Privacy Policy for 99ad

§1 Data Controller Identity

For the purposes of this Privacy Policy, the data controller responsible for the personal information of 99ad users is the operating entity behind the 99ad platform at 99ad.bid. 99ad operates under an international online gaming licence and is subject to data protection obligations imposed by that licensing framework.

All data protection enquiries, subject access requests, and privacy complaints should be directed to the 99ad Data Protection contact at [email protected]. Please mark all formal data protection correspondence with the subject line "DATA PROTECTION" for priority routing to the appropriate team.

§2 Personal Data We Collect

99ad collects personal data only where it is necessary for a defined purpose. The following table sets out the categories of personal data 99ad collects, the source of that data, and the purpose for which it is collected.

99ad does not knowingly collect sensitive personal data categories — such as racial or ethnic origin, political opinions, religious beliefs, or biometric data — beyond what is strictly required for KYC identity verification purposes as mandated by 99ad's licensing obligations.

§3 How 99ad Uses Your Personal Data

99ad uses the personal data it collects for the following specific and defined purposes. No personal data collected by 99ad is used for any purpose not listed in this Privacy Policy without prior notice to affected data subjects.

• Account Management: To register, maintain, and administer your 99ad account, including processing login requests, account security verification, and account settings updates.
• Identity Verification (KYC): To verify your identity and age in fulfilment of 99ad's obligations under its international gaming licence, including confirming that you are 21 years of age or older.
• Payment Processing: To process deposits and withdrawals via JazzCash, EasyPaisa, bank transfers, card payments, and cryptocurrency, and to maintain accurate financial records for all 99ad account transactions.
• Gaming Services Delivery: To provide access to casino games, live dealer tables, sports betting markets, and other features of the 99ad platform, and to maintain accurate records of gaming activity for dispute resolution purposes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and unauthorised account access, including by sharing relevant data with fraud prevention partners under appropriate data sharing agreements.
• Responsible Gaming Compliance: To monitor gaming activity for indicators of problem gambling, to implement player-requested responsible gaming tools (deposit limits, self-exclusion, etc.), and to comply with responsible gaming obligations under 99ad's licensing framework.
• Legal and Regulatory Compliance: To fulfil 99ad's obligations under applicable gaming, anti-money laundering, and data protection regulations, including reporting requirements imposed by licensing and regulatory authorities.
• Customer Support: To respond to player queries, complaints, and account assistance requests, and to maintain a record of communications for quality assurance and dispute resolution.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the 99ad platform, identifying technical issues, and optimising user experience — all without identifying individual players.
• Marketing Communications (Consent Only): To send promotional offers, bonus notifications, and news about 99ad to players who have explicitly opted in to receive marketing communications. Players may opt out at any time.

§4 Legal Basis for Processing

99ad processes personal data only where a valid legal basis exists under applicable data protection law. The primary legal bases on which 99ad relies are as follows:

• Contractual Necessity: Processing necessary to perform the contract between 99ad and the Player, including account management, payment processing, game delivery, and KYC verification required to provide the service.
• Legal Obligation: Processing necessary for 99ad to comply with its legal and regulatory obligations, including anti-money laundering reporting, gaming licence compliance, and age verification requirements.
• Legitimate Interests: Processing for purposes of fraud prevention, platform security, and aggregated analytics where such interests do not override the data subject's fundamental rights and freedoms.
• Consent: Processing for marketing communications is conducted only where the Player has given explicit, freely withdrawable consent. Consent may be withdrawn at any time by contacting 99ad support or adjusting account notification settings.

§5 Data Sharing and Disclosure

99ad does not sell, rent, or commercially transfer personal data to any third party for their own commercial or marketing purposes. This is an absolute commitment at 99ad and is not subject to exception. Personal data may, however, be shared with third parties in the following limited and controlled circumstances:

• Licensed Payment Processors: Financial data necessary to process deposits and withdrawals is shared with 99ad's licensed payment processing partners, including JazzCash, EasyPaisa, and banking institutions. All payment processors are contractually bound to process data only for the specified payment purpose.
• Identity Verification Partners: KYC data (including CNIC details and facial photographs) is shared with 99ad's licensed KYC verification technology partner solely for the purpose of identity and age verification. KYC partners are bound by strict confidentiality and data protection obligations.
• Fraud Prevention Services: Aggregated technical data may be shared with fraud prevention and anti-money laundering screening services where 99ad has legitimate grounds to suspect fraudulent activity.
• Gaming Licence Regulatory Authorities: 99ad's gaming licence requires the submission of periodic compliance reports and the provision of specific player data to the applicable regulatory authority upon lawful request. Such disclosures are made only where legally mandated.
• Law Enforcement: 99ad will disclose personal data to law enforcement agencies where required to do so by valid court order, legal process, or mandatory statutory reporting obligation.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets involving the 99ad business, personal data may be transferred to the acquiring entity, subject to the acquiring entity being bound by obligations no less protective than those set out in this Privacy Policy.

§6 Cookies and Tracking Technologies

The 99ad platform uses cookies and similar tracking technologies to operate the website correctly, maintain user sessions, analyse platform performance, and deliver relevant content. The following categories of cookies are used on the 99ad platform:

Players may manage cookie preferences through their browser settings. Disabling strictly necessary cookies will prevent access to the 99ad platform. Instructions for managing cookies in common browsers (Chrome, Firefox, Safari) are available through those browsers' respective help documentation.

§7 Data Security Measures

99ad takes the security of player personal data seriously and implements a comprehensive set of technical and organisational security measures to protect data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between player devices and 99ad's servers is encrypted using Transport Layer Security (TLS) with a minimum 256-bit cipher strength.
• Password Hashing: Player account passwords are stored exclusively in cryptographically hashed form using industry-standard algorithms. Plaintext passwords are never stored or accessible to any 99ad system or personnel.
• OTP Authentication: Login from new devices triggers mandatory one-time password (OTP) verification via the Player's registered Pakistani mobile number, providing a second authentication factor against unauthorised account access.
• Database Encryption at Rest: All personally identifiable data stored in 99ad's databases is encrypted at rest, providing an additional layer of protection against data breach scenarios.
• Access Controls: Access to personal data within 99ad's systems is restricted on a strict need-to-know basis. Internal access is logged, audited, and subject to regular review by 99ad's security team.
• Regular Security Audits: 99ad's platform and data security posture is subject to regular independent security audits and vulnerability assessments, with findings acted upon promptly.
• Data Breach Response: 99ad maintains a documented data breach response procedure. In the event of a data breach likely to result in risk to Player rights and freedoms, 99ad will notify affected Players without undue delay and will report to relevant regulatory authorities where required.

§8 Data Retention

99ad retains personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected, to comply with applicable legal and regulatory obligations, or to resolve disputes and enforce agreements. The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship plus 5 years following permanent account closure, in fulfilment of 99ad's gaming licence audit and anti-money laundering record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction in accordance with 99ad's anti-money laundering compliance obligations.
• KYC Documentation: Retained for 5 years from the date of verification or from account closure, whichever is later, as required under 99ad's licensing framework.
• Customer Support Communications: Retained for 3 years from the date of the most recent interaction, for quality assurance and dispute resolution purposes.
• Technical and Usage Data: Aggregated platform analytics data is retained indefinitely in anonymised form. Individually identifiable technical logs are retained for 12 months.
• Marketing Consent Records: Consent records are retained for 3 years from the date of consent or withdrawal of consent, whichever is later, to demonstrate regulatory compliance.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with 99ad's documented data disposal procedures. Players who close their accounts may request confirmation that their data has been deleted to the extent permitted by applicable legal and regulatory obligations.

§9 Your Data Subject Rights

As a data subject, you hold the following rights with respect to the personal data that 99ad holds about you. These rights may be exercised at any time by contacting 99ad's data protection team at [email protected] with "DATA SUBJECT REQUEST" in the subject line.

• Right of Access: You have the right to request a copy of all personal data that 99ad holds about you, along with information about how that data is used and who it is shared with.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data that 99ad holds about you. Account holders may also correct certain data directly through their account settings panel.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal or regulatory retention obligations applicable to 99ad.
• Right to Restriction of Processing: You have the right to request that 99ad restricts processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to 99ad in a structured, commonly used, and machine-readable format, and to request that this data be transmitted to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your personal data for legitimate interest purposes or direct marketing at any time. Where you object to direct marketing, 99ad will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

99ad will respond to all data subject requests within 30 calendar days of receipt. Where a request is complex or numerous, 99ad may extend this period by a further 60 days, in which case 99ad will inform you of the extension and the reasons for it within the initial 30-day period.

§10 Children's Privacy — 21+ Platform

If you believe that a minor has registered an account on the 99ad platform and their personal data is being processed, please contact 99ad immediately at [email protected] with the subject line "MINOR ACCOUNT CONCERN" and the matter will be investigated and resolved with the highest priority within 24 hours of receipt.

§11 International Data Transfers

As an internationally licensed gaming platform serving players across Pakistan and operating on globally distributed infrastructure, 99ad may transfer personal data to servers and service providers located outside of Pakistan. Where such transfers occur, 99ad ensures that adequate protections are in place to safeguard your personal data, including:

• The use of Standard Contractual Clauses (SCCs) or equivalent international data transfer mechanisms where applicable.
• Ensuring receiving entities are bound by contractual data protection obligations no less stringent than those applicable to 99ad under this Privacy Policy.
• Assessing the data protection laws and practices of recipient countries as part of 99ad's data transfer impact assessment process.

Players who have concerns about the international transfer of their personal data may contact 99ad's data protection team at [email protected] for further information about the specific safeguards in place for such transfers.

§12 Third-Party Services and Links

The 99ad platform may reference or link to third-party game providers, payment processing services, and technology partners. This Privacy Policy applies only to personal data processed by 99ad directly in its capacity as data controller. 99ad is not responsible for the privacy practices of third-party service providers, including game studios whose titles appear within the 99ad casino lobby.

All third-party providers integrated into the 99ad platform — including game studios, payment processors, and identity verification services — are subject to contractual data processing agreements that restrict their use of any 99ad player data to the specific service purpose for which it is shared. However, where a Player accesses a third-party service independently of the 99ad platform, that third party's own privacy policy governs the processing of personal data in that context, not this Privacy Policy.

§13 Amendments to This Privacy Policy

99ad reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or 99ad's data processing practices. Material amendments that significantly affect the rights of data subjects will be communicated to registered Players via email to their registered address and/or via a prominent notice on the 99ad platform, with a minimum of 14 days' notice before the amended policy takes effect.

The current version of this Privacy Policy, with its version number and effective date, is always accessible at 99ad.bid/privacy-policy. Players who continue to use the 99ad platform following the effective date of an amendment accept the revised Privacy Policy. Players who do not accept the revised Privacy Policy should cease using all 99ad services and request account closure.

§14 Contact & Privacy Complaints

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how 99ad processes your personal data, please contact the 99ad data protection team using the details below. All privacy-related correspondence receives priority handling by a dedicated member of our team.

For full details on the games and services available at 99ad, please also review our Terms & Conditions and our Responsible Gaming policy, which together form the complete legal framework governing your use of the 99ad platform.