d999 Privacy Policy

1.1 This Policy applies to all personal data collected by d999 in connection with the provision of its online gaming services, including but not limited to: casino games, sports betting, live dealer tables, slot games, fishing arcade games, and associated account management and payment processing services.

1.2 This Policy applies to all individuals who access d999's platform — whether registered account holders or visitors browsing the public-facing website. Different provisions apply depending on the nature of your interaction with d999, as detailed in the relevant sections below.

1.3 This Policy is to be read in conjunction with d999's Terms & Conditions and Responsible Gaming Policy. In the event of a conflict between this Policy and any other d999 document on the specific topic of personal data protection, this Privacy Policy shall prevail.

1.4 d999 is committed to handling personal data responsibly and in accordance with applicable data protection principles, including the requirements of its international gaming license. We review and update this Policy periodically to reflect changes in our data practices or applicable regulations.

2.1 The data controller responsible for your personal information as collected through d999 is the licensed operating entity behind the d999 platform, operating the website d999.vu under a valid international gaming license.

2.2 For all data protection queries, access requests, or complaints relating to the processing of your personal information by d999, please contact the d999 Data Protection team through the contact details provided in Section 15 of this Policy.

2.3 d999's data protection practices are governed by the terms of its international operating license, which mandates compliance with internationally recognised data protection principles including purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

3.1 d999 collects the following categories of personal data from its users. The specific data points collected depend on the nature of your interaction with the Platform:

• Full legal name as it appears on your CNIC (Computerised National Identity Card).
• Date of birth (for age verification — all players must be 21 or above).
• Pakistani mobile number (used as primary account identifier and for SMS authentication).
• Email address (optional but recommended for account recovery).
• Username chosen at registration.
• Account password (stored in hashed, non-reversible form — never in plain text).

• Copy of valid CNIC (front and back), required for identity and age verification.
• Live selfie photograph for biometric match against CNIC.
• Proof of address documentation (requested on a risk-based basis for certain accounts).
• Source of funds documentation (requested where required by d999's AML compliance obligations).

• JazzCash mobile wallet number or EasyPaisa account number.
• HBL, UBL, or Meezan Bank account details (IBAN) where bank transfer methods are used.
• USDT TRC20 wallet address where cryptocurrency payments are used.
• Transaction history — deposits, withdrawals, wager amounts, game outcomes, and bonus activity.

• IP address and geolocation data at time of login and transaction.
• Device type, operating system, and browser information.
• Session duration, pages visited, games accessed, and betting patterns.
• Cookie identifiers and similar tracking technologies (see Section 8).

4.1 Directly from you: The majority of personal data d999 holds about you is provided directly by you during the registration process, KYC verification, deposit and withdrawal requests, support interactions, or when you otherwise communicate with d999.

4.2 Automatically: Certain technical and usage data is collected automatically when you access and use the d999 platform — including your IP address, device information, and session activity — through server logs and cookie technologies as described in Section 8.

4.3 From third parties: In limited circumstances, d999 may receive data about you from third-party identity verification services, fraud prevention agencies, or payment processors — for example, confirmation of JazzCash account ownership — where necessary to fulfil its compliance and payment obligations.

5.1 d999 processes your personal data on the following legal bases, depending on the specific processing activity:

6.1 d999 uses the personal data it collects for the following purposes:

• To create, verify, and manage your d999 account and ensure secure login via your registered Pakistani mobile number.
• To verify your identity and confirm that you are aged 21 or above, as required by d999's licensing terms.
• To process deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or USDT, and to process withdrawal requests to your verified payment method.
• To maintain your account balance, transaction history, wagering records, and bonus activity ledger.
• To detect, investigate, and prevent fraudulent activity, account abuse, and multiple account registrations.
• To fulfil d999's anti-money laundering (AML) and counter-terrorist financing (CTF) obligations as required by its operating license.
• To operate and improve d999's responsible gaming tools — including deposit limits, session timers, cooling-off periods, and self-exclusion — and to intervene proactively where d999's systems identify potentially harmful gambling patterns.
• To send service-related communications including account notifications, transaction confirmations, and security alerts.
• To send promotional communications (including bonus offers and new game announcements) to players who have opted in — never to players who have not given explicit consent.
• To analyse aggregate platform usage data for the purpose of improving the d999 user experience, platform performance, and game selection.

6.2 d999 does not use your personal data for automated decision-making that produces legal or similarly significant effects, except where required by fraud detection or AML monitoring systems, in which case you have the right to request human review of any automated decision affecting your account.

7.1 d999 does not sell, rent, or commercially share your personal data with third parties for their own marketing or commercial purposes. Personal data is shared with third parties only in the following controlled circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT payment infrastructure providers receive only the transaction data necessary to process your deposits and withdrawals.
• Identity Verification Services: Third-party KYC service providers receive your CNIC data and biometric selfie for the sole purpose of verifying your identity and age on d999's behalf.
• Game Providers: d999's licensed game studios (PG Soft, Pragmatic Play, Evolution Gaming, and others) receive anonymised session and wager data necessary to deliver game functionality. These providers do not receive your identity or payment information.
• Fraud Prevention: Fraud detection service providers may receive limited account and technical data to assist in the identification of fraudulent activity patterns.
• Regulatory and Legal Authorities: d999 is obligated to disclose certain player data to its licensing authority and, where legally required, to law enforcement and anti-money laundering regulatory bodies. Such disclosures are made strictly in accordance with d999's legal obligations.
• Professional Advisers: d999's legal, audit, and compliance advisers may access personal data on a need-to-know, confidentiality-bound basis.

7.2 All third-party service providers engaged by d999 are subject to contractual data processing agreements that require them to maintain the confidentiality and security of your personal data and to process it only for the purposes specified by d999.

8.1 d999 uses cookies and similar tracking technologies on its platform for the following purposes:

• Essential Cookies: Required for core platform functionality including maintaining your login session, remembering your language preference, and ensuring the security of your connection. These cannot be disabled without impairing platform use.
• Functional Cookies: Remember your preferences such as game lobby filters, bet size defaults, and display settings to improve your d999 experience across sessions.
• Analytics Cookies: Collect aggregate, anonymised data about how players interact with the d999 platform — which games are most accessed, where users encounter friction in the deposit flow, and similar performance metrics — to guide platform improvements.
• Security Cookies: Assist in the detection of anomalous login patterns and the prevention of cross-site request forgery and session hijacking attacks.

8.2 d999 does not use cross-site tracking cookies, third-party advertising cookies, or social media tracking pixels that would allow your activity on d999 to be shared with social media platforms or advertising networks.

8.3 You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will impair the functionality of the d999 platform, including your ability to maintain a login session.

9.1 d999 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and d999's servers.
• AES-256 encryption for sensitive data at rest, including KYC documents, payment details, and CNIC copies.
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access your personal data, and that all such access is logged.
• Password hashing using industry-standard one-way cryptographic algorithms — d999 never stores your password in readable form.
• Two-factor SMS authentication available for all accounts, adding a second verification layer to your d999 login.
• Anomaly detection systems that flag suspicious login attempts, unusual geographic access patterns, and high-velocity transaction anomalies.
• Regular internal security reviews and third-party penetration testing of d999's platform infrastructure.

9.2 Notwithstanding the security measures above, no electronic system is entirely immune to breach. In the event of a data security incident that may affect your personal data, d999 will notify affected users in accordance with its obligations under applicable law and its licensing terms, without undue delay.

10.1 d999 retains personal data for only as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention periods are as follows:

10.2 Where data is retained solely for regulatory compliance purposes following account closure, it will be stored in an access-restricted archive environment and will not be used for any commercial purpose.

11.1 As a d999 account holder, you have the following rights in relation to the personal data d999 holds about you. These rights are meaningful — d999 is committed to responding to all data rights requests within thirty (30) days of receipt.

12.1 d999 is strictly an adult gaming platform for players aged twenty-one (21) years and above. d999 does not knowingly collect personal data from any individual under the age of 21.

12.2 During registration, users are required to confirm that they are aged 21 or above. CNIC verification is mandatory for all accounts before withdrawal is permitted — this serves as the primary age verification mechanism for Pakistani d999 players.

12.3 If d999 discovers or has reason to believe that personal data has been collected from an individual under 21 years of age, that account will be immediately suspended, the data will be permanently deleted (subject to any mandatory legal retention obligations), and any account balance will be forfeited in accordance with d999's Terms & Conditions.

13.1 d999 is an internationally licensed operator. Some of the third-party service providers d999 engages — including game providers, cloud infrastructure services, and fraud prevention platforms — may process personal data in jurisdictions outside Pakistan.

13.2 Where personal data is transferred to an international jurisdiction, d999 ensures that appropriate safeguards are in place to protect the data to a standard at least equivalent to that provided by d999's own privacy practices. Safeguards include contractual data processing agreements incorporating standard data protection clauses and, where applicable, certification under internationally recognised data protection frameworks.

13.3 d999 does not transfer your raw CNIC documents or selfie photographs outside of the secure environments of d999's licensed identity verification service providers, which are contractually bound to equivalent security standards.

14.1 d999 reserves the right to update or amend this Privacy Policy at any time. The revised Policy will be published on this page with an updated effective date. For material changes that significantly affect your rights or the way d999 processes your data, d999 will provide notice to registered account holders via their registered mobile number or email address, or via a prominent notice on the Platform, no fewer than fourteen (14) days before the revised Policy takes effect.

14.2 Your continued use of d999 after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with the updated Policy, you may close your d999 account by contacting support.

14.3 d999 maintains archived copies of prior versions of this Policy. If you require a copy of a previous version, please contact the d999 Data Protection team.

15.1 For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data by d999, please contact the d999 Data Protection team through the following channels:

• Live Chat: Available 24/7 directly through the d999 platform — fastest response for urgent data or account security concerns.
• Email: [email protected] — for formal data rights requests, Subject Access Requests, erasure requests, and privacy complaints. Please include "Privacy Request" in the subject line.

15.2 d999 commits to responding to all privacy-related enquiries within thirty (30) days of receipt. For Subject Access Requests, the response period may be extended by a further two months in complex or high-volume cases, with notice provided to the requesting party before the initial thirty-day period expires.

15.3 If you are not satisfied with d999's response to a privacy complaint, you may escalate the matter to the relevant data protection authority in the jurisdiction of d999's operating license. d999 will co-operate fully with any regulatory investigation arising from a player privacy complaint.