Privacy Policy – How 99xo Handles Your Personal Data in Pakistan

1What Personal Information 99xo Collects

To provide you with a safe, functional and personalised betting experience, 99xo needs to collect certain categories of personal information. Below is a full breakdown of each category and why we hold it.

99xo does not collect special category data such as biometric identifiers, health information or political opinions. The CNIC number is collected solely for identity and age verification purposes and is not used for any other purpose without explicit consent.

2How 99xo Collects Your Information

We collect personal information through three main channels:

• Directly from you: When you register an account, complete verification, make a deposit or withdrawal, contact our support team, or participate in a promotion on 99xo. You are always in control of what you provide through these channels.
• Automatically through your use of the platform: When you browse the 99xo website or use our platform, certain technical data is collected automatically. This includes your IP address, the pages you visit, the features you use and the duration of your sessions. This data is collected through server logs and analytics tools.
• From third-party service providers: Our identity verification partner may provide us with a verified confirmation of your identity document status. Our payment processors confirm the status and account registration details of your JazzCash, Easypaisa or bank account to enable withdrawals to the correct registered account. We do not receive your full payment credentials — only the reference information needed to route transactions correctly.

3Why 99xo Uses Your Personal Data

Every use of your personal data at 99xo is underpinned by a specific lawful basis. We process your data for the following purposes:

• Account operation: Your registration information is necessary to create and maintain your account, authenticate your logins, and provide you access to the 99xo platform. Without this, you simply cannot have an account.
• Payment processing: Financial data and contact information are used to process deposits from and withdrawals to your registered payment accounts. This is a contractual necessity — you cannot use the platform without a functional payment setup.
• Legal and regulatory compliance: We are required under our operating licence to verify player identity and age, maintain records of transactions and communicate data to regulatory or law enforcement authorities when lawfully required to do so. This is a legal obligation that takes precedence over player preferences.
• Fraud and money laundering prevention: Transaction data, technical data and behavioural data are analysed by automated systems to identify patterns consistent with fraudulent activity, bonus abuse, account sharing or money laundering. This protects the integrity of the platform for all players on 99xo.
• Responsible gaming: Behavioural and transaction data is used to identify indicators of problem gambling. Where our systems detect concerning patterns, we may proactively contact a player or apply voluntary safeguards. This use of data is in the player's interest and is a condition of our operating licence.
• Platform improvement: Aggregated and anonymised usage data helps us understand how players interact with the 99xo platform, which features are used most and where friction exists in the user experience. This data is not used to identify individuals.
• Marketing communications (with consent only): If you opted in to promotional emails or SMS messages at registration or at any point since, we use your contact details to send relevant offers. You can withdraw this consent at any time.

4Who 99xo Shares Your Data With

99xo does not sell or rent your personal data. The following categories of third parties receive data solely to perform specific functions on our behalf:

• Payment processors: JazzCash, Easypaisa, NayaPay, SadaPay, bank payment networks and card scheme processors receive the transaction data and account reference information necessary to complete your deposits and withdrawals. Each provider operates under their own regulated privacy framework.
• Identity verification providers: When we request CNIC verification or address verification, a specialist third-party provider performs the check. They receive your document image and return a verified status. They do not store your documents for any purpose other than the verification itself.
• Fraud and AML screening services: Automated screening tools check transaction and account data against known fraud patterns and regulatory watchlists. These systems are contractually bound to use data only for the purposes of fraud and AML detection.
• Technology infrastructure providers: Cloud hosting and content delivery services that support the operation of the 99xo platform may have access to data as part of infrastructure management. All such providers are bound by data processing agreements with equivalent protections to those described in this policy.
• Regulatory and law enforcement authorities: We are legally required to disclose player data to relevant authorities when presented with a lawful request. We cannot decline such requests, but we will only comply with requests that meet the required legal standard and will disclose only the minimum data necessary.

5Payments and Financial Data

Financial data held by 99xo deserves specific attention given its sensitivity. Here is exactly how we handle it:

• Full payment account credentials — your JazzCash PIN, Easypaisa password, online banking password or full card number — are never stored by 99xo. These credentials are entered directly on your payment provider's own system.
• What 99xo receives and stores is a transaction reference, the masked account identifier (for example, the last 4 digits of a card or the mobile number linked to a JazzCash account) and the confirmed status of the payment. This is the minimum data needed to operate deposits and withdrawals.
• All withdrawal requests are matched against the account name on your 99xo profile. Withdrawals to third-party accounts are not processed under any circumstances. This is both a security measure and a regulatory requirement.
• Transaction records — deposits, withdrawals, and bet settlements — are retained for a minimum of 5 years from the date of transaction to meet financial record-keeping obligations under applicable regulations. This retention period cannot be waived even by an account deletion request.

6Cookies and Tracking Technologies

99xo uses cookies and similar technologies on our website. A cookie is a small text file stored on your device that allows the platform to recognise your browser across visits. We use the following types:

• Essential cookies: Required for the platform to function. These include your session authentication cookie (which keeps you logged in), your language preference, and cookies that remember your bet slip contents during a session. You cannot opt out of essential cookies without stopping using the platform.
• Performance cookies: These collect anonymised data about how players use the platform — which pages are most visited, where errors occur, and how long pages take to load. This data is aggregated and does not identify individual users.
• Functional cookies: These remember your preferences — for example, which deposit method you last used or which game category you were browsing. They are not essential but improve convenience.
• Analytics cookies: 99xo uses analytics tools to understand broad usage patterns on the platform. Data collected through analytics is aggregated and anonymised before being reviewed by our team.

99xo does not use advertising tracking cookies that follow you across third-party websites. We do not participate in behavioural advertising networks. The only tracking on the 99xo domain relates to your activity on our own platform.

You can control cookie preferences through your browser settings. Blocking essential cookies will prevent the platform from functioning correctly. Blocking performance and functional cookies will not affect core platform access but may reduce convenience features.

7How Long 99xo Retains Your Data

We do not keep your data indefinitely. Different categories of data have different retention periods based on their purpose and our legal obligations:

• Account data (name, contact details, login history): Retained for the duration of your account plus 2 years after voluntary account closure, or 5 years after an account closed due to a suspected breach of our Terms.
• Identity verification documents (CNIC scans): Retained for 5 years from the date of verification in compliance with anti-money-laundering record-keeping requirements. After this period, documents are securely deleted from our systems.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required under financial regulations applicable to our operating licence.
• Bet and game history: Retained for 3 years from the date of each session for dispute resolution purposes, and in anonymised aggregate form beyond that for platform improvement.
• Support communications: Chat and email records are retained for 2 years from the date of the communication or the resolution of any related dispute, whichever is later.
• Marketing consent records: A record of your opt-in or opt-out decision, including the date and method, is retained for 3 years to evidence compliance in the event of a complaint.

When a retention period expires, data is securely deleted or anonymised in a way that makes individual identification impossible. 99xo conducts periodic data audits to ensure that data is not held beyond its required retention period.

8Your Rights Over Your Personal Data

As a 99xo player, you have the following rights regarding your personal data. All of these can be exercised by emailing support@99xo.plus with the subject line "Data Rights Request" and your registered account username:

We will verify your identity before acting on any data rights request to ensure that a third party cannot obtain or delete your data by impersonating you. Response time for all data rights requests is a maximum of 30 days from verification of your identity.

9How 99xo Secures Your Data

Data security at 99xo is not a single measure — it is a layered set of technical and organisational controls:

• Encryption in transit: All data moving between your browser or device and 99xo's servers is encrypted using TLS 1.2 or higher. This prevents interception by third parties on any network you are using, including shared Wi-Fi.
• Encryption at rest: Sensitive data stored in our databases — including identity documents and financial references — is encrypted at rest using AES-256. The encryption keys are managed separately from the data stores they protect.
• Access controls: Access to personal data within 99xo is restricted to staff who genuinely need it for their specific role. Access is governed by role-based permissions and logged. Privileged access is subject to additional authentication requirements.
• Security testing: 99xo conducts periodic penetration tests and vulnerability assessments of our platform infrastructure. Critical vulnerabilities are remediated on a priority basis.
• Incident response: In the event of a data security incident that could affect players, 99xo has a documented incident response process. Affected players will be notified within 72 hours of an incident being confirmed, along with clear guidance on any recommended actions they should take.

Despite these measures, no system connected to the internet can be guaranteed completely secure. We encourage all 99xo players to use a strong and unique password, enable two-factor authentication where available, and contact us immediately if they suspect unauthorised access to their account.

10Minors and Players Under 18

99xo is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. Our registration process requires confirmation of age and identity verification is carried out before withdrawal processing begins.

If we discover or are informed that a player's account was registered by someone under 18, we will immediately close the account, delete the personal data collected in connection with that account (other than the data retained to evidence the age violation), and void any winnings. No exceptions are made to this policy.

Parents and guardians who believe a minor in their household has accessed 99xo should contact us immediately at support@99xo.plus. We will investigate and act promptly on any credible report of underage account registration.

11Changes to This Privacy Policy

99xo may update this Privacy Policy from time to time to reflect changes in our practices, technology or regulatory requirements. The updated policy will be published on this page with a revised "Last Updated" date.

For changes that materially affect how we use your personal data or your rights as a player, we will notify you by email or in-platform notification at least 14 days before the change takes effect. This gives you time to review the changes and, if you disagree, to close your account and withdraw your balance before the new policy applies to you.

Continued use of 99xo after the effective date of any change constitutes acceptance of the updated Privacy Policy. We recommend revisiting this page periodically, particularly before making significant deposits, to stay informed of the current policy.

12Contact Us About Privacy

If you have any questions, concerns or complaints about how 99xo handles your personal data, we want to hear from you. Privacy-related enquiries are handled with particular care and are escalated to our compliance team.

• Email: support@99xo.plus — use the subject line "Privacy Enquiry" for faster routing to the right team.
• Live chat: Available 24/7 inside your logged-in account. Our support agents can handle basic privacy queries and escalate to the compliance team where necessary.

We commit to acknowledging all privacy-related enquiries within 24 hours and providing a substantive response within 14 days. For formal data rights requests, the 30-day response period begins from the point of identity verification, not from the initial submission.

If you are not satisfied with our response to a privacy complaint, you may also refer the matter to the relevant data protection authority applicable in your jurisdiction.