y99o Privacy Policy

This Privacy Policy ("Policy") describes how y99o ("y99o", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals who access or use the y99o platform at y99o.app ("Platform"), including all associated mobile interfaces, sub-pages, promotional pages, and customer support channels.

This Policy applies to:

• Registered players who have created a y99o account.
• Visitors who browse the y99o platform without registering.
• Individuals who contact y99o via live chat, email, or other support channels.
• Former players whose accounts have been closed but whose data is retained for legal or regulatory reasons.

This Policy does not apply to third-party websites, payment processors, or game providers that may be accessible via links or integrations within the y99o platform. Those entities operate under their own separate privacy policies, and y99o accepts no responsibility for their data practices.

y99o acts as the data controller in respect of personal data collected through the y99o platform. As data controller, y99o determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all data-related enquiries, correction requests, deletion requests, and complaints, players should contact the y99o Data Protection team using the contact details provided in Section 16 of this Policy.

y99o collects the following categories of personal data from players and platform visitors:

y99o does not intentionally collect sensitive personal data such as biometric data, racial or ethnic origin, religious beliefs, or health information unless specifically required for responsible gaming assessments (e.g., self-exclusion records) or as mandated by applicable law.

y99o collects personal data through the following mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically as you interact with the platform, including via cookies, server logs, and analytics tools. See Section 8 for full cookie details.
• Third-party sources: Identity verification data returned by our KYC partners; fraud risk scores from fraud prevention services; payment transaction data from JazzCash, EasyPaisa, and banking partners; geolocation signals from IP address databases.
• Device permissions: Where you have granted permission on your mobile device, y99o may access location data at a city or country level to comply with jurisdictional access restrictions. y99o does not access your contacts, camera, microphone, or file storage without explicit consent.

y99o processes your personal data only where a valid legal basis exists. The primary legal bases applicable to y99o's data processing activities are:

• Contractual necessity: Processing required to create and manage your account, process deposits and withdrawals, provide access to games, resolve disputes, and fulfil any other obligations arising from your use of the y99o platform.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, KYC verification requirements, tax reporting, and responses to lawful requests from regulatory bodies or law enforcement.
• Legitimate interests: Processing carried out for y99o's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of data for optional purposes such as marketing communications and personalised game recommendations, where you have given clear, informed, and freely withdrawn consent.

y99o uses collected personal data for the following specific purposes:

• Creating and maintaining your y99o player account, including identity verification and age confirmation (21+ policy enforcement).
• Processing financial transactions — deposits, withdrawals, bonus credits — and maintaining accurate PKR account balances.
• Delivering the full range of y99o gaming services, including Teen Patti, Andar Bahar, slot games, cricket betting, and live dealer games.
• Providing customer support, including responding to queries, resolving disputes, and processing complaints.
• Complying with AML, KYC, and other legal and regulatory requirements applicable to online gaming operations.
• Detecting, investigating, and preventing fraudulent activity, multi-accounting, match-fixing, and other prohibited conduct as defined in our Terms & Conditions.
• Monitoring gameplay for responsible gaming indicators and intervening where player welfare concerns are identified.
• Improving the y99o platform through internal analytics, A/B testing, and user experience research.
• Sending marketing and promotional communications where you have opted in to receive them.
• Personalising your y99o experience — for example, surfacing game recommendations based on your stated preferences or play history, with your consent.

y99o shares personal data with third parties only in the following specific circumstances and only to the minimum extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction data necessary to process your deposits and withdrawals. These entities are contractually bound to handle your data securely and in compliance with applicable financial regulations.
• KYC and identity verification partners: Licensed third-party KYC providers receive identity documents and personal data as required to verify your age and identity. These providers operate under strict data processing agreements.
• Game providers: Licensed game studios providing Teen Patti, Andar Bahar, slots, and live dealer games may receive a player session token and anonymous session ID necessary to initialise and record game rounds. Full personal identity data is not shared with game providers.
• Fraud prevention services: Aggregated technical and behavioural data may be shared with licensed fraud prevention platforms to support real-time risk scoring.
• Regulatory and law enforcement authorities: y99o will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory instruction.
• Business transfers: In the event of a merger, acquisition, or sale of y99o's assets, player data may be transferred as part of the transaction. Affected players will be notified in advance and given the opportunity to request account closure.

y99o uses cookies and similar tracking technologies to operate the platform effectively, maintain your login session, remember your preferences, and gather analytics data. The following categories of cookies are in use on the y99o platform:

You can manage your cookie preferences at any time through the Cookie Settings panel accessible from the footer of the y99o platform. Please note that disabling strictly necessary cookies will prevent you from logging in and using core platform features.

y99o retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by law or regulation. The following general retention periods apply:

• Active account data: Retained for the lifetime of your account plus 5 years following permanent account closure, in line with AML record-keeping obligations applicable to online gaming operators.
• Financial transaction records: Retained for 7 years following each transaction, as required by standard financial record-keeping practices.
• KYC documentation: Retained for 5 years after account closure. Original document images are destroyed after verification; metadata and verification outcome records are retained for the full period.
• Customer support communications: Retained for 3 years from the date of the final communication in each support thread.
• Marketing preference records: Retained until you withdraw consent or close your account, plus 1 year to evidence compliance with opt-out requests.
• Self-exclusion records: Retained permanently in anonymised form to prevent the re-registration of self-excluded players.
• Technical and usage logs: Retained for 13 months on a rolling basis, unless flagged as part of a fraud or security investigation in which case they may be retained for the duration of that investigation plus 3 years.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

As a y99o player, you have the following rights with respect to your personal data. To exercise any of these rights, contact the y99o Data Protection team as described in Section 16. y99o will respond to all valid requests within 10 business days:

• Right of Access: You may request a copy of the personal data y99o holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. For identity data, corrections may require re-submission of KYC documents.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. This right does not apply where retention is required by law (e.g., AML and financial record-keeping obligations).
• Right to Restriction: You may request that y99o restrict processing of your data while a rectification request is under review or where you contest the lawfulness of processing.
• Right to Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a machine-readable export of the personal data you have provided to y99o.
• Right to Object: You may object to processing based on legitimate interests at any time. You have an unconditional right to object to processing for direct marketing purposes, which y99o will action immediately upon receipt.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right Not to Be Subject to Automated Decision-Making: You may request human review of any automated decision that significantly affects your account or gameplay.

y99o implements a comprehensive, layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• TLS 1.3 encryption for all data in transit between your device and y99o servers.
• AES-256 encryption for sensitive data stored at rest, including payment method details and identity documents.
• Bcrypt password hashing — plaintext passwords are never stored or transmitted. All stored passwords are salted and hashed using industry-standard algorithms.
• SMS two-factor authentication (2FA) available to all registered players and mandatory for withdrawal requests above Rs 10,000.
• Role-based access controls restricting internal staff access to personal data on a strict need-to-know basis.
• 24/7 intrusion detection and monitoring of y99o infrastructure for anomalous access patterns.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• Data breach response plan — in the event of a confirmed breach affecting player data, y99o will notify affected players and relevant authorities within 72 hours of becoming aware of the incident.

While y99o takes every reasonable precaution to secure your data, no system is entirely immune to security risks. Players are strongly encouraged to use a strong unique password, enable 2FA, and report any suspicious activity on their account to y99o support immediately.

y99o enforces a strict minimum age of 21 years for all registered players. The y99o platform is not intended for, and must not be used by, any person under the age of 21. y99o does not knowingly collect personal data from persons under 21 years of age.

If y99o discovers or is notified that a registered account belongs to a person under 21, the account will be immediately suspended, all funds will be returned to the payment method used for deposit, and all personal data associated with the account will be deleted promptly in accordance with our data retention policies.

y99o sends promotional and marketing communications — including SMS messages, email newsletters, and in-platform notifications — only to players who have expressly opted in to receive them. We never add players to marketing lists without consent.

You can manage your marketing preferences at any time by:

• Visiting the Notifications & Marketing section in your y99o account settings.
• Clicking the unsubscribe link included in every marketing email y99o sends.
• Replying STOP to any promotional SMS sent by y99o.
• Contacting y99o customer support via live chat or email and requesting removal from all marketing lists.

Opting out of marketing communications does not affect transactional communications — you will continue to receive essential account notifications such as deposit confirmations, withdrawal updates, KYC status alerts, and security notices regardless of your marketing opt-out status.

y99o's primary player data is stored on servers located within the jurisdiction of our operating licence. However, certain service providers — including licensed game studios and KYC verification partners — may process data in other countries. Where personal data is transferred outside Pakistan or the primary hosting jurisdiction, y99o ensures that appropriate safeguards are in place, including:

• Data processing agreements incorporating internationally recognised standard contractual clauses (SCCs) or equivalent protections.
• Transfer only to jurisdictions with an adequate level of data protection as assessed by relevant regulatory bodies.
• Contractual obligations requiring recipient processors to apply security standards at least equivalent to those described in this Policy.

Players may request details of specific international transfer mechanisms applicable to their data by contacting the y99o Data Protection team.

y99o reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Where changes are material — meaning they significantly alter how we collect, use, or share your personal data — y99o will provide advance notice through:

• A prominent banner displayed on the y99o platform homepage and login page for at least 7 days prior to the effective date.
• An email notification sent to your registered email address.
• An in-platform notification upon your next login to the y99o platform.

For non-material amendments — such as typographical corrections or clarifications that do not alter the substance of the Policy — updates may take effect immediately upon publication. The "Last Updated" date and version number at the top of this page will always reflect the most recent revision. Continued use of the y99o platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

For all privacy-related enquiries, data rights requests, or complaints regarding y99o's handling of your personal data, please contact our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a link) — subject line: "Data Privacy Request"
• Live Chat: Available 24/7 directly from the y99o platform — request to speak with the Data Protection team
• Response Time: y99o commits to acknowledging all privacy requests within 48 hours and providing a substantive response within 10 business days
• Languages: Requests may be submitted in English or Urdu; responses will be provided in the same language

If you are not satisfied with y99o's response to your privacy complaint, you may escalate the matter to the applicable data protection authority in the jurisdiction of y99o's operating licence. Details of the relevant supervisory authority will be provided upon request.

y99o takes all privacy complaints seriously and is committed to resolving them fairly, transparently, and within the timeframes stated above. Our Data Protection team operates independently of our commercial teams to ensure impartial handling of all data-related concerns.