999m Privacy Policy

This Privacy Policy is issued by the operating company behind the 999m online gaming platform, accessible at 999m.im and all associated subdomains. When this Policy refers to "999m", "we", "us" or "our", it means that company in its capacity as the data controller — the entity that determines how and why your personal data is processed.

As the data controller, 999m is responsible for ensuring that all personal data processing activities described in this Policy comply with applicable data protection and privacy laws, as well as the requirements of our international gaming licence which include specific obligations regarding player data handling.

If you have any questions about this Privacy Policy or how 999m processes your personal data, you can contact us at any time at support@999m.im. We will respond to privacy-related enquiries within 5 business days.

999m collects the following categories of personal data. We have deliberately kept this list specific — we do not collect vague or catch-all categories of data.

999m collects personal data through several distinct routes, and we want to be transparent about each one.

• Directly from you: The majority of data we hold is information you provide yourself — when you fill in the registration form, when you submit KYC documents, when you add a payment method, when you contact our support team, or when you set responsible gaming limits in your account dashboard.
• Automatically during platform use: When you visit and use the 999m platform, certain technical data is collected automatically. This includes your IP address, the device and browser you're using, pages visited, time spent on the platform and actions taken within the gaming lobby. This data is collected via server logs and, where you consent, via cookies (see Section 8).
• From third-party verification services: When you submit KYC documents, 999m uses a third-party identity verification provider to check the authenticity of your documents and confirm that the details match official records. That provider returns a verification result to 999m — we do not receive or store the third party's full database records about you.
• From payment processors: When you deposit or withdraw PKR via Easypaisa, JazzCash or other supported methods, our payment processor confirms transaction status to 999m. We receive transaction reference numbers and confirmation of success or failure — we do not receive your full mobile wallet credentials or bank PIN.

Every processing activity at 999m has a lawful basis. We do not process personal data speculatively. The table below sets out the primary purposes for which we use your data and the lawful basis for each.

Given that 999m is a real-money platform operating exclusively in Pakistani Rupees, payment data handling deserves specific attention. Here is exactly how your financial information moves through the 999m system.

When you initiate a deposit via Easypaisa or JazzCash, you are redirected or provided with account details to complete the transfer within your existing mobile wallet app. 999m does not handle your Easypaisa or JazzCash login credentials at any point. The transaction is processed by the payment provider and 999m receives a confirmation notification and a transaction reference number only.

For bank IBFT transfers, you initiate the transfer directly from your bank's app or branch to 999m's registered account. 999m receives the deposited amount and the sender's bank details as part of the transfer record, which is retained for anti-money laundering compliance purposes.

For Visa/Mastercard deposits, card processing is handled entirely by a PCI-DSS compliant payment gateway. 999m receives confirmation of the transaction and the last four digits of your card for identification purposes only. Full card numbers are never transmitted to or stored by 999m.

All PKR transaction records — deposits, withdrawals, bonuses credited and wagering activity — are retained for a minimum of five years from the date of the transaction, as required by financial record-keeping regulations applicable to licensed gaming operators.

999m shares personal data only where necessary to deliver the platform, meet legal obligations, or protect the security of players and the platform. We do not sell, rent or trade player data with any third party for their own commercial purposes.

The categories of third parties we share data with are as follows:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay and card payment gateway providers. We share only the data required to process the specific transaction — typically identity data for KYC-linked payments and transaction amounts in PKR.
• KYC / identity verification providers: Third-party services that verify the authenticity of documents you submit. These providers are bound by strict data processing agreements and may only use your data for the verification purpose.
• Game software providers: Some game titles on 999m are supplied by third-party software providers. These providers may receive gameplay session data (such as bets placed and game outcomes) for the purpose of delivering the game and resolving any technical disputes. They do not receive your identity or financial data.
• Regulatory and law enforcement authorities: Where required by our gaming licence or applicable law, 999m will disclose player data to relevant regulatory bodies or law enforcement agencies. This includes reports required under anti-money laundering legislation.
• Professional advisors: Lawyers, auditors and insurers who require access to data in the course of providing services to 999m, subject to professional confidentiality obligations.

999m operates its primary server infrastructure in a jurisdiction with recognised data protection standards. However, some of the third-party service providers we work with — such as KYC verification platforms and game software providers — may be based in or operate infrastructure in other countries.

Where personal data is transferred outside Pakistan or outside the jurisdiction of 999m's primary data hosting, we ensure that appropriate safeguards are in place. These safeguards include contractual clauses with data processors that require them to apply equivalent data protection standards to those under which 999m operates, and in some cases, reliance on adequacy decisions where the receiving country's laws provide comparable protection.

If you would like specific information about the international transfer mechanisms we use for any particular data processing activity, please contact us at support@999m.im.

999m uses cookies and similar tracking technologies on the platform. Here is a straightforward explanation of what we use and why.

• Essential cookies: These are required for the platform to function. They maintain your login session, remember your language preference and enable the gaming interface to load correctly. The platform cannot work without these cookies and they cannot be disabled.
• Security cookies: These help 999m identify and prevent suspicious activity — for example, detecting if an account is being accessed from an unusual location or device. They are part of our fraud prevention infrastructure.
• Analytics cookies: With your consent, we use analytics tools to understand how players navigate the 999m platform — which pages are most visited, where players drop off during registration, and which games are most popular. This data is aggregated and anonymised. It helps us improve the platform for all users.
• Preference cookies: These remember choices you make on the platform — such as your preferred game category or deposit method — to reduce the number of steps required in repeat sessions.

You can manage cookie preferences through your browser settings at any time. Disabling analytics or preference cookies will not affect your ability to play games or make transactions on 999m, but some convenience features may not function as expected.

999m does not retain personal data longer than necessary for the purposes for which it was collected. Our retention periods are as follows:

• Account and identity data: Retained for the duration of your active account plus a minimum of five years after account closure. This is required by anti-money laundering regulations applicable to licensed gaming operators.
• Financial transaction records (PKR deposits, withdrawals, wagers): Retained for a minimum of five years from the date of each transaction.
• KYC documents: Retained for five years from account closure or from the date of the last transaction, whichever is later.
• Gameplay history: Retained for three years from the date of each gaming session, then aggregated and anonymised for statistical purposes.
• Customer support communications: Retained for two years from the date of the interaction, unless the communication relates to a disputed transaction or ongoing investigation, in which case it is retained until that matter is resolved.
• Technical and session data (IP logs, device data): Retained for 90 days from collection, unless flagged for security investigation.

As a 999m player, you have several rights with respect to your personal data. These rights are genuine and exercisable — they are not simply listed here as a formality.

To exercise any of these rights, contact 999m at support@999m.im with the subject line "Data Rights Request". Please include your registered username and a brief description of the right you wish to exercise. We will acknowledge receipt within 48 hours and respond substantively within 30 days.

999m is strictly an adults-only platform. Players must be 18 years of age or older to register an account and use any part of the 999m platform. We do not knowingly collect personal data from individuals under the age of 18.

If 999m becomes aware that personal data has been collected from a person under 18, we will delete that data and close the associated account immediately. If you believe that a minor has registered on 999m using false age information, please contact us at support@999m.im immediately so that we can investigate and take appropriate action.

Parents and guardians who are concerned about underage gambling should be aware of the parental control tools available through Pakistani mobile carriers and internet service providers. 999m also recommends the use of site-blocking tools that can restrict access to gambling platforms on shared family devices.

999m takes the security of your personal data seriously and has implemented technical and organisational measures appropriate to the risk involved in processing it. These measures include:

• Encryption in transit: All communication between your device and 999m's servers uses 256-bit SSL/TLS encryption. The connection is verified as secure before any login credentials or personal data are transmitted.
• Encryption at rest: Sensitive personal data stored in 999m's databases — including KYC documents, financial data and authentication credentials — is encrypted at the storage level.
• Access controls: Internal access to player personal data is restricted to employees and contractors with a legitimate operational need. Access is logged and regularly audited. Former employees have their access revoked upon termination.
• Two-factor authentication: Players can enable two-factor authentication (2FA) on their accounts via the security settings page. 999m strongly recommends enabling 2FA, particularly for accounts with significant PKR balances.
• Fraud detection systems: 999m runs continuous automated systems that monitor for unusual account activity — such as logins from new devices, large withdrawal requests following recent large deposits, or patterns consistent with account takeover. These systems trigger additional verification steps to protect the account holder.
• Regular security audits: The 999m platform undergoes periodic third-party security assessments to identify and address vulnerabilities before they can be exploited.

999m may send you promotional communications about bonuses, new games, sports betting promotions and VIP programme updates. These communications are sent only if you have given your explicit consent during registration or have subsequently opted in via your account communication preferences.

Marketing communications from 999m may be delivered via email, SMS to your registered mobile number, or in-platform notifications within the 999m dashboard. We do not send marketing communications via WhatsApp without your specific consent to that channel.

You can opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email from 999m
• Updating your communication preferences in your account dashboard under Settings > Notifications
• Contacting support@999m.im with the subject line "Marketing Opt-Out"

Opting out of marketing communications does not affect transactional communications — you will still receive emails about your deposits, withdrawals, account security, and important updates to these policies.

999m reviews this Privacy Policy periodically and updates it when our data practices change or when legal requirements are updated. The effective date at the top of this document reflects when the current version was last updated.

For material changes — those that significantly affect how we use your data or what rights you have — 999m will provide at least 7 days' advance notice by email to your registered address before the changes take effect. For minor changes such as corrections, clarifications or updates to contact details, we will update the policy on this page without prior notice.

We encourage you to review this Privacy Policy periodically. Your continued use of the 999m platform after any changes take effect constitutes your acceptance of the updated Policy.

If you have any questions about this Privacy Policy, about how 999m handles your personal data, or if you wish to exercise any of the rights described in Section 10, please contact us through any of the following channels.

• Email (preferred for privacy matters): support@999m.im — please use the subject line "Privacy Enquiry" or "Data Rights Request" so that your message is routed to the right team.
• Live Chat: Available on the 999m platform 24/7. For complex privacy matters, email is more appropriate, but live chat can handle initial questions and help you identify the right process.
• VIP Account Manager: Gold tier and above players can raise privacy-related concerns with their personal account manager, who will escalate to the appropriate internal team.

If you are not satisfied with how 999m handles your privacy complaint after going through our internal process, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction of 999m's gaming licence, or to the independent dispute resolution body specified in our licence conditions. Details of the relevant authority are available upon request.

999m takes all privacy complaints seriously and aims to resolve them fairly and promptly. We will acknowledge your complaint within 48 hours and provide a substantive response within 30 days. Complex complaints involving data audits may take longer — we will keep you informed of the timeline if this is the case.