xy999 Privacy Policy

01 Introduction

This Privacy Policy (hereinafter "Policy") is published by xy999 (the "Operator", "we", "us" or "our") and applies to all personal data collected from individuals (each a "User", "you" or "your") who access or use the xy999 platform at https://xy999.cam, including any associated mobile-optimised interface, features and services.

xy999 is an English-language online sports betting and casino information platform designed for adult users in Pakistan. We are committed to handling your personal data responsibly, transparently and in accordance with applicable data protection legislation. This Policy describes what data we collect, why we collect it, how it is used and stored, to whom it may be disclosed and what rights you hold as a data subject.

By registering an account, accessing the platform or submitting any personal information, you acknowledge that you have read and understood this Policy. Where we rely on your consent as a legal basis for processing, your continued use of the platform following notification of any material change to this Policy constitutes renewed consent to the updated terms.

02 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

03 Data Controller

xy999, operating the platform at https://xy999.cam, is the Data Controller responsible for personal data collected through the platform. As Data Controller, xy999 determines the purposes for which and the means by which personal data is processed.

For all data-related enquiries, requests to exercise your rights, or complaints regarding the processing of your personal data, please contact:

04 Data We Collect

xy999 collects personal data through multiple channels in the course of operating the platform. The categories of data collected are set out below:

4.1 Registration Data

When you create an account on xy999, we collect:

• Full legal name
• Date of birth (to verify you meet the minimum age requirement of 18+)
• Residential address, including city (e.g. Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar)
• Email address
• Mobile telephone number
• Username and encrypted password
• Preferred currency (e.g. PKR)

4.2 Identity Verification (KYC) Data

To comply with KYC/AML obligations, we collect and process the following when required:

• Copies of government-issued photo identification, including Pakistani CNIC (front and back)
• Proof of residential address (e.g. utility bill or bank statement dated within three months)
• Selfie photograph for facial verification purposes
• Proof of payment method ownership, where required by compliance review

4.3 Financial Transaction Data

In connection with deposits and withdrawals, we process:

• Deposit and withdrawal amounts in PKR and other accepted currencies
• Payment method type (e.g. bank transfer, mobile wallet reference — subject to cashier availability)
• Transaction timestamps and reference identifiers
• Partial payment method identifiers (e.g. masked account or wallet numbers)

4.4 Technical & Usage Data

When you access the platform, we automatically collect:

• IP address and approximate geographic location (city/country level)
• Device type, operating system and browser type and version
• Session duration, pages visited and features interacted with
• Login timestamps and access logs
• Referral source (where applicable)

4.5 Communication Data

We retain records of:

• Live chat transcripts and email correspondence with our support team
• Complaints, dispute submissions and associated correspondence
• Responses to optional surveys or feedback requests
• Opt-in marketing preference records

05 Legal Basis for Processing

xy999 processes your personal data only where a lawful basis exists for doing so. The applicable legal bases are as follows:

06 How We Use Your Data

xy999 uses the personal data it collects for the following purposes:

• Account creation and management: Registering your account, maintaining your profile and enabling access to the platform's features and services.
• Identity and age verification: Confirming that you meet the minimum age requirement (18+ or as required by the operator's license jurisdiction) and verifying your identity in accordance with KYC obligations.
• Payment processing: Facilitating deposits and withdrawals, processing transactions and maintaining accurate financial records in connection with your account.
• Fraud prevention and security: Detecting and investigating suspicious activity, preventing unauthorised account access, identifying multi-accounting and applying AML monitoring.
• Responsible gambling: Operating deposit limits, loss limits, session controls and self-exclusion tools in accordance with your account settings and applicable regulations.
• Customer support: Responding to enquiries, resolving disputes and providing account assistance via live chat and email.
• Platform improvement: Analysing usage patterns to improve the performance, design and content of the xy999 platform.
• Marketing communications: Sending promotional offers, bonus notifications and platform updates by email or in-platform notification, where you have opted in to receive such communications. You may opt out at any time.
• Legal compliance: Meeting our obligations under applicable licensing, tax, anti-money laundering and data protection regulations.

07 Sharing of Personal Data

xy999 does not sell, rent or trade your personal data to third parties for their own marketing purposes. Personal data is shared only in the following circumstances and only to the extent necessary:

• Service providers and data processors: Trusted third-party companies engaged to provide services on our behalf, including payment processing, identity verification, fraud detection, data hosting, platform analytics and customer support tooling. All such processors are bound by contractual data protection obligations consistent with this Policy.
• Licensing and regulatory authorities: Personal data may be disclosed to the Operator's licensing authority or other competent regulators where required by law or license condition.
• Law enforcement and legal proceedings: Where required by a valid court order, warrant or other lawful demand from a competent authority, we may disclose personal data. We will, where legally permissible, notify you of such a request before complying.
• Fraud prevention and AML networks: In connection with our AML and fraud prevention obligations, information may be shared with industry-standard fraud prevention databases or screening services.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of all or part of the business, personal data held by xy999 may be transferred to the relevant successor entity as part of that transaction, subject to the same data protection obligations as set out in this Policy.

08 International Data Transfers

As an online platform serving users across multiple regions, xy999 and its service providers may process personal data in countries outside your country of residence. Where personal data is transferred internationally, xy999 takes steps to ensure that appropriate safeguards are in place, including the use of contractual data protection clauses with receiving parties.

Users in Pakistan should be aware that data protection frameworks vary between jurisdictions and that Pakistani data protection law may differ from the law of the jurisdiction in which data is stored or processed. By using the platform, you acknowledge this and consent to such transfers as described in this Policy.

09 Data Retention

xy999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, licensing and regulatory retention obligations.

• Account and transaction data: Retained for the duration of the account relationship and for a minimum period following account closure, as required by the Operator's AML/KYC and licensing obligations.
• KYC identity documents: Retained for the period prescribed by the Operator's licensing and AML obligations, which is typically a minimum of five years from the date of account closure.
• Support communications: Retained for a reasonable period necessary to resolve disputes and maintain a record of customer service interactions.
• Marketing data: Retained until you withdraw your consent or opt out of marketing communications, after which marketing preferences will be updated promptly.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents re-identification.

10 Cookies & Similar Technologies

xy999 uses cookies and similar tracking technologies on the platform to provide core functionality, improve user experience and conduct analytics. Cookies are small data files placed on your device when you visit the platform.

The categories of cookies in use include:

• Strictly Necessary Cookies: Required for the platform to function correctly, including session authentication, security tokens and user preference storage. These cannot be disabled without significantly affecting platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Users interact with the platform — including pages visited, session duration and error reports — to help us improve performance and content.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible-gambling tool configurations, between sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access and unauthorised login attempts.

You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect platform functionality. Most modern browsers (Chrome, Firefox, Edge, Safari) include cookie management tools in their settings or privacy menus.

11 Security Measures

xy999 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• HTTPS/SSL encryption on all pages and API communications
• Password storage using industry-standard cryptographic hashing algorithms
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Regular security reviews and vulnerability assessments of the platform
• Incident response procedures for investigating and responding to data security events
• Third-party processor contractual security obligations

Despite these measures, no internet-based system can guarantee absolute security. Users are encouraged to use a strong, unique password for their xy999 account and to enable any available two-factor authentication options. If you become aware of any suspected unauthorised access to your account, contact support at [email protected] immediately.

12 Minors

The xy999 platform is strictly for adults. Users must be at least 18 years of age — or the higher minimum age required by the operator's license jurisdiction — to register an account and use the platform.

xy999 does not knowingly collect or process personal data from individuals below the applicable minimum age. During registration, Users are required to confirm their date of birth, and age verification may be conducted as part of the KYC process.

If the Operator becomes aware that personal data has been collected from a minor without appropriate parental or guardian consent, that data will be deleted immediately and the associated account closed without prior notice.

If you have reason to believe that a minor has registered an account on the xy999 platform, please notify us immediately at [email protected].

13 Your Data Rights

Subject to applicable data protection legislation and the specific circumstances of your data processing, you may hold some or all of the following rights in respect of the personal data we hold about you:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request", including your registered username and account email address. We will acknowledge requests within 72 hours and aim to respond substantively within 30 calendar days, subject to identity verification requirements.

14 Marketing Communications

With your explicit consent, xy999 may send you promotional communications by email or in-platform notification. These may include information about new bonuses, seasonal promotions, sports betting offers related to Pakistan cricket, PSL, ICC tournaments and other relevant events, and platform updates.

You may opt out of marketing communications at any time by:

• Using the unsubscribe link included in every marketing email
• Updating your communication preferences in your account settings
• Contacting the support team at [email protected] with a request to be removed from marketing lists

Opting out of marketing communications will not affect transactional communications, including account notifications, security alerts, KYC requests and support correspondence, which are sent regardless of marketing preferences.

15 Third-Party Links & Services

The xy999 platform may reference or link to third-party services in connection with payment method guidance, responsible gambling resources or game technology providers. xy999 is not responsible for the privacy practices or content of any third-party website or service.

Users who access third-party services through or in connection with the xy999 platform do so at their own risk and should review the relevant third-party privacy policies independently. xy999 has no control over, and accepts no responsibility for, the data collection or handling practices of third-party sites or services.

16 Changes to This Privacy Policy

xy999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements or business practices. Where material changes are made, we will endeavour to provide reasonable advance notice to registered Users by email or in-platform notification.

The effective date of the current version of this Policy is displayed at the top of this page. Continued use of the platform following notification of a material change constitutes acceptance of the revised Policy. If you do not agree to the updated Policy, you must close your account and cease use of the platform.

17 Contact & Complaints

For all privacy-related enquiries, data rights requests or complaints regarding the handling of your personal data by xy999, please contact our data protection team using the details below. We are committed to resolving all data-related concerns promptly and transparently.

If you are not satisfied with our response to a data-related complaint, you have the right to escalate the matter to the relevant data protection supervisory authority or regulator in your jurisdiction. The Operator's licensing documentation provides details of the applicable supervisory authority in the operator's license jurisdiction.