Privacy Policy – 99ba Data Protection Notice

1. Data Controller

The data controller responsible for personal data collected through the 99ba platform is 99ba (referred to throughout this Privacy Policy as "99ba", "we", "us", or "our"). By registering an account on the 99ba platform or by submitting personal information through any part of the 99ba website, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

If you have questions about this Privacy Policy or wish to exercise any of your data rights described in Section 11, please contact 99ba's data compliance team using the contact details published on this site. Contact is available via the email address displayed in the footer of this page.

2. Data We Collect

99ba collects the following categories of personal data from users of the platform:

99ba does not knowingly collect personal data from persons under 18 years of age. If we become aware that data has been collected from a minor, that data will be deleted and the associated account will be closed immediately.

3. How We Collect Data

99ba collects personal data through the following mechanisms:

• Direct submission: Data you provide voluntarily when registering an account, completing KYC, initiating a deposit or withdrawal, or contacting our support team;
• Automated technical collection: Device and connection data collected automatically when you access the 99ba platform, including IP address, browser fingerprint, and session identifiers;
• Transaction records: Financial data generated when you make deposits or request withdrawals via JazzCash, Easypaisa, bank transfer, card, or cryptocurrency;
• Platform activity logs: Betting history, game outcomes, and session duration data recorded as part of the normal operation of the 99ba gaming platform;
• Cookies and similar technologies: See Section 9 for full details on cookie usage.

4. Legal Basis for Processing

99ba processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil the account registration contract, process your deposits and withdrawals, settle bets, and provide the Services you have requested;
• Legal obligation: Processing required to comply with applicable KYC, anti-money laundering (AML), and financial reporting obligations;
• Legitimate interests: Processing necessary for fraud prevention, platform security, abuse detection, and service improvement, where such interests are not overridden by your data protection rights;
• Consent: Where you have provided specific consent to a particular form of processing, such as receiving marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

5. How We Use Your Data

99ba uses your personal data for the following purposes:

• To create, manage, and maintain your 99ba account, including processing your registration and verifying your identity via KYC;
• To process deposits and withdrawals in PKR via JazzCash, Easypaisa, bank transfer, card, and cryptocurrency channels;
• To settle sports bets, casino game outcomes, slot results, and card game sessions;
• To detect and prevent fraudulent activity, including the use of multiple accounts, bonus abuse, and money laundering;
• To comply with applicable AML, counter-terrorism financing, and financial compliance obligations;
• To enforce 99ba's Terms & Conditions, including age verification and the one-account-per-person rule;
• To communicate with you regarding your account status, security alerts, and significant platform changes;
• To provide customer support and resolve disputes or queries you raise through our support channels;
• To administer responsible gaming tools including deposit limits, self-exclusion, and session reminders;
• To send marketing communications where you have provided consent to receive them, and to target platform improvements based on aggregated usage data.

6. Data Sharing & Disclosure

99ba does not sell your personal data to third parties. We may share your data with the following categories of recipient in the circumstances described below:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa, Mastercard, and USDT processing partners receive the minimum data necessary to execute your requested transactions;
• KYC and identity verification providers: Third-party identity verification services that assist 99ba in validating CNIC documents and confirming user identity;
• Fraud and AML screening services: Providers of transaction monitoring and fraud detection tools that help 99ba fulfil its compliance obligations;
• Game content providers: Licensed game studios whose titles appear on the 99ba platform may receive anonymised session data for game performance and RNG auditing purposes;
• Regulatory and law enforcement authorities: Where required by applicable law or valid legal process, 99ba may disclose personal data to competent authorities;
• Professional advisers: Legal, audit, and financial advisers acting under professional confidentiality obligations.

All third parties with whom 99ba shares personal data are required to process that data in accordance with applicable privacy requirements and 99ba's instructions. 99ba does not permit third-party processors to use shared data for their own independent purposes.

7. KYC & Identity Verification

CNIC-based KYC verification is a mandatory requirement for all 99ba account holders before withdrawal functionality is enabled. During KYC, 99ba collects and processes the following identity data:

• Your full legal name as it appears on your CNIC;
• Your CNIC number;
• Photographic images of the front and reverse of your CNIC;
• Your date of birth (to confirm the 18+ age requirement);
• Where requested, additional documentation to confirm address or source of funds.

KYC data is processed strictly for identity verification and legal compliance purposes. CNIC images and associated identity documents are stored in an encrypted format and are not made available to third parties except for the limited KYC verification purposes described in Section 6. CNIC data is retained for the period described in Section 10.

By submitting your CNIC to 99ba, you confirm that the document is genuine, that the identity presented is your own, and that you consent to the processing of this sensitive identity data for the purposes described in this Privacy Policy.

8. Payment Data

When you make a deposit or withdrawal on the 99ba platform, financial data is processed in order to execute the transaction. The specific data processed depends on the payment method selected:

• JazzCash / Easypaisa: Your registered mobile wallet number and the transaction reference generated by the wallet provider;
• Bank transfer (HBL, UBL, Meezan Bank, Bank Alfalah): Your bank account number or IBAN and the associated bank reference code;
• Card payments (Visa / Mastercard): Card number, expiry date, and cardholder name. Full card numbers are not stored by 99ba following transaction authorisation. Card data is processed by PCI-DSS compliant payment processors;
• USDT TRC20: Your wallet address and transaction hash. Blockchain transactions are publicly visible by their nature.

99ba maintains a full record of all deposit and withdrawal transactions associated with your account, including amounts in PKR, timestamps, payment method used, and transaction status. This data is retained for the period described in Section 10 and may be required to be disclosed to regulatory authorities in response to valid legal process.

9. Cookies & Tracking

The 99ba platform uses cookies and similar tracking technologies to operate correctly, maintain your session, and improve the user experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your 99ba account. These cannot be disabled without disrupting platform functionality;
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and recent game history;
• Analytics cookies: Collect anonymised data about how users interact with the 99ba platform to identify usability issues and prioritise improvements. This data does not identify you personally;
• Security cookies: Used to detect bot activity, fraudulent login attempts, and session hijacking threats.

You may control non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of the 99ba platform. Continuing to use the platform without adjusting your cookie settings constitutes consent to the use of cookies as described in this section.

10. Data Retention

99ba retains personal data for as long as necessary to fulfil the purposes described in this Privacy Policy and to comply with applicable legal obligations. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping obligations;
• KYC and CNIC documents: Retained for the duration of the account and for a minimum of five (5) years post-closure;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Technical and session data: Retained for up to ninety (90) days for security and fraud prevention purposes, after which it is deleted or anonymised;
• Support communications: Retained for up to three (3) years from the date of the last interaction.

Where data is no longer required, 99ba will delete or anonymise it in a manner that prevents reconstruction of your identity from the retained data.

11. Your Rights

Subject to applicable law and the specific circumstances of your request, you may have the following rights in relation to your personal data held by 99ba:

• Right of access: You may request a copy of the personal data 99ba holds about you;
• Right to rectification: You may request correction of inaccurate personal data. Note that KYC data can only be corrected through a formal re-verification process;
• Right to erasure: In certain circumstances you may request deletion of your personal data. This right may be limited where retention is required by legal obligation (for example, AML record-keeping requirements);
• Right to restriction: You may request that 99ba restrict the processing of your data in certain circumstances, for example while a complaint or accuracy dispute is under review;
• Right to object: You may object to processing based on legitimate interests, including direct marketing;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact 99ba using the contact information in the footer of this page. 99ba will respond to verified requests within a reasonable period. Identity verification may be required before a request is processed.

12. Security Measures

99ba implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the 99ba platform;
• Encryption at rest for sensitive data including KYC documents and financial records;
• Access controls restricting internal access to personal data on a need-to-know basis;
• Multi-factor authentication for administrative access to systems processing personal data;
• Continuous monitoring for security anomalies and intrusion attempts;
• Regular security assessments and penetration testing of platform systems.

This Privacy Policy may be updated periodically. Material changes will be communicated to registered users via their registered mobile number or email address. The "Last Updated" date at the top of this page reflects the most recent revision.