yr999 Privacy Policy
Your Data, Your Rights

yr999 is Pakistan's premier online gaming destination, accessible at yr999.org. This Privacy Policy applies to all personal data collected and processed by yr999 in connection with the operation of the yr999 platform, including sports betting, live casino, slots, and all associated account management, payment processing, and customer support functions.

This policy applies to all yr999 account holders and visitors to the yr999 website, regardless of their location within Pakistan. It covers data collected through the yr999 website, mobile-optimised interface, and any associated applications through which yr999 services are delivered.

yr999 is the data controller for all personal data collected through the yr999 platform. yr999 processes personal data in accordance with applicable data protection law and the data governance requirements of its international gaming licence.

yr999 collects personal data through several channels: directly from players during registration and account management; automatically through platform usage; and from third-party verification providers in connection with KYC and payment processing. The categories of personal data yr999 collects include:

• Identity Data: Full legal name, date of birth, CNIC number, and CNIC document images (front and back) submitted during the KYC process. This data is mandatory for all players wishing to make withdrawals from their yr999 account.
• Contact Data: Pakistani mobile phone number, email address, and residential address. These are collected at registration and are required for account communication, OTP-based two-factor authentication, and regulatory correspondence.
• Financial Data: Payment method references including JazzCash and EasyPaisa mobile wallet identifiers, HBL, UBL, and Meezan Bank account details used for deposits and withdrawals, masked Visa card numbers, and full transaction history including deposit and withdrawal amounts, timestamps, and payment method used.
• Technical Data: IP address at login, device type and model, operating system and browser version, and session timestamps. This data is collected automatically and is used for platform security and fraud detection.
• Usage Data: Records of games played, wager amounts, session durations, pages visited within the yr999 platform, and feature interactions. This data feeds into responsible gaming monitoring and platform improvement functions.
• Marketing Preference Data: Your opted-in or opted-out status for SMS and email marketing communications, and any gaming category preferences you have indicated.
• Responsible Gaming Data: Records of any deposit limits, session time limits, cool-off periods, or self-exclusion requests you have set or applied to your account.

yr999 does not collect sensitive personal data categories — such as data concerning health, religion, ethnicity, or political opinions — unless directly relevant to a responsible gaming or safeguarding obligation and with your explicit consent.

yr999 uses personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your yr999 account, including OTP authentication, password resets, and security alerts.
• Payment Processing: Processing PKR deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and Visa. Financial data is shared with payment processing partners only to the extent required to complete transactions.
• Identity Verification (KYC): Verifying that all yr999 players are aged 21 or over and are who they claim to be, in accordance with our international gaming licence obligations.
• Fraud and AML Detection: Monitoring account and transaction activity to identify unusual patterns that may indicate fraud, money laundering, or match-fixing. This includes automated screening and, where flagged, manual review.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling behaviour, enforcing player-set limits, and maintaining self-exclusion records in accordance with our licensing obligations.
• Customer Support: Processing and responding to support queries, complaints, and dispute submissions. Support records are retained to maintain service quality and for dispute resolution purposes.
• Platform Improvement: Analysing anonymised and aggregated usage data to improve the yr999 platform experience, game selection, and interface performance.
• Marketing Communications: Sending promotional communications — including PSL betting offers, new game announcements, and bonus alerts — where you have explicitly opted in. yr999 does not send unsolicited marketing communications.
• Legal Compliance: Meeting reporting, record-keeping, and cooperation obligations under applicable law and yr999's international gaming licence conditions.

yr999 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to deliver the yr999 service under the account agreement, including account creation, payment processing, bet placement, and withdrawal processing.
• Legal Obligation: Processing required to comply with applicable law and licensing conditions, including KYC identity verification, AML transaction monitoring, and responsible gaming record-keeping.
• Legitimate Interest: Processing for fraud prevention, platform security, technical data collection, and anonymised analytics where these purposes do not override your data rights.
• Consent: Processing for direct marketing communications, where you have explicitly opted in. Consent may be withdrawn at any time from your account settings or by contacting support.
• Vital Interest: Processing in connection with responsible gaming safeguarding obligations where a player's wellbeing may be at risk.

yr999 does not sell, rent, or trade personal data to third parties for commercial purposes. yr999 shares personal data only in the following limited circumstances:

• Payment Processors: Financial data is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and Visa solely for the purpose of processing transactions. These providers are contractually bound to process data only as instructed by yr999 and for no other purpose.
• KYC Verification Partners: Identity data including CNIC information may be shared with regulated third-party identity verification providers for the purpose of age and identity verification in compliance with licensing requirements.
• Game Content Providers: Usage data related to specific game sessions may be shared with the third-party game providers whose certified games are hosted on yr999, for the purpose of dispute resolution and game performance monitoring.
• Regulatory Authorities: yr999 may be required to disclose personal data to licensing regulators, financial intelligence units, or law enforcement authorities in response to lawful requests or as required by yr999's licence conditions. Such disclosures are made only to the extent legally required.
• Responsible Gaming Bodies: Self-exclusion data may be shared with multi-operator self-exclusion schemes where yr999 participates in such schemes under its licensing obligations.

All third parties with whom yr999 shares personal data are subject to data processing agreements that require them to maintain appropriate technical and organisational security measures and to process data only for the specified purpose.

yr999 uses cookies and similar tracking technologies on the yr999 platform to support platform functionality, security, and performance. The categories of cookies used by yr999 are:

• Strictly Necessary Cookies: Required for the yr999 platform to function. These include session management cookies, authentication tokens, and security cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings and display options. These improve your experience but are not required for core platform operation.
• Analytics Cookies: Used to collect anonymised and aggregated data about how players interact with the yr999 platform, including pages visited and session duration. This data is used solely to improve the platform and is never used to identify individual players for marketing purposes.
• Security Cookies: Used as part of yr999's fraud detection and account security systems, including device fingerprinting to identify unusual login patterns.

yr999 does not use third-party advertising cookies or tracking pixels that would enable external advertisers to track your behaviour across other websites. You may manage your cookie preferences through your browser settings, but note that disabling strictly necessary cookies will impair your ability to use the yr999 platform.

yr999 retains personal data only for as long as is necessary for the purpose for which it was collected, subject to applicable legal and regulatory minimum retention periods. The following retention periods apply:

• Account and Identity Data: Retained for the duration of the account relationship and for a minimum of five years following account closure, in accordance with AML and licensing record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five years from the date of the transaction, in accordance with applicable financial regulations and licensing requirements.
• KYC Documents: CNIC images and verification records are retained for a minimum of five years following account closure or the completion of the relevant transaction, whichever is later.
• Customer Support Records: Retained for three years from the date of the interaction, unless the matter relates to an ongoing dispute in which case records are retained until final resolution plus one year.
• Responsible Gaming Records: Self-exclusion and limit records are retained for the duration of the exclusion or limit and for five years thereafter, in accordance with licensing obligations.
• Marketing Preference Records: Consent and opt-out records are retained indefinitely to evidence compliance, even where the underlying marketing communications have ceased.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of individual identifiable records.

yr999 implements technical and organisational security measures appropriate to the sensitivity of the personal data it holds and the risks associated with online gaming platform operations. These measures include:

• 256-bit TLS encryption for all data transmitted between player devices and yr999 servers;
• AES-256 encryption for sensitive data stored in yr999 databases, including CNIC documents and payment references;
• Multi-factor authentication for all yr999 internal system access;
• Regular third-party penetration testing and vulnerability assessments;
• Role-based access controls limiting internal access to personal data to staff with a legitimate operational need;
• Automated intrusion detection and anomaly monitoring on yr999 infrastructure.

While yr999 takes all reasonable steps to protect your data, no internet transmission is entirely risk-free. Players are responsible for maintaining the security of their own device, network connection, and yr999 account credentials.

yr999 operates a mandatory Know Your Customer (KYC) process as a condition of withdrawal processing and as required by our international gaming licence. The KYC process requires all players to submit a valid CNIC (Computerised National Identity Card) — both front and back — before withdrawal requests are approved.

KYC data submitted to yr999 is used exclusively for the following purposes:

• Confirming that the account holder is at least 21 years of age;
• Confirming that the account holder's identity matches the registration information provided;
• Satisfying yr999's AML and source-of-funds verification obligations under our licensing conditions;
• Preventing the use of the yr999 platform by individuals who are subject to sanctions or financial crime restrictions.

CNIC documents are stored in encrypted format and are accessible only to yr999's compliance team on a need-to-know basis. yr999 does not use CNIC data for any marketing, profiling, or non-compliance purpose. yr999 may engage a regulated third-party identity verification provider to assist with document authentication — any such provider is bound by a data processing agreement with yr999.

Players may be asked to provide additional source-of-funds documentation in connection with large or unusual deposit or withdrawal activity. This is a standard AML compliance measure and is not an indicator of any suspicion against the individual player.

yr999 strictly requires all players to be at least 21 years of age. The yr999 platform is not directed at, and does not knowingly collect personal data from, any individual under the age of 21.

Parents and guardians who are concerned about underage access to online gaming platforms are advised to use appropriate parental control and internet filtering software. If you believe a minor has accessed the yr999 platform, please contact our support team immediately at [email protected] so that the account can be reviewed and closed without delay.

As a yr999 player, you have the following rights in relation to your personal data. To exercise any of these rights, contact yr999 support in writing at [email protected]. yr999 will respond to all verified data rights requests within 30 calendar days.

• Right of Access: You may request a copy of all personal data yr999 holds about you. yr999 will provide this in a structured, readable format at no charge.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data yr999 holds about you. Where data is shared with third-party processors, yr999 will communicate the correction to those processors.
• Right to Erasure: You may request deletion of your personal data where yr999 no longer has a legal or contractual basis to retain it. Note that AML, KYC, and licensing obligations require yr999 to retain certain data for defined minimum periods even following account closure — erasure requests will be actioned to the fullest extent permitted by those obligations.
• Right to Restrict Processing: You may request that yr999 suspends processing of your data while a correction request or objection is being assessed.
• Right to Data Portability: You may request a machine-readable export of personal data you have directly provided to yr999, where technically feasible.
• Right to Object: You may object to yr999 processing your data on the basis of legitimate interest. You may also object to direct marketing processing at any time — such objections take immediate effect and yr999 will cease marketing communications promptly.
• Right to Withdraw Consent: Where processing is based on your consent (including marketing communications), you may withdraw that consent at any time from your yr999 account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

yr999 may request identity verification before acting on a data rights request to ensure that personal data is not disclosed to or deleted at the request of an unauthorised third party. yr999 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive.

yr999 will only send promotional and marketing communications — including bonus offers, PSL season promotions, new game announcements, and slot tournament alerts — to players who have explicitly opted in to receive such communications at the time of registration or subsequently through their account settings.

yr999 uses the following channels for marketing communications where consent has been given:

• Email to the registered email address;
• SMS to the registered Pakistani mobile number.

yr999 does not engage in cold-call telephone marketing or push notification marketing to unregistered individuals. All yr999 marketing communications include a clear and functional opt-out mechanism. You may also withdraw marketing consent at any time by updating your communication preferences in your yr999 account settings or by contacting support.

yr999 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, licensing requirements, or platform operations. Material changes to this policy will be communicated to all registered players via email to the address on file and by a prominent notice on the yr999 platform prior to the change taking effect.

The effective date at the top of this policy reflects the date of the most recent revision. Continued use of the yr999 platform following notification of a material policy change constitutes acceptance of the updated policy. If you do not accept a material change to this policy, you should close your yr999 account before the change takes effect.

Non-material updates — such as corrections to typographical errors, clarification of existing provisions without substantive change, or updates to contact details — may be made without individual player notification and will be reflected by an updated effective date on this page.

For any questions, concerns, or requests relating to this Privacy Policy or yr999's handling of your personal data, please contact the yr999 support team:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the yr999 platform
• Response Time: Within 30 calendar days for data rights requests; within 48 hours for general privacy queries

yr999 takes all privacy complaints seriously. If you submit a privacy complaint and are not satisfied with yr999's response, you have the right to escalate your complaint to the relevant data protection supervisory authority or to yr999's licensing regulator. yr999 will cooperate fully with any such regulatory investigation.