y9990 Privacy Policy

1 Introduction

Welcome to y9990. We are committed to protecting the personal data of every player who uses our Platform. This Privacy Policy sets out in clear, legal-grade terms exactly how y9990 collects, stores, processes, shares, and protects your personal information when you access y9990.net or use any service offered on the Platform.

y9990 operates under an international gaming licence and is fully committed to upholding the privacy rights of all Pakistani players and users of the Platform. This policy applies to all individuals who register a Player Account, browse the Platform as a guest, contact our support team, or interact with y9990 in any other capacity.

This Privacy Policy is to be read alongside the y9990 Terms & Conditions and Responsible Gaming Policy, both of which are available on this Platform. In the event of any inconsistency between this Privacy Policy and the Terms & Conditions with respect to data handling, this Privacy Policy shall prevail.

2 Personal Data We Collect

y9990 collects the following categories of personal data from players and Platform users. We collect only what is necessary for the stated purposes described in Section 5 of this policy.

y9990 does not collect special-category sensitive data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where health-related information is voluntarily disclosed by a player in the context of a responsible gaming self-exclusion request. In that case, it is processed only to give effect to the player's own request.

3 How We Collect Your Data

y9990 collects personal data through the following channels:

• Direct provision by you: When you register a Player Account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, or enter a promotion, you directly provide us with personal data.
• Automated technical collection: When you visit y9990.net, our servers automatically log Technical Data and Usage Data through server logs, cookies, pixel tags, and similar tracking technologies. See Section 9 for full details on cookies.
• Third-party KYC and payment providers: When you complete KYC verification or process a payment via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or debit card, our service providers may supply y9990 with verification status and transaction reference data.
• Fraud prevention and AML screening services: y9990 may receive data from third-party risk screening services as part of our anti-money laundering and fraud detection obligations.

4 Legal Basis for Processing

y9990 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to enter into or perform the Player Account agreement with you, including account registration, payment processing, KYC, and gameplay.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorist financing (CTF), and gaming licence regulatory requirements, including mandatory record-keeping and identity verification obligations.
• Legitimate interests: Processing carried out for y9990's legitimate business interests, including fraud prevention, Platform security, service improvement, and responsible gaming monitoring, provided these interests are not overridden by your data protection rights.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily in the context of marketing communications. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

5 How We Use Your Personal Data

y9990 uses your personal data for the following specific purposes:

• To create, operate, and maintain your y9990 Player Account and provide access to all Platform services.
• To verify your identity through KYC processes, including CNIC document verification, as required by our gaming licence conditions.
• To process deposits and withdrawals in PKR via your chosen payment method (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or debit card) and to maintain accurate financial records of all transactions.
• To detect, investigate, and prevent fraud, money laundering, unauthorised account access, bonus abuse, and other prohibited conduct as defined in the y9990 Terms & Conditions.
• To monitor gameplay for responsible gaming purposes, including enforcing deposit limits, cooling-off periods, and self-exclusion requests placed by or on behalf of Players.
• To provide 24/7 customer support via live chat and email, and to maintain records of support interactions for quality assurance and complaint resolution purposes.
• To communicate with you about your account status, transaction confirmations, security alerts, and material updates to Platform policies.
• To send promotional communications, including bonus offers, free spins, and tournament invitations, where you have provided consent or where permitted by applicable law.
• To carry out Platform analytics, A/B testing, and product development to improve the y9990 gaming experience for all Pakistani players.
• To comply with all applicable legal, regulatory, and licensing obligations, including mandatory reporting to relevant authorities where legally required.

6 Sharing Your Personal Data

y9990 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited and controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and debit card processing partners receive the minimum financial data necessary to authorise and settle transactions. These providers are contractually bound to process data only for payment purposes and to maintain appropriate security standards.
• KYC and identity verification providers: Third-party KYC service providers receive identity documents and related data solely to perform mandatory identity verification. They are prohibited from using this data for any other purpose.
• Fraud prevention and AML screening services: y9990 may share data with risk intelligence and AML screening services to fulfil our legal obligations in relation to financial crime prevention. Data shared with these providers is strictly limited to what is necessary for screening purposes.
• Game content providers: Third-party game studios and live casino providers may receive anonymised or pseudonymised session data necessary for game delivery and RNG certification. They do not receive identifiable personal data unless technically required for a specific live casino integration, in which case data minimisation principles apply.
• Regulatory and law enforcement authorities: y9990 will disclose personal data to gaming regulators, financial intelligence units, courts, or law enforcement agencies where required to do so by a valid legal order, warrant, or regulatory requirement. y9990 will, where legally permitted, notify affected players of such disclosures.
• Professional advisers: Lawyers, auditors, and insurers acting as professional advisers to y9990 may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

All third-party service providers engaged by y9990 are required to enter into data processing agreements that impose data protection obligations consistent with applicable law and y9990's own standards. y9990 conducts due diligence on all third-party data processors before engagement.

7 International Data Transfers

As an internationally licensed gaming operator, y9990 may transfer your personal data to servers or service providers located outside Pakistan. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable under y9990's licensing obligations, y9990 will implement appropriate safeguards, which may include:

• Standard contractual clauses (SCCs) approved by a recognised data protection authority, incorporated into agreements with the receiving third party.
• Binding corporate rules applicable to transfers within the y9990 group of companies, where applicable.
• Adequacy decisions recognising the receiving country as providing an adequate level of data protection.

By registering a Player Account on y9990, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan. y9990 will always ensure that such transfers are made with appropriate safeguards in place and that your data protection rights are respected regardless of where processing occurs.

8 Data Retention

y9990 retains your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law and our gaming licence conditions. The following general retention periods apply:

• Player Account data and transaction records: Retained for a minimum of five (5) years following account closure, as required by AML and gaming regulatory obligations.
• KYC identity documents: Retained for a minimum of five (5) years following the completion of verification or account closure, whichever is later.
• Support correspondence and complaint records: Retained for three (3) years following the resolution of the relevant matter.
• Marketing preferences and consent records: Retained for the duration of your Player Account and for two (2) years following account closure or withdrawal of consent, whichever is earlier.
• Technical and usage data: Retained for up to thirteen (13) months from collection for analytics and fraud prevention purposes, after which it is anonymised or deleted.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data must be retained beyond the standard retention period due to an ongoing legal dispute, regulatory investigation, or audit, it will be retained only until that matter is concluded.

9 Cookies & Tracking Technologies

y9990 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit y9990.net. Cookies allow us to recognise your device, maintain your session, and improve your overall experience on the Platform.

y9990 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the operation of the Platform. These cookies enable you to log in to your Player Account, maintain your session securely, and use core Platform features. They cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to collect anonymised or pseudonymised data about how players navigate and use the Platform, including pages visited, time spent, and features accessed. This data helps y9990 improve Platform performance and user experience.
• Functional cookies: Used to remember your preferences, such as preferred language, previously selected games, and responsible gaming settings, so that you do not need to re-enter them each visit.
• Marketing and targeting cookies: Used only where you have provided explicit consent, to deliver relevant promotional content about y9990 bonuses, tournaments, and Platform features. y9990 does not use third-party advertising cookies for cross-site tracking.

Third-party service providers engaged by y9990 (such as analytics platforms and payment processors) may set their own cookies on the Platform. These providers act as independent data controllers for their own cookies, and their data practices are governed by their own privacy policies.

10 Your Data Protection Rights

Subject to applicable law and the legitimate interests of y9990 in fraud prevention and regulatory compliance, you have the following rights in relation to your personal data held by y9990:

• Right of access: You have the right to request a copy of the personal data y9990 holds about you, together with information about how it is processed.
• Right of rectification: You have the right to request the correction of inaccurate or incomplete personal data held by y9990. Certain data, such as CNIC-verified identity information, may require re-verification before correction can be applied.
• Right to erasure: You have the right to request the deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected. This right is subject to y9990's legal obligations to retain data as described in Section 8.
• Right to restriction of processing: You have the right to request that y9990 restrict the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of the data is being resolved.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to y9990 in a structured, commonly used, machine-readable format, and to have it transmitted directly to another controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data on the basis of legitimate interests, including profiling, and to object to direct marketing processing at any time.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact y9990 support via live chat or by email at [email protected]. y9990 will respond to all data rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further two (2) months, in which case y9990 will notify you of the extension and the reasons for it.

y9990 will not charge a fee for processing data rights requests unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply or the request may be declined.

11 Children's Privacy

If you are a parent or guardian and believe that a minor has registered an account or provided personal data to y9990, please contact our support team immediately via live chat or at [email protected]. y9990 will take prompt action to investigate and, where confirmed, to close the account and delete the minor's data to the extent permitted by law.

y9990 employs age verification measures at the point of registration and as part of the KYC process to prevent underage access to real-money gaming. These measures include CNIC verification, which requires players to confirm they are Pakistani nationals aged 21 or above.

12 Marketing Communications

With your prior consent, y9990 may send you promotional communications about bonuses, free spins, new game releases, PSL cricket betting markets, slot tournaments, and other Platform features. Marketing communications will be delivered via the email address and/or Pakistani mobile number associated with your Player Account.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by y9990.
• Updating your communication preferences directly within your Player Account settings.
• Contacting y9990 support via live chat and requesting removal from all marketing lists.

Please note that opting out of marketing communications will not affect the delivery of transactional or account-related communications, such as deposit confirmations, withdrawal notifications, KYC requests, or security alerts. These communications are sent on the basis of contractual necessity and cannot be opted out of while your Player Account remains active.

y9990 does not share your contact details with third-party marketers for the purpose of sending you unsolicited marketing communications from third parties.

13 Security Measures

y9990 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include, but are not limited to:

• TLS encryption: All data transmitted between your browser or device and the y9990 Platform is encrypted using Transport Layer Security (TLS) protocols to prevent interception in transit.
• Encrypted data storage: Sensitive personal data, including financial information and identity documents, is stored in encrypted form on secure servers. Encryption keys are managed using industry-standard key management practices.
• Access controls: Access to personal data within y9990's systems is restricted on a need-to-know basis. All staff with access to personal data undergo regular data protection training and are bound by confidentiality obligations.
• Two-factor authentication (2FA): y9990 supports 2FA for Player Account login and strongly encourages all players to enable this feature to protect their accounts from unauthorised access.
• Intrusion detection and monitoring: y9990's Platform is monitored continuously for suspicious activity, attempted breaches, and anomalous behaviour. Automated systems flag unusual login attempts, large withdrawal requests, and other risk indicators for review.
• Regular security auditing: y9990 conducts regular independent security audits and penetration testing of the Platform to identify and remediate vulnerabilities before they can be exploited.

While y9990 takes all reasonable steps to protect your personal data, no security system is completely impenetrable. In the event of a data security incident that poses a risk to your rights and freedoms, y9990 will notify affected players promptly and take all necessary steps to contain and remediate the incident.

14 Changes to This Privacy Policy

y9990 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our gaming licence conditions, the services we offer, or our data processing practices. The most current version of this Privacy Policy will always be available at y9990.net/privacy-policy.

In the event of a material change to this Privacy Policy — meaning a change that significantly affects your rights or the manner in which y9990 processes your personal data — y9990 will provide advance notice to registered players via the email address associated with their Player Account and/or by means of a prominent notice on the Platform, no less than fourteen (14) days before the change takes effect.

Your continued use of the y9990 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the updated policy. If you do not accept a material amendment, you may close your Player Account before the amendment takes effect by contacting y9990 support via live chat.

15 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which y9990 processes your personal data, please contact our dedicated Privacy support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within the y9990 Platform after logging in to your Player Account. This is the fastest way to reach our support team for any data-related enquiry.
• Email: [email protected] — please include "Privacy Enquiry" in your subject line to ensure your message is directed to the correct team.

y9990 aims to acknowledge all privacy-related enquiries within forty-eight (48) hours and to provide a substantive response within thirty (30) days of receipt. For data rights requests, please refer to the timelines set out in Section 10 above.

If you are not satisfied with y9990's response to a privacy complaint, you may have the right to escalate your complaint to the relevant data protection authority or gaming regulator in the jurisdiction applicable to your Player Account under y9990's operating licence conditions.