Privacy Policy

This Privacy Policy ("Policy") describes how 99ae ("we", "us", "our") collects, uses, stores, shares and protects personal data obtained from individuals ("User", "you", "your") who access or use the 99ae online gaming platform, website and associated services (collectively, the "Platform").

99ae is committed to handling personal data responsibly and in compliance with applicable data protection and privacy laws in the jurisdictions in which it operates. This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform as a whole.

By registering an account on 99ae or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, directly or indirectly.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For Platform users, the Data Controller is the 99ae operator entity.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under contractual obligations.
• "Special Category Data" — sensitive categories of personal data including health information, financial vulnerability indicators and, where relevant, government-issued identity numbers.
• "Cookies" — small text files placed on your device by a web server to store session information, preferences and analytics data.
• "KYC" — Know Your Customer; the identity and address verification process required under AML regulations.

The Data Controller for personal data collected through the 99ae Platform is the operator entity responsible for the gaming license under which 99ae operates. Contact details for the Data Controller are available in the Contact & Complaints section of this Policy and in the Platform's Terms & Conditions.

Where 99ae engages third-party Data Processors — such as KYC verification providers, payment service providers, fraud detection systems and customer support platforms — those parties act under written data processing agreements that restrict their use of personal data to the specific services they provide to 99ae.

We collect personal data across the following categories depending on how you interact with the Platform:

4.1 Registration Data

When you create a 99ae account, we collect your full legal name, date of birth, residential address, email address, phone number and chosen username. This data is required to create and administer your account.

4.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations, we collect copies of government-issued identity documents (e.g., CNIC, passport), proof of address and, in some cases, proof of source of funds. This may include CNIC numbers or passport numbers of Pakistani users.

4.3 Financial Data

We collect transaction data including deposit amounts, withdrawal requests, payment method identifiers and transaction history. Full payment card numbers are not stored on 99ae servers; payment processing is handled by PCI-DSS compliant payment service providers.

4.4 Usage & Behavioural Data

We automatically collect data about how you use the Platform, including pages visited, games played, bet amounts, session duration, click-through patterns and in-session behaviour. This data supports responsible gambling monitoring, fraud detection and platform improvement.

4.5 Device & Technical Data

We collect IP address, device type and model, operating system, browser type and version, language settings and approximate geolocation derived from IP. This data is used for security, fraud prevention and regulatory geo-compliance.

4.6 Communications Data

Records of your communications with 99ae support — including Live Chat transcripts, emails and support tickets — are retained for quality assurance, dispute resolution and regulatory record-keeping.

99ae processes personal data on the following legal bases, which vary depending on the specific processing activity:

Personal data collected by 99ae is used for the following purposes:

• Account administration: Creating and maintaining your account, processing login and session management, handling password resets and security alerts.
• Identity verification: Conducting KYC checks to verify your identity, age and address, as required by the applicable gaming license and AML regulations.
• Payment processing: Facilitating deposits and withdrawals, reconciling transactions and managing payment disputes or chargebacks.
• Regulatory compliance: Meeting reporting obligations under the applicable gaming license, AML/CTF laws, and any applicable data retention requirements.
• Responsible gambling: Monitoring usage patterns to identify indicators of problem gambling, enforcing deposit limits and self-exclusion decisions, and fulfilling duty-of-care obligations.
• Fraud and security: Detecting and preventing cheating, multi-accounting, payment fraud, money laundering and other prohibited activities.
• Customer support: Responding to enquiries, resolving disputes and improving support quality through interaction records.
• Platform improvement: Analysing aggregated usage data to improve game performance, interface design and content relevance for Pakistani users.
• Marketing (where consented): Sending promotional offers, bonus notifications and event-based communications via email or push notification where you have opted in to receive them.

99ae does not sell personal data to any third party. We share personal data only in the following circumstances and only to the extent necessary:

• KYC / Identity Verification Providers: Third-party identity verification services receive your identification documents and personal details to conduct age, identity and address verification checks on our behalf.
• Payment Service Providers: Transaction data is shared with payment processors to facilitate deposits and withdrawals. These providers are PCI-DSS compliant and process data only as necessary for payment execution.
• Fraud & AML Screening: We use specialist fraud detection and AML screening tools that process transaction and behavioural data to flag suspicious activity.
• Game Providers: Third-party game studios that supply games to the 99ae Platform may receive non-identifiable session data to support game performance and fairness auditing.
• Customer Support Platforms: Live Chat and ticketing system providers process support interaction data as part of service delivery.
• Regulatory and Law Enforcement Authorities: We disclose personal data to licensing authorities, financial intelligence units or law enforcement agencies when required by law, court order or regulatory demand.
• Professional Advisors: Legal, audit and compliance advisors may access personal data where necessary for professional advice, subject to confidentiality obligations.

Given the global nature of online gaming infrastructure, personal data collected from Pakistani users may be transferred to and processed in countries outside Pakistan. Where such transfers occur, 99ae ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by applicable data protection authorities;
• Adequacy decisions recognising the destination country's data protection standards as equivalent; or
• Binding corporate rules where transfers occur within a corporate group.

For users in Pakistan, this means that your personal data may be processed in the jurisdiction in which the 99ae operator entity is licensed and where its infrastructure is hosted. All such processing remains subject to the protections described in this Policy.

99ae retains personal data only for as long as is necessary for the purposes described in this Policy or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and KYC records: Retained for a minimum of 5 years from account closure, as typically required by AML regulations applicable to gaming operators.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Support interaction records: Retained for 3 years from the date of the interaction, unless the matter relates to an unresolved dispute.
• Marketing consent records: Retained for 3 years from the date of consent or until consent is withdrawn, whichever is earlier.
• Usage and analytics data: Aggregated analytics data is retained indefinitely in anonymised form. Identifiable usage logs are deleted after 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted from 99ae systems or anonymised in a manner that prevents re-identification.

99ae uses cookies and similar tracking technologies to operate and improve the Platform. The cookies we use fall into the following categories:

• Essential Cookies: Required for the Platform to function. These include session authentication cookies, security tokens and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Store your preferences — such as language settings, display preferences and game history — to improve your experience on return visits.
• Analytics Cookies: Collect aggregated, anonymised data about how users navigate the Platform. This data is used internally to improve performance and content. No personal identifiers are included in analytics reports.
• Responsible Gambling Cookies: Track session duration and deposit activity to support compliance with responsible gambling obligations, including reality-check display frequency.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from logging in to the Platform. Third-party advertising cookies are not used on 99ae.

99ae implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration and destruction:

• TLS 1.2 or higher encryption for all data in transit between client devices and 99ae servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and identity records.
• Role-based access controls ensuring that staff can access personal data only to the extent required for their specific role.
• Multi-factor authentication for all internal systems with access to personal data.
• Regular security assessments and penetration testing conducted by qualified third-party security firms.
• Incident response procedures with defined timelines for breach detection, containment and notification.

Despite these measures, no online system can guarantee absolute security. Users are also responsible for maintaining the confidentiality of their account credentials and for reporting any suspected unauthorised access to 99ae support immediately.

The 99ae Platform is strictly for adults aged 18 or older, or such higher minimum age as is required by the applicable operator license jurisdiction. We do not knowingly collect personal data from individuals below the applicable minimum age.

If we discover or have reasonable grounds to believe that personal data has been submitted by a minor, we will immediately suspend the associated account, delete the personal data in question and refund any deposits in line with our Terms & Conditions, without payment of winnings.

If you are a parent or guardian and believe that a minor has registered on the Platform using your details or otherwise, please contact our support team immediately at the email address in the Contact section of this Policy.

To exercise any of the data rights described in this Policy — access, rectification, erasure, restriction, portability or objection — please submit a written request to our Data Protection contact (details below). Your request should include:

• Your full name and registered email address on 99ae;
• A clear description of the right you wish to exercise and the specific data in question;
• A copy of a government-issued identity document (for identity verification purposes — this copy will be used only to process your request and then securely deleted).

We will acknowledge your request within 72 hours and aim to resolve it within 30 calendar days. In cases of particular complexity, this period may be extended by a further 30 days, with written notice provided to you before the initial deadline expires.

Requests are provided free of charge. However, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or repetitive requests.

With your explicit consent, 99ae may send you marketing communications including promotional offers, bonus notifications, tournament invitations and platform updates via email, push notification or SMS. You may opt in to these communications during registration or at any time through your account communication preferences.

You may withdraw consent for marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email;
• Updating your communication preferences in your account dashboard; or
• Contacting our support team via Live Chat or email.

Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before its withdrawal, and does not affect transactional communications such as account security alerts, deposit confirmations and withdrawal notifications, which are necessary for the operation of your account.

99ae reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance or Platform services. Where changes are material, we will notify registered users via email and by publishing the revised Policy on this page with an updated "Last Updated" date.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the Platform and contact support to request account closure.

For questions, concerns or formal requests regarding this Privacy Policy or the processing of your personal data, please contact us through the following channels:

• Email (Data Protection enquiries): [email protected] — please include "Privacy Request" in the subject line so your message is directed to our Data Protection team.
• Live Chat: Available 24 hours a day, 7 days a week, in English and Urdu (Urdu support during selected hours — please ask an agent for availability).
• Help Center: Detailed FAQs on privacy and data rights are available in the 99ae Help Center accessible via the Platform.

If you are dissatisfied with our response to a privacy complaint, you may have the right to lodge a complaint with a supervisory authority in the jurisdiction in which you are located or in the jurisdiction in which the Data Controller operates. 99ae will cooperate fully with any investigation by a competent supervisory authority.

Support available in PKT (UTC+5). Serving users from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar.