Privacy Policy

This Privacy Policy ("Policy") describes how 999bat ("we", "us", "our", "the Platform") collects, uses, stores, shares and protects personal data relating to users ("you", "your") of the 999bat website, mobile applications and associated services (collectively, the "Services").

By registering an account on 999bat, accessing the platform or using any of its features, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy forms part of the overall legal framework governing your relationship with 999bat and should be read alongside our Terms & Conditions and Responsible Gambling Policy.

If you do not agree with the practices described in this Policy, you must discontinue use of the Services and may request closure of your account by contacting our support team.

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, CNIC number, IP address, device identifiers and financial data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, 999bat.
• "Processor" means a third party that processes Personal Data on behalf of the Controller, such as a payment gateway or KYC verification provider.
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data.
• "Cookie" means a small data file placed on your device by the platform to enable session management, analytics and personalisation.
• "KYC" (Know Your Customer) means the identity and document verification process, which may include collection of government-issued identity documents such as a CNIC, passport or driving licence.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, such as financial details, identity documents and responsible gambling self-assessment data.

999bat collects Personal Data through several channels: directly from you when you register or interact with the platform, automatically through your use of the Services, and from third-party sources where permitted. The categories of data we collect are set out below.

• Registration Data: Full legal name, date of birth, residential address, email address, mobile phone number and chosen username and password.
• KYC and Verification Data: Copies of government-issued identity documents (e.g., CNIC, passport), proof of address, and in certain cases, selfies or video verification for liveness checks.
• Financial Data: Payment method details, transaction records, deposit amounts (in PKR), withdrawal requests and any associated reference numbers. Payment method names (e.g., Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah) are referenced only as familiar payment context; their mention does not imply endorsement or confirmed availability.
• Responsible Gambling Data: Any deposit limits, loss limits, self-exclusion requests, cooling-off periods or responsible gambling self-assessments you submit through the platform.
• Support Communications: The content of any messages, emails or live chat transcripts exchanged with the 999bat support team.

• Technical Data: IP address, browser type and version, operating system, device type and model, screen resolution and language settings.
• Usage Data: Pages visited, features used, betting activity, session duration, click-paths, search queries within the platform and in-play betting patterns.
• Cookie and Tracking Data: Information collected via cookies, web beacons, pixels and similar technologies as described in Section 7.
• Geolocation Data: Approximate geographic location derived from your IP address, used to apply appropriate access controls and detect potential access from restricted territories.

• KYC Providers: Identity verification results, fraud risk scores and document authenticity assessments from third-party KYC and AML screening services.
• Payment Processors: Transaction status confirmations and fraud flags from payment processing partners.
• Responsible Gambling Databases: Where applicable, cross-referencing with self-exclusion registers maintained by licensed gambling operators or recognised responsible gambling bodies.

We use the Personal Data we collect for the following purposes:

Where we process Personal Data on the basis of legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time — see Section 11 for details on exercising your rights.

999bat processes Personal Data only where a valid legal basis exists. The primary legal bases we rely on are:

• Contract Performance: Processing that is necessary to register your account, verify your identity, process financial transactions, and provide the Services you have requested. Without this processing, we cannot operate your account.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering (AML) requirements, counter-terrorism financing (CTF) obligations, age verification mandates and responses to lawful requests from competent authorities.
• Legitimate Interests: Processing necessary for purposes that are reasonably expected by users and do not unduly interfere with their privacy rights, such as fraud prevention, platform security monitoring, improving service quality and responsible gambling risk detection.
• Consent: Processing for purposes that are not strictly necessary — such as marketing communications, non-essential cookies and certain analytics activities — will only take place where you have provided clear, specific and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

999bat does not sell, rent or trade your Personal Data to third parties for their own commercial purposes. We share data only in the circumstances described below, and only to the extent necessary for the stated purpose.

We engage trusted third-party service providers who process data strictly on our behalf and under binding contractual terms that prohibit them from using your data for any purpose other than the service they provide to us. These include:

• KYC and identity verification platforms
• Payment processing partners
• Cloud hosting and infrastructure providers
• Customer support software providers
• Anti-fraud and AML screening services
• Analytics and platform performance monitoring tools

999bat may disclose Personal Data to competent regulatory bodies, law enforcement agencies or courts where required by law, court order or lawful regulatory demand. We will notify you of such requests where legally permitted to do so.

Where required under the terms of the platform's applicable licence, or where a user has voluntarily self-excluded, limited data may be shared with recognised responsible gambling organisations or inter-operator self-exclusion registers to give effect to a user's responsible gambling choices.

In the event of a merger, acquisition, restructuring or sale of all or part of 999bat's business, your Personal Data may be transferred to the relevant successor entity. We will notify registered users of any such transfer and its privacy implications.

The 999bat platform uses cookies and similar tracking technologies to enable core functionality, improve user experience, and gather analytics data. This section explains what these technologies are, how we use them, and how you can manage your preferences.

Strictly necessary cookies cannot be disabled as they are essential to the core operation of the platform. All other cookie categories are activated only with your consent, which you can provide or withdraw via the Cookie Preferences centre accessible from the platform's footer.

You may also manage cookies through your browser settings; however, disabling certain cookies may affect the functionality of the platform. Most browsers allow you to block cookies entirely, delete existing cookies, or be notified when a new cookie is set.

999bat retains Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulation. The key retention periods that apply are:

• Active Account Data: Retained for the duration of your account relationship with 999bat plus a further period as required by applicable AML, gambling licence, or financial record-keeping obligations (typically five to seven years from account closure).
• KYC and Identity Documents: Retained for a minimum of five years following account closure, or longer where required by the applicable licensing jurisdiction or anti-money-laundering regulations.
• Transaction Records: Financial transaction logs are retained for a minimum of five years to meet regulatory and audit requirements.
• Support Communications: Retained for up to three years from the date of the interaction, or longer where a dispute or investigation is ongoing.
• Marketing Data: Retained until you withdraw consent or unsubscribe, whichever is earlier.
• Analytics and Usage Data: Anonymised or aggregated after 13 months; raw usage logs are not retained indefinitely.

When data reaches the end of its retention period, it is either securely and permanently deleted or irreversibly anonymised so that it can no longer be associated with any individual.

999bat employs a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure or destruction. These include:

• Encryption in Transit: All data exchanged between your device and the 999bat platform is protected using TLS (Transport Layer Security) encryption.
• Encryption at Rest: Sensitive data fields, including identity document copies and financial details, are encrypted when stored.
• Access Controls: Strict role-based access controls ensure that only authorised 999bat personnel with a legitimate business need can access Personal Data, and all access is logged and audited.
• Two-Factor Authentication (2FA): Available to all registered users and strongly recommended to protect account access.
• Penetration Testing and Security Audits: The platform undergoes regular security assessments to identify and remediate vulnerabilities.
• Incident Response: A documented data breach response plan is in place. In the event of a breach that poses a risk to affected users, 999bat will notify those users without undue delay.

999bat operates as an international platform and some of our service providers and infrastructure partners are located outside Pakistan. As a result, your Personal Data may be transferred to, and processed in, countries other than the one in which you are based.

Where Personal Data is transferred internationally, 999bat takes steps to ensure that appropriate safeguards are in place. These safeguards may include:

• Transferring data only to countries that provide an adequate level of data protection as recognised by applicable law;
• Entering into standard contractual clauses or equivalent data transfer agreements with receiving parties;
• Applying technical and organisational security measures that meet or exceed those applied within Pakistan.

By using the Services and providing Personal Data, you acknowledge that your data may be processed outside Pakistan for the purposes described in this Policy.

999bat is committed to respecting your rights over your own Personal Data. You may exercise the following rights at any time by contacting our support team:

To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 72 hours and respond in full within 30 days. Where a request is complex or numerous, we may extend this period by a further 60 days with prior notice.

Please note that certain rights are subject to exceptions. For example, we may decline an erasure request where retention is required for legal or regulatory compliance, or to establish, exercise or defend legal claims.

999bat does not knowingly collect Personal Data from any person under the age of 18. Age verification is performed as part of the KYC process, and accounts where the user is found to be underage are suspended immediately and any associated funds handled in accordance with applicable regulatory requirements.

If you believe that a minor has registered on the platform or that we have inadvertently collected data from a person under 18, please contact us immediately at [email protected] so that we can take prompt corrective action.

Parents and guardians in Pakistan are encouraged to use parental control tools and internet filtering software to prevent underage access to online gambling services. Local laws may impose additional restrictions — users are responsible for understanding applicable rules in their province.

999bat reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the Services we offer. When we make material changes, we will:

• Update the "Effective Date" at the top of this page;
• Post a prominent notice on the platform informing registered users of the change;
• Where required by applicable law or the significance of the change, seek fresh consent from affected users before applying the updated terms to their data.

We encourage you to review this Policy periodically to stay informed about how we protect your data. Your continued use of the Services following notification of any changes constitutes your acceptance of the updated Policy, subject to any consent requirements that apply.

If you have any questions, concerns or requests relating to this Privacy Policy or the way 999bat handles your Personal Data, please get in touch with our support team using the details below. All data-related enquiries are handled by our dedicated privacy support function.

For rights requests specifically (access, erasure, portability, etc.), please include your registered email address and username in your message so we can locate your account promptly and process your request within the applicable timeframe.