br999 Privacy Policy — How We Collect, Use & Protect Your Personal Data

1 Introduction & Scope

br999 takes the privacy and security of its players' personal data with utmost seriousness. This Privacy Policy sets out in full and transparent terms the data practices of the br999 platform — covering what personal data we collect, the lawful basis on which we collect and process it, how it is used, with whom it may be shared, how long it is retained, and the rights available to you as a data subject.

This Privacy Policy applies to all individuals who visit the br999 website at br999.vu, register a br999 account, access any br999 gaming or sportsbook service, contact br999 customer support, or otherwise interact with the br999 platform in any capacity. It applies equally to players accessing br999 from Karachi, Lahore, Faisalabad, Rawalpindi, Islamabad, Multan, or any other location.

Where br999 processes personal data on behalf of third-party content providers — such as live casino game operators or software providers whose games are available in the br999 lobby — br999 does so strictly in accordance with its data processing agreements with those providers, and does not share identifiable player data with game providers beyond what is technically required to deliver the gaming service.

2 Data Controller

For the purposes of applicable data protection legislation, the data controller in respect of personal data processed through the br999 platform is the licensed operator entity that holds the br999 international gaming licence and operates the platform at br999.vu. References to "br999", "we", "us", or "our" throughout this Privacy Policy refer to that entity in its capacity as data controller.

Where br999 engages third-party service providers to process personal data on its behalf — for example, payment processors such as JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or SadaPay, or identity verification service providers for KYC processing — those providers act as data processors under written contractual arrangements that bind them to process data only on br999's documented instructions and to implement appropriate security measures.

3 Personal Data We Collect

br999 collects personal data across several categories, depending on your relationship with the platform. The following table sets out the main categories of personal data we collect and the context in which each category is gathered:

br999 does not collect sensitive categories of personal data — including data concerning racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — except where explicitly required by our licensing obligations or where you have provided such data voluntarily in the context of a responsible gaming self-assessment.

4 How We Collect Your Data

br999 collects personal data through the following primary channels:

4.1 Data You Provide Directly

The majority of personal data br999 holds about you is data that you have provided to us directly — through the account registration form, the KYC document upload process, payment method entry during deposit and withdrawal, customer support communications via live chat or email, and through the completion of any promotional or responsible gaming forms on the platform.

4.2 Data Collected Automatically

When you access the br999 platform, certain technical data is collected automatically by our servers and analytics systems. This includes your IP address, device identifier, browser type and version, operating system, referring URL, pages viewed, session start and end times, and in-session events such as game launches. This data is collected to maintain platform security, detect fraudulent access, and optimise platform performance.

4.3 Data From Third-Party Verification Partners

Where br999 uses third-party identity verification or fraud prevention services to assist with KYC processing, those services may return data to br999 confirming or supplementing the information you have provided. br999 does not use such services to collect data beyond what is necessary for identity verification and AML compliance purposes.

4.4 Data From Payment Service Providers

When you make a deposit or request a withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, or USDT TRC20, our payment service providers transmit confirmation data to br999, including transaction reference numbers, amounts, timestamps, and payment method identifiers. Full payment credentials (such as complete bank account numbers or full card numbers) are never transmitted to br999 — payment processors retain full credential data within their own secure environments.

5 Legal Basis for Processing

br999 processes your personal data on the following lawful bases, depending on the specific processing purpose:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a br999 account holder — including account management, game provision, payment processing, and customer support.
• Legal Obligation: Processing required to comply with our international gaming licence conditions, anti-money-laundering legislation, and any other applicable regulatory or legal requirement — including KYC verification, transaction record-keeping, and regulatory reporting.
• Legitimate Interests: Processing that serves br999's legitimate business interests, where those interests are not overridden by your data protection rights — including fraud prevention, platform security, platform improvement, and analytics. br999 applies a legitimate interests assessment to all processing relying on this basis.
• Consent: Where br999 seeks to send you marketing communications or to process data for any purpose beyond the above categories, we will seek your explicit, freely given, and revocable consent. You may withdraw consent for marketing communications at any time by contacting br999 support.

6 How We Use Your Personal Data

br999 uses your personal data for the following purposes:

• Creating, maintaining, and managing your br999 account, including authentication and security;
• Processing deposits and withdrawals via your chosen PKR payment method;
• Conducting identity and payment method verification (KYC) as required by our international gaming licence;
• Providing access to and operation of casino games, sportsbook markets, and all other br999 platform features;
• Calculating, crediting, and monitoring bonus funds, wagering progress, and VIP loyalty tier status;
• Operating and enforcing responsible gaming tools including deposit limits, cool-off periods, and self-exclusion;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Responding to customer support requests via live chat, email, and any other communication channel;
• Complying with applicable legal and regulatory obligations, including reporting requirements under our gaming licence;
• Improving platform functionality, user experience, and game performance through aggregated, anonymised analytics;
• Sending transactional communications related to your account, including deposit confirmations, withdrawal notifications, and security alerts — these communications are essential and cannot be opted out of while your account is active;
• Sending promotional communications about br999 bonuses, offers, and platform updates, where you have consented to receive such communications.

7 Data Sharing & Disclosure

br999 does not sell, rent, lease, or commercially transfer your personal data to any third party. We share personal data only in the following circumstances, and only to the extent strictly necessary for each purpose:

• Payment Processors: We share the minimum necessary data with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT processing services to execute your deposit and withdrawal instructions. These providers process your data under their own privacy policies and are bound by applicable financial services data protection obligations.
• KYC & Identity Verification Partners: To fulfil our gaming licence KYC obligations, we may share identity documents and related data with authorised identity verification service providers. These providers are contracted to process such data solely for verification purposes.
• AML & Fraud Prevention Services: br999 uses specialist fraud detection and AML screening services. These services receive transaction and identity data to assist in identifying suspicious activity and may flag accounts for additional review.
• Gaming Software Providers: Game providers whose titles are available on the br999 platform may receive session data (but not full identity data) to facilitate game delivery and resolve technical disputes.
• Regulatory & Law Enforcement Authorities: br999 will disclose personal data to regulatory bodies, gaming licensing authorities, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or our gaming licence conditions. br999 will notify affected players of such disclosures where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of br999's business assets, personal data held by br999 may be transferred to the acquiring entity, subject to the same privacy protections set out in this policy.

8 Cookies & Tracking Technologies

The br999 platform uses cookies and similar tracking technologies to operate correctly, maintain your logged-in session, prevent fraud, and understand how players interact with different areas of the platform. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the br999 platform to function and cannot be disabled. They include session cookies that maintain your login state, security tokens that protect against cross-site request forgery, and cookies required to remember your responsible gaming preferences. These cookies do not track you across third-party sites.
• Functional Cookies: These cookies remember your preferences — such as language settings and last-selected game category — to improve your experience on subsequent visits. They are not used for advertising purposes.
• Analytics Cookies: br999 uses anonymised analytics tools to understand aggregate platform usage patterns — including which games are most popular, session duration trends, and deposit flow conversion. These cookies process data in anonymised or pseudonymised form and are not used to identify individual players.
• Security Cookies: br999 uses cookies as part of its device fingerprinting and fraud detection systems to identify unusual login patterns and alert players to suspicious account access attempts.

You may configure your browser to refuse or delete cookies. However, disabling strictly necessary cookies will prevent the br999 platform from functioning correctly and will result in your inability to log in or conduct transactions. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

9 Data Retention

br999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to our obligations under applicable law and gaming licence conditions. The following retention periods apply:

• Account Data & Identity Records: Retained for a minimum of five (5) years from the date of account closure, as required by AML legislation and gaming licence audit requirements.
• Transaction Records: All deposit and withdrawal records, including supporting KYC documentation, are retained for a minimum of five (5) years from the date of each transaction.
• Gaming Activity Data: Bet history, game session records, and wagering data are retained for a minimum of three (3) years from the date of each session.
• Customer Support Communications: Live chat transcripts and email correspondence are retained for twenty-four (24) months from the date of each interaction, unless the subject matter requires longer retention for legal or dispute purposes.
• Technical & Log Data: Server access logs and security event logs are retained for twelve (12) months from the date of generation, unless required for longer in the context of an ongoing fraud investigation or legal proceeding.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify any individual.

10 Data Security

br999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS encryption of all data transmitted between your device and the br999 platform;
• AES-256 encryption of personal data at rest on br999's servers;
• Strict role-based access controls limiting employee access to personal data on a need-to-know basis;
• Multi-factor authentication required for all administrative access to systems holding personal data;
• Regular third-party security audits and penetration testing of platform infrastructure;
• Incident response and data breach notification procedures, including notifying affected players and relevant authorities in the event of a significant data breach within the timeframe required by applicable law.

While br999 takes all reasonable steps to protect your data, no internet-based system can be guaranteed to be 100% secure. Players are responsible for maintaining the security of their own account credentials, enabling two-factor authentication, and promptly notifying br999 support if they suspect unauthorised access to their account.

11 Your Data Rights

Subject to applicable law and our gaming licence obligations, registered br999 players hold the following rights in relation to their personal data:

To exercise any of the above rights, please contact the br999 support team via live chat within your account dashboard or via the email address displayed in the footer of this page. We will respond to all verified data rights requests within thirty (30) days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further thirty (30) days with prior notice to you.

Please note that certain rights are subject to limitations under our gaming licence obligations — in particular, the right to erasure cannot be applied to transaction records and identity documents that we are legally required to retain for AML compliance purposes. Where we are unable to fulfil a rights request in full, we will explain the reasons for the limitation clearly.

12 Children & Minors — 21+ Only

The br999 platform is strictly restricted to individuals aged 21 years and above. br999 does not knowingly collect or process personal data relating to individuals under 21 years of age. The br999 registration process includes an age declaration, and KYC verification confirms the age of all account holders prior to withdrawal processing.

If br999 becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately suspended and all personal data associated with the account will be deleted as promptly as our legal obligations permit. Any balance held in the account of an underage player will be handled in accordance with our Terms & Conditions and applicable gaming licence requirements.

If you believe that a minor in your household may have accessed the br999 platform, please contact br999 support immediately via live chat for assistance.

13 International Data Transfers

As an internationally licensed gaming operator, br999 may transfer personal data to countries outside Pakistan for processing in connection with the services described in this Privacy Policy — for example, to KYC verification providers, AML screening services, or gaming software providers whose infrastructure is located in other jurisdictions.

Where br999 transfers personal data internationally, we implement appropriate safeguards to protect the security and integrity of that data, including contractual data protection clauses and, where applicable, transfer to jurisdictions that maintain recognised data protection standards. In all cases, international data transfers are conducted on a data-minimisation basis — only the data necessary for the specific processing purpose is transferred.

14 Third-Party Content & Links

The br999 platform may contain references to third-party game providers and software companies whose products are available within the br999 casino lobby. br999 is not responsible for the privacy practices of third-party software providers in relation to data they independently collect through their own platforms or websites. This Privacy Policy applies solely to personal data processed by br999 in connection with br999.vu and does not extend to any third-party website, application, or service.

br999 encourages players to review the privacy policies of any third-party providers they interact with directly outside the br999 platform environment.

15 Amendments to This Privacy Policy

br999 reserves the right to update and amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or gaming licence requirements. Where amendments are material — meaning they meaningfully change how we process your personal data or affect your data rights — br999 will provide advance notice via email to your registered address and/or via a prominent notice displayed on the br999 platform, a minimum of fourteen (14) days before the amended policy takes effect.

Your continued use of the br999 platform after the effective date of any amended Privacy Policy constitutes your acknowledgement of the changes. If you do not agree to any amendment, you should cease using the br999 platform and contact support to request account closure. The date of the most recent update to this Privacy Policy is always displayed at the top of this page and in the "Last Updated" badge above.

16 Contact Us — Privacy Enquiries

If you have any question, concern, or complaint regarding this Privacy Policy or br999's data processing practices, please contact our support team. The fastest route to a response is via the live chat function within your br999 account dashboard, which is staffed 24 hours a day, seven days a week in both Urdu and English.

For written privacy enquiries, you may contact us at the email address displayed in the footer of this page. We aim to acknowledge all written privacy enquiries within 48 hours and to provide a substantive response within fourteen (14) calendar days.

br999 takes all privacy complaints seriously. Where you are not satisfied with our response to a privacy enquiry, you are entitled to escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances.