, at no charge for the first request per calendar year.
• Right to Rectification: If any personal data y99com holds about you is inaccurate or incomplete, you may request that it be corrected. Many fields can be updated directly within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis applies. Note that regulatory retention obligations (Section 6) may prevent full deletion of certain records during the mandatory retention period.
• Right to Restrict Processing: You may request that y99com restricts processing of your data while a dispute about its accuracy or the lawfulness of processing is being resolved.
• Right to Data Portability: You may request a structured, machine-readable copy of the personal data you have provided to y99com, where processing is based on consent or contract and is carried out by automated means.
• Right to Object: You may object to processing based on legitimate interests at any time. y99com will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact the y99com privacy team via email at [email protected] with the subject line "Data Rights Request" and include your registered username and a description of the right you wish to exercise. y99com will verify your identity before processing any data rights request to protect against fraudulent access to another user's data.

y99com operates a strict 21+ age policy. The platform is not directed at, and does not knowingly collect personal data from, any individual under the age of 21. Age verification is a mandatory step in the y99com registration process and is completed before any deposit, withdrawal, or wagering activity is permitted.

Parents and guardians in Pakistan are encouraged to use internet filtering and parental control software to prevent minors from accessing gambling platforms. y99com cooperates with responsible gaming organisations and supports the use of device-level controls alongside the platform's own age verification measures.

Any account found to belong to a user under 21 will be immediately closed, all funds will be returned to the verified payment source, and any winnings generated will be forfeited. y99com will report confirmed cases of underage gambling to the relevant licensing authority as required.

y99com reviews and updates this Privacy Policy on a regular basis to reflect changes in our data processing activities, applicable legal requirements, and best practice standards. When we make material changes to this Policy, we will:

• Update the "Effective Date" and "Last Reviewed" fields at the top of this page.
• Send a notification to all registered users at their registered email address summarising the key changes, at least 14 days before the changes take effect where feasible.
• Display a prominent notice on the y99com platform for a period of 30 days following any material policy update.

Your continued use of the y99com platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must stop using the platform and may request account closure by contacting customer support.

Non-material changes — such as clarifications of existing language, corrections of typographical errors, or updates to contact details — may be made without prior notice, though the effective date will always be updated to reflect the latest revision.

All privacy-related enquiries, data rights requests, and concerns regarding this Policy should be directed to the y99com privacy team. We aim to acknowledge all privacy requests within 5 business days and to provide a substantive response within 30 calendar days.

If you are not satisfied with y99com's response to a privacy request or complaint, you may escalate the matter to the relevant supervisory authority under y99com's licensing jurisdiction. Details of the relevant authority are available on request from the y99com support team.

For responsible gaming-related concerns, self-exclusion requests, or problem gambling support, please visit our dedicated Responsible Gaming page where you will find self-exclusion tools, deposit limit controls, and links to recognised support organisations available to players across Pakistan.