by9999 Privacy Policy —
Your Data, Handled With Respect

1 Introduction & Scope

1.1 This Privacy Policy is published by by9999 ("by9999", "we", "us", "our") and applies to all personal data collected, processed, stored, or otherwise handled in connection with your use of the by9999 platform at by9999.org, including all gaming services, sports betting features, account management functions, promotions, and customer support interactions.

1.2 This Policy applies to all registered players, prospective players who browse the by9999 website without registering, and any individual who contacts by9999's support team. It applies regardless of the device used to access the platform — desktop browser, mobile browser, or any future by9999 application.

1.3 by9999 is committed to handling all personal data in compliance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. These principles are embedded throughout our operational data handling practices, not merely reflected in this policy document.

1.4 This Privacy Policy should be read alongside by9999's Terms & Conditions and Responsible Gaming Policy, all of which collectively govern your relationship with by9999 as a platform user.

2 Data Controller

2.1 For the purposes of this Privacy Policy, by9999 acts as the data controller in respect of personal data collected from players and platform users. As data controller, by9999 determines the purposes for which and the manner in which personal data is processed.

2.2 Where by9999 engages third-party service providers to process personal data on its behalf — such as KYC verification services, payment processors, and game providers — those parties act as data processors under contractual arrangements that require them to process data only on by9999's documented instructions and in accordance with appropriate security standards.

2.3 Contact details for data-related queries are provided in Section 17 of this Policy. by9999 designates a nominated contact for data protection matters who is responsible for overseeing compliance with this Policy and responding to data rights requests.

3 Personal Data We Collect

3.1 by9999 collects the following categories of personal data in connection with your use of the platform:

• Full legal name (as it appears on your CNIC);
• Date of birth;
• Pakistani mobile number;
• Email address;
• Residential address;
• Username chosen at registration.

• Copy of CNIC (Computerised National Identity Card) — front and back;
• Proof of address documentation (utility bill, bank statement, or equivalent issued within 3 months);
• Payment method verification documentation where required (screenshot of JazzCash or EasyPaisa account, bank statement, or equivalent);
• Selfie or live photograph for biometric identity matching purposes where required by compliance procedures.

• Deposit and withdrawal history including amounts, timestamps, and payment method identifiers;
• JazzCash account number, EasyPaisa account number, or bank account details used for transactions;
• Bonus credits received, wagering activity related to bonuses, and promotional participation history;
• Account balance history.

• Game session logs including games played, bets placed, stakes, outcomes, and session duration;
• Sports betting history including markets selected, odds accepted, stakes, and results;
• Responsible gaming tool settings and any self-imposed limits applied to your account;
• Self-exclusion requests and cool-off period activations.

• IP address at login and during active sessions;
• Device type, operating system, and browser or application version;
• Geolocation data (country/city level only — not precise GPS coordinates) derived from IP address;
• Session timestamps and duration;
• Cookie identifiers and similar tracking technologies as described in Section 11.

• Content of support conversations via live chat, email, or any other communication channel;
• Complaint and dispute records;
• Responses to surveys or feedback requests (where voluntarily submitted).

4 How We Collect Your Data

4.1 by9999 collects personal data through the following mechanisms:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, participate in a promotion, or update your account settings;
• Automatically during platform use — technical and device data including IP addresses, session logs, and cookie data are collected automatically whenever you access or interact with by9999.org;
• From third-party verification providers — where by9999 uses external KYC services to verify identity documents, those providers may return verification results and risk flags to by9999 as part of the verification process;
• From payment processors — transaction confirmation data including payment reference numbers and status codes are received from JazzCash, EasyPaisa, and banking partners to confirm successful deposits and facilitate withdrawals.

4.2 by9999 does not purchase personal data lists from third parties or engage in data scraping from social media platforms or other external sources to obtain personal data about its players.

5 Why We Use Your Personal Data

6 Legal Basis for Processing

6.1 by9999 processes personal data on the following legal bases, which apply across the processing activities described in Section 5:

• Performance of a contract: Processing necessary to create and administer your by9999 account, process your deposits and withdrawals, deliver gaming services, and provide customer support — all of which are required to fulfil the contractual relationship established when you register on the platform;
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements — including KYC and AML obligations, responsible gaming monitoring requirements, and regulatory reporting duties imposed on by9999 as a licensed gaming operator;
• Legitimate interests: Processing for fraud detection, platform security, internal analytics and performance improvement, and certain responsible gaming monitoring activities, where by9999's interests in operating a secure and compliant platform do not override your fundamental privacy rights;
• Consent: Processing for optional activities, particularly marketing communications and optional cookies. Where consent is the legal basis for processing, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

6.2 by9999 does not make decisions about your account that produce significant legal or similarly significant effects based solely on automated processing, without human review being available upon request.

7 Data Sharing & Third Parties

7.1 by9999 does not sell your personal data to any third party. Data sharing occurs only in the following strictly defined circumstances:

• KYC and Identity Verification Providers: by9999 shares identity documents and personal details with contracted verification service providers for the purpose of conducting mandatory identity checks. These providers are contractually prohibited from using your data for any purpose beyond delivering verification results to by9999;
• Payment Processors: Necessary financial data is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, and other payment service providers to the extent required to process your transactions;
• Game Providers: Anonymised session data is shared with game providers (including PG Soft, Pragmatic Play, and similar certified providers) to the extent required for game delivery, fair play certification, and technical support. Game providers do not receive your personally identifiable information beyond a session token;
• Regulatory and Law Enforcement Authorities: by9999 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by applicable law or court order. In such cases, by9999 will disclose only the minimum data legally required;
• Fraud Prevention Services: by9999 may share relevant data with industry-standard fraud prevention and AML screening services to detect and prevent financial crime on the platform;
• Business Transfers: In the event of a merger, acquisition, or sale of by9999's business assets, player personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being contractually required of the acquirer.

8 International Data Transfers

8.1 by9999 operates internationally and certain personal data may be processed on servers located outside Pakistan. Where personal data is transferred to servers or service providers in other countries, by9999 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

8.2 Safeguards used for international transfers include: contractual data processing agreements incorporating standard data protection clauses; transfers only to service providers operating in jurisdictions with adequate data protection frameworks; and technical security measures ensuring data integrity during transmission.

8.3 by9999 does not transfer personal data to jurisdictions that do not maintain adequate data protection standards without first ensuring that supplementary safeguards are in place to protect that data.

9 Data Retention

9.1 by9999 retains personal data for the periods set out below, after which data is securely deleted or anonymised:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years following account closure, in compliance with AML regulatory record-keeping obligations;
• KYC documents: Retained for a minimum of 5 years from the date of the last transaction on your account, as required by applicable financial crime compliance regulations;
• Financial and transaction records: Retained for a minimum of 5 years from the date of each transaction, consistent with applicable financial record-keeping obligations;
• Gaming activity logs: Retained for 3 years from the date of each session, primarily for dispute resolution, responsible gaming monitoring, and regulatory reporting purposes;
• Support communication records: Retained for 3 years from the date of each interaction;
• Technical and device data: Session logs retained for 12 months; aggregated anonymised analytics data may be retained indefinitely for platform improvement purposes;
• Marketing preferences and consent records: Retained for the duration of your account plus 3 years.

9.2 Where you request deletion of your personal data under Section 12, by9999 will fulfil that request subject to the retention obligations described above — data that by9999 is legally required to retain cannot be deleted in response to a deletion request until the applicable retention period has expired.

10 Security Measures

10.1 by9999 implements the following technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption: All data in transit is protected using TLS 1.3 encryption. Sensitive data at rest — including KYC documents, financial records, and authentication credentials — is encrypted using AES-256 encryption;
• Access Controls: Access to personal data within by9999's systems is restricted on a strict need-to-know basis. Role-based access controls ensure that staff can only access the data required to perform their specific functions;
• Authentication: Multi-factor authentication is required for all by9999 internal system access. Player accounts support OTP-based authentication for enhanced account security;
• Penetration Testing: by9999's platform undergoes regular independent security penetration testing and vulnerability assessments to identify and remediate potential weaknesses;
• Incident Response: by9999 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to player rights and freedoms, by9999 will notify affected players and relevant authorities within the timeframes required by applicable law;
• Vendor Security: All third-party data processors used by by9999 are required to maintain security standards equivalent to those described above as a condition of their contractual engagement.

11 Cookies & Tracking Technologies

11.1 by9999.org uses cookies and similar tracking technologies to enable core platform functionality, improve the user experience, and gather analytical data on platform usage. The categories of cookies used on by9999.org are as follows:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing your ability to log in and use the platform. No consent is required for strictly necessary cookies;
• Functional Cookies: Store your preferences such as language settings, preferred game lobby views, and last-used payment method to personalise your experience. Disabling functional cookies will cause your preferences to reset on each visit;
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate and use by9999.org — including which pages are visited most frequently, which game categories attract the most engagement, and where players encounter difficulties. This data is used to improve the platform. Analytics cookies require your consent;
• Responsible Gaming Cookies: Store your session start time and duration on-device to power session time reminders and reality check features. These are classified as strictly necessary for players who have enabled these responsible gaming tools.

11.2 You may manage your cookie preferences through the cookie consent settings available on by9999.org. Please note that disabling strictly necessary cookies will prevent normal platform access. All other cookie categories can be declined without preventing basic platform access, though some features may be less personalised as a result.

11.3 by9999.org does not use third-party advertising or retargeting cookies. No advertising networks can place tracking technologies on by9999.org or collect data about your browsing activity on the platform for their own advertising purposes.

12 Your Data Rights

12.1 As a by9999 player, you hold the following rights in respect of your personal data. These rights are genuine and exercisable — not theoretical:

12.2 To exercise any of these rights, contact by9999's data protection contact via the support email address in Section 17. Please include your registered by9999 username and the specific right you wish to exercise. by9999 will respond within 30 calendar days. by9999 may request verification of your identity before actioning a data rights request to ensure that data is not disclosed to or deleted at the request of an unauthorised third party.

13 Marketing Communications

13.1 by9999 may send promotional communications — including bonus offers, new game announcements, PSL betting promotions, and platform news — to registered players via email and SMS. These communications are sent only to players who have provided their consent to receive marketing at the time of registration or through their account communication preferences settings.

13.2 You may withdraw consent to receive marketing communications at any time by: updating your communication preferences in your account settings panel; clicking the unsubscribe link included in any marketing email; or contacting by9999 support and requesting removal from marketing lists. Withdrawal of marketing consent does not affect your ability to receive transactional communications — including deposit confirmations, withdrawal notifications, and account security alerts — which are sent regardless of marketing preference as they are necessary for account operation.

13.3 by9999 does not engage in cold marketing to non-registered individuals. by9999 does not share contact details with third-party marketers for the purpose of those parties sending their own marketing to by9999 players.

14 Responsible Gaming & Data Processing

14.1 by9999 processes certain personal data specifically in connection with its responsible gaming obligations. This processing is both a legal obligation (as a licensed operator) and a legitimate interest (protecting players from potential gambling harms). The specific data processing activities in this context include:

• Monitoring gaming activity patterns to detect behavioural indicators of potential problem gambling, such as rapidly escalating bet sizes, extended session duration without breaks, or repeated deposit-and-loss patterns;
• Recording and enforcing responsible gaming tool settings applied by the player, including deposit limits, loss limits, session time limits, and self-exclusion requests;
• Maintaining records of self-excluded players to prevent re-registration during active exclusion periods;
• Sharing player status information with national self-exclusion schemes where by9999 participates in such schemes.

14.2 Data processed for responsible gaming monitoring purposes is handled with the same security standards as all other personal data and is accessed only by by9999 staff with a specific compliance or player safety function. It is not used for marketing profiling or any commercial purpose other than player protection.

For more information about by9999's responsible gaming tools and resources, please visit the Responsible Gaming page.

15 Children's Privacy

15.1 by9999 employs age verification procedures at registration and during KYC processes to prevent individuals under 21 years of age from accessing the platform. Where by9999 discovers or has reasonable cause to believe that a registered account holder is under 21 years of age, the account will be immediately suspended, any balance will be returned (net of any bonuses credited), and the relevant personal data associated with the underage account will be deleted promptly in accordance with applicable law.

15.2 Parents and guardians who become aware that a minor may have registered on by9999 should contact by9999 support immediately via live chat or the support email address in Section 17. by9999 will investigate and close the account promptly.

16 Updates to This Privacy Policy

16.1 by9999 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law or regulatory requirements, or changes in the services offered on the platform. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

16.2 For material changes to this Policy — particularly changes that expand the categories of data collected, introduce new sharing arrangements, or affect your rights as a data subject — by9999 will notify registered players via email or in-platform notification prior to those changes taking effect. A minimum notice period of 14 days will apply for material changes wherever possible.

16.3 For minor clarifications, corrections of typographical errors, or non-material updates, by9999 may update the Policy without advance individual notice. The revised Policy will be effective from the date published on this page. Continued use of the by9999 platform after the effective date of any revision constitutes acceptance of the updated Policy.

16.4 We encourage all registered players to review this Privacy Policy periodically. The most current version will always be accessible at by9999.org/privacy-policy.

17 Contact Us

17.1 For any questions, concerns, or requests relating to this Privacy Policy or by9999's data processing practices, please contact us using the following channels:

• Data Protection Enquiries (Email): support@by9999.org — please use the subject line "Privacy / Data Request" to ensure your message is routed directly to by9999's data protection contact. Responses within 2 business days for general enquiries; data rights requests fulfilled within 30 calendar days;
• 24/7 Live Chat: Available directly within the by9999 platform after login — suitable for general privacy questions and initial guidance on exercising your data rights.

17.2 by9999 is committed to resolving all data-related complaints and enquiries fairly and promptly. If you are not satisfied with by9999's response to a data rights request or privacy complaint, you have the right to raise the matter with the relevant data protection supervisory authority in your jurisdiction.

17.3 by9999 does not charge fees for standard data rights requests. Where requests are manifestly unfounded or excessive in repetition, by9999 reserves the right to charge a reasonable administrative fee or decline to respond, consistent with applicable data protection law.