Your Privacy Matters at 99x666

99x666 is an internationally licensed online gaming and sports betting platform serving players across Pakistan, including Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, and Multan. The platform operates exclusively in Pakistani Rupees (PKR) and supports local payment methods including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and SadaPay.

For the purposes of this Privacy Policy, 99x666 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed. All data processing activities described in this Policy are conducted under the authority of our international gaming licence and applicable data protection frameworks.

99x666 collects personal data through multiple channels: directly from you during registration and account use, automatically through platform interaction, and in limited circumstances from verified third-party sources. The categories of data we collect are outlined below:

99x666 uses the personal data described in Section 02 for the following specific purposes. We process data only where a valid legal basis exists (see Section 04):

• Account Management: Creating and maintaining your 99x666 account, verifying your identity through KYC, and ensuring only the registered account holder can access your PKR wallet and betting history.
• Payment Processing: Facilitating PKR deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20, as well as processing withdrawal requests to verified account holders.
• Platform Security & Fraud Prevention: Monitoring for irregular betting patterns, multi-account activity, bonus abuse, money laundering indicators, and other prohibited activities outlined in our Terms & Conditions.
• Regulatory Compliance: Fulfilling our obligations under our international gaming licence, including maintaining transaction records, responding to regulatory audits, and cooperating with lawful authority requests.
• Personalisation: Tailoring the 99x666 experience to your preferences — surfacing relevant cricket and PSL betting markets, recommending games aligned with your play history, and displaying promotions relevant to your activity profile.
• Marketing Communications: Where you have given consent, sending promotional emails and SMS notifications about bonuses, PSL promotions, new game launches, and platform updates. You may withdraw this consent at any time.
• Responsible Gaming: Using behavioural data to identify signs of problem gambling and proactively offering responsible gaming tools such as deposit limits, session reminders, and self-exclusion options to affected members.
• Platform Improvement: Analysing aggregated, anonymised behavioural data to improve game offerings, platform performance, UI design, and customer support quality.

Every data processing activity carried out by 99x666 is grounded in at least one of the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the 99x666 Terms & Conditions — including account creation, payment processing, and bet settlement — is conducted on the basis of contractual necessity.
• Legal Obligation: Where processing is required to comply with regulatory requirements under our gaming licence, anti-money-laundering frameworks, or a lawful order from a competent authority, we process data on the basis of legal obligation.
• Legitimate Interests: Fraud detection, platform security monitoring, responsible gaming interventions, and aggregated analytics are conducted on the basis of 99x666's legitimate business interests, provided those interests are not overridden by your fundamental rights.
• Consent: Marketing communications, optional personalisation features, and non-essential cookies are processed on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

99x666 does not sell your personal data. We do not share your information with third-party advertising networks or data brokers. In limited and specific circumstances, data may be shared with the following categories of recipients:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 network processors receive only the transaction data necessary to execute your deposit or withdrawal. These partners operate under their own regulatory frameworks and privacy policies.
• KYC Verification Partners: Third-party identity verification services may receive your submitted KYC documents (CNIC image, selfie) to validate your identity. These partners are contractually bound to use the data only for verification purposes.
• Game Software Providers: Licensed game studios whose titles are available on 99x666 may receive anonymised game session data for the purpose of ensuring game integrity and calculating RTPs (return-to-player rates). No personally identifiable information is shared with game providers.
• Fraud Prevention Services: Aggregated technical data (IP addresses, device fingerprints, session patterns) may be shared with fraud detection partners to protect the platform and all members from fraudulent activity.
• Regulatory & Law Enforcement Authorities: Where required by a lawful court order, regulatory directive, or our gaming licence obligations, 99x666 will disclose relevant member data to competent authorities. We will notify the affected member of such disclosure where legally permitted to do so.

99x666 retains personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical analysis.

99x666 uses cookies, local storage, and similar tracking technologies to operate the platform, maintain session security, and analyse usage patterns. The following cookie categories are in use:

• Essential Cookies: Required for the platform to function correctly. These include session authentication cookies, CSRF protection tokens, and load balancing identifiers. They cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your platform preferences such as language settings, odds format, and preferred payment method. These persist across sessions for your convenience.
• Analytics Cookies: Collect anonymised data on how members navigate the platform — which pages are visited most, where users drop off during registration, and how game categories perform. This data is used solely to improve 99x666 platform quality. No personally identifiable information is included in analytics reports.
• Security Cookies: Help detect fraudulent login attempts, bot activity, and session hijacking. These work in conjunction with our fraud prevention systems to protect your account.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional cookies may affect your platform experience. 99x666 does not use third-party advertising or retargeting cookies.

As a 99x666 member, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]":

• Right of Access: Request a copy of all personal data 99x666 holds about you, including your account information, bet history, transaction records, and any communications on file. We will provide this within 30 days of receiving a verified request.
• Right to Rectification: Request correction of any personal data we hold that is inaccurate or incomplete. For identity and KYC data, updated documentation may be required.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where no overriding legitimate interest or legal obligation applies. Note that regulatory retention requirements (Section 06) may prevent full erasure during mandatory retention periods.
• Right to Restrict Processing: Request that we limit how your data is used in specific circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Request your personal data in a structured, machine-readable format (JSON or CSV) so you can transfer it to another service provider.
• Right to Object: Object to processing carried out on the basis of legitimate interests, including profiling for personalisation or responsible gaming monitoring purposes.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time. This will not affect the lawfulness of processing carried out prior to withdrawal.

99x666 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. The 99x666 registration process includes a mandatory date-of-birth verification step, and accounts are subject to age verification as part of the KYC process.

If we become aware that a member has provided false information to circumvent our age verification controls and is in fact under 21, the account will be immediately suspended, all funds will be held pending investigation, and the incident will be reported to the relevant regulatory authority. Any winnings generated by an underage account are not payable and will be forfeited.

99x666 implements a layered security architecture to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security measures include:

• Encryption in Transit: All data exchanged between your browser or app and 99x666 servers is encrypted using TLS 1.3 / SSL 256-bit protocols.
• Encryption at Rest: Sensitive data fields — including identity documents, KYC records, and financial references — are encrypted at the database level using AES-256 encryption.
• Password Security: Member passwords are never stored in plain text. They are processed through bcrypt hashing with a unique salt per account, making brute-force attacks computationally infeasible.
• Two-Factor Authentication (2FA): SMS-based 2FA is available to all members and strongly recommended. Accounts with 2FA enabled are significantly more resistant to credential-based attacks.
• Access Controls: 99x666 staff access to member data is strictly role-based and operates on a need-to-know principle. All internal data access is logged and subject to periodic review.
• Penetration Testing: The platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that may affect member data, 99x666 will notify affected members and relevant regulatory authorities within 72 hours of becoming aware of the incident.

While we implement robust technical and organisational measures, no digital system can guarantee absolute security. We encourage you to use a strong, unique password and enable 2FA to maximise the protection of your own account.

99x666 reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, platform features, regulatory requirements, or applicable law. When material changes are made:

• The "Last Updated" date at the top of this page will be revised.
• A notice will be displayed on the 99x666 platform homepage or login page for a minimum of 14 days following the update.
• Where changes materially affect how we process your personal data, we will send a notification to your registered email address.

Continued use of the 99x666 platform after a Privacy Policy update constitutes your acknowledgement of the revised Policy. If you do not agree with the updated terms, you may request account closure and data deletion by contacting the support team.

For any privacy-related queries, data rights requests, or concerns about how 99x666 handles your personal information, please contact our Data Protection team using the details below:

• Email: [email protected]
• Subject Line Format: "Privacy Query — [Your Username]" or "Data Rights Request — [Your Username]"
• Response Time: Within 72 hours for acknowledgement; up to 30 days for full resolution
• Support Hours: 09:00 – 01:00 PKT, daily including weekends

If you believe your privacy rights have been violated and are not satisfied with 99x666's response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction or the supervisory authority under our gaming licence. Details of the applicable authority are available upon request from the support team.