Privacy Policy — xy999 Online Casino

Who We Are & How This Policy Applies

xy999 ("the Platform", "we", "us", "our") operates the online casino and sports betting website located at https://xy999.bio. xy999 is the data controller responsible for the personal data of players who register and use the platform. This Privacy Policy applies to all users of the xy999 website regardless of which device, browser, or network connection is used to access the platform.

This Privacy Policy should be read alongside the xy999 Terms & Conditions, which govern the overall contractual relationship between xy999 and its players. By creating an account on xy999 or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

Personal Data We Collect & How We Collect It

xy999 collects personal data through several channels, including directly from you during registration, through your ongoing use of the platform, via our payment processors, and from identity verification providers. The categories of data collected are described in the table in the previous section.

In addition to information you provide directly, xy999 automatically collects certain technical data whenever you interact with the platform. This includes:

• Your IP address and approximate geographic location (city-level), used for fraud detection and to confirm you are accessing from a permitted jurisdiction.
• Device identifiers including device model, operating system version, and unique device ID where available, used for multi-account detection and security monitoring.
• Session data including login time, session duration, pages visited, and in-platform navigation patterns, used for responsible gaming analysis and platform optimisation.
• Referral source data indicating how you arrived at xy999 (e.g., via a search engine, a link, or direct navigation), used for internal analytics only.

We may also receive data about you from third parties, including identity verification providers who assist with CNIC-based KYC checks, and payment service providers such as JazzCash, EasyPaisa, and Pakistani banking partners who process your PKR transactions.

How We Use Your Personal Data

xy999 uses personal data collected from Pakistani players for the following specific, legitimate, and clearly defined purposes:

• Account Creation & Management: To register your account, verify your identity, confirm your age (21+ requirement), maintain your account balance, and manage your profile settings.
• Payment Processing: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast/1LINK, and to maintain accurate transaction records for your account.
• Legal & Regulatory Compliance: To meet our obligations under international gaming regulations, anti-money-laundering (AML) laws, and know-your-customer (KYC) requirements, including age verification and source-of-funds checks.
• Fraud & Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, unauthorised access, and any other activity that threatens the integrity of the platform or the security of player accounts.
• Customer Support: To respond to your queries, process complaints, and resolve disputes in a fair and timely manner. Support interactions may be recorded for quality assurance and training purposes.
• Responsible Gaming: To monitor your gambling activity for signs of problem gambling behaviour and, where appropriate, to apply deposit limits, reality checks, or self-exclusion measures in accordance with our responsible gaming obligations.
• Marketing Communications: To send you relevant promotional offers — such as PSL season bonuses, Eid promotions, or reload offers — where you have given explicit consent. You can withdraw consent at any time by updating your communication preferences in your account settings.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve game performance, identify technical issues, and enhance the overall user experience on xy999.

Data Sharing & Third-Party Disclosure

xy999 does not sell your personal data. We share personal data with third parties only in the limited circumstances described below, and only where doing so is necessary, proportionate, and legally justified.

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast/1LINK receive the transaction data necessary to process your PKR deposits and withdrawals. These providers operate under their own privacy policies and are bound by Pakistani financial regulations.
• Identity Verification Providers: Third-party KYC service providers receive your CNIC data, date of birth, and selfie image for the purpose of identity and age verification. These providers are contractually bound to process your data solely for KYC purposes and to maintain appropriate security standards.
• Regulatory Authorities: xy999 may be required by law, court order, or regulatory directive to disclose player data to licensing authorities, financial intelligence units, or law enforcement agencies. Such disclosures are made only to the extent legally required.
• Technology Partners: Trusted technology service providers — including cloud hosting providers and platform infrastructure vendors — may process personal data on xy999's behalf. All such providers are subject to data processing agreements that restrict their use of your data to the specific services they provide to xy999.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of xy999's business, player data may be transferred to the acquiring entity. You will be notified of any such transfer and your choices respected under the updated privacy framework.

All third-party processors engaged by xy999 are required to implement appropriate technical and organisational security measures to protect your personal data and are prohibited from using it for any purpose beyond the specific service they provide.

Cookies & Tracking Technologies

xy999 uses cookies and similar tracking technologies to enable core platform functionality, remember your preferences, monitor platform performance, and — where you have consented — deliver relevant promotional content. Below is a summary of the cookie types used on xy999:

• Essential Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your language preference, display settings, and last-used payment method to streamline your experience on return visits.
• Analytics Cookies: Collect anonymised data about how players navigate the platform — which games are most popular, where users drop off during registration, and which pages generate the most support queries. This data is aggregated and does not identify individual players.
• Marketing Cookies: Used only where you have explicitly opted in to receiving promotional communications. These cookies help us attribute promotional engagement (e.g., whether you claimed a welcome bonus after seeing an offer) and ensure you do not see the same offer repeatedly.

You can manage or withdraw your consent to non-essential cookies at any time through your browser settings. Most modern browsers allow you to block or delete cookies via the privacy or settings menu. Please note that disabling essential cookies may prevent you from accessing your xy999 account.

Data Retention Periods

xy999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The retention periods applicable to different categories of data are outlined below:

• Account & Identity Data: Retained for the duration of your active account plus a minimum of 5 years after account closure, in line with international AML and gaming regulatory requirements.
• Financial Transaction Data: Retained for a minimum of 5 years following the date of each transaction, as required for AML compliance and financial audit purposes.
• Support Communications: Retained for 3 years from the date of the last interaction, for dispute resolution, quality assurance, and legal purposes.
• Marketing Preferences & Consent Records: Retained for the duration of your active account and for 2 years following account closure or consent withdrawal, as evidence of the lawful basis for any marketing communications sent.
• Technical & Usage Data: Anonymised after 12 months and retained in aggregate form for platform analytics. Non-anonymised technical logs are deleted after 90 days unless required for an ongoing security investigation.

When a retention period expires, personal data is securely deleted or irreversibly anonymised. If you request deletion of your data before the applicable retention period has ended, xy999 will restrict processing to the minimum necessary for legal compliance and will delete all non-legally-required data immediately.

Your Privacy Rights as an xy999 Player

As a player on the xy999 platform, you have a number of rights in relation to your personal data. These rights are summarised below. To exercise any of them, contact xy999 at [email protected] with the subject line "Privacy Rights Request" and your registered account email address.

• Right of Access: You have the right to request a copy of all personal data xy999 holds about you. We will provide this within 10 business days of receiving a verified request.
• Right to Rectification: If any of the personal data xy999 holds about you is inaccurate or incomplete, you have the right to request correction. Some data — such as your CNIC-verified legal name — can only be corrected through the KYC re-verification process.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Where no legal retention obligation applies, we will delete the data within 30 days. Where a retention obligation applies (e.g., AML regulations), we will restrict processing and delete the data as soon as the obligation expires.
• Right to Restriction of Processing: You can request that xy999 limit the processing of your data to storage only — for example, while a dispute is being investigated or while you await a rectification decision.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another platform or service provider of your choice.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Object: You may object to the processing of your personal data where xy999 relies on legitimate interests as the legal basis. xy999 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

Children, Minors & the 21+ Policy

The xy999 platform is strictly intended for adults aged 21 years and above. xy999 does not knowingly collect, process, or retain personal data from any individual under the age of 21. The platform implements mandatory age verification during the KYC process to enforce this policy.

If xy999 becomes aware — through the KYC process, a third-party report, or any other means — that a registered account belongs to a person under 21, the following actions will be taken immediately:

• The account will be permanently suspended and access revoked without notice.
• All bets placed and winnings accrued on the account will be voided. No withdrawals will be processed.
• Any deposits made to the account will be returned to the original payment method after deducting any losses incurred during the period of underage usage.
• All personal data associated with the underage account will be deleted within 30 days, except where retention is legally required for AML or fraud investigation purposes.

Parents and guardians in Pakistan who believe a minor may have registered on xy999 should contact us immediately at [email protected]. We will respond within 24 hours and take all appropriate action.

Security Measures & Data Breach Protocol

xy999 implements a layered, defence-in-depth security architecture to protect player data. The key technical and organisational measures in place include:

• Encryption in Transit: All data transmitted between your browser and xy999 servers is encrypted using TLS 1.3 with 256-bit AES encryption, preventing interception by third parties.
• Encryption at Rest: Sensitive data fields — including CNIC numbers, payment method details, and password hashes — are encrypted at the database level using industry-standard algorithms.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to background screening, confidentiality agreements, and regular privacy training.
• Intrusion Detection: xy999 operates 24/7 security monitoring, automated intrusion detection systems, and regular third-party penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Two-Factor Authentication: Players are encouraged to enable 2FA on their xy999 accounts. Support staff are trained never to request passwords or 2FA codes during support interactions.

In the event of a confirmed personal data breach that poses a risk to player rights and freedoms, xy999 will notify affected players within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories of data affected, and the steps xy999 has taken to contain and remediate the incident.

International Data Transfers

xy999 operates under an international gaming licence and may process or store player data on servers located outside Pakistan. Where personal data is transferred internationally, xy999 ensures that appropriate safeguards are in place to maintain an equivalent level of protection to that which applies within Pakistan.

These safeguards include contractual data transfer agreements with all international data processors, requiring them to apply security standards and data subject rights protections that meet or exceed the requirements of applicable international data protection frameworks. xy999 does not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing additional contractual protections.

Updates to This Privacy Policy

xy999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When we make material changes to this policy, we will notify active players via email to their registered address and display a prominent notice on the xy999 platform for a minimum of 30 days prior to the changes taking effect.

Minor updates — such as clarifications of existing language, corrections of typographical errors, or additions of further detail that do not alter the substance of the policy — may be made without advance notice. The "Effective Date" at the top of this policy will always reflect the date of the most recent update.

Continued use of the xy999 platform following the effective date of any policy update constitutes acceptance of the revised Privacy Policy. If you do not agree with any changes, you should cease using the platform and contact us to request account closure and data deletion.

Contact Us & Privacy Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or xy999's handling of your personal data, please contact our privacy support team. We are committed to resolving all privacy-related queries promptly and fairly.

• Email: [email protected] — use subject line "Privacy Query" or "Data Rights Request" for fastest routing.
• Response Time: We aim to acknowledge all privacy queries within 3 business days and resolve them within 10 business days.
• Support Hours: Privacy support is available Monday to Friday, 9:00 AM – 6:00 PM PKT (Pakistan Standard Time).

If you are not satisfied with xy999's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection or gaming regulatory authority. xy999 will cooperate fully with any such regulatory investigation.