cr999 Privacy Policy

1.1 When you register a cr999 account, cr999 collects the following categories of personal data:

• Identity data — full legal name as it appears on your government-issued CNIC or passport, date of birth, gender, and CNIC number.
• Contact data — mobile phone number (must be registered in your name in Pakistan), email address, and city of residence (e.g., Karachi, Lahore, Islamabad, Faisalabad).
• Financial data — JazzCash wallet number, EasyPaisa wallet number, HBL / UBL / Meezan Bank account details, and Raast ID where applicable. cr999 does not store full bank account numbers or card numbers in unencrypted form.
• Verification documents — scanned or photographed copies of CNIC (front and back), and where enhanced due diligence is required, a selfie alongside the CNIC, a proof-of-address document, and proof of payment method ownership.
• Account credentials — username and encrypted password hash. cr999 does not store plaintext passwords at any point.

1.2 As you use the cr999 platform, cr999 also automatically collects the following technical and behavioural data:

• Device and technical data — IP address, device type, operating system, browser type and version, device identifier, and mobile network operator.
• Usage data — pages visited, features used, betting history, game session durations, login timestamps, and navigation patterns within the platform.
• Transaction data — deposit amounts, withdrawal amounts, bet records, bonus activations, and wallet balance history.
• Communications data — records of live chat conversations with cr999 support agents and any written correspondence submitted through the platform's contact channels.

2.1 cr999 collects your personal data through the following channels:

• Directly from you — during account registration, identity verification, deposit and withdrawal requests, bonus claim forms, and communications with cr999 customer support.
• Automatically via the platform — through cookies, session tokens, server logs, and analytics tools that record your interaction with the cr999 website and mobile application.
• From third-party service providers — identity verification services may return enhanced identity-match scores and document authenticity results to cr999; payment processors confirm transaction status and flag potentially fraudulent payment activity; fraud-prevention tools may share device-reputation and behavioural-risk signals.

2.2 cr999 does not purchase personal data lists from third-party data brokers or marketing agencies. All personal data held by cr999 relates directly to individuals who have interacted with the cr999 platform or registered an account.

3.1 cr999 uses your personal data for the following purposes:

3.2 cr999 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your separate consent or being required to do so by law.

3.3 Where cr999 relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.1 cr999 does not sell your personal data to any third party. Your data may be shared with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast receive transaction data necessary to process your deposits and withdrawals. Each payment processor operates under its own data protection terms and applicable Pakistani financial regulations.
• Identity verification providers — cr999 uses a third-party KYC service provider to verify CNIC authenticity, match names against identity databases, and confirm date of birth. This provider receives only the minimum data necessary for verification purposes.
• Fraud prevention and security services — device fingerprint data, IP address information, and behavioural signals may be shared with specialist fraud-prevention providers to protect cr999 and its users from financial crime and account takeover attacks.
• Game content providers — where you play games provided by third-party game studios integrated into the cr999 platform, a pseudonymous player identifier and game session data may be shared with those studios for the purpose of game operation and dispute resolution. No full identity data is shared with game studios.
• Law enforcement and regulatory authorities — cr999 may disclose personal data to Pakistani law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by a valid legal obligation, court order, or in connection with the investigation of financial crime.
• Corporate successors — in the event of a merger, acquisition, or asset sale involving cr999, your personal data may be transferred to the acquiring entity as part of the business assets, subject to the same privacy protections described in this policy.

4.2 All third-party service providers that process personal data on behalf of cr999 are bound by contractual data processing agreements that require them to maintain appropriate technical and organisational security measures and to process your data only on cr999's documented instructions.

5.1 cr999 retains your personal data for as long as your account remains active and for a period after account closure as required by applicable law and cr999's operational needs. The following general retention periods apply:

• Account and identity data — retained for the duration of account activity and for a minimum of five years following account closure, in line with standard anti-money-laundering record-keeping requirements.
• Transaction and financial data — retained for a minimum of five years from the date of each transaction, as required for financial audit and AML compliance purposes.
• KYC verification documents — retained for a minimum of five years from the date of verification or account closure, whichever is later.
• Customer support communications — retained for three years from the date of the interaction, to facilitate dispute resolution and quality assurance.
• Cookie and analytics data — anonymised usage analytics are retained for up to 26 months. Non-anonymised session data is retained for up to 90 days.
• Marketing preferences and consent records — retained for as long as your account is active and for one year following account closure or the withdrawal of marketing consent, whichever is earlier.

5.2 Upon expiry of the applicable retention period, cr999 will securely delete or anonymise your personal data in accordance with cr999's data destruction policy. Anonymised and aggregated data that can no longer identify you may be retained indefinitely for analytical purposes.

6.1 cr999 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• AES-256 encryption for all personal data stored in cr999 databases.
• TLS 1.2 or higher for all data transmitted between your device and cr999 servers.
• Tokenisation of financial data — payment credentials are never stored in plain text on cr999 systems.
• Role-based access controls limiting internal access to personal data to staff members with a documented operational need.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Multi-factor authentication (MFA) enforced for all cr999 staff accounts with access to user data systems.
• Automated anomaly detection systems that flag unusual access patterns for immediate security review.

6.2 In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, cr999 will notify affected users without undue delay via the email address registered on your account, and will implement remediation measures as a matter of priority.

6.3 While cr999 takes all reasonable and practicable steps to protect your data, no online platform can guarantee absolute security. You are encouraged to use a strong, unique password for your cr999 account and to enable two-factor authentication from your account settings dashboard.

7.1 cr999 uses cookies and similar tracking technologies on the cr999 website and mobile application. The following categories of cookies are used:

• Strictly necessary cookies — required for the platform to function. They manage your login session, maintain your betting slip state, and protect against cross-site request forgery. These cookies cannot be disabled.
• Functional cookies — remember your preferences such as your preferred language, default stake amount, and display settings. Disabling these cookies may affect your platform experience.
• Analytics cookies — collect anonymised information about how users navigate the cr999 platform, which features are most used, and where users encounter errors. This data helps cr999 improve the platform experience.
• Security cookies — support fraud detection, device fingerprinting, and the identification of suspicious login activity.

7.2 cr999 does not use third-party advertising or retargeting cookies. cr999 does not share cookie data with social media platforms or advertising networks.

7.3 You can manage non-essential cookies via the cookie preference panel accessible from the footer of the cr999 website. Note that disabling analytics or functional cookies may limit certain platform features.

8.1 As a cr999 user, you have the following rights in relation to your personal data. To exercise any of these rights, contact cr999 via live chat or email at [email protected]. cr999 will respond to all valid requests within 30 calendar days.

9.1 The cr999 platform is strictly for adults aged 21 years or older. cr999 does not knowingly collect or process personal data from any person under the age of 21. Age verification is a mandatory step during the cr999 registration process and is conducted using CNIC-based identity confirmation.

9.2 If cr999 discovers or reasonably suspects that an account has been registered by a person under the age of 21, cr999 will immediately suspend real-money access to that account, initiate an age verification investigation, and if underage registration is confirmed, permanently close the account. Any deposits made to an underage account will be returned to the originating payment method, net of any withdrawals already processed.

9.3 Parents and guardians who believe that a minor in their household may have registered a cr999 account are encouraged to contact cr999 immediately via live chat. cr999 takes underage gambling with the utmost seriousness and will act swiftly on any credible report of a minor accessing the platform.

10.1 cr999 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, cr999's data processing activities, or industry best practice. The current version of the Privacy Policy is always accessible at cr999.biz/privacy-policy.

10.2 Where cr999 makes a material change to this Privacy Policy — meaning a change that significantly affects your rights or the way your data is processed — cr999 will notify all registered users via the email address on file and via an in-platform notification at least 7 days before the updated policy takes effect.

10.3 Minor, non-material amendments (such as clarifications of existing language or corrections of typographical errors) may be made without prior notice. The "Last Reviewed" date at the top of this page will be updated to reflect all amendments, whether material or not.

10.4 Your continued use of the cr999 platform after a revised Privacy Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with an amended Privacy Policy, you must stop using the platform and contact cr999 support to close your account.

11.1 If you have any questions, concerns, or requests relating to this Privacy Policy or cr999's handling of your personal data, please contact the cr999 Data Protection team through any of the following channels:

• Live Chat — available 24/7 directly on the cr999 platform, average response time 3 to 5 minutes.
• Email — [email protected] — please include "Privacy Request" in the subject line. cr999 aims to respond to all written privacy enquiries within 5 business days.

11.2 cr999 will handle all privacy-related requests and complaints with strict confidentiality. Your identity will not be disclosed to any third party in connection with a privacy complaint without your explicit consent, except where disclosure is required by law.