BR999 Privacy Policy — How We Handle Your Personal Data in Pakistan

1. Who We Are and What This Policy Covers

BR999 is an online gaming platform providing sports betting, casino games, poker, jackpot slots, virtual sports, and related entertainment services to players in Pakistan. When we say "BR999", "we", "us", or "our" in this Privacy Policy, we mean the operator of the BR999 platform at br999.online and all associated services.

This Privacy Policy applies to all personal data collected and processed through the BR999 website, mobile application, and any communication channels — including live chat support, email, and in-app messaging. It applies to all registered BR999 members as well as to individuals who visit the BR999 website without registering.

This policy should be read alongside the BR999 Terms and Conditions, which govern your overall use of the platform. The Terms and Conditions are available at br999.online/terms-conditions.

2. What Personal Data BR999 Collects

BR999 follows a principle of minimal data collection — we only collect information that is genuinely necessary for operating the platform, fulfilling our legal obligations, and providing you with a safe and functional gaming experience. The categories of personal data we collect are described below.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, gender, and residential address in Pakistan.
• Contact information: Mobile phone number and email address (if provided).
• Identity verification documents: CNIC (Computerised National Identity Card), passport, or other government-issued photo ID as required for KYC verification.
• Payment information: Mobile wallet account numbers (Easypaisa, JazzCash, NayaPay, SadaPay), IBFT bank account details, and Visa/Mastercard card details. Card numbers are tokenised and not stored in full by BR999.
• Communications: Any messages, requests, or complaints you send to BR999 through live chat, email, or in-app support.

2.2 Data Collected Automatically

• Device and access data: IP address, device type, operating system, browser type, and mobile carrier.
• Usage data: Pages visited, games played, bet history, session duration, login and logout times, and click-stream data within the BR999 platform.
• Location data: Country and city-level location inferred from IP address. BR999 does not collect GPS-level location data.
• Cookie data: Data collected via cookies and similar tracking technologies as described in Section 6 of this policy.

2.3 Data Collected from Third Parties

• Identity verification results from BR999's KYC provider — a confirmation of whether your submitted documents have been verified, without the underlying document being retained by the provider beyond the verification check.
• Fraud risk signals from payment processors and fraud prevention services used by BR999 to protect against unauthorised transactions.

3. How BR999 Uses Your Personal Data

Every use of your personal data on BR999 has a specific, legitimate purpose. We don't collect data speculatively and we don't use data for purposes beyond what's described below without notifying you first.

4. Legal Basis for Processing Your Data

BR999 processes your personal data under the following legal grounds. Understanding these grounds helps you know why BR999 has the right to process your information and under what circumstances you can object to or request that we stop.

4.1 Contractual Necessity

The majority of personal data processing on BR999 is necessary to fulfil the contract between you and BR999 — meaning the Terms and Conditions you agreed to when registering. Processing your payment details to deposit and withdraw PKR, maintaining your account, and managing your bets are all examples of processing done to perform this contract. Without this processing, BR999 cannot provide you with its services.

4.2 Legal Obligation

Certain processing — particularly KYC identity verification, anti-money-laundering checks, and the retention of transaction records — is required by applicable laws and regulations. BR999 has no choice but to conduct this processing to remain compliant. Players cannot opt out of legally mandated processing.

4.3 Legitimate Interest

BR999 processes some data under the basis of legitimate interest, where our interests (or those of third parties) don't override your rights. Fraud prevention monitoring, platform security, usage analytics to improve the platform, and responsible gaming monitoring fall under this basis. Where legitimate interest is the basis, BR999 has conducted an assessment confirming that players' rights are not disproportionately affected.

4.4 Consent

Where BR999 relies on consent as the legal basis — primarily for direct marketing communications — you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.

5. Who BR999 Shares Your Data With

BR999 does not sell your personal data to third parties. Full stop. We will never hand over your information to a data broker, advertiser, or third-party marketer. The sharing that does occur is limited to what's operationally necessary and legally required.

5.1 Service Providers

BR999 works with a small number of trusted service providers who process data on our behalf, under strict contractual data protection obligations. These include:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and the card payment gateway process transaction data to execute your deposits and withdrawals.
• KYC verification provider: A third-party identity verification service processes your submitted documents to confirm your identity. Documents are processed and then securely deleted by the provider — BR999 retains only the verification outcome.
• Cloud infrastructure provider: BR999's platform data is hosted on encrypted cloud infrastructure. The infrastructure provider has no access to the content of your data.
• Fraud prevention service: BR999 uses an automated fraud-detection system that analyses transaction patterns to identify potentially fraudulent activity.

5.2 Legal and Regulatory Disclosure

BR999 may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts in response to legally valid requests. BR999 will always seek to verify the legitimacy of such requests and will only disclose the minimum data required to comply with the legal obligation.

5.3 Business Transfers

In the event that BR999 undergoes a merger, acquisition, or sale of assets, personal data held by BR999 may be transferred to the acquiring entity. In such circumstances, BR999 will notify affected users in advance and the new controller will be required to honour the commitments made in this Privacy Policy.

6. Cookies and Tracking Technologies

BR999 uses cookies and similar tracking technologies on its website and mobile application. Cookies are small text files stored on your device when you visit a website. They help BR999 function properly, remember your preferences, and understand how the platform is being used.

You can manage your cookie preferences through the settings panel available in your BR999 account or through your device's browser settings. Disabling non-essential cookies will not prevent you from using BR999 but may affect some personalisation features.

7. How Long BR999 Keeps Your Data

BR999 does not hold personal data longer than necessary. Retention periods are determined by the original purpose of collection and by legal obligations that require us to retain certain records for specified minimum periods.

• Active account data: Retained for the full duration of your BR999 account and for a period of five years after account closure, as required for financial record-keeping and anti-money-laundering compliance.
• Transaction records: Deposits, withdrawals, bets, and wins are retained for a minimum of five years from the date of the transaction in accordance with financial record requirements.
• KYC documents: Identity verification documents are retained for five years from the date of verification or from account closure, whichever is later.
• Customer support communications: Retained for three years from the date of the communication, to allow for follow-up and dispute resolution.
• Marketing data: Email or marketing preferences are retained until you withdraw consent or close your account, whichever comes first.
• Website analytics data: Retained in aggregated, anonymised form for up to two years.

When data is no longer required under any retention obligation, BR999 securely deletes or irreversibly anonymises it so that it can no longer be linked to an individual.

8. How BR999 Protects Your Personal Data

Data security is taken seriously at BR999. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. The measures BR999 has in place include the following.

8.1 Technical Security Measures

• All data transmitted between your device and BR999's servers is encrypted using TLS (Transport Layer Security) with industry-standard cipher suites.
• Personal data stored on BR999's servers is encrypted at rest using AES-256 encryption.
• Payment card data is tokenised — BR999 does not store full card numbers at any point.
• Access to personal data within BR999's systems is restricted to staff who require it for their specific job function, using role-based access controls.
• BR999's infrastructure undergoes regular security assessments including penetration testing and vulnerability scanning.

8.2 Organisational Measures

• All BR999 staff with access to personal data are trained in data protection principles and are bound by confidentiality obligations.
• Data breach response procedures are in place to detect, contain, and report any security incidents promptly.
• Third-party service providers are vetted for security standards before being granted access to any BR999 data.

9. Your Privacy Rights as a BR999 Member

You have meaningful rights over the personal data BR999 holds about you. These rights are not formalities — BR999 will respond to every valid request within a reasonable timeframe, typically within 30 days, and will clearly explain the outcome and any reasons if a request cannot be fully fulfilled.

To exercise any of these rights, contact the BR999 support team through live chat on the platform or via the email address listed in Section 13. BR999 may need to verify your identity before processing a rights request to ensure we're providing your data to you and not to someone impersonating you.

10. Children's Privacy

BR999 is strictly an 18+ platform. We do not knowingly collect, process, or retain personal data from individuals under the age of 18. If you are under 18, you must not use BR999 under any circumstances.

If BR999 becomes aware that personal data has been collected from a person under 18 — whether through registration, payment, or any other means — the account will be immediately terminated, all balance will be forfeited, and all personal data collected will be deleted as quickly as technically possible. BR999 will also take steps to prevent the same individual from re-registering.

If you are a parent or guardian and believe that your child has created a BR999 account or shared personal information with BR999, please contact us immediately through the live chat support so we can investigate and take action without delay.

11. Marketing Communications

BR999 may send you promotional communications about offers, new games, jackpot promotions, and platform updates. We will only send marketing communications where you have explicitly opted in to receive them. Marketing communications are not sent as a condition of registering or using BR999.

11.1 Opting In and Out

During registration you will be given the option to opt in to marketing communications from BR999. You can change this preference at any time through your account settings or by contacting support. Opting out of marketing communications does not affect your ability to use any part of the BR999 platform and will not result in you missing out on publicly visible promotions.

11.2 Transactional Communications

Regardless of your marketing preference, BR999 will continue to send you communications that are essential for operating your account. These include deposit and withdrawal confirmations, security alerts such as new device logins, KYC status notifications, and important updates to these terms or the Privacy Policy. These are not marketing communications and cannot be opted out of while your account is active.

12. Changes to This Privacy Policy

BR999 may update this Privacy Policy from time to time to reflect changes in our data practices, new features added to the platform, or changes in applicable law. When we make material changes to this policy, we will notify you by email or through a prominent notice within the BR999 platform at least 7 days before the changes take effect.

The "Effective" date at the top of this page will always show when the current version of the policy came into force. We encourage you to review this policy periodically, especially if you haven't visited it since you first registered. Previous versions of this Privacy Policy are available on request from the support team.

Your continued use of BR999 after the effective date of any update to this policy constitutes your acceptance of the updated terms. If you do not accept an update, you should contact support to close your account before the update takes effect.

13. Contact Us and How to Make a Privacy Complaint

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or want to raise a concern about how BR999 has handled your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly within the BR999 platform — the quickest way to reach the team for most requests.
• Email: support@br999.online — for formal written requests or complaints. Please include your account username and a description of your request or concern.

BR999 will acknowledge any privacy complaint within 48 hours and aims to resolve it within 30 days. For complex issues this may take longer, in which case we will keep you updated on progress throughout the process.

If you are not satisfied with BR999's response to a privacy complaint, you have the right to escalate the matter through whatever dispute resolution or regulatory channels are available in your jurisdiction.