Privacy Policy — 999ad Platform

1. Introduction

999ad ("we", "us", "our", "the Platform") operates the online gaming information platform accessible at https://999ad.cam. This Privacy Policy ("Policy") describes how we collect, use, store, disclose and protect the personal data of individuals ("Users", "you", "your") who access or interact with the Platform.

We serve users primarily located in Pakistan — including users accessing the Platform from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and other cities across the country. We recognise that privacy is a fundamental right, and we are committed to handling your personal data with honesty, transparency and security.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform. Together, these documents form the complete agreement between you and 999ad with respect to data handling and platform usage.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could reasonably identify a living individual, directly or in combination with other data.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transmission, alteration or deletion.
• "Data Controller" — 999ad, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of 999ad, subject to our instructions and applicable data protection obligations.
• "Cookies" — small text files stored on your device by a web browser, used to retain session information and usage preferences.
• "KYC" — Know Your Customer; identity and age verification procedures typically conducted by Operator platforms, not directly by 999ad.
• "Operator" — a third-party online gambling or gaming service provider independent of 999ad.
• "CNIC" — Computerised National Identity Card issued by the National Database and Registration Authority (NADRA) of Pakistan.

3. Data We Collect

Depending on how you interact with the Platform, 999ad may collect the following categories of personal data:

4. How We Collect Your Data

We collect personal data through the following channels and mechanisms:

4.1 Direct Collection

When you contact our support team by email ([email protected] — plain text, not a link) or via our live chat interface, you voluntarily provide us with personal data such as your name and email address. This data is used solely to respond to your query and to maintain a record of our correspondence with you.

4.2 Automated Technical Collection

When you access the Platform, your browser automatically transmits certain technical data to our servers — including your IP address, browser type, operating system and device type. This data is collected through standard web server logging and is used for security monitoring, performance optimisation and geographic access analysis. It is not used to identify you personally without additional information.

4.3 Analytics Tools

We use web analytics tools to understand how users navigate the Platform — which pages are most visited, how long users stay on each section, and from which sources users arrive. This usage data is collected in an aggregated and, where possible, anonymised form. Analytics data helps us improve the Platform's content relevance and user experience.

4.4 Cookies and Similar Technologies

The Platform uses cookies and similar tracking technologies as described in Section 10 of this Policy. Cookies may collect session-related data and usage preferences. You can manage cookie settings through your browser; however, disabling certain cookies may affect Platform functionality.

5. Purposes of Data Processing

999ad processes your personal data only for specific, legitimate and clearly defined purposes. We do not process your data beyond what is necessary for those purposes. Our processing activities include:

• Platform Operation: Ensuring the Platform is accessible, functional and secure for all users.
• User Support: Responding to queries, resolving complaints and providing assistance in English and Urdu through our support channels.
• Security and Fraud Prevention: Detecting, investigating and preventing unauthorised access, malicious activity and security incidents that could compromise the Platform or its users.
• Analytics and Improvement: Analysing usage patterns to improve content quality, page structure and overall user experience for Pakistani users.
• Legal Compliance: Meeting applicable legal obligations, including retaining records of user communications where required by law.
• Responsible Gambling: Providing users with clearly labelled responsible gambling information and tools to support safe and informed gambling behaviour.
• Communication: Sending service-related communications where you have provided contact information and where it is necessary or appropriate to do so.

6. Legal Basis for Processing

Where applicable data protection law requires a legal basis for the processing of personal data, 999ad relies on the following bases:

• Contractual Necessity: Processing necessary to provide the services described in our Terms & Conditions, including responding to support queries and maintaining Platform functionality.
• Legitimate Interests: Processing for the purposes of security monitoring, fraud prevention, analytics and Platform improvement — where these interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations or court orders.
• Consent: Where we rely on your consent (e.g., for non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

Pakistan's data protection framework is developing. While there is currently no comprehensive national data protection law equivalent to the GDPR in force in Pakistan, 999ad applies internationally recognised data protection principles — including purpose limitation, data minimisation, accuracy and storage limitation — as baseline standards.

7. Data Sharing & Disclosure

999ad does not sell, rent or otherwise trade your personal data to third parties. We may share your data only in the following limited and controlled circumstances:

7.1 Service Providers

We engage third-party service providers to support Platform operations — including hosting providers, content delivery networks, analytics platforms and customer support tools. These providers act as Data Processors under our instructions and are contractually bound to handle your data only as directed, to maintain confidentiality and to apply appropriate security measures.

7.2 Legal Requirements

We may disclose personal data where required by applicable law, regulation, legal process or governmental request, including disclosure to law enforcement agencies or regulatory bodies where we are legally compelled to do so.

7.3 Protection of Rights

We may disclose personal data where we believe, in good faith, that such disclosure is necessary to protect the rights, property or safety of 999ad, our users or the general public — including in connection with the prevention or investigation of fraud, security incidents or violations of our Terms & Conditions.

7.4 Business Transfers

In the event of a merger, acquisition, asset sale or other corporate transaction involving 999ad, personal data held by us may be transferred as part of that transaction. You will be notified of any such transfer and any applicable changes to this Policy via a Platform notice.

8. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our general retention approach is as follows:

• Support Communications: Retained for up to 24 months from the date of last contact, after which they are securely deleted or anonymised.
• Technical / Server Logs: Retained for up to 12 months for security and performance monitoring, then automatically purged.
• Analytics Data: Retained in aggregated or anonymised form for up to 36 months to support long-term Platform improvement analysis.
• Cookie Data: Retention periods vary by cookie type — session cookies expire at the end of your browser session; persistent cookies are retained for the durations specified in our cookie configuration, typically between 30 days and 24 months.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed or irreversibly anonymised. If you submit a deletion request under your data rights (see Section 11), we will action your request within the timelines described therein.

9. Data Security

999ad implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Our security practices include:

• TLS Encryption: All data transmitted between your browser and the Platform is encrypted using Transport Layer Security (TLS). Look for the padlock icon and HTTPS prefix in your browser address bar when using 999ad.
• Access Controls: Access to personal data is restricted to authorised personnel only, on a need-to-know basis, and is protected by strong authentication mechanisms.
• Regular Security Reviews: We conduct periodic security assessments to identify and remediate potential vulnerabilities in our Platform infrastructure.
• Secure Document Handling: As stated on our Platform, KYC documents must never be shared via unsecured channels. If you are directed to share documents anywhere other than through a secure HTTPS Operator portal, you should treat that as a potential security risk and report it immediately.
• Incident Response: In the event of a data breach that affects your personal data, we will notify affected users and relevant authorities in accordance with applicable legal obligations.

While we apply robust security practices, no online platform can guarantee complete immunity from all security threats. You also have a role to play — using strong, unique passwords, keeping your device software up to date and not sharing account credentials with any third party.

10. Cookies & Tracking Technologies

The Platform uses cookies and similar technologies to provide core functionality, to understand how users interact with our content and to store your preferences. The following types of cookies are used:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They enable core features such as page navigation, session management and security controls. They cannot be disabled without preventing you from using the Platform. No consent is required for strictly necessary cookies.

10.2 Analytics Cookies

Analytics cookies help us understand how visitors use the Platform — which pages attract the most engagement, how users navigate between sections and where visitors typically leave the site. This data is collected in aggregated form and does not personally identify individual users. Where required, we seek your consent before placing analytics cookies.

10.3 Preference Cookies

Preference cookies remember your settings and choices on the Platform — such as language preference or previously dismissed notices — so you do not need to re-enter them on each visit. These cookies are activated only with your consent.

10.4 Managing Cookies

You can manage or delete cookies at any time through your browser settings. Most modern browsers allow you to block all cookies, block only third-party cookies or delete existing cookies. Please note that disabling cookies may limit some Platform functionality. Your browser provider's help documentation will guide you through cookie management specific to your browser.

11. Your Data Rights

Depending on applicable data protection law in your jurisdiction, you may have some or all of the following rights with respect to your personal data held by 999ad. To exercise any of these rights, contact us using the details in Section 16. We will respond within a reasonable timeframe — typically within 30 calendar days — and will not charge a fee for standard requests.

• Right of Access: You may request a copy of the personal data we hold about you, together with information on how it is used, where it is stored and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it without undue delay.
• Right to Erasure: Subject to certain legal and contractual obligations, you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent.
• Right to Restriction: In certain circumstances, you may request that we restrict the processing of your personal data — for example, while you contest the accuracy of data we hold.
• Right to Object: Where we process your data on the basis of legitimate interests, you may object to that processing. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
• Right to Data Portability: Where technically feasible and legally applicable, you may request a copy of your personal data in a structured, commonly used, machine-readable format for transfer to another data controller.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of your rights, please contact us at the email address provided in Section 16 of this Policy. Please note that we may request identity verification before actioning certain requests to protect against unauthorised access to your data.

12. Children & Minors

The Platform is strictly intended for adults aged 18 years or older — or such higher minimum age as may be required by the applicable Operator's licence jurisdiction. We do not knowingly collect personal data from individuals under the age of 18.

If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data from our records and to prevent further access by that individual. If you believe a minor has provided us with personal data, please contact us immediately using the details in Section 16.

13. International Data Transfers

The Platform serves users primarily located in Pakistan. However, the technical infrastructure supporting the Platform — including hosting servers, analytics tools and content delivery networks — may be located in other countries. As a result, your personal data may be transferred to, and processed in, countries outside Pakistan.

Where such transfers occur, we take reasonable steps to ensure that appropriate safeguards are in place to protect your personal data, including contractual obligations imposed on recipient service providers. We do not transfer personal data to jurisdictions where we have no basis for believing adequate protection will be maintained.

By using the Platform, you acknowledge that your data may be processed outside Pakistan in connection with the technical operations described in this Policy.

14. Third-Party Links & Operator Platforms

The Platform may contain informational references to Operator platforms and payment services. If you navigate away from 999ad to a third-party website or Operator platform, you do so at your own risk. This Privacy Policy does not apply to third-party platforms. Their data handling practices are governed by their own privacy policies.

References to payment services commonly known in Pakistan — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are contextual and informational only. 999ad does not share your personal data with these providers, and these references do not imply that those providers endorse 999ad or support gambling services.

We recommend that you review the privacy policy of any third-party platform before providing personal or financial information on it.

15. Updates to This Privacy Policy

999ad reserves the right to update, revise or replace this Privacy Policy at any time. Material changes will be reflected by an update to the "Effective Date" displayed at the top of this document. Where we make significant changes that affect how we use your personal data, we will endeavour to provide notice via a prominent Platform announcement.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated Policy. We encourage you to review this page periodically to remain informed of how we handle your personal data.

16. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact the 999ad data team using the details below. All email addresses are displayed as plain text only and are not clickable links.