d999 Privacy Policy — How We Protect Your Personal Information

d999 is an online betting and casino platform operated at d999.life and built specifically for the Pakistani market. d999 is the data controller responsible for the personal information you provide when you register and use the platform. As data controller, d999 determines the purposes and means by which your personal data is processed and takes responsibility for ensuring that processing is carried out lawfully and securely.

d999 is designed for Pakistani residents and operates entirely in Pakistani Rupees (PKR). Our payment infrastructure, customer support and content are all built with Pakistani players as the primary audience. When you share personal data with d999, it is processed by a team that understands the Pakistani context — your mobile wallet provider, your national identity document type and the local payment methods you use every day.

d999 collects the minimum personal data genuinely required to operate your account, comply with legal obligations and provide a safe, reliable betting and gaming experience. The categories of data we collect are described below.

d999 does not collect sensitive categories of personal data such as health information, religious beliefs or political opinions. Data is collected directly from you during account registration and use, and automatically through the technical operation of the platform.

d999 uses your personal data for clearly defined purposes. We do not use your data for anything beyond what is described here, and we do not use it in ways that would be surprising or harmful to you.

• Account management: Creating and maintaining your d999 account, verifying your identity, processing your login and keeping your account details up to date.
• Payment processing: Processing deposits and withdrawals in PKR via your chosen payment method (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or Visa/Mastercard), matching incoming transfers to your d999 wallet and resolving payment queries.
• Identity verification (KYC): Verifying that you are who you say you are before processing withdrawals, as required by financial regulations applicable to online gaming platforms.
• Platform security and fraud prevention: Monitoring account activity to detect and prevent fraudulent transactions, unauthorised account access, bonus abuse, money laundering and other prohibited activities described in the Terms and Conditions.
• Responsible gaming: Using your transaction and betting history to identify patterns that may indicate problem gambling, to enforce deposit and loss limits you have set, and to administer self-exclusion requests.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints and improving the quality of support based on interaction history.
• Legal and regulatory compliance: Meeting obligations under applicable financial, anti-money-laundering and data protection regulations, including producing records for regulatory inspections when required by law.
• Platform improvement: Using anonymised and aggregated usage data to understand how players interact with d999, identify technical issues and develop new features. This analysis does not identify you personally.
• Communications: Sending you account-related notifications such as deposit confirmations, withdrawal updates, security alerts and changes to platform terms. You may also receive promotional communications if you have opted in — you can opt out at any time.

d999 processes your personal data only where there is a valid legal basis for doing so. The primary legal bases on which d999 relies are as follows:

• Contractual necessity: Processing your registration data, payment information and transaction history is necessary to fulfil the contract between you and d999 — in other words, to operate your account and deliver the services you have signed up for. Without this processing, d999 cannot provide its services.
• Legal obligation: Identity verification (KYC), anti-money-laundering checks and the retention of transaction records are required by applicable financial regulations. d999 has no discretion to waive these obligations — they are legal requirements that apply to all online gaming platforms handling financial transactions.
• Legitimate interests: Processing data for fraud prevention, platform security, responsible gaming monitoring and platform improvement is in d999's legitimate interests as a responsible platform operator and in the interests of the broader player community. d999 ensures these interests do not override your fundamental privacy rights.
• Consent: For promotional marketing communications beyond essential account notifications, d999 relies on your consent. You can withdraw consent for marketing communications at any time by contacting support or updating your notification preferences in your account settings.

d999 does not sell, rent or trade your personal data to any third party. Your data is shared only in the limited circumstances described below, and always with appropriate contractual protections in place.

• Payment processors: Your payment details are shared with the relevant payment service providers — Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking networks or Visa/Mastercard acquiring banks — to the extent required to process your transaction. These providers operate under their own privacy and security standards and are not permitted to use your data for any purpose other than processing the specific transaction.
• Identity verification providers: Your CNIC data and selfie may be shared with a third-party identity verification service to confirm your identity during the KYC process. This provider processes your data solely for verification purposes under a strict data processing agreement with d999.
• Regulatory and law enforcement authorities: d999 is required to disclose transaction records, account information and identity data to relevant authorities when required by law — for example, in connection with anti-money-laundering investigations, court orders or regulatory inspections. d999 does not make such disclosures voluntarily and will comply only where legally required.
• Technology infrastructure providers: d999 uses third-party hosting, database and cloud infrastructure services to operate the platform. These providers have access to data only as necessary to deliver their services and are bound by data processing agreements that restrict their use of your information.

All financial transactions on d999 are conducted in Pakistani Rupees (PKR). d999 does not process or store full card numbers for Visa or Mastercard transactions — these are handled by the payment processor using tokenisation, and d999 retains only masked card details (for example, the last four digits) for account management and dispute resolution purposes.

Mobile wallet numbers used for Easypaisa, JazzCash, NayaPay and SadaPay transactions are stored securely in your d999 account and are used solely to direct deposits and withdrawals. These numbers are not shared with any party other than the relevant mobile wallet operator for the purpose of processing your transaction.

Bank account details provided for IBFT transfers are stored with the same security standards as other payment data. d999 retains payment method records to facilitate future transactions and to maintain the withdrawal audit trail required by financial regulations. You may request removal of stored payment details at any time, subject to the retention requirements described in Section 8.

d999 uses cookies and similar technologies to operate the platform efficiently, maintain your session while you are logged in and understand how players use the site. Below is a summary of the types of cookies used on d999.

• Essential cookies: Required for the platform to function. These maintain your login session, remember your language preference and enable the cashier to work correctly. You cannot opt out of essential cookies without impacting platform functionality.
• Analytics cookies: Used to collect anonymised data about how players navigate d999 — which pages are visited, how long sessions last and where technical errors occur. This data is used in aggregate form to improve the platform and does not identify you personally.
• Security cookies: Used to detect fraudulent activity, suspicious login patterns and bot access. These are essential for account security and cannot be disabled.

d999 does not use third-party advertising cookies or tracking pixels that share your browsing behaviour with external advertisers. Your activity on d999 is not tracked across other websites. You can manage cookie preferences through your browser settings, though disabling essential cookies will prevent some platform features from working correctly.

d999 retains your personal data only for as long as is necessary for the purposes described in this policy and to comply with applicable legal obligations. The following retention periods apply:

• Account data and transaction history: Retained for a minimum of five years from the date of your last transaction, as required by anti-money-laundering regulations applicable to financial services platforms. This includes your registration data, KYC documents and full transaction history.
• Payment data: Retained for the period necessary to process the transaction plus any dispute resolution window, and thereafter as required by the financial regulations described above. Tokenised card details may be retained longer for recurring deposit facilitation if you have enabled this feature.
• Customer support communications: Retained for two years from the date of the last communication in a support thread, to facilitate resolution of any future queries related to the same issue.
• Anonymised analytics data: Retained indefinitely in aggregate, anonymised form for platform improvement purposes. This data cannot be used to identify you.

When retention periods expire, data is securely deleted or anonymised in a manner that makes re-identification impossible. If your account is closed at your request, d999 will retain the minimum data required to comply with legal obligations and will delete all other personal data within 30 days of account closure.

You have meaningful rights over your personal data at d999. These are not theoretical rights buried in legal small print — you can exercise them by contacting d999 support, and all requests are processed within 72 hours.

To exercise any of these rights, contact the d999 support team via live chat or email support@d999.life. d999 may need to verify your identity before processing a data request to ensure that your information is not released to an unauthorised person. Requests are processed at no charge.

d999 is strictly for adults aged 18 and over. d999 does not knowingly collect personal data from anyone under the age of 18. Age verification is carried out at the point of KYC identity verification — your CNIC date of birth is checked to confirm you are 18 or older before withdrawal functionality is enabled.

If d999 discovers or is informed that an account has been registered by or is being used by a minor, the account will be immediately suspended, all transactions will be reversed where possible and the account data will be handled in accordance with applicable child protection guidelines. If you believe a minor is using your device or account to access d999, contact support immediately to have the account suspended.

d999 applies technical and organisational security measures appropriate to the nature of the personal data it processes. These measures include:

• TLS encryption on all data transmitted between your device and d999 servers, preventing interception of your login credentials, payment details and personal information in transit.
• Password hashing using strong one-way cryptographic functions. d999 does not store your password in a readable format. Even in the event of a data breach, your password is not exposed in plain text.
• Access controls that restrict which staff members can access which categories of data, with full audit logging of all administrative access to personal data systems.
• Two-factor authentication (2FA) available for all player accounts and mandatory for all d999 administrative accounts. We strongly recommend all players enable 2FA on their d999 account.
• Automated fraud monitoring that detects unusual transaction patterns, suspicious login activity and potential account compromise in real time, triggering alerts and account restrictions where necessary.
• Regular security assessments including vulnerability scanning and access review. Any identified vulnerabilities are remediated on a priority basis.

Despite these measures, no system connected to the internet can be guaranteed 100% secure. d999 will notify affected players without undue delay in the event of a data breach that is likely to result in a high risk to their rights, and will take all appropriate steps to contain and remediate any security incident.

d999 may update this Privacy Policy from time to time to reflect changes in how we process data, changes to the services we offer or changes to applicable data protection law. When material changes are made, d999 will notify registered players by email or via an in-account notification before the changes take effect.

The most current version of this Privacy Policy is always available at d999.life/privacy-policy. The Last Updated date at the top of this page reflects the date on which changes were most recently made. We encourage you to review this policy periodically — it is not long and it covers everything you need to know about how d999 handles your information.

If you have any questions about this Privacy Policy, want to exercise any of the rights described in Section 9, or have a concern about how d999 has handled your personal data, please reach out through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week from within your d999 account. This is the fastest route for any account-related data queries. The support team handles English and Urdu enquiries and average first response time is under two minutes.
• Email: support@d999.life — for formal data requests, document submissions or written complaints. Responses to data-related requests are provided within 72 hours.

For formal data access requests, d999 may ask you to verify your identity before releasing account information — this is to protect you from someone else requesting your data without authorisation. Verification typically requires confirming the mobile number registered to your account.

d999 takes all privacy concerns seriously and will investigate any reported issue thoroughly. This Privacy Policy was last reviewed in January 2025. Thank you for trusting d999 with your personal information — we do not take that trust lightly.