r999 Privacy Policy

r999 operates the online casino and sports betting platform accessible at r999.lol (the "Platform"). For the purposes of applicable data protection legislation, r999 acts as the Data Controller in respect of all personal data collected from users, visitors, and registered players of the Platform.

As Data Controller, r999 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable data protection standards.

If you have any questions about how r999 processes your personal data, or if you wish to exercise any of the rights described in this Privacy Policy, please contact our Data Protection team using the contact details provided in Section 14 of this document.

r999 collects the following categories of personal data from players and users of the Platform:

r999 does not intentionally collect any special category data (such as racial or ethnic origin, health data, religious beliefs, or political opinions) from players. If any such data is inadvertently disclosed to r999 — for example, via a support message — it will not be processed for any purpose other than responding to the specific enquiry and will be deleted as soon as reasonably practicable.

r999 collects your personal data through the following channels and methods:

• Direct submission by you: When you register an account on r999, complete the KYC verification process, make a deposit or withdrawal, contact customer support, or respond to a promotional communication.
• Automated technical collection: Through cookies, web beacons, pixel tags, server logs, and similar tracking technologies that capture your device information, IP address, and browsing behaviour on the r999 Platform. See Section 9 for full details on cookies.
• Payment providers: When you initiate a deposit or withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, or 1LINK, these providers share transaction confirmation data and payment method identifiers with r999 to enable the transaction and support AML compliance.
• Identity verification services: r999 may use third-party identity verification providers to assist with CNIC verification. These providers return a pass/fail verification result and, in some cases, the name and date of birth extracted from the CNIC image.
• Fraud and AML screening services: r999 may query third-party databases for sanctions screening, politically exposed persons (PEP) checks, and fraud risk scoring. The data returned by such queries is used solely for compliance purposes.
• Publicly available sources: In limited circumstances related to fraud investigation or compliance, r999 may consult publicly available information such as court records or published regulatory decisions.

r999 processes your personal data only for specific, defined purposes. The table below sets out the primary purposes for which each category of data is used:

• Account registration and management: To create and administer your r999 player account, verify your identity, authenticate your login sessions, and maintain accurate account records.
• Age and eligibility verification (KYC): To confirm that you meet the minimum age requirement of 21 years and satisfy all other eligibility criteria before permitting you to deposit or wager on the r999 Platform.
• Payment processing: To facilitate deposits to and withdrawals from your r999 wallet in PKR via your chosen payment method, and to maintain an accurate financial ledger of all transactions.
• Regulatory compliance and AML: To meet r999's obligations under its gaming licence, including anti-money laundering (AML) transaction monitoring, sanctions screening, and the maintenance of records for the period required by our licensing authority.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, to enforce self-exclusion and deposit limits set by players, and to fulfil r999's responsible gaming obligations under its gaming licence.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity including multi-accounting, bonus abuse, collusion, and money laundering. To protect the security and integrity of the r999 Platform and the interests of all registered players.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance via live chat or email in connection with your r999 account.
• Platform improvement and analytics: To analyse aggregate behavioural data (not individual profiling) to identify technical issues, optimise the user experience, and inform product development decisions.
• Marketing communications: Where you have provided explicit consent, to send you promotional offers, bonus notifications, and news about r999 products and features relevant to the games and sports you engage with on the Platform.

r999 relies on the following legal bases for processing your personal data, depending on the purpose of the specific processing activity:

• Contractual necessity: The majority of data processing by r999 is necessary for the performance of the contract between you and r999 — namely, the Terms and Conditions you agree to upon registration. This includes account creation, payment processing, game provision, and customer support.
• Legal obligation: Processing carried out to comply with r999's obligations under its gaming licence and applicable law — including KYC verification, AML monitoring, responsible gaming record-keeping, and data retention obligations — is carried out on the basis of legal obligation.
• Legitimate interests: r999 processes certain data on the basis of its legitimate interests, including fraud prevention, platform security, multi-accounting detection, and aggregate analytics for product improvement. Where legitimate interests are relied upon, r999 has assessed that its interests do not override your fundamental rights and freedoms.
• Consent: Where r999 relies on your consent — specifically for marketing communications and for the use of non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent will not affect your ability to access the r999 Platform or your account.

r999 does not sell your personal data to third parties under any circumstances. r999 may share your personal data with the following categories of recipients, strictly for the purposes described in this Privacy Policy:

• Payment service providers (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, Visa): Receive only the data necessary to process your deposit or withdrawal transaction.
• Identity verification providers: Receive your CNIC images and personal details for the purpose of completing KYC verification. These providers are contractually bound to use your data only for this purpose.
• AML and fraud screening services: Receive transaction data, account identifiers, and in some cases name and date of birth for sanctions screening and fraud risk scoring.
• Game software providers: May receive a pseudonymous player identifier (not your name or CNIC) to enable game session management and RNG certification auditing. Game providers do not receive your financial or identity data.
• Customer support technology providers: Receive support chat data in order to provide the live chat platform through which r999 customer support operates. These providers process data only as data processors acting on r999's instructions.
• Regulatory and licensing authorities: r999 is required under its gaming licence to provide player data and transaction records to its licensing authority on request and as part of periodic compliance reporting. r999 has no discretion to refuse such requests.
• Law enforcement and government agencies: r999 will disclose personal data to competent authorities where required to do so by law, court order, or regulatory instruction, including in connection with AML investigations.

All third-party data processors engaged by r999 are bound by contractual data processing agreements requiring them to process personal data only on r999's documented instructions, to implement appropriate technical and organisational security measures, and to delete or return data upon termination of their engagement with r999.

r999 retains personal data only for as long as is necessary for the purposes for which it was collected, or for as long as is required by r999's regulatory and legal obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that makes individual re-identification impossible. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

r999 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, and accidental loss. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption: All data transmitted between your device and r999.lol is encrypted using 256-bit SSL/TLS, the same encryption standard used by major international banking institutions.
• Encrypted data storage: Personal and financial data is stored in encrypted databases with access controls restricting access to authorised personnel only on a strict need-to-know basis.
• Two-Factor Authentication (2FA): r999 offers 2FA for all player accounts via OTP to your registered Pakistani mobile number. r999 strongly recommends enabling 2FA to protect your account from unauthorised access.
• Regular security audits: r999's platform undergoes regular penetration testing and security audits conducted by independent cybersecurity professionals to identify and remediate vulnerabilities.
• Access controls and logging: All internal access to player personal data is logged, access-controlled, and subject to periodic review. Staff access is granted on a minimum-necessary basis.
• Data breach response: r999 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to players' rights and freedoms, r999 will notify affected players without undue delay in accordance with applicable regulatory requirements.

r999 uses cookies and similar tracking technologies on the r999.lol Platform. A cookie is a small text file placed on your device by a website server. Cookies allow the website to recognise your device on subsequent visits and to retain certain information about your preferences and session.

r999 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the r999 Platform to function correctly. They maintain your login session, preserve your account settings, enable payment page navigation, and support the security features of the Platform. These cookies cannot be disabled without impairing your ability to use r999.
• Performance and Analytics Cookies: These cookies collect information about how players use the r999 Platform — which pages are visited most frequently, how long sessions last, and where errors occur. This data is used in aggregate form to improve Platform performance. These cookies require your consent.
• Functional Cookies: These cookies remember your preferences — such as your preferred game category or language setting — to provide a more personalised experience. These cookies require your consent.
• Marketing Cookies: Where you have consented to receiving marketing communications, certain cookies may be used to track whether you opened a promotional email or clicked a specific offer, in order to measure campaign effectiveness. These cookies are not used to build a profile of your browsing behaviour across third-party websites.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to view, block, and delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to or using core features of the r999 Platform.

Subject to applicable law and r999's regulatory obligations, you have the following rights in respect of your personal data held by r999. To exercise any of these rights, please contact r999's Data Protection team using the details in Section 14.

The r999 Platform is strictly intended for adults aged 21 and over. r999 does not knowingly collect personal data from any person under the age of 21, and takes active steps to prevent under-age registration through CNIC-based age verification during the account registration and KYC process.

If r999 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all data associated with the account will be reviewed, and all funds will be returned to the payment method used — after which the account will be permanently closed and the data deleted to the extent permitted by regulatory obligations.

If you are the parent or guardian of a child and you believe your child has registered on the r999 Platform, please contact r999 Customer Support immediately via live chat or email at [email protected]. r999 will investigate and take appropriate action without delay.

As an internationally licensed gaming operator, r999 may process or store your personal data in countries outside Pakistan, including countries where r999's technology infrastructure, game providers, or licensed data processors are based. Such transfers may include countries in Europe, Asia, or other regions where adequate data protection standards apply.

Where personal data is transferred outside Pakistan to jurisdictions that do not have equivalent data protection legislation, r999 ensures that appropriate safeguards are in place before the transfer is made. These safeguards may include:

• Standard contractual clauses (SCCs) approved by relevant data protection authorities, incorporated into r999's agreements with recipient organisations;
• Binding corporate rules, where applicable within r999's group structure;
• Adequacy decisions or equivalent determinations confirming that the recipient jurisdiction provides an adequate level of data protection.

You may request information about the specific safeguards in place for any particular international data transfer by contacting the r999 Data Protection team.

r999 reserves the right to update or amend this Privacy Policy at any time. Material changes — those that significantly affect the way r999 processes your personal data, the purposes for which it is used, or the rights available to you — will be communicated to registered players via the email address or mobile number associated with their r999 account, and will be prominently highlighted on the r999 Platform for a period of not less than 14 days prior to the effective date of the change.

The most current version of the r999 Privacy Policy will always be accessible on the Platform at r999.lol/privacy-policy. The "Last Updated" date at the top of this document indicates when the current version was published. We encourage you to review this Privacy Policy periodically to stay informed about how r999 protects your personal data.

For all privacy-related enquiries, data protection rights requests, or concerns about how r999 processes your personal data, please contact the r999 Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the r999 Platform. State "Data Protection" at the start of your message to ensure it is routed to the appropriate team.
• Email: [email protected] — Use the subject line "Data Protection Request" and include your full name, registered email address, and registered mobile number. r999 will acknowledge your request within 24 hours and respond substantively within 30 days.

If you are dissatisfied with r999's response to a data protection request or complaint, you may be entitled to lodge a complaint with the data protection supervisory authority in the jurisdiction governing r999's data processing activities.