1 Introduction & Scope
999bd ("we", "us", "our") is committed to protecting the privacy and personal data of every player who uses the 999bd platform. This Policy sets out, in full and transparent detail, the categories of personal data we collect from players in Pakistan and elsewhere, the legal bases upon which we rely for processing that data, the purposes for which we use it, and the rights available to you as a data subject.
This Policy applies to:
- All visitors to the 999bd website at https://999bd.cam, including visitors who have not registered a Player Account;
- All registered 999bd Players, wherever located;
- All users of any 999bd mobile or web application;
- Any person who contacts 999bd Customer Support by any channel.
This Policy does not apply to third-party websites, payment processors, or game providers linked to or integrated within the 999bd platform. Those entities maintain their own privacy policies for which 999bd accepts no responsibility. Players are encouraged to review the privacy practices of any third-party service they interact with in connection with their 999bd account.
Pakistan-Specific Note: 999bd serves a significant number of players from Karachi, Lahore, Islamabad, Faisalabad, Peshawar, and other Pakistani cities. While 999bd operates under an international gaming license, we take the privacy expectations of Pakistani users seriously and have designed our data practices to align with globally recognised data protection principles including those reflected in GDPR frameworks applicable to international operators.
2 Data Controller
For the purposes of applicable data protection law, the data controller in respect of personal data collected through the 999bd platform is the legal entity operating 999bd under its international gaming license. All data protection enquiries, rights requests, and complaints should be directed to:
- Data Protection Contact: [email protected]
- Subject Line: "Data Protection Enquiry" or "Data Rights Request"
- Response Time: Acknowledgement within 48 hours; substantive response within 30 calendar days
Where 999bd uses third-party data processors to perform specific functions (such as payment processing or identity verification), those processors act on 999bd's instructions and are bound by contractual obligations consistent with this Policy.
3 Personal Data We Collect
999bd collects personal data across several categories, each of which serves a specific operational or regulatory purpose. The categories are as follows:
3.1 Registration & Identity Data
When you create a 999bd Player Account, we collect:
- Full legal name;
- Date of birth (for 21+ age verification);
- Pakistani mobile number (primary account identifier);
- Residential address;
- Email address (where provided);
- Chosen username and encrypted account password.
3.2 Identity Verification (KYC) Data
To comply with our obligations under our international gaming license and to enforce the 21+ age restriction, 999bd collects the following during the KYC process:
- Government-issued photo identification — CNIC, passport, or driving licence;
- Proof of residential address (utility bill, bank statement, or official correspondence not older than 3 months);
- In certain circumstances, a live facial verification image for biometric identity matching.
3.3 Financial & Transaction Data
In connection with deposits and withdrawals conducted via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, or Mastercard, 999bd collects:
- Payment method identifiers (mobile wallet number, masked card number);
- Transaction amounts in PKR;
- Transaction dates and reference numbers;
- Account balance history.
3.4 Gaming Activity Data
- Game session logs (games played, stakes, outcomes);
- Sports betting selections, stakes, and settlement records;
- Bonus claims and wagering progress;
- Session duration and login timestamps.
3.5 Technical & Device Data
- IP address;
- Device type, operating system, and browser type;
- Mobile network operator (e.g. Jazz, Zong, Telenor, Ufone);
- Session identifiers and authentication tokens;
- Cookie data (see Section 7).
3.6 Customer Support Data
- Correspondence content from live chat, email, and any other support channel;
- Support ticket reference numbers and timestamps;
- Details of complaints or enquiries submitted.
| Data Category |
Primary Purpose |
Retention Period |
| Registration & Identity |
Account creation, communication, age verification |
Duration of account + 5 years post-closure |
| KYC Documents |
Age verification, regulatory compliance |
5 years from verification date |
| Financial & Transaction |
Payment processing, AML compliance, dispute resolution |
7 years from transaction date |
| Gaming Activity |
Fair play, responsible gaming, bonus tracking |
3 years from account closure |
| Technical & Device |
Security monitoring, fraud prevention |
90 days rolling |
| Customer Support |
Complaint resolution, service improvement |
3 years from last interaction |
4 How We Collect Your Data
999bd collects personal data through the following channels:
- Directly from you — when you register a 999bd account, complete KYC, make deposits or withdrawals, place bets, contact support, or update your account profile;
- Automatically — when you use the 999bd platform, our systems automatically collect technical data including IP address, device information, and session activity through server logs and cookies;
- From third-party partners — identity verification providers, payment processors (including JazzCash and EasyPaisa gateway operators), and fraud prevention services may provide data to 999bd in connection with account verification and transaction processing;
- From publicly available sources — where necessary for fraud prevention or regulatory compliance, 999bd may cross-reference data against publicly available records.
5 Legal Basis for Processing
999bd processes personal data on the following legal bases:
- Contractual Necessity: Processing required to perform the contract between 999bd and the Player — including account creation, game provision, payment processing, and customer support;
- Legal Obligation: Processing required to comply with applicable law and 999bd's obligations under its international gaming license — including KYC identity verification, age verification (21+), and anti-money laundering reporting;
- Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement where our interests do not override Players' data protection rights;
- Consent: Where we send marketing communications by email or SMS, we do so only on the basis of your freely given, specific, informed consent, which you may withdraw at any time.
6 How We Use Your Personal Data
999bd uses collected personal data for the following specific purposes:
- Creating and managing your 999bd Player Account;
- Processing deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard;
- Verifying your identity and age (21+) in compliance with our gaming license obligations;
- Providing live dealer games, slots, table games, and cricket sportsbook services;
- Detecting and preventing fraudulent activity, money laundering, and collusion;
- Monitoring for responsible gaming indicators and enforcing deposit limits and self-exclusion arrangements;
- Responding to Customer Support enquiries submitted to [email protected];
- Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) to your registered mobile number;
- Sending promotional communications where you have provided explicit consent — with an easily accessible opt-out mechanism in every message;
- Improving the 999bd platform based on aggregated, anonymised usage analytics;
- Complying with legal obligations including tax reporting and regulatory enquiries.
No Automated Decision-Making with Legal Effect: 999bd does not use fully automated decision-making processes that produce legal or similarly significant effects on Players without human review. Where automated systems flag an account for investigation (e.g. for suspected fraud or underage play), a 999bd compliance team member reviews the case before any action is taken.
7 Cookies & Tracking Technologies
7.1 Types of Cookies Used
The 999bd platform uses the following categories of cookies:
- Strictly Necessary Cookies: Essential for the operation of the 999bd platform — including session authentication, security tokens, and game state preservation. These cannot be disabled without breaking platform functionality;
- Performance Cookies: Used to collect anonymised data about how Players interact with 999bd — page load times, most-visited game categories, and error rates. No personal data is transmitted to third-party analytics providers in identifiable form;
- Functionality Cookies: Store your preferences such as language settings and preferred payment method display order;
- Security Cookies: Used to detect fraudulent login attempts, bot activity, and suspicious session behaviour.
7.2 Cookie Management
On your first visit to 999bd, a cookie consent notice is displayed. You may accept all cookies or configure your preferences. Strictly necessary and security cookies cannot be disabled. You may also manage cookies through your browser settings — most modern Pakistani mobile browsers including Chrome for Android and Safari for iOS provide granular cookie controls. Note that disabling certain cookies may affect your 999bd gaming experience.
8 Third-Party Disclosure
999bd does not sell, rent, or share your personal data with third parties for their own marketing purposes. We share personal data with third parties only in the following circumstances:
- Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard gateway operators receive the minimum data necessary to process your deposit or withdrawal transactions;
- Identity Verification Providers: Third-party KYC verification partners receive your identity documents and personal details solely to perform age and identity verification on 999bd's behalf;
- Game Software Providers: Game providers integrated into the 999bd platform may receive anonymised session data (Player ID, bet amount, game outcome) for game operation and fairness certification purposes;
- Fraud Prevention Services: 999bd uses third-party fraud detection systems that process technical data including IP addresses and device fingerprints to identify suspicious account activity;
- Legal Authorities: 999bd will disclose personal data to law enforcement, regulatory authorities, or courts when legally compelled to do so — for example in connection with anti-money laundering investigations or court orders. 999bd will notify affected Players of such disclosures to the extent permitted by law;
- Professional Advisors: Lawyers, auditors, and compliance consultants engaged by 999bd may access personal data under confidentiality obligations as necessary for their professional services.
Data Processor Contracts: All third parties who process personal data on behalf of 999bd are bound by written Data Processing Agreements that require them to process data only in accordance with 999bd's instructions, maintain appropriate security measures, and not retain data beyond the period necessary for the contracted purpose.
9 International Data Transfers
As 999bd operates under an international gaming license and uses globally distributed technology infrastructure, your personal data may be transferred to, stored in, and processed in countries outside Pakistan. Where such transfers occur, 999bd ensures that appropriate safeguards are in place — including:
- Standard contractual clauses consistent with internationally recognised data protection frameworks;
- Processing only by third parties who maintain security standards equivalent to or exceeding those described in this Policy;
- Limiting the scope of international transfers to data that is strictly necessary for the contracted purpose.
By registering a 999bd account and accepting this Privacy Policy, you acknowledge that your personal data may be transferred internationally as described above.
10 Data Security Measures
999bd implements the following technical and organisational security measures to protect your personal data:
- Encryption: All data transmitted between your device and 999bd servers is encrypted using 256-bit TLS/SSL. Account passwords are stored using bcrypt hashing with per-user salt — they cannot be retrieved in plain text by anyone;
- Access Controls: Access to personal data systems is restricted to 999bd personnel who require it for their job function. Access is governed by role-based permissions and reviewed regularly;
- Two-Factor Authentication: 999bd offers 2FA at the account login level — available and recommended to all registered Players;
- Intrusion Detection: 999bd's infrastructure is monitored 24/7 for unauthorised access attempts, unusual data access patterns, and security anomalies;
- Penetration Testing: The 999bd platform undergoes periodic security assessments by independent cybersecurity specialists;
- Incident Response: 999bd maintains a documented data breach response procedure. In the event of a breach affecting Player personal data, affected Players will be notified without undue delay in accordance with applicable obligations.
11 Data Retention
999bd retains personal data for the minimum period necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. The retention periods applicable to each data category are summarised in the table in Section 3. Upon expiry of the applicable retention period:
- Personal data that is no longer required is securely and irreversibly deleted from 999bd's active systems;
- Where permanent deletion is not immediately technically feasible (e.g. in backup archives), data is securely isolated and deleted at the next scheduled backup rotation;
- Where data is required to be retained for legal or regulatory purposes beyond the standard retention period, it is retained in a secure, access-restricted environment for the minimum additional period required by law.
Players may request early deletion of their personal data subject to our legal retention obligations — see Section 12 for details of how to exercise this right.
12 Your Data Rights
Subject to applicable law and our legal obligations (including mandatory KYC retention requirements), you hold the following rights in respect of your personal data held by 999bd:
Right of Access
You may request a copy of all personal data 999bd holds about you. 999bd will provide this in a structured, machine-readable format within 30 days of receipt of a verified request.
Right to Rectification
If any personal data held by 999bd is inaccurate or incomplete, you may request that it be corrected. You may also update many fields directly from within your 999bd account settings.
Right to Erasure ("Right to be Forgotten")
You may request deletion of your personal data. This right is subject to our legal obligation to retain certain data (e.g. KYC documents for 5 years and transaction records for 7 years) — 999bd will delete all data not subject to a mandatory retention obligation and inform you of any data that must be retained and why.
Right to Data Portability
Where processing is based on consent or contract and is carried out by automated means, you may request that your personal data be provided to you in a portable, machine-readable format (JSON or CSV) suitable for transfer to another service.
Right to Restrict Processing
In certain circumstances (e.g. while a data accuracy dispute is under review) you may request that 999bd restrict active processing of your personal data without deleting it. Restricted data is retained but not actively used during the restriction period.
Right to Object
You may object to processing of your personal data that is based on legitimate interests. 999bd will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is required for legal claims.
Exercising Your Rights: To exercise any of the above rights, contact 999bd at
[email protected] with the subject line "Data Rights Request". Please include your registered mobile number or Account ID for identity verification purposes. 999bd will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days.
13 Children & Minors
Strict 21+ Policy: 999bd does not knowingly collect personal data from or provide services to persons under the age of 21. The collection of personal data from minors (under 21) is not permitted under any circumstances on the 999bd platform. All 999bd accounts must complete KYC age verification before withdrawal privileges are activated.
If 999bd discovers or is informed that it has inadvertently collected personal data from an individual under the age of 21, it will:
- Immediately suspend the associated Player Account;
- Refund any deposited funds to the source payment method (minus any bonus or promotional credits);
- Permanently delete all personal data associated with the account upon completion of any required regulatory reporting;
- Block re-registration from the associated mobile number, device, and payment method.
If you are a parent or guardian and believe that a person under 21 in your care has registered a 999bd account, please contact us immediately at [email protected].
14 Responsible Gaming & Data Processing
999bd processes certain personal data specifically for responsible gaming purposes — to protect players from gambling-related harm. This includes:
- Monitoring gaming activity data to identify patterns associated with problematic gambling behaviour (high-frequency sessions, rapid deposit sequences, large loss accumulation);
- Storing deposit limit, loss limit, session reminder, and self-exclusion settings applied by a Player to their 999bd account;
- Retaining self-exclusion records for a minimum of 5 years to prevent re-registration by excluded Players during their mandatory exclusion period;
- Sharing relevant account data with third-party responsible gaming support services where a Player consents to a referral.
The processing of gaming activity data for responsible gaming purposes is conducted on the legal basis of legitimate interests — specifically, 999bd's interest in preventing gambling-related harm and fulfilling its obligations under its international gaming license. This processing is proportionate and does not involve automated decision-making with significant consequences for Players without human review.
15 Amendments to This Policy
999bd reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where material changes are made, 999bd will:
- Post the updated Policy at https://999bd.cam/privacy-policy with a revised "Last Updated" date;
- Notify registered Players via SMS to their registered Pakistani mobile number at least 14 days before material changes take effect;
- Where the change requires new consent (e.g. a new processing purpose), present an explicit consent request to affected Players before the change takes effect.
Your continued use of the 999bd platform after the notification period constitutes acceptance of the amended Privacy Policy. If you do not accept the amended Policy, you should cease using the platform and request account closure under Section 3.4 of the Terms & Conditions.
16 Contact Us — Data & Privacy Enquiries
For all privacy-related enquiries, data rights requests, and data protection complaints, please contact 999bd as follows:
- Email: [email protected] (plain text — not a clickable link)
- Subject Line: "Privacy Policy Enquiry" or "Data Rights Request"
- Availability: 24 hours a day, 7 days a week
- Languages: Urdu and English
- Response Time: Acknowledgement within 48 hours; full response within 30 calendar days
If you are not satisfied with 999bd's response to a data protection complaint, you may have the right to lodge a complaint with the supervisory authority applicable under your jurisdiction's data protection framework.
Security Note: 999bd's data protection team will never ask for your account password, OTPs, or full payment card details by email. Any communication requesting this information does not originate from 999bd — please report it to
[email protected] immediately.