Your Privacy Is a
Core Commitment at xy999

1 Introduction

xy999 ("we", "us", "the Company") operates the online gaming platform accessible at xy999.games. We are fully committed to protecting the personal data of every player who registers and engages with our Platform, including players based across Pakistan in cities such as Karachi, Lahore, Islamabad, Rawalpindi, Peshawar, and Faisalabad.

This Privacy Policy explains in clear, plain English what personal data we collect, why we collect it, how it is stored and protected, who it may be shared with, how long we keep it, and what rights you hold over your own information. This Policy should be read alongside our Terms & Conditions, which are available at xy999.games/terms-and-conditions.

By registering an account on the xy999 Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should not register or continue to use the Platform.

2 Data Controller

xy999 acts as the data controller for all personal data collected through the Platform. As data controller, xy999 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out in a lawful, fair, and transparent manner.

For all data protection enquiries, requests to exercise your rights, or formal complaints, you may contact the xy999 data protection team by email at [email protected] with the subject line "Data Protection Request". All requests will be acknowledged within 48 hours and fully addressed within 30 calendar days.

3 Data We Collect

xy999 collects the following categories of personal data from players:

3.1 Identity & Contact Data

• Full legal name as it appears on your CNIC (Computerised National Identity Card)
• Date of birth (to verify the 18+ age requirement)
• Registered Pakistan mobile number
• Email address
• Residential city and region within Pakistan

3.2 Account & Login Data

• Username and encrypted password hash (we do not store plain-text passwords)
• Account creation date and time
• Login history including device type, IP address, and timestamp
• Two-factor authentication (2FA) preferences and associated records

3.3 Financial Data

• Easypaisa or JazzCash wallet number (for payment processing)
• HBL or other registered bank account details where applicable
• Deposit and withdrawal transaction history in PKR
• Bonus claim and wagering activity records

3.4 Gameplay & Behavioural Data

• Game session logs including game title, start/end time, stake, and outcome in PKR
• Sports betting slip history
• Responsible gaming tool usage (deposit limits, session timers, self-exclusion records)
• Customer support interaction transcripts

3.5 Technical Data

• IP address and approximate geolocation (city level)
• Device type, operating system, and browser version
• Cookie identifiers and session tokens (see Section 11)
• Platform error logs and crash reports

4 How We Collect Data

xy999 collects personal data through the following channels:

• Direct submission: Information you provide when registering, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device information, and cookie-based session data.
• Payment providers: Transaction confirmation data received from Easypaisa, JazzCash, or HBL following a payment event, limited to transaction reference numbers, amounts in PKR, and timestamps.
• Identity verification partners: KYC verification providers may return a pass/fail verification status and the data points used to confirm your identity. Raw document images are not retained by xy999 beyond the verification process.
• Fraud prevention services: Risk scoring and device fingerprint data from third-party fraud detection services is processed in real time but not stored in identifiable form beyond 90 days.

5 How We Use Your Data

6 Legal Basis for Processing

xy999 processes your personal data under the following legal bases, depending on the purpose of processing:

• Contract performance: Processing necessary to fulfil the account agreement between you and xy999, including deposits, withdrawals, gameplay, and support services.
• Legal obligation: Processing required to comply with applicable laws and regulations, including age verification, KYC/AML (Anti-Money Laundering) requirements, and responsible gaming obligations.
• Legitimate interests: Processing conducted for xy999's legitimate business interests — such as fraud prevention, platform security, and anonymised analytics — where those interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional promotional communications. You may withdraw consent at any time without affecting the legality of processing carried out before withdrawal.

7 Data Sharing

xy999 does not sell, rent, or otherwise transfer your personal data to third parties for their independent marketing purposes. Data is shared only in the following circumstances:

7.1 Service Providers

xy999 engages carefully selected third-party service providers who process data on xy999's behalf under strict contractual data processing agreements. These include payment processors (Easypaisa, JazzCash, HBL payment gateway), KYC verification providers, fraud detection services, cloud hosting infrastructure providers, and the Live Chat support platform. Service providers are permitted to use your data only for the specific purpose for which they were engaged.

7.2 Legal & Regulatory Disclosure

xy999 may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or regulatory instruction. In such cases, xy999 will disclose only the minimum data necessary to satisfy the legal requirement.

7.3 Business Transfers

In the event of a merger, acquisition, or asset sale involving xy999, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. xy999 will provide notice to affected players prior to any such transfer where practicable.

8 International Data Transfers

Some of xy999's service providers — including cloud infrastructure and fraud detection partners — may process data on servers located outside Pakistan. Where personal data is transferred internationally, xy999 ensures that appropriate safeguards are in place, including contractual standard clauses that require the recipient to maintain data protection standards equivalent to those applied by xy999.

Payment data processed by Easypaisa and JazzCash remains within their own Pakistan-based infrastructure and is governed by their respective privacy policies. xy999 does not transfer payment instrument data internationally.

9 Data Retention

xy999 retains personal data only for as long as necessary to fulfil the purposes described in this Policy. The following retention periods apply:

• Active account data: Retained for the duration of the account relationship and for 5 years following account closure, for regulatory compliance purposes.
• Transaction records (PKR deposits, withdrawals, wagers): Retained for a minimum of 5 years from the date of the transaction, in accordance with applicable financial record-keeping requirements.
• KYC verification documents: Retained for 5 years following account closure. Document images are stored in encrypted form and access is restricted to authorised compliance staff only.
• Customer support transcripts: Retained for 2 years from the date of the interaction, unless the interaction is related to a formal dispute, in which case records are retained until the dispute is fully resolved.
• Technical logs (IP address, login history): Retained for 90 days for security monitoring purposes, then deleted.
• Marketing consent records: Retained for as long as consent remains active and for 2 years following withdrawal of consent, as evidence of the consent history.

Upon expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to any individual player.

10 Security Measures

xy999 applies the following technical and organisational security measures to protect your personal data:

• Encryption in transit: All data transmitted between your device and xy999 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive data including payment references and identity data is encrypted at rest on xy999's database infrastructure.
• Password security: Account passwords are stored exclusively as salted cryptographic hashes. xy999 cannot retrieve your plain-text password — this is by design.
• Access controls: Access to personal data within xy999's systems is restricted to staff with a legitimate operational need and is subject to role-based access permissions and audit logging.
• Two-factor authentication: Optional 2FA is available to all players via SMS to their registered Pakistan mobile number and is strongly recommended.
• Penetration testing: xy999's platform and infrastructure undergo regular third-party security assessments to identify and remediate vulnerabilities.
• Incident response: xy999 maintains a documented data breach response procedure. In the event of a breach affecting player data, affected players will be notified within 72 hours of xy999 becoming aware of the incident.

Despite these measures, no online platform can guarantee absolute security. You play an important role in protecting your own data by maintaining a strong, unique password for your xy999 account and enabling 2FA where available.

11 Cookies & Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device by the xy999 Platform when you visit. They allow the Platform to recognise your device across sessions and to store preferences and session state. xy999 uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load balancer routing cookies. These cannot be disabled without breaking Platform functionality.
• Functional cookies: Remember your preferences such as language, remembered username, and notification settings. These persist between sessions.
• Analytical cookies: Collect anonymised usage data to help xy999 understand how players navigate the Platform and where improvements are needed. No personal data is linked to analytical cookies.
• Security cookies: Used for fraud detection and to identify unusual login patterns that may indicate account compromise.

11.2 Cookie Control

You can control non-essential cookies through the cookie preference panel accessible at the bottom of the xy999 Platform. You can also control cookies through your browser settings; however, disabling strictly necessary cookies will prevent the Platform from functioning correctly. For guidance on managing cookies in your browser, refer to your browser's own help documentation.

12 Minors

The xy999 Platform is strictly intended for adults aged 18 and over. xy999 does not knowingly collect or process personal data from individuals under the age of 18. Age verification is conducted as part of the account registration process, and KYC verification is required before any withdrawal is processed.

If xy999 becomes aware that personal data has been collected from a player who is under 18, that account will be immediately closed, all funds will be returned via the registered payment method (less any bonus amounts), and the personal data will be securely deleted. xy999 encourages parents and guardians to take appropriate precautions to prevent minors from accessing online gaming platforms.

13 Your Rights Over Your Data

Subject to applicable law, you hold the following rights regarding the personal data xy999 holds about you:

• Right of Access: Request a copy of all personal data xy999 holds about you, delivered in a portable electronic format within 30 days of your request.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data. For account-critical data such as your legal name, supporting documentation may be required.
• Right to Erasure: Request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to legal retention obligations. Note that regulatory retention requirements (Section 9) mean some data cannot be deleted upon request during the retention period.
• Right to Restrict Processing: Request that xy999 temporarily suspends processing of your data in certain circumstances — for example, while the accuracy of data is being disputed.
• Right to Data Portability: Receive your account and transaction data in a structured, commonly used, machine-readable format (such as JSON or CSV) where technically feasible.
• Right to Object: Object to processing based on xy999's legitimate interests. xy999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Withdraw consent for processing based on consent (such as marketing communications) at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact xy999's data protection team at [email protected] with the subject line "Data Rights Request" and a description of your request. xy999 will respond within 30 calendar days and will not charge a fee for reasonable requests.

14 Changes to This Policy

xy999 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable regulations, or Platform features. Where material changes are made — meaning changes that affect your rights or the way your data is used — xy999 will notify you via your registered email address or Pakistan mobile number at least 14 days before the changes take effect.

The current version of this Policy is always available at xy999.games/privacy-policy and is identified by its version number and effective date. Continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgement of the changes.

If you do not agree with any change to this Policy, you may close your account by contacting Live Chat support or by emailing [email protected], and your outstanding real-money balance will be processed for withdrawal within 5 business days.

15 Contact Us

For any question, concern, or request related to this Privacy Policy or to the personal data xy999 holds about you, please contact us through one of the following channels:

• Email: [email protected] — use subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 through your logged-in xy999 account dashboard — average response time under 5 minutes
• WhatsApp: Available from within your account settings panel after login
• Telegram: Available from within your account settings panel after login

xy999's support team operates on Pakistan Standard Time (PST) as its primary timezone. Players across Pakistan — from Karachi to Islamabad, Lahore to Faisalabad — are always connected to a responsive, English-speaking support team.