by99 Privacy Policy

1 Introduction & Scope

by99 is committed to protecting the privacy and personal data of every player on its platform. This Privacy Policy applies to all personal data collected, processed and stored by by99 in connection with your use of the by99 website, mobile interface, customer support services, and all associated features and tools — regardless of the device or location from which you access the platform.

This Policy applies to all players registered on the by99 platform, including players based in Karachi, Lahore, Islamabad, Faisalabad, Peshawar and all other locations across Pakistan, as well as players accessing the platform internationally.

This Policy does not apply to third-party websites, payment processors, game providers or other external services that may be linked to or integrated with the by99 platform. by99 recommends that you review the privacy policies of those third-party services independently, as their data practices are outside by99's control and responsibility.

2 Data Controller

For the purposes of applicable data protection law, by99 acts as the Data Controller in respect of all personal data collected from players through the by99 platform. As Data Controller, by99 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly and transparently.

If you have any questions, concerns or requests relating to the processing of your personal data by by99, you may contact by99's data protection point of contact at any time using the following details:

• Email: [email protected] (mark your message "Data Privacy Request" in the subject line)
• Live Chat: Available 24/7 on every page of the by99 platform, average response time 3–5 minutes
• Support Languages: English and Urdu

by99 will acknowledge all data-related requests within 48 hours and will use its best endeavours to respond fully within 30 days of receipt of the request, consistent with applicable data protection obligations.

3 Data We Collect

by99 collects personal data through several channels in the course of providing its platform and services. The categories of personal data collected, and the circumstances in which they are collected, are described below:

4 How We Use Your Data

by99 uses the personal data it collects strictly for the following identified and lawful purposes. by99 will not use your personal data for any purpose that is incompatible with those listed below without first obtaining your explicit consent:

• Account Management: Creating, maintaining and securing your by99 account; authenticating your identity at login; managing your PKR wallet balance; and processing account-related requests and updates.
• KYC & Age Verification: Verifying that you meet the minimum age requirement of 21 years; confirming your identity as required under by99's operating licence; and ensuring that you are the legitimate owner of the payment methods registered on your account.
• Payment Processing: Processing deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, 1LINK and USDT TRC20; processing withdrawal requests to your nominated payment method; and maintaining accurate transaction records.
• AML & Fraud Prevention: Monitoring transactions for AML red flags; detecting and investigating suspicious activity; complying with by99's obligations under its operating licence regarding financial crime prevention; and sharing data with relevant regulatory or law enforcement authorities where legally required.
• Platform Improvement: Analysing behavioural and technical data in aggregate and anonymised form to understand how players use the by99 platform, identify bugs and performance issues, and improve the overall player experience.
• Responsible Gaming: Monitoring player activity for indicators of problem gambling behaviour; applying deposit limits, loss limits and self-exclusion restrictions requested by players; and proactively reaching out to players who display concerning patterns of play.
• Customer Support: Responding to queries, complaints and requests submitted via live chat and email; maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Marketing Communications: Sending promotional emails, push notifications and in-platform messages about bonuses, PSL cricket betting promotions, new games and other by99 offers — but only where you have actively opted in to receive such communications, and only via the channels you have authorised.
• Legal & Regulatory Compliance: Meeting by99's obligations under applicable laws, regulations and its gaming licence, including record-keeping requirements, regulatory reporting, and responding to lawful requests from competent authorities.

5 Legal Basis for Processing

by99 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which by99 relies for its data processing activities are as follows:

• Contractual Necessity: Processing of identity data, contact data, financial data and account activity data is necessary for by99 to perform its obligations under the by99 Terms & Conditions — the contract between you and by99. Without this processing, by99 cannot provide you with access to the platform, process your payments, or deliver the services you have requested.
• Legal Obligation: Processing of KYC documents, AML-related transaction monitoring, age verification records, and regulatory reporting data is required to comply with by99's obligations under its operating licence and applicable financial crime prevention regulations.
• Legitimate Interests: Processing of technical data, behavioural data and communications data for fraud prevention, platform security, responsible gaming monitoring and platform improvement is conducted on the basis of by99's legitimate interest in maintaining a safe, secure and fair gaming environment for all players. by99 has assessed that this interest is not overridden by your fundamental rights and freedoms in the context of an adult-regulated gambling platform.
• Consent: Processing of your personal data for direct marketing communications is conducted solely on the basis of your explicit, freely given and revocable consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing based on consent.

6 Cookies & Tracking Technologies

by99 uses cookies and similar tracking technologies on the by99 platform to enable core functionality, improve user experience, and support by99's analytics and security systems. A cookie is a small text file placed on your device by the by99 website when you visit it. by99 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the by99 platform to function correctly and cannot be disabled. They include session management cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery, and cookies that remember your language and currency preferences. No personal data collected by these cookies is used for marketing purposes.
• Functional Cookies: These cookies enable enhanced functionality and personalisation on the by99 platform, such as remembering your preferred game category, your responsible gaming settings, and your in-platform notification preferences. Disabling these cookies may affect the quality of your by99 experience.
• Analytics Cookies: by99 uses first-party analytics cookies to collect aggregated and anonymised data about how players navigate and use the platform. This data is used exclusively to identify areas for improvement and to optimise the by99 platform experience. No individual player is identified from analytics cookie data.
• Security Cookies: These cookies support by99's fraud detection and AML monitoring systems by helping identify unusual patterns of activity — such as logins from unrecognised devices or locations — that may indicate unauthorised account access.

You may manage your cookie preferences via your browser settings at any time. Please note that disabling strictly necessary cookies will affect your ability to use the by99 platform. by99 does not use third-party advertising or tracking cookies that share your data with external advertising networks.

7 Third-Party Data Sharing

by99 does not sell, rent or trade your personal data to any third party. by99 shares personal data with third parties only in the following strictly defined circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment Processors: by99 shares relevant financial and identity data with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, 1LINK and USDT TRC20 processors solely for the purpose of processing your deposits and withdrawals. Each payment processor operates under its own privacy policy and is independently regulated.
• KYC & Identity Verification Providers: by99 uses licensed third-party identity verification services to conduct document verification and age checks as part of the KYC process. These providers are contractually bound to use your data solely for the verification purpose and to maintain strict data security standards.
• Game Content Providers: Casino game providers integrated into the by99 platform may receive anonymised session data — such as game rounds played and RTP statistics — for the purpose of game performance monitoring. These providers do not receive your personally identifiable information.
• Regulatory & Law Enforcement Authorities: by99 will share personal data with gaming regulatory authorities, financial intelligence units, law enforcement agencies and courts where required to do so by applicable law, court order, or regulatory obligation. by99 will notify you of such disclosure where it is legally permitted to do so.
• Business Successors: In the event of a merger, acquisition, restructuring or sale of by99's business or assets, your personal data may be transferred to the successor entity as part of that transaction. by99 will notify you of any such transfer and of any material changes to how your data will be processed as a result.

8 International Data Transfers

The by99 platform serves players across Pakistan and is operated under an internationally recognised gaming licence. As a result, your personal data may be transferred to and processed in countries outside Pakistan, including countries where by99's servers, gaming licence authority, or third-party service providers are located.

Where such international transfers occur, by99 ensures that appropriate safeguards are in place to protect your personal data, including:

• Transferring data only to countries or organisations that maintain an adequate level of data protection as assessed against internationally recognised standards.
• Implementing Standard Contractual Clauses or equivalent contractual safeguards with all international data recipients.
• Conducting data transfer impact assessments where required to evaluate the risks associated with any given transfer and to implement supplementary measures where necessary.

If you would like further information about the specific safeguards applicable to any international transfer of your personal data, please contact by99 at [email protected].

9 Data Retention

by99 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory and licensing obligations — whichever retention period is longer. The general retention periods applied by by99 are as follows:

• Account and Identity Data: Retained for the lifetime of your by99 account plus a minimum of 5 years following account closure, as required by AML regulatory obligations and by99's gaming licence conditions.
• Financial Transaction Data: Retained for a minimum of 5 years from the date of each transaction, in compliance with applicable financial record-keeping regulations and AML requirements.
• KYC Documents: Retained for the lifetime of your account plus 5 years following account closure. In cases involving a suspicious activity report or regulatory investigation, relevant documents may be retained for a longer period as directed by the relevant authority.
• Responsible Gaming Records: Retained for the lifetime of your account plus 5 years. Self-exclusion records are retained for a longer period to prevent re-registration during a self-exclusion period.
• Marketing Consent Records: Retained for the duration of your marketing consent, plus 3 years following withdrawal of consent, as evidence of the consent that was given.
• Technical and Behavioural Data: Retained in identifiable form for up to 24 months from collection, after which it is anonymised or deleted. Anonymised aggregate data may be retained indefinitely for analytical purposes.
• Customer Support Communications: Retained for 3 years from the date of the relevant communication, for quality assurance, dispute resolution and training purposes.

Following the expiry of the applicable retention period, by99 will securely delete or anonymise your personal data in accordance with industry-standard data destruction procedures.

10 Your Data Rights

As a player whose personal data is processed by by99, you hold the following rights in respect of that data. by99 is committed to facilitating the exercise of these rights promptly and without unnecessary barriers:

• Right of Access: You have the right to request a copy of all personal data that by99 holds about you, along with information about how and why that data is being processed. by99 will respond to a valid access request within 30 days.
• Right to Rectification: You have the right to request that by99 correct any inaccurate or incomplete personal data held about you. Some corrections may require supporting documentation to verify the accuracy of the requested change.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent on which processing was based, or where you believe the data has been processed unlawfully. This right is subject to by99's legal data retention obligations — by99 may be required to retain certain data even following a deletion request.
• Right to Restrict Processing: You have the right to request that by99 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on by99's legitimate interests. by99 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent — including marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw marketing consent via your by99 account settings or by emailing [email protected].

To exercise any of these rights, please contact by99 in writing via email to [email protected] with the subject line "Data Rights Request", or via the 24/7 live chat. by99 will verify your identity before processing any rights request to ensure the security of your data.

11 Security Measures

by99 implements and maintains a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and the by99 platform is protected using 256-bit TLS SSL encryption. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive personal data — including KYC documents, payment details and passwords — is stored in encrypted form using industry-standard encryption algorithms. Passwords are stored as one-way cryptographic hashes and are never stored or transmitted in plaintext.
• Access Controls: Access to systems holding player personal data is restricted to by99 personnel and authorised third-party providers on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication requirements for administrative access.
• Regular Security Testing: by99 conducts regular vulnerability assessments, penetration testing and security audits of its platform infrastructure to proactively identify and remediate security weaknesses before they can be exploited.
• Incident Response: by99 maintains a documented data breach incident response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, by99 will notify the relevant regulatory authority within 72 hours of becoming aware of the breach, and will notify affected players without undue delay where required by applicable law.
• Employee Training: All by99 personnel with access to player personal data receive regular data protection training and are contractually bound by confidentiality obligations.

12 Policy Updates & Contact

by99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, by99's business practices, or the technologies used on the platform. The "Last Updated" date at the top of this document will be revised each time a material change is made to this Policy.

Where changes to this Policy are material — meaning they significantly affect your rights or how your personal data is processed — by99 will notify you by:

• Displaying a prominent notification banner on the by99 platform homepage and login page.
• Sending a notification to the email address registered to your by99 account.
• Displaying an in-platform notification upon your next login following the amendment date.

Your continued use of the by99 platform following the effective date of any revision to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must cease using the by99 platform and may request account closure and return of your remaining balance by contacting by99 support.