99ad Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1. About This Privacy Policy

1.1 This Privacy Policy describes how 99ad (referred to as "99ad", "we", "us", or "our") collects, uses, shares, stores, and protects personal data obtained from individuals who register for and use the 99ad online gaming platform accessible at 99ad.one (the "Platform").

1.2 This Policy applies to all registered players, visitors to the Platform, and any other individuals whose personal data is processed by 99ad in connection with the operation of its services. It applies regardless of whether you access the Platform via a desktop browser, mobile browser, or any other compatible device.

1.3 This Policy should be read in conjunction with the 99ad Terms & Conditions, which together constitute the full legal relationship between you and 99ad. In the event of any conflict between this Policy and the Terms and Conditions on matters relating to data privacy, this Privacy Policy shall take precedence.

1.4 99ad is committed to processing personal data in a manner consistent with internationally recognised data protection principles, including those set out under the General Data Protection Regulation (GDPR) framework, as relevant to our international licensing obligations.

2. Data Controller

2.1 For the purposes of this Privacy Policy, 99ad acts as the Data Controller with respect to the personal data of its registered users and platform visitors. As Data Controller, 99ad determines the purposes and means of processing your personal data.

2.2 In circumstances where 99ad engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, or analytics platforms — those providers act as Data Processors operating under contractual data processing agreements that impose obligations consistent with this Policy.

2.3 Questions regarding 99ad's role as Data Controller, or any matter relating to the processing of your personal data, may be directed to the 99ad Data Privacy team via the contact details set out in Section 16 of this Policy.

3. Personal Data We Collect

3.1 99ad collects the following categories of personal data in the course of operating the Platform and providing gaming services to Pakistani players and all other registered users:

3.1 Identity and Contact Data

• Full legal name (collected during KYC verification);
• Date of birth (for age verification — 21+ requirement);
• Registered Pakistani mobile number;
• Email address (where provided);
• Residential address (collected during advanced KYC);
• National Identity Card (CNIC) number or equivalent government-issued identification number.

3.2 Account and Authentication Data

• Username and encrypted password hash;
• One-time passwords (OTPs) issued during two-factor authentication sessions (not retained post-verification);
• Login timestamps, session durations, and device identifiers associated with account access events;
• Account preferences and responsible gaming tool settings.

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method references;
• JazzCash account reference numbers, EasyPaisa wallet identifiers, bank account details (IBAN), or debit/credit card last-four digits and expiry dates associated with verified payment methods;
• Wallet balance history and bonus transaction records;
• KYC identity document images (CNIC front and back, selfie, and proof of address documents).

3.4 Gaming and Behavioural Data

• Game session histories including game types played, bet amounts, results, and session durations;
• Sports betting market selections, stake amounts, and outcomes;
• Responsible gaming tool usage (deposit limits set, session reminders activated, self-exclusion periods);
• Platform navigation behaviour, page visit sequences, and feature interaction patterns used for platform improvement purposes.

3.5 Technical and Device Data

• IP address at time of access;
• Device type, operating system version, and browser type;
• Mobile network operator (e.g., Jazz, Telenor, Zong, Ufone) where determinable;
• Cookie identifiers and similar tracking technologies as described in Section 8.

4. How We Collect Personal Data

4.1 Directly from You: The majority of personal data held by 99ad is provided directly by you during the registration process, KYC verification, deposit and withdrawal transactions, communications with support, and through your use of the Platform's gaming and responsible gaming features.

4.2 Automatically: Certain technical and behavioural data is collected automatically as you interact with the Platform, through cookies, server logs, and analytics tools. See Section 8 for detailed information on cookies and tracking technologies used by 99ad.

4.3 From Third Parties: 99ad may receive personal data about you from:

• Payment processors — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and card networks — in connection with transaction verification and anti-fraud checks;
• KYC and identity verification providers engaged by 99ad to verify the accuracy of identity documents submitted by players;
• Fraud prevention and anti-money laundering (AML) screening databases used by 99ad to fulfil its licensing obligations;
• Publicly available sources, such as government sanction lists, politically exposed person (PEP) registers, and adverse media databases, consulted during enhanced due diligence reviews.

5. Lawful Basis for Processing

5.1 99ad processes personal data only where a valid lawful basis exists under applicable data protection law. The lawful bases relied upon by 99ad are as follows:

• Contractual Necessity: Processing required to create and manage your 99ad account, authenticate your identity, process deposits and withdrawals, deliver gaming services, and handle support communications.
• Legal Obligation: Processing required to comply with KYC, AML, and counter-terrorism financing (CTF) obligations imposed by 99ad's licensing authority and applicable international financial crime prevention standards.
• Legitimate Interests: Processing for the purposes of fraud detection and prevention, platform security, responsible gaming monitoring, product improvement, and internal analytics, where 99ad's legitimate interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing purposes (including promotional SMS, email newsletters, and push notifications) where you have given explicit, freely-given consent. You may withdraw this consent at any time.

6. How 99ad Uses Your Personal Data

6.1 Personal data collected by 99ad is used for the following defined purposes:

• Account Management: Creating, maintaining, and administering your 99ad account, including verifying your identity and age (21+ requirement), authenticating login sessions, and managing account settings and preferences;
• Service Delivery: Processing deposits and withdrawals via JazzCash, EasyPaisa, and other supported Pakistani payment methods; enabling access to gaming products; crediting bonus balances; and maintaining accurate wallet and transaction records;
• KYC and Compliance: Conducting identity and age verification; carrying out AML and CTF screening; fulfilling reporting obligations to 99ad's licensing authority; and responding to lawful requests from regulatory and law enforcement bodies;
• Security and Fraud Prevention: Detecting and preventing unauthorised account access, fraudulent transactions, bonus abuse, money laundering, and other prohibited conduct; monitoring for unusual account activity patterns; and maintaining audit trails for investigation purposes;
• Responsible Gaming: Monitoring gaming behaviour for indicators of problem gambling; administering deposit limits, session reminders, loss limits, and self-exclusion periods; and providing responsible gaming resources to players who may need them;
• Platform Improvement: Analysing anonymised and aggregated usage data to improve platform performance, identify technical issues, develop new features, and optimise the user experience for Pakistani mobile users;
• Marketing Communications: Sending promotional offers, bonus announcements, PSL season promotions, and other marketing content to players who have opted in to receive such communications, and only via channels for which consent has been given;
• Customer Support: Responding to account queries, payment issues, technical problems, complaints, and responsible gaming requests submitted through live chat and email.

7. Data Sharing and Disclosure

7.1 99ad does not sell, rent, or trade your personal data. Personal data is shared with third parties only in the following defined circumstances:

7.1 Service Providers and Data Processors

99ad engages trusted third-party service providers who process personal data on its behalf under binding data processing agreements, including: payment processors (JazzCash, EasyPaisa, banking partners), KYC verification providers, fraud and AML screening platforms, cloud infrastructure providers, and customer support platform operators.

7.2 Regulatory and Legal Obligations

99ad may disclose personal data to its licensing authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, regulatory order, or court order. Such disclosures are made only to the extent required by the specific legal obligation.

7.3 Fraud Prevention and AML

Where 99ad suspects or identifies fraudulent activity, money laundering, or other criminal conduct involving a player's account, personal data may be shared with relevant law enforcement authorities, financial intelligence bodies, and other licensed gaming operators where permitted by applicable fraud prevention frameworks.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of 99ad's assets, personal data held by 99ad may be transferred to the successor entity as part of the transaction, subject to equivalent privacy protections. You will be notified of any such transfer by email or prominent Platform notice.

8. Cookies and Tracking Technologies

8.1 99ad uses cookies and similar tracking technologies on the Platform. A cookie is a small data file placed on your device that allows the Platform to recognise your browser, maintain session state, remember your preferences, and gather analytical data about Platform usage.

8.2 The following categories of cookies are used on the 99ad Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during a gaming session and security cookies used in the two-factor authentication process. These cannot be disabled without preventing core Platform functionality.
• Functional Cookies: Store your stated preferences such as language settings, responsible gaming limit configurations, and game lobby display settings. These enhance your experience but are not strictly necessary.
• Analytical Cookies: Used to collect anonymised data about how the Platform is used — page visits, session durations, game category preferences, and navigation paths — to help 99ad understand and improve the player experience. These cookies do not identify you personally.
• Marketing Cookies: Used to track whether marketing communications have been opened or acted upon, and to avoid sending duplicate promotions. These are only active where you have consented to receiving marketing from 99ad.

8.3 You may control cookie settings through your browser preferences. Blocking strictly necessary cookies will impair your ability to use the Platform. Blocking analytical or marketing cookies will not affect core gaming functionality.

9. Data Retention

9.1 99ad retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by legal, regulatory, or licensing obligations.

9.2 The following general retention guidelines apply:

9.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 99ad's data destruction procedures. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes as it can no longer identify individual players.

10. International Data Transfers

10.1 As an internationally licensed gaming operator, 99ad may process or store personal data in jurisdictions outside the country in which you are located. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that in your home jurisdiction, 99ad ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the relevant data protection authority;
• Data processing agreements with all third-party processors that impose obligations equivalent to those in this Privacy Policy;
• Technical security measures ensuring the security of data in transit and at rest regardless of storage location.

10.2 By using the 99ad Platform, Pakistani players acknowledge that their personal data may be processed by 99ad's infrastructure and service providers in jurisdictions outside Pakistan. 99ad takes all reasonable steps to ensure that such international transfers are conducted securely and in compliance with applicable data protection standards.

11. Your Data Protection Rights

11.1 Subject to applicable law and certain exceptions, you have the following rights with respect to your personal data held by 99ad:

To exercise any of the above rights, please contact the 99ad Data Privacy team as described in Section 16. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. There is no charge for exercising these rights in standard cases.

12. Children's Privacy and the 21+ Requirement

12.1 The 99ad Platform is strictly intended for adults aged 21 years and over. 99ad does not knowingly collect personal data from individuals under the age of 21. The minimum age requirement is enforced at registration and verified through the KYC process before any withdrawal is processed.

12.2 If 99ad discovers or has reason to believe that personal data has been collected from an individual under the age of 21, 99ad will immediately suspend the relevant account, cease all processing of that individual's data, delete or anonymise the data to the extent not required by law, and return any funds deposited subject to investigation and verification.

12.3 Parents or guardians who believe that a minor has created a 99ad account are urged to contact support immediately so that the account can be investigated and closed without delay.

13. Security Measures

13.1 99ad implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and 99ad servers is encrypted using TLS 1.2 or higher, providing 256-bit encryption of data in transit;
• Encryption at Rest: Sensitive data, including payment method details and identity documents, is encrypted at rest using AES-256 or equivalent encryption standards;
• Two-Factor Authentication (2FA): All account logins require verification via SMS OTP, adding a second layer of authentication that prevents unauthorised access even if login credentials are compromised;
• Access Controls: Logical access to personal data is restricted on a strict need-to-know basis. Employee access is governed by role-based access controls and is subject to regular review and audit;
• Intrusion Detection: 99ad's infrastructure is monitored by automated intrusion detection systems that flag and respond to anomalous access patterns in real time;
• Regular Security Audits: 99ad's security posture is subject to regular internal review and periodic independent third-party penetration testing and vulnerability assessment.

13.2 Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed as 100% secure. 99ad takes all commercially reasonable steps to protect your data but cannot guarantee absolute security against all potential threats.

14. Marketing Communications

14.1 99ad may send you marketing communications about bonuses, promotions, new games, PSL and cricket betting specials, and other 99ad services via SMS, email, or push notifications, but only where you have given your explicit consent to receive such communications during registration or subsequently through your account settings.

14.2 Opt-Out: You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your 99ad account settings;
• Replying "STOP" to any promotional SMS received from 99ad;
• Clicking the unsubscribe link in any promotional email;
• Contacting 99ad support with a written opt-out request.

14.3 Withdrawal of marketing consent will be actioned within 5 business days. You may continue to receive transactional communications — such as account security alerts, deposit confirmations, withdrawal notifications, and OTPs — regardless of your marketing preferences, as these are strictly necessary for account security and service delivery.

14.4 Profiling for Marketing: 99ad may use gaming behaviour data to personalise promotional offers — for example, directing PSL cricket betting promotions to players who regularly use the sportsbook. This profiling is based on legitimate interest and you have the right to object to it at any time as described in Section 11.

15. Changes to This Privacy Policy

15.1 99ad reserves the right to update or amend this Privacy Policy at any time to reflect changes in how we operate, changes in applicable data protection law, or updates to our licensing obligations. The most current version of this Policy will always be accessible at 99ad.one/privacy-policy.

15.2 Where changes to this Policy are material — for example, where they affect the categories of data collected, the purposes for which it is processed, or the rights available to you — 99ad will provide advance notice to registered users via their registered contact details, or via a prominent notice on the Platform, no less than 14 days before the amended Policy takes effect.

15.3 Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the updated Policy, you should cease using the Platform and contact support to request account closure and the return of any remaining wallet balance.

16. Contact Us — Privacy Enquiries and Data Requests

16.1 For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by 99ad, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24/7 from within your 99ad account dashboard in English and Urdu. Please state "Privacy Request" or "Data Request" clearly when initiating the chat so that your query is directed to the appropriate team.
• Email: [email protected] — please use the subject line "Privacy Policy Request" and include your registered mobile number. Note: this email address is provided as plain text only and is not a clickable link.

16.2 99ad will acknowledge all formal privacy requests within 5 business days and provide a substantive response within 30 calendar days of receipt, as required under applicable data protection standards.

16.3 If you are dissatisfied with 99ad's response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.