99as Privacy Policy

1. About This Privacy Policy

1.1  This Privacy Policy ("Policy") applies to all personal data processed by 99as ("we", "us", or "the Company") in connection with the 99as website, mobile site, and any applications operating under the 99as brand (collectively, the "Platform"). The Company is the data controller in respect of personal data collected through the Platform.

1.2  By registering an account on the 99as Platform or by continuing to use the Platform after this Policy has been brought to your attention, you acknowledge that you have read and understood how we handle your personal information. If you do not agree with the practices described in this Policy, you should not use the Platform.

1.3  This Policy should be read together with the 99as Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into our overall player agreement.

1.4  This Policy is written in English. Where a translation is provided for convenience, the English version shall prevail in the event of any inconsistency.

2. Personal Data We Collect

2.1  99as collects and processes the following categories of personal data in connection with your use of the Platform:

2.2  We do not knowingly collect sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) except where a Player voluntarily discloses such information in the context of a responsible gaming or self-exclusion request, in which case the data is processed solely for player protection purposes.

3. How We Collect Your Data

3.1  Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in promotions, or set responsible gaming preferences.

3.2  Automatically — when you use the Platform, our servers and analytics tools automatically record technical and usage data including your IP address, device type, browser fingerprint, session timestamps, and in-platform navigation behaviour.

3.3  From third parties — we may receive data about you from identity verification providers (for KYC), payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay), fraud detection services, and, where applicable, from responsible gaming databases maintained by gaming regulators.

3.4  Cookies and tracking technologies — as described in Section 7 of this Policy, we use cookies and similar technologies to collect technical and usage data when you interact with the Platform.

4. How We Use Your Personal Data

4.1  99as uses your personal data only for the purposes set out below. We do not use your data for automated decision-making that produces legal or similarly significant effects without human oversight, except as required by our anti-money-laundering screening obligations.

• Account Management: Creating, verifying, and maintaining your 99as player account, including processing password resets and account updates.
• KYC & Age Verification: Verifying that you are at least 21 years of age and that your identity documents are authentic, as required by our gaming licence.
• Payment Processing: Processing PKR deposits and withdrawals via your chosen payment method, reconciling transactions, and managing refunds.
• Regulatory Compliance: Meeting our obligations under anti-money-laundering (AML) regulations, our international gaming licence conditions, and any requests from competent regulatory authorities.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, multi-accounting, bonus abuse, and unauthorised access to player accounts.
• Responsible Gaming: Monitoring gaming behaviour for indicators of problem gambling, enforcing self-exclusions and deposit limits, and proactively contacting players who may be at risk.
• Customer Support: Responding to your queries, complaints, and support requests in a timely and effective manner.
• Marketing & Promotions: Sending you promotional communications about 99as offers where you have consented to receive such communications. You may withdraw consent at any time by contacting support@99as.app.
• Platform Improvement: Analysing aggregated usage data to improve the performance, design, and features of the 99as Platform.

5. Legal Basis for Processing

5.1  We process your personal data on one or more of the following legal bases, depending on the specific purpose:

• Performance of a Contract: Processing necessary to provide you with gaming services under the 99as Terms & Conditions, including account management, payments, and game delivery.
• Legal Obligation: Processing required to comply with our gaming licence conditions, AML obligations, tax reporting requirements, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where our interests do not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications, certain non-essential cookies, and voluntary participation in surveys or feedback programmes. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sharing Your Personal Data

6.1  We do not sell your personal data to any third party, ever. We share your data only in the limited circumstances described below.

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 processors receive the financial data necessary to execute your deposit and withdrawal transactions. Each processor operates under its own privacy terms.
• KYC & Identity Verification Providers: Third-party identity verification services receive your identity documents and biometric data solely for the purpose of verifying your identity and age in accordance with our licence conditions.
• Fraud & AML Screening Services: We share data with fraud detection and anti-money-laundering screening providers to meet our regulatory obligations and protect the integrity of the Platform.
• Gaming Regulators & Licensing Authorities: We are obliged to share player data with our licensing authority and any other competent regulatory body upon lawful request.
• Law Enforcement & Government Authorities: We will disclose personal data to police, courts, or government agencies where required by law or where we believe disclosure is necessary to prevent serious harm or criminal activity.
• Technology & Hosting Providers: Our platform infrastructure relies on trusted technology partners (hosting providers, CDN operators, analytics services) who process data on our behalf under strict data processing agreements.
• Game Content Providers: Third-party casino game studios (providing live dealer and RNG game content) may process limited session data to deliver game functionality. These providers operate under their own regulatory standards.
• Professional Advisers: Our legal, accounting, and auditing advisers may access personal data on a need-to-know basis and are bound by professional confidentiality obligations.

6.2  All third parties with whom we share personal data are required to implement appropriate technical and organisational security measures and to process your data only as directed by 99as or as required by applicable law.

7. Cookies & Tracking Technologies

7.1  The 99as Platform uses cookies and similar technologies (including pixel tags and local storage objects) to deliver a functional, secure, and personalised experience. The table below describes the categories of cookies we use.

7.2  You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use core Platform features. For full details on managing browser cookies, refer to your browser's help documentation.

8. Data Retention

8.1  We retain your personal data only for as long as necessary to fulfil the purposes set out in this Policy or as required by applicable law and our licensing obligations.

• Active Account Data: Retained for the duration of your account with 99as, plus a minimum period of five years following account closure to comply with AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five years from the date of submission, as required by our gaming licence and applicable AML regulations.
• Transaction Records: Retained for a minimum of five years from the date of each transaction.
• Responsible Gaming Records: Self-exclusion records and problem gambling intervention records are retained indefinitely to prevent re-registration during an exclusion period and to support the integrity of player protection measures.
• Support Communications: Retained for three years from the date of the last communication, unless the communication relates to a dispute or complaint still under review.
• Marketing Consent Records: Retained until you withdraw consent, plus one year thereafter for audit purposes.

8.2  When data is no longer required for its stated purpose and no legal obligation requires its retention, we will securely delete or anonymise it. Anonymised, aggregated data may be retained indefinitely for statistical analysis.

9. Data Security

9.1  99as takes the security of your personal data seriously. We implement a layered set of technical and organisational security measures appropriate to the risk profile of the data we hold, including:

• 256-bit TLS/SSL encryption for all data transmitted between your device and the 99as Platform.
• Encryption at rest for all sensitive account data and financial records stored on our servers.
• Multi-factor authentication requirements for account access and internal administrative systems.
• Role-based access controls ensuring that staff can only access personal data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Automated fraud detection and anomalous login monitoring systems that operate in real time.
• Documented incident response procedures in the event of a data breach, including regulatory notification obligations.

9.2  While we apply industry-standard security practices, no method of transmission over the internet or electronic storage is completely secure. You are responsible for keeping your own login credentials confidential and for notifying us immediately at support@99as.app if you suspect any unauthorised access to your account.

10. Your Data Rights

10.1  As a data subject, you hold the following rights in respect of your personal data held by 99as. To exercise any of these rights, please contact us at support@99as.app with the subject line "Data Rights Request" and we will respond within 30 days.

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations (such as AML record-keeping requirements).
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time.

10.2  Please note that certain rights may be limited or overridden by our legal and regulatory obligations. For example, we cannot delete KYC records during the mandatory retention period required by our gaming licence, and we cannot delete self-exclusion records while an exclusion is active.

11. Children's Privacy

11.1  The 99as Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. If we become aware that personal data has been collected from a person under 21, we will delete that data promptly and close the associated account.

11.2  Age is verified through the KYC process as described in the 99as Terms & Conditions. If you believe a minor has registered an account on the 99as Platform, please contact us immediately at support@99as.app.

12. International Data Transfers

12.1  As an internationally licensed gaming platform, 99as may process and store personal data on servers located outside Pakistan. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place, which may include standard contractual clauses, data processing agreements with sub-processors, or reliance on the adequacy frameworks applicable under our licensing jurisdiction.

12.2  In all cases, your personal data is transferred and stored only with service providers who have committed to implementing security standards at least equivalent to those described in Section 9 of this Policy.

13. Changes to This Privacy Policy

13.1  99as may update this Privacy Policy from time to time to reflect changes in our data practices, Platform features, or applicable legal requirements. When we make material changes, we will notify registered Players via a platform notification and/or an email to the address registered on your account, at least 14 days before the changes take effect.

13.2  The effective date at the top of this Policy will be updated each time a new version is published. Your continued use of the 99as Platform after the effective date of any revision constitutes your acknowledgment of the updated Policy.

13.3  We encourage you to review this Policy periodically. Previous versions are available on request by emailing support@99as.app.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about how 99as processes your personal data, please contact us using the details below. All contact details are provided as plain text and are not clickable links.

We aim to acknowledge all data rights requests within 5 business days and to provide a substantive response within 30 calendar days. If you are unsatisfied with our response, you may escalate your complaint to the data protection supervisory authority or dispute resolution body designated under the Company's gaming licence.