Privacy Policy – 99ba Pakistan

1. Overview — What This Policy Covers

This Privacy Policy applies to all personal data collected and processed by 99ba ("99ba", "we", "us", "our") in connection with the website at 99ba.click and all associated gaming, payment, and account management services.

When we say "personal data" we mean any information that can identify you as an individual — your name, mobile number, email address, CNIC details, device identifiers, payment credentials, gaming history, and related information. We take the protection of that information seriously because it's your data, not ours, and you deserve to know exactly how it's handled.

This policy is written for Pakistani players and reflects the privacy standards we hold ourselves to for every account on the 99ba platform. It applies to data you give us directly, data generated through your use of the platform, and data we receive from third-party payment and verification providers.

By creating an account or using the 99ba platform, you confirm that you have read and understood this Privacy Policy. If you disagree with how we handle data, please do not register or use the platform. You may also contact us at any time at support@99ba.click to ask questions or raise concerns.

2. Data We Collect

The following table sets out the categories of personal data 99ba collects and the primary purpose of collecting each category:

99ba does not collect sensitive personal data such as biometric data, racial or ethnic origin, political opinions, religious beliefs, or health information unless legally required for specific verification purposes, in which case you will be informed separately and explicitly at the time of collection.

3. How We Collect Your Data

99ba collects personal data through the following channels:

• Direct submission: When you register an account, complete identity verification, contact support, or submit any form on the 99ba platform.
• Automated platform interactions: Technical data and usage data are automatically recorded when you access and use the 99ba website or mobile interface — including IP addresses, device identifiers, and session logs.
• Payment providers: When you initiate a deposit or withdrawal, your payment provider (JazzCash, Easypaisa, NayaPay, SadaPay, your bank, or card network) shares transaction reference data with 99ba to confirm and reconcile the transaction.
• Identity verification services: Where 99ba uses a third-party KYC provider to verify CNIC or age information, that provider may share verification results with 99ba.
• Cookies and tracking technologies: As described in the Cookies section below, certain data is collected automatically through cookies placed on your device when you visit the 99ba website.

99ba does not purchase personal data from data brokers or any other third-party sources for marketing or targeting purposes.

4. How We Use Your Data

99ba uses your personal data for the following purposes:

4.1 Account Creation and Management

Your identity and contact data are used to create and maintain your 99ba account — verifying your age, confirming your identity, delivering OTP codes for deposits and withdrawals, and communicating account updates and notices.

4.2 Payment Processing

Payment data is used exclusively to process deposits from and withdrawals to your registered payment methods in PKR. Every transaction is processed via certified payment gateways — 99ba does not handle raw card or wallet credentials directly.

4.3 Fraud Prevention and Security

Technical data — including IP addresses, device fingerprints, and login patterns — is used to detect and prevent fraudulent activity, account takeovers, money laundering, and other security threats. This monitoring is continuous and automated, with human review triggered by suspicious patterns.

4.4 Regulatory Compliance

Identity and transaction data is retained as required by applicable anti-money laundering (AML) regulations and any other legal obligations that apply to 99ba's operations. Sharing with law enforcement occurs only where legally required or under court order.

4.5 Responsible Gaming Monitoring

Gaming activity data is monitored to support responsible gaming obligations — identifying patterns that may indicate problem gambling behaviour and enabling the platform's self-exclusion and limit-setting tools to function correctly.

4.6 VIP Club and Loyalty

Your wagering activity data is used to calculate VIP points, determine tier status, and deliver the associated benefits of the 99ba VIP Club programme.

4.7 Customer Support

Communication data (support interactions, emails, chat logs) is retained to resolve disputes, improve support quality, and train the 99ba support team.

4.8 Platform Improvement

Aggregated and anonymised usage data is used to understand how players interact with the platform, identify features that need improvement, and prioritise product development decisions. This analysis does not involve identifying individual players.

5. Legal Basis for Processing

99ba processes your personal data under the following legal bases:

• Contractual necessity: Processing your identity, contact, and payment data is necessary to create and maintain your account and to execute deposit and withdrawal transactions — the core services 99ba provides.
• Legal obligation: Retaining identity and transaction records to comply with anti-money laundering, counter-terrorism financing, and other regulatory requirements is a legal obligation that 99ba must fulfil.
• Legitimate interests: Security monitoring, fraud detection, responsible gaming monitoring, and platform improvement are conducted under 99ba's legitimate interests, balanced against your rights as a data subject.
• Consent: Marketing communications (promotional emails, SMS) are sent only on the basis of your explicit consent, which you can withdraw at any time.

6. Payment Data — Special Protections

Given the sensitivity of financial data, 99ba applies additional protections specifically to payment information beyond the baseline security measures that apply to all personal data.

Every withdrawal from your 99ba account requires OTP confirmation via your registered mobile number. This means that even if someone were to access your account credentials, they cannot withdraw your funds without physical access to your registered phone.

Transaction records (amounts, timestamps, payment method references) are retained by 99ba for a minimum of five years for regulatory compliance purposes. These records are used only for account reconciliation, dispute resolution, and legal compliance — not for marketing or profiling.

Deposits and withdrawals at 99ba are denominated exclusively in Pakistani Rupees (PKR). There are no foreign currency conversions associated with your 99ba account, which means there is no exposure to foreign exchange rate data or international card network processing on standard transactions.

7. Data Sharing — Who Sees Your Data

99ba does not sell your personal data to any third party under any circumstances. Data is shared only in the following limited and necessary situations:

7.1 Payment Processors

Transaction data is shared with JazzCash, Easypaisa, NayaPay, SadaPay, and other certified payment service providers solely to process your deposits and withdrawals. Each of these providers operates under their own privacy and security standards as certified payment institutions.

7.2 Identity Verification Providers

Where 99ba uses a third-party KYC or age verification service, your identity documents and verification results are shared with that provider for the limited purpose of completing the verification check. The provider is contractually bound to use this data only for the verification purpose.

7.3 Legal and Regulatory Authorities

99ba will share personal data with law enforcement agencies, regulatory bodies, or courts when legally compelled to do so — for example, in response to a valid court order, subpoena, or regulatory investigation. In such cases, 99ba will share only the minimum data necessary to comply with the specific legal requirement.

7.4 Fraud Prevention Services

Anonymised or pseudonymised technical data (such as IP addresses flagged as associated with fraud) may be shared with industry-standard fraud prevention networks to protect the 99ba platform and its players.

7.5 Business Successors

In the event of a merger, acquisition, or transfer of all or part of 99ba's operations to a new entity, player data would transfer to the acquiring entity under the same or equivalent privacy protections. Players would be notified of any such transfer.

8. How Long We Keep Your Data

99ba retains personal data for as long as is necessary for the purposes it was collected and to comply with applicable legal retention obligations. The following retention periods apply as a guide:

• Active account data (identity, contact, payment method references): Retained for the life of your account plus five years after account closure.
• Transaction records (deposit and withdrawal histories): Retained for a minimum of five years from the date of each transaction for AML compliance.
• Gaming activity logs: Retained for three years from the date of the activity, after which they are anonymised or deleted.
• Customer support communications: Retained for two years from the date of the interaction unless retained longer for active dispute purposes.
• Cookie data: Varies by cookie type — session cookies expire when you close the browser; persistent cookies expire as described in the cookie preference settings.

At the end of applicable retention periods, personal data is securely deleted or irreversibly anonymised. 99ba does not retain data "just in case" — retention is specifically tied to documented legal or operational requirements.

9. How We Protect Your Data

99ba implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the 99ba platform.
• AES-256 encryption at rest for sensitive data stored on 99ba servers.
• Tokenisation for all payment credential storage — no raw financial credentials are stored by 99ba.
• OTP-based second factor authentication required for all withdrawals and account changes.
• Role-based access controls ensuring that 99ba staff can only access player data necessary for their specific job function.
• Regular security audits and penetration testing conducted by qualified independent security professionals.
• Automated intrusion detection systems monitoring for suspicious access patterns in real time.
• Segregated data architecture ensuring player fund data, personal data, and operational systems are separately firewalled.

In the event of a data breach that creates significant risk to your personal data, 99ba will notify affected players as quickly as practicable and will take all necessary steps to contain the breach and protect remaining data.

10. Cookies & Tracking Technologies

99ba uses cookies and similar tracking technologies on the 99ba.click website. Cookies are small text files placed on your device that allow the website to recognise your browser, remember preferences, and gather usage data. The cookies 99ba uses fall into the following categories:

You can also manage cookies through your browser settings at any time. Note that disabling certain cookies beyond essential ones may affect the functionality of some platform features. Clearing cookies will reset your stored preferences and may require you to log back in.

11. Your Privacy Rights

As a player on the 99ba platform, you have the following rights with respect to your personal data. You can exercise any of these rights by contacting 99ba at support@99ba.click:

99ba will acknowledge all privacy rights requests within 5 business days and aim to resolve them within 30 days. If a request requires more time due to complexity, you will be informed. There is no fee for exercising any of these rights.

12. Minors — Under-18 Protection

The 99ba platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. Age verification is conducted as part of the account registration process and may be re-verified at withdrawal stage.

If 99ba discovers that an account has been created by a person under 18, the account will be immediately suspended, any balance will be returned to the originating payment method, and all personal data associated with the account will be deleted from our systems as quickly as is legally permissible.

13. Marketing Communications

99ba sends promotional emails and SMS messages — including information about bonuses, new games, VIP promotions, and platform updates — only to players who have explicitly opted in to marketing communications at the time of registration or subsequently through account settings.

You can unsubscribe from marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email from 99ba.
• Replying "STOP" to any marketing SMS from 99ba.
• Updating your communication preferences in your 99ba account settings.
• Contacting 99ba support at support@99ba.click and requesting removal from marketing lists.

Unsubscription from marketing communications does not affect transactional communications — you will still receive account security notifications, withdrawal OTPs, and important account updates regardless of your marketing preference, as these are essential for platform and account security.

99ba does not send marketing communications to players who have self-excluded under the responsible gaming programme. Self-exclusion automatically removes players from all marketing lists for the duration of the exclusion period.

14. Third-Party Services & Links

The 99ba platform integrates with third-party services to deliver payment processing, identity verification, and certain gaming content. These integrations are governed by the respective providers' own privacy policies, which 99ba has reviewed to ensure adequate data protection standards. The primary third-party categories are:

• Payment processors: JazzCash, Easypaisa, NayaPay, SadaPay — all operate under Pakistani financial regulation and maintain their own data protection standards as certified payment institutions.
• KYC/identity verification providers: Used for CNIC verification where required. Data is shared only for the specific verification purpose and not retained by the provider beyond the verification transaction.
• Game software providers: Where 99ba hosts games developed by third-party studios, those studios may receive anonymised technical data (e.g., game session IDs) necessary to deliver and support their games. No personally identifiable information is shared with game studios without specific necessity and appropriate contractual protections.

99ba is not responsible for the privacy practices of external websites that may be linked from the platform or that players navigate to independently. This Privacy Policy applies only to the 99ba.click website and associated services.

15. Changes to This Privacy Policy

99ba may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made, 99ba will:

• Update the "Last updated" date at the top of this page.
• Send a notification to your registered email address summarising the key changes.
• Display a notice on the 99ba platform for a reasonable period following the update.

We encourage you to review this Privacy Policy periodically. Continued use of the 99ba platform after the effective date of any update constitutes your acknowledgement of the revised policy. If the changes are significant and you do not agree with them, you should close your account and cease use of the platform before the revised policy takes effect.

16. Contact Us & Complaints

If you have questions about this Privacy Policy, want to exercise any of your privacy rights, or wish to raise a complaint about how 99ba handles your personal data, please contact us:

• Email: support@99ba.click — please use the subject line "Privacy Request" or "Privacy Complaint" as appropriate.
• Live Chat: Available 24/7 via the Help section of your account dashboard. Our support team responds in English and Urdu.

99ba will acknowledge your message within 2 business days and aim to provide a full response within 30 days. For complex requests, we may require additional verification to confirm your identity before processing the request — this is to protect your data, not to create obstacles.

If you are not satisfied with 99ba's response to a privacy complaint after giving us a reasonable opportunity to resolve it, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction or to seek legal remedy through the courts.