c9999 Privacy Policy —
How We Handle Your Personal Data

c9999 is the trading name of the internationally licensed gaming company that owns and operates the online casino and sports betting platform accessible at c9999.biz (the "Platform"). For the purposes of this Privacy Policy, "c9999", "we", "us", and "our" refer to that operating entity and its authorised data processing arrangements.

c9999 acts as the data controller in respect of the personal data of registered Account holders and visitors to the Platform. This means c9999 determines the purposes for which personal data is collected and the means by which it is processed.

The c9999 Platform is operated specifically for players based in Pakistan and is offered in English. All financial transactions on the Platform are conducted in Pakistani Rupees (PKR). If you have questions about how your personal data is handled, please refer to Section 15 (Contact Us) for the appropriate contact channel.

c9999 collects personal data across several categories. The specific data collected depends on the nature of your interaction with the Platform:

c9999 does not intentionally collect sensitive personal data beyond what is required for identity verification (CNIC) and responsible gaming monitoring. Where sensitive data is incidentally received, it is handled with heightened protection measures and is not used for marketing purposes.

c9999 collects personal data through the following mechanisms:

• Direct Collection: Data you provide when creating your c9999 Account, completing the KYC verification process, making a deposit or withdrawal, contacting support, or responding to surveys and promotions.
• Automated Collection: Technical data collected automatically as you interact with the c9999 Platform, including session cookies, server logs, and device identification data. This collection occurs every time you access the Platform.
• Payment Processor Data: When you deposit or withdraw via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or Raast, our payment processing partners may share transaction confirmation data with c9999 solely for the purpose of crediting or debiting your account Wallet.
• KYC Verification Partners: c9999 may use third-party identity verification services to validate the documents you submit as part of the KYC process. These services confirm document authenticity and may cross-reference data against publicly available identity databases.
• Responsible Gaming Monitoring: c9999's internal systems analyse betting and gaming behaviour patterns to identify potential indicators of problem gambling. This analysis is conducted using data already held within your Account records.

c9999 processes your personal data only where a valid legal basis exists. The following table sets out the primary purposes of processing and the corresponding legal basis for each:

c9999 does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast receive transaction-relevant data (such as your registered mobile number and transaction amount) necessary to process your deposits and withdrawals. These parties operate under their own privacy policies and are independently regulated financial institutions in Pakistan.
• KYC & Identity Verification Providers: c9999 engages licensed third-party KYC service providers to verify identity documents submitted during Account registration. These providers are contractually bound to use data only for the stated verification purpose and not to retain or independently process your data beyond that purpose.
• Game Software Providers: Casino game providers whose titles appear on c9999 may receive anonymous session data (such as game ID, bet amounts, and outcomes) for game integrity and RTP audit purposes. No personally identifiable information is shared with game providers beyond what is necessary for technical game delivery.
• Regulatory and Legal Authorities: c9999 may be required to disclose personal data to regulatory bodies, law enforcement agencies, or courts in response to lawful demands, court orders, or to comply with anti-money laundering and counter-terrorism financing reporting obligations. c9999 will disclose the minimum necessary data in each such case.
• Fraud Prevention Networks: In cases of suspected fraud or money laundering, c9999 may share relevant data with industry fraud prevention databases or law enforcement agencies to support the investigation of financial crime.
• Business Successors: In the event of a merger, acquisition, or transfer of business assets involving c9999, personal data held by c9999 may be transferred to the successor entity, subject to the same privacy protections as described in this Policy.

All third-party data processors engaged by c9999 are required by contract to maintain appropriate data security standards and to process data only in accordance with c9999's instructions and applicable data protection law.

c9999 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Session Cookies: Required for the Platform to function — they maintain your logged-in session, preserve your language and account preferences, and enable secure authentication. These cannot be disabled without breaking core Platform functionality.
• Security Cookies: Used to detect and prevent fraudulent login attempts, identify suspicious session activity, and enforce account security measures including 2FA session binding.
• Analytics Cookies: Aggregate, anonymised data about how users navigate the c9999 Platform — which pages are visited, how long sessions last, and where errors occur — collected to improve Platform performance and user experience. No personally identifiable information is stored in analytics cookies.
• Preference Cookies: Store your display preferences such as notification settings and game lobby filter preferences to personalise your experience on return visits.

c9999 does not use advertising or cross-site tracking cookies. We do not share cookie data with advertising networks or data brokers. You may manage cookie preferences through your browser settings, though disabling essential cookies will impair your ability to use the Platform.

c9999 implements a multi-layered technical and organisational security framework to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and c9999's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This includes login credentials, payment data, and personal account information.
• Encryption at Rest: Sensitive personal data — including identity documents submitted for KYC and financial transaction records — is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to personal data within c9999's systems is restricted to authorised personnel on a strict need-to-know basis. Access rights are reviewed periodically and revoked immediately upon role change or termination.
• Anomaly Detection: c9999's security systems continuously monitor for unusual login patterns, access from unrecognised devices, and abnormal transaction activity, triggering automatic security reviews where anomalies are detected.
• Password Security: Account passwords are stored using one-way hashing with salting — c9999 staff cannot retrieve your password in plain text. In the event of a forgotten password, a reset process is initiated via SMS to your registered number.
• Two-Factor Authentication: c9999 offers optional 2FA to all Account holders, providing an additional layer of protection beyond your password.

No data security measure is infallible. In the event that c9999 becomes aware of a security breach that is likely to result in a high risk to your rights, we will notify affected Users without undue delay and take immediate remediation steps.

c9999 retains personal data for defined periods appropriate to the purpose for which it was collected and the applicable regulatory retention obligations:

• Account & Identity Data: Retained for the duration of your c9999 Account and for a minimum of five (5) years following Account closure, to meet anti-money laundering record-keeping obligations.
• Transaction & Betting Records: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping requirements.
• KYC Documents: Identity documents submitted for KYC verification are retained for a minimum of five (5) years following Account closure or the completion of the most recent transaction, whichever is later.
• Support & Communications Records: Records of support interactions are retained for a minimum of three (3) years from the date of each communication.
• Technical & Session Logs: Server logs and session data are retained for up to twelve (12) months for security and fraud investigation purposes, after which they are deleted or anonymised.
• Self-Exclusion Records: Data relating to voluntary self-exclusion is retained permanently to prevent the circumvention of exclusion restrictions.

Following the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised aggregate data may be retained indefinitely for analytical purposes.

As a data subject whose personal data is processed by c9999, you hold the following rights, exercisable by contacting c9999 through the channels described in Section 15:

c9999 will respond to verified rights requests within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days, with prior notification. Requests may be subject to identity verification to protect against unauthorised access to personal data.

Please note that certain rights are subject to limitations — for example, the right to erasure does not apply where c9999 is required to retain data to comply with a legal obligation, such as anti-money laundering record-keeping requirements.

c9999 may send promotional communications — including information about bonuses, new games, special promotions, and Platform updates — via SMS to your registered Pakistani mobile number. Such communications are sent only where you have provided your consent at the time of registration or have subsequently opted in through your Account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Adjusting the marketing preferences in your c9999 Account settings; or
• Contacting c9999 support and requesting removal from marketing communications.

Withdrawal of consent for marketing communications will not affect your ability to use c9999 Services or receive transactional and security-related messages, which are sent regardless of marketing preferences as they are necessary for Account operations.

c9999 does not share your contact information with third-party marketers. All promotional messages originate from c9999 directly and relate exclusively to c9999's own Services.

c9999's responsible gaming programme involves the collection and analysis of betting and gaming behaviour data to identify early indicators of problem gambling. This processing activity is conducted in the interest of player protection and is mandated by c9999's international gaming license obligations.

Specifically, c9999 monitors: deposit frequency and volume, gaming session duration, loss pattern escalation, wagering-to-deposit ratios, and self-exclusion request history. Where these indicators suggest potentially harmful gambling patterns, c9999 may contact the Account holder with information about available support tools or, in serious cases, apply temporary account restrictions as a protective measure.

Data collected through responsible gaming monitoring is used exclusively for player protection purposes. It is not used for marketing, profiling for commercial purposes, or shared with third parties other than where required by c9999's licensing obligations.

Voluntary self-exclusion data is permanently retained to prevent exclusion circumvention. Where you have applied a self-exclusion on your c9999 Account, we maintain a record of that exclusion for the full duration of the exclusion period and for a reasonable period thereafter, to prevent the re-opening of an excluded Account. More information is available at c9999.biz/responsible-gaming.

The c9999 Platform does not include links to external third-party websites for general browsing purposes. However, certain services accessed through the Platform — such as payment processing through JazzCash, EasyPaisa, and Pakistani banking institutions — are operated by independent third-party entities with their own privacy policies.

c9999 has no control over and accepts no responsibility for the privacy practices of third-party payment processors or identity verification providers. We strongly recommend that you read the privacy policies of any third-party service you interact with in connection with your c9999 Account, including those of your chosen payment method provider.

Game content on the Platform is delivered by licensed third-party casino software providers. These providers may collect limited technical data (such as game session identifiers) for game integrity and RTP audit purposes. This data collection is governed by each provider's own data processing arrangements, and no personally identifiable information is shared with game providers beyond what is technically necessary for game delivery.

c9999 does not knowingly collect or process personal data of individuals under the age of 21. The Platform is strictly for adults aged 21 and above, and age verification is enforced at registration and again through the KYC process prior to any withdrawal.

If c9999 discovers that an Account has been created by a person under the age of 21, the Account will be immediately closed, the personal data of the underage individual will be deleted from c9999's systems as promptly as is technically feasible, and any balance in the Account will be subject to forfeiture in accordance with c9999's Terms & Conditions.

If you believe a person under 21 has created an Account on c9999, please contact c9999 support immediately so that the Account can be investigated and closed without delay.

c9999 reviews and may update this Privacy Policy from time to time to reflect changes in data processing practices, regulatory requirements, or Platform functionality. The effective date shown at the top of this Policy will be updated to reflect the date of the most recent revision.

Where changes to this Policy are material — meaning they affect how your personal data is collected, used, or shared in a way that is meaningfully different from the previous version — c9999 will notify registered Users via SMS to their registered mobile number at least seven (7) days prior to the changes taking effect, except where immediate changes are required to comply with a legal obligation.

Continued use of the c9999 Platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy. If you do not agree with the revised Policy, you may request Account closure in accordance with the provisions of the Terms & Conditions.

The current version of this Privacy Policy is always accessible at c9999.biz/privacy-policy.

If you have any questions, concerns, or requests related to this Privacy Policy or c9999's data processing practices, please contact us through the following channels:

• Support Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week through your c9999 Account after logging in at c9999.biz/c9999-login.

When submitting a data rights request or privacy concern, please include your registered mobile number and a description of your request. c9999 may require identity verification before actioning data access, correction, or deletion requests to protect against unauthorised data disclosure.

c9999 aims to acknowledge all privacy-related queries within 48 hours and to provide a substantive response within the timelines described in Section 9 above. For urgent account security matters, live chat remains the fastest contact channel.