SECTION 1
Who We Are
999x is an online gaming and sports betting platform operating at 999x.world. When we refer to "999x", "we", "us" or "our" in this Privacy Policy, we mean the entity responsible for operating the 999x platform and processing the personal data of its registered players.
This Privacy Policy applies to all personal data collected through the 999x website, any mobile-optimised version of the site, and all communications between 999x and its players including email, live chat and SMS. It should be read alongside the 999x Terms and Conditions, which govern the broader player relationship.
If you have any questions about how 999x handles your personal data — before or after reading this policy — please contact our support team at support@999x.world. Our team is available 24 hours a day in both English and Urdu.
This Privacy Policy was last updated in January 2025. Material changes are communicated to registered players by email before taking effect.
SECTION 2
What Personal Data We Collect
999x collects personal data that falls into three broad categories: data you provide directly when registering and using the platform, data generated automatically when you interact with 999x, and data we receive from payment providers and identity verification services.
Data You Provide Directly
- Full legal name as it appears on your identity document.
- Date of birth (required for age verification — 999x is an 18+ platform).
- Pakistani mobile phone number and email address.
- Residential address.
- Identity document information — CNIC number, passport number or driver's licence number — provided during account verification.
- Payment method details — mobile wallet numbers (Easypaisa, JazzCash, NayaPay, SadaPay), bank account details (IBFT) or card details (Visa/Mastercard). Full card numbers are never stored by 999x directly; card processing is handled by PCI-DSS certified third-party payment processors.
- Communications you send to 999x support including chat transcripts and emails.
Data Generated Automatically
- Device information: device type, operating system, browser type and version.
- IP address and approximate geographic location derived from it.
- Session data: pages visited, time spent, games played, bets placed and navigation patterns.
- Login timestamps and security event logs.
- Cookie and tracking data as described in Section 9.
Data from Third Parties
- Identity verification confirmation from CNIC validation services.
- Transaction status confirmations from payment providers.
- Fraud screening signals from our payment security partners.
SECTION 3
How We Collect Your Data
Most of the personal data 999x holds is provided directly by you during account registration, identity verification, deposit and withdrawal processes, and when you contact our support team. This is the primary collection method and the most significant in terms of data volume and sensitivity.
A second category of data is collected automatically through standard web technologies as you browse and interact with the 999x platform. This includes session cookies, server logs and analytics tracking. The purpose of this automatic collection is to keep the platform secure, improve the user experience, and diagnose technical issues when they arise.
A smaller amount of data is received from trusted third-party partners — specifically our payment processors and identity verification partners — to confirm transaction outcomes and verify identity documents. This data sharing goes both ways: 999x sends these partners the minimum information needed to complete the relevant check or transaction, and they return confirmation or status data.
999x does not purchase data from data brokers or marketing companies and does not receive personal data about you from social media platforms unless you explicitly use a social login integration — which is not currently offered by 999x.
SECTION 4
How We Use Your Personal Data
999x uses the personal data it collects only for purposes that are clearly necessary to operate the platform and serve players. The following table summarises the primary uses and the data categories involved in each:
| Purpose | Data Used | Legal Basis |
|---|
| Account creation and management | Name, email, phone, DOB | Contract |
| Identity and age verification | CNIC / passport, DOB | Legal obligation |
| Processing deposits and withdrawals | Payment details, account info | Contract |
| Anti-fraud and AML compliance | Transaction records, IP, ID docs | Legal obligation |
| Customer support | Contact info, chat history | Contract |
| Platform security and abuse prevention | Device data, IP, login logs | Legitimate interest |
| Responsible gaming monitoring | Play patterns, deposit history | Legitimate interest |
| Promotional communications (opted-in) | Email, phone | Consent |
| Analytics and platform improvement | Anonymised session data | Legitimate interest |
999x does not use your personal data to make fully automated decisions that have significant legal or similarly significant effects on you without human review. Where automated systems flag an account for review — for example, as part of fraud detection — a member of the 999x compliance team reviews the case before any action is taken.
SECTION 5
Legal Basis for Processing
Every use of your personal data by 999x has a legal basis. The three bases that apply to 999x's data processing are:
- Contract: Processing that is necessary to provide the service you have registered for. Account management, payment processing and customer support fall into this category. Without this processing, 999x cannot operate your account.
- Legal Obligation: Processing required to comply with law. Identity verification, anti-money laundering record-keeping and responsible gaming obligations are examples. 999x cannot waive these requirements even if a player requests it.
- Legitimate Interest: Processing that 999x conducts because it has a genuine operational reason to do so, provided that this interest does not override your privacy rights. Platform security monitoring, fraud detection and anonymised analytics fall into this category.
- Consent: Processing you have actively agreed to — specifically, receiving marketing communications. You can withdraw consent at any time as described in Section 11.
SECTION 6
Sharing Your Personal Data
999x does not sell, rent or trade your personal data to any third party for their own marketing purposes. Data sharing is limited to what is strictly necessary to operate the platform and comply with legal obligations. The categories of recipients are:
- Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank partners and card processors receive the minimum data required to execute transactions. These partners are independently PCI-DSS certified and operate under their own privacy and security frameworks.
- Identity Verification Services: Third-party CNIC and document verification providers receive document data solely for the purpose of confirming your identity. They do not retain this data beyond the verification period under their contracts with 999x.
- Game Providers: Some crash games and other titles are provided by third-party studios (for example, Spribe for Aviator, Pragmatic Play for Spaceman). A player identifier is shared with these providers to operate the game session. No financial data is shared with game providers.
- Legal and Regulatory Authorities: 999x will disclose personal data to law enforcement, financial intelligence authorities or regulatory bodies when required to do so by law or valid legal process. We will notify you of such disclosures where legally permitted to do so.
- Fraud Prevention Partners: Anonymised risk signals may be shared with industry fraud prevention services to protect the platform and its players.
If 999x is ever acquired or merged with another entity, your personal data may be transferred as part of that transaction. In such an event, 999x will notify registered players and the acquiring entity will be bound by this Privacy Policy or provide a replacement policy of equivalent or greater standard.
SECTION 7
Data Retention
999x retains personal data only for as long as it is required — either to operate your account or to meet applicable legal and regulatory obligations. The following retention periods apply as a general guide:
- Active account data (name, contact details, payment methods) — retained throughout the life of your active 999x account.
- Transaction records — retained for a minimum of five years from the date of the transaction, in line with anti-money laundering record-keeping requirements.
- Identity documents — retained for a minimum of five years from account closure or the date of the last transaction, whichever is later.
- Customer support communications — retained for three years from the date of the communication unless related to an unresolved dispute.
- Session and analytics data — retained in anonymised form for up to 24 months for platform improvement purposes.
When personal data reaches the end of its retention period and there is no ongoing legal reason to retain it, 999x deletes or irreversibly anonymises it using secure data erasure procedures. You may request early deletion of specific data categories where this is legally permissible — see Section 10 for your rights.
SECTION 8
Security Measures
999x implements a layered set of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration or destruction. These include:
- Encryption in transit: All communication between your device and 999x is encrypted using TLS 1.3. Connections using older, weaker protocol versions are rejected.
- Encryption at rest: Personal data and financial records stored in 999x databases are encrypted using AES-256.
- Access controls: Internal access to personal data is restricted to staff who have a genuine need for it to perform their role. All internal access is logged and subject to regular audit.
- Multi-factor authentication: Available on 999x player accounts and mandatory for internal staff accounts with access to player data.
- Intrusion detection: 999x operates continuous network monitoring and intrusion detection systems. Anomalies trigger automated alerts reviewed by our security team.
- Security testing: The 999x platform undergoes regular penetration testing by qualified independent security professionals.
Despite these measures, no system is completely immune to attack. In the event of a data breach that is likely to pose a risk to your rights, 999x will notify affected players and, where required, relevant authorities within 72 hours of becoming aware of the breach.
Players can strengthen account security by enabling two-factor authentication in their 999x account settings. We strongly recommend doing so — particularly if you use Easypaisa or JazzCash withdrawals, where account security directly protects financial access.
SECTION 9
Cookies and Tracking Technologies
999x uses cookies and similar technologies to operate core platform functions, improve performance and — where you have consented — support marketing analytics. A cookie is a small text file stored on your device by your browser when you visit a website.
Essential Cookies
Required for the platform to function. These manage your login session, remember your language preferences and maintain security tokens. They cannot be disabled without breaking core functionality.
Functional Cookies
Remember your settings and preferences across sessions — such as your preferred deposit method and game layout settings. These improve your experience but are not required for basic access.
Analytics Cookies
Collect anonymised data about how the platform is used — which pages are visited most, where players encounter errors, and how navigation flows work. This helps 999x improve the platform. Requires consent.
Marketing Cookies
Used only where you have consented to receive promotional communications. These help 999x understand whether marketing outreach has been effective. You can withdraw consent at any time via account settings or the opt-out mechanisms described in Section 11.
You can manage your cookie preferences through your browser settings. Note that disabling non-essential cookies does not affect your ability to log in and play on 999x — it only affects analytics and marketing tracking.
SECTION 10
Your Data Rights
As a registered 999x player, you have the following rights in relation to your personal data. To exercise any of these rights, email support@999x.world with the subject line "Data Rights Request". We will respond within 30 days.
Right of Access
Request a copy of all personal data 999x holds about you. We will provide this in a readable format within 30 days of receiving a valid request.
Right of Rectification
Ask 999x to correct personal data that is inaccurate or incomplete. Basic contact information can also be updated directly in your account settings.
Right to Erasure
Request deletion of your personal data where it is no longer needed for the purpose it was collected, or where you have withdrawn consent. Note that data subject to legal retention obligations (such as AML records) cannot be deleted early.
Right to Restrict Processing
Request that 999x limits how it uses your personal data in specific circumstances — for example, while a dispute about data accuracy is being resolved.
Right to Data Portability
Receive the personal data you have provided to 999x in a structured, machine-readable format — where processing is based on your consent or contract.
Right to Object
Object to 999x processing your data on the basis of legitimate interest. 999x will stop the relevant processing unless it has compelling grounds that override your interests.
SECTION 11
Marketing Preferences
999x sends promotional communications — including bonus offers, new game announcements and VIP programme updates — only to players who have opted in to receive them. You are never automatically added to marketing lists. During registration, there is a clear, unticked opt-in box for marketing communications. If you do not tick it, you will not receive marketing emails or SMS from 999x.
If you have opted in and later change your mind, you can opt out at any time through any of the following channels:
- Click the unsubscribe link at the bottom of any marketing email from 999x.
- Reply STOP to any promotional SMS from 999x.
- Update your communication preferences in the Notifications section of your 999x account settings.
- Email support@999x.world with the subject line "Marketing Opt-Out".
Opting out of marketing communications does not affect transactional communications — you will still receive emails about account security, withdrawal confirmations, identity verification requests and other messages that are necessary to operate your 999x account.
SECTION 12
Children's Privacy
999x is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. All accounts are subject to age verification before withdrawal is permitted. If 999x becomes aware that an account belongs to a person under 18, the account will be immediately and permanently closed, all balances will be forfeited, and any personal data associated with the account will be deleted except where its retention is required by law.
If you have reason to believe that a minor has registered on 999x using falsified age information, please contact us immediately at support@999x.world so we can investigate and act promptly.
SECTION 13
Changes to This Privacy Policy
999x reviews this Privacy Policy regularly and will update it when necessary — for example, when we add new data processing activities, change a third-party partner, or in response to regulatory developments. The "Last Updated" date at the top of this page always reflects the most recent revision.
For material changes — those that meaningfully affect how your data is collected, used or shared — 999x will notify registered players by email at least seven days before the change takes effect. For minor clarifications that do not affect player rights, the policy will be updated without prior notice.
Continued use of the 999x platform after a policy update constitutes acceptance of the revised terms. If you do not agree with a material change, you may close your account and withdraw your remaining balance before the effective date of the change.
SECTION 14
Contact Us
For any privacy-related questions, data rights requests or concerns about how 999x handles your personal data, please contact our team:
- Email: support@999x.world
- Subject line for data requests: "Data Rights Request" or "Privacy Query"
- Response time: Within 30 days for data rights requests; within 24 hours for general privacy queries.
- Language: Support available in English and Urdu.
We take every privacy query seriously. If you feel that your concern has not been adequately addressed after contacting 999x, you have the right to escalate the matter to the relevant regulatory authority in your jurisdiction.
