Privacy Policy
ay999 Online Casino

ay999 ("we", "us", "the Platform") is committed to protecting the privacy and personal data of all individuals who register and use the ay999 online casino and sports betting platform at ay999.org. This Privacy Policy explains, in clear and transparent terms, what personal data ay999 collects from players, why it is collected, how it is used and stored, with whom it may be shared, and what rights players have in relation to their personal data.

This Policy applies to all personal data collected through ay999.org, through the ay999 mobile interface, through the platform's customer support channels including live chat and email, and through any other touchpoint where a player provides personal information to ay999. It should be read alongside the ay999 Terms & Conditions, which are available at /terms-conditions.

By registering an account on ay999, accessing the platform, or placing any wager, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time without prejudice to the lawfulness of processing carried out before withdrawal.

For the purposes of applicable data protection law, the data controller responsible for your personal data is the entity operating the ay999 platform under its international gaming license. The operator is accessible via the following contact:

• Platform: ay999 — ay999.org
• Support Email: [email protected] (plain text correspondence only; do not send CNIC images or financial data by email)
• Live Chat: Available 24/7 directly on the ay999 platform

All data protection enquiries, rights requests, and complaints should be directed to the ay999 support team using the contact channels above. ay999 will acknowledge data protection correspondence within 48 hours and will provide a substantive response within 30 calendar days.

ay999 collects the following categories of personal data:

ay999 collects personal data through the following channels and mechanisms:

• Direct submission by the player: Registration forms, KYC document uploads, deposit and withdrawal requests, support enquiries, and promotional opt-in forms all involve the player directly providing data to ay999;
• Automated platform systems: Technical data including IP addresses, device identifiers, session timestamps, and gameplay records are collected automatically as part of normal platform operation and are necessary for security, fraud prevention, and responsible gaming monitoring;
• Payment service providers: When a player deposits or withdraws via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or USDT, ay999 receives transaction confirmation data including the payment method identifier and transaction reference from the relevant payment service provider;
• Third-party verification services: ay999 may use third-party identity verification services to validate CNIC authenticity as part of the KYC process. These services confirm the authenticity of the document without ay999 sharing raw CNIC data with the service in a form that identifies the player independently;
• Cookies and similar technologies: As described in Section 12 of this Policy, ay999 uses cookies and similar tracking technologies to maintain session state, prevent fraud, and improve platform performance.

ay999 processes your personal data on the following legal bases:

• Contractual necessity: Processing of identity, contact, financial, and gameplay data is necessary to perform the contract between ay999 and the player — specifically, to provide access to ay999's gaming and betting services, process deposits and withdrawals in PKR, and manage the player's account;
• Legal obligation: KYC identity verification, AML transaction monitoring, and the retention of financial records for the minimum periods required by ay999's international gaming license are mandatory legal obligations. ay999 cannot operate its licensed services without fulfilling these requirements, and player consent is not a valid basis to waive them;
• Legitimate interests: Technical data processing for fraud prevention, security monitoring, platform performance optimisation, and responsible gaming monitoring is conducted on the basis of ay999's legitimate interests in operating a secure, fair, and compliant platform;
• Consent: Marketing communications, promotional emails, and non-essential cookies are processed on the basis of the player's explicit consent. Where consent is the legal basis, the player may withdraw consent at any time by contacting ay999 support or by using the unsubscribe mechanism in marketing emails.

ay999 uses personal data for the following specific purposes:

1. Account creation and management: Processing registration, verifying identity via CNIC, maintaining your account dashboard, and enabling login and two-factor authentication;
2. Payment processing: Facilitating PKR deposits via JazzCash, EasyPaisa, and bank transfer channels, processing withdrawal requests to verified payment methods, and maintaining financial transaction records;
3. KYC and AML compliance: Verifying player identity and age (21+), screening transactions for money laundering indicators, and meeting the reporting obligations of ay999's international gaming license;
4. Platform security: Detecting and preventing unauthorised account access, identifying fraudulent activity, monitoring for prohibited conduct as defined in the ay999 Terms & Conditions, and maintaining the integrity of the gaming environment;
5. Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling, administering player-requested deposit limits, loss limits, session timers, cooling-off periods, and self-exclusion, and fulfilling ay999's obligations to prevent underage gambling;
6. Customer support: Responding to support enquiries via live chat and email, investigating complaints, and maintaining records of support interactions;
7. Platform improvement: Analysing anonymised or aggregated technical and gameplay data to identify performance issues, improve game lobby navigation, and enhance the overall platform experience for Pakistani players;
8. Marketing and promotions (consent-based only): Sending promotional emails about new games, PSL season offers, welcome bonuses, and reload promotions to players who have explicitly opted in to marketing communications. Marketing preferences can be updated at any time.

ay999 does not sell, rent, or share personal data with third parties for their own marketing purposes. Personal data is shared with third parties only in the following circumstances and only to the extent necessary:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, and USDT payment processors receive transaction-level data necessary to process deposits and withdrawals. These providers are subject to their own data protection obligations and regulatory requirements;
• Live casino content providers: ay999's live dealer studio partners, including Evolution Gaming and other certified providers, receive the minimum data necessary to facilitate gameplay — typically a session token and game-level transaction data. No CNIC or payment method data is shared with studio providers;
• KYC and identity verification services: Third-party KYC verification platforms receive CNIC document data solely for the purpose of authenticating document validity. These services are bound by strict confidentiality and data security agreements with ay999;
• Regulatory and law enforcement authorities: ay999 is obliged to share personal data with its licensing authority, financial intelligence units, and law enforcement agencies where required by law, court order, or the terms of its gaming license. ay999 cannot provide advance notice to players before disclosures of this nature where doing so would compromise an investigation;
• IT and infrastructure service providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data on ay999's behalf under data processing agreements that prohibit use of the data for any purpose other than providing the contracted service.

ay999 operates under an international gaming license and uses infrastructure and service providers located in multiple jurisdictions. As a result, personal data may be transferred to and processed in countries outside Pakistan. ay999 ensures that any such international transfer is subject to appropriate safeguards, including:

• Data processing agreements that require recipient parties to maintain data protection standards equivalent to those applied by ay999;
• Technical and organisational security measures appropriate to the sensitivity of the data being transferred;
• Limitation of transferred data to the minimum necessary for the specific purpose of the transfer.

Players may request information about the specific safeguards applicable to international transfers of their personal data by contacting ay999 support. ay999 will respond to such requests within 30 calendar days.

ay999 applies the following technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration:

• 256-bit SSL/TLS encryption across all pages and data transmission channels on ay999.org;
• AES encryption at rest for sensitive data including CNIC images, financial identifiers, and account credentials;
• Access controls: Personal data is accessible internally only to ay999 staff who require it to perform their specific role. Access is governed by the principle of least privilege and is subject to audit logging;
• Two-factor authentication available to all players for account access, strongly recommended for all registered accounts;
• Regular security assessments including penetration testing of the ay999 platform infrastructure;
• Incident response procedures: ay999 maintains documented procedures for identifying, containing, and responding to personal data security incidents, including notification obligations under its licensing framework.

ay999 retains personal data for no longer than is necessary for the stated purpose or required by applicable legal obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data cannot be immediately deleted due to technical constraints, it is isolated from active processing systems and scheduled for deletion at the next available deletion cycle.

Subject to applicable law and the limitations described below, you have the following rights in relation to your personal data held by ay999:

ay999 uses cookies and similar tracking technologies on ay999.org for the following purposes:

• Strictly necessary cookies: Session management cookies that maintain your logged-in state while navigating the platform. These are essential for the platform to function and cannot be disabled without disrupting core functionality;
• Security cookies: Cookies used to detect and prevent fraudulent account access, bot activity, and session hijacking. These operate automatically as part of ay999's security infrastructure;
• Performance cookies: Anonymous analytics cookies that help ay999 understand how players navigate the platform, which games are most popular, and where technical issues occur. These use aggregated, non-identifiable data only;
• Preference cookies: Cookies that remember your language setting, display preferences, and responsible gaming tool configurations so you do not need to re-enter them each session;
• Marketing cookies (consent-based): Cookies that track whether a player arrived at ay999 via a promotional link, used only with explicit player consent and only for the purpose of attributing promotional offers correctly.

You can manage your cookie preferences through your browser settings. Disabling cookies beyond strictly necessary categories may affect the functionality and performance of the ay999 platform. Strictly necessary and security cookies cannot be disabled as they are essential to a secure platform experience.

Parents and guardians who believe a minor has registered with ay999 are encouraged to contact ay999 support immediately via live chat or at [email protected]. ay999 will investigate and act upon such reports with priority. ay999 also recommends that households with minors install parental control software to prevent access to online gambling platforms. For responsible gaming and parental control resources, visit /responsible-gaming.

ay999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in law, regulatory requirements, platform features, or data processing practices. Where changes are material — meaning they significantly affect how ay999 processes your personal data or your rights in relation to it — ay999 will provide not less than 14 days' advance notice by email to your registered address and via a prominent notice on ay999.org before the revised Policy takes effect.

Minor, non-material changes such as typographical corrections or clarifications that do not alter the substance of the Policy may be published without advance notice. The effective date displayed at the top of this document will be updated whenever the Policy is revised. ay999 recommends that players review this Policy periodically to stay informed of any updates.

Continued use of the ay999 platform after the effective date of any revised Privacy Policy constitutes acceptance of the revised terms. Where you do not accept the revised Policy, you must cease using the platform and contact ay999 support to arrange account closure and withdrawal of your balance.

For any questions, concerns, or requests relating to this Privacy Policy or to ay999's data processing practices, please contact the ay999 data protection team through the following channels:

• Live Chat: 24/7 live chat is available directly on the ay999 platform — this is the fastest route for data rights requests and urgent privacy concerns;
• Email: [email protected] — for written data rights requests, please state "Privacy Request" in the subject line and include your registered email address and mobile number for identity verification purposes. Do not include your full CNIC number in the email body.

ay999 will acknowledge all privacy-related correspondence within 48 hours and will provide a substantive response within 30 calendar days. Where a request is complex or ay999 receives a high volume of requests, the response period may be extended by a further 30 days, in which case ay999 will notify you of the extension within the initial 30-day period.