Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how the operator of the pi999 platform ("pi999", "we", "us", "our") collects, processes, stores, shares and protects personal data about individuals ("you", "User", "Player") who access or use the website located at https://pi999.cam and any associated mobile applications, products and services (collectively, the "Platform").

We are committed to handling your personal data with transparency, integrity and in accordance with applicable data protection legislation in the jurisdiction in which we operate. By registering an Account, accessing the Platform or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read together with our Terms and Conditions and our Responsible Gambling Policy, both of which are published on the Platform and are incorporated by reference. Defined terms used but not defined in this Policy have the meanings given to them in our Terms and Conditions.

2 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• Account means the registered user profile created by a Player on the Platform.
• Controller means the entity that determines the purposes and means of processing personal data — in this case, the pi999 operator.
• Cookie means a small text file placed on your device by the Platform to facilitate functionality, analytics or session management.
• Data Subject means any identified or identifiable natural person whose personal data is processed by the Controller.
• KYC means Know Your Customer procedures comprising identity verification, age verification and, where required, source-of-funds checks.
• Personal Data means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, IP address, device identifier and financial transaction data.
• Processing means any operation performed on personal data, including collection, storage, retrieval, use, disclosure and deletion.
• Processor means a third party that processes personal data on behalf of the Controller, subject to a data-processing agreement.
• Special Category Data means data revealing racial or ethnic origin, political opinions, religious beliefs, health information, biometric data or other sensitive categories requiring enhanced protection.

3 Data We Collect

We collect personal data through several channels: directly from you when you register or use the Platform, automatically through technical systems as you browse, and from third parties such as identity-verification providers and payment processors. The categories of personal data we collect are set out in the table below.

4 Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The primary legal bases we rely upon are:

4.1 Performance of Contract

Processing is necessary to provide the services you have requested — including Account registration, bet placement, payment processing, withdrawal handling and customer support. Without this processing, we cannot perform the contract between you and pi999.

4.2 Legal Obligation

We are required by our licensing jurisdiction and applicable anti-money-laundering (AML) and counter-terrorism financing (CTF) regulations to verify your identity, retain transaction records and report suspicious activity to relevant authorities. KYC and AML processing falls within this legal basis.

4.3 Legitimate Interests

We process certain data — such as technical logs and usage patterns — where we have a legitimate interest in maintaining platform security, preventing fraud, improving product quality and understanding how users interact with pi999. We conduct a balancing assessment to ensure our legitimate interests do not override your privacy rights.

4.4 Consent

Where we send direct marketing communications or place non-essential cookies on your device, we rely on your explicit consent. You may withdraw consent for marketing at any time and manage cookie consent through your browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5 How We Use Your Data

pi999 uses the personal data we collect for the following purposes. Each purpose is linked to the legal basis set out in Section 4:

• Account creation and management: Setting up your Account, verifying your identity and age, maintaining your profile and processing your login sessions. (Contract performance)
• Bet processing and game delivery: Recording your bets, calculating results and winnings, settling markets and crediting your Account Balance. (Contract performance)
• Payment processing: Facilitating deposits and withdrawals, reconciling transaction records and detecting payment fraud. (Contract performance; Legal obligation)
• KYC and AML compliance: Verifying your identity documents, screening against sanctions lists, conducting enhanced due diligence and retaining mandatory records. (Legal obligation)
• Responsible gambling: Monitoring betting patterns for signs of problem gambling, administering deposit/loss/session limits, processing self-exclusion requests and flagging Accounts for intervention. (Legal obligation; Legitimate interests)
• Customer support: Responding to your queries, resolving disputes and following up on formal complaints. (Contract performance)
• Security and fraud prevention: Detecting and investigating suspicious activity, preventing multi-accounting, identifying bonus abuse and protecting Platform integrity. (Legitimate interests)
• Analytics and product improvement: Understanding how players use the Platform so we can improve navigation, add relevant markets (e.g., Pakistan cricket, PSL fixtures, ICC tournaments) and optimise the mobile experience for users across Karachi, Lahore, Islamabad and other cities. (Legitimate interests)
• Direct marketing: Sending you relevant promotions, bonus offers and sports-event updates where you have opted in. (Consent)
• Legal and regulatory compliance: Responding to lawful requests from competent authorities, enforcing our Terms and Conditions and defending legal claims. (Legal obligation; Legitimate interests)

6 Sharing Your Data

pi999 does not sell, rent or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Service Providers (Processors)

We engage trusted third-party service providers to help operate the Platform, including identity-verification and KYC providers, payment processing partners, cloud infrastructure and hosting providers, customer support platform vendors, and analytics tool providers. All Processors are bound by data-processing agreements that restrict them to processing your data only on our documented instructions.

6.2 Regulatory and Law Enforcement Authorities

We may be required to disclose personal data to our licensing authority, financial intelligence units, law enforcement agencies or other competent governmental bodies where required by law or where we reasonably believe disclosure is necessary to prevent serious harm, fraud or criminal activity. We will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets or reorganisation involving the pi999 operator, your personal data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify you of any such transfer via a notice on the Platform or via the email address on your Account.

6.4 Group Companies

We may share personal data with affiliated entities within the operator's corporate group for purposes consistent with this Policy, including consolidated AML screening and responsible-gambling monitoring. All group companies are subject to the same data-handling standards as the Controller.

7 Cookies & Similar Technologies

pi999 uses cookies and similar tracking technologies — including web beacons and local storage — to provide essential Platform functionality, remember your preferences and understand how users interact with the site. The categories of cookies we use are described below.

You can control and delete cookies through your browser settings at any time. Disabling strictly necessary or security cookies may impair Platform functionality and prevent you from logging into your Account. We do not use third-party advertising or retargeting cookies.

8 Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following retention principles:

• Active Account data: Retained throughout the lifetime of your Account and for a minimum of five (5) years following Account closure, in order to meet AML record-keeping obligations applicable in the operator's licensing jurisdiction.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or from the date of Account closure, whichever is later, in accordance with AML and licensing requirements.
• Transaction records: Retained for a minimum of five (5) years to satisfy financial reporting and anti-money-laundering obligations.
• Support correspondence: Retained for up to three (3) years following resolution of the relevant query or complaint, for dispute resolution and quality-assurance purposes.
• Marketing preferences and consent records: Retained for up to two (2) years from the date consent was given or withdrawn, to demonstrate compliance with consent obligations.
• Technical and analytical logs: Typically retained for up to thirteen (13) months on a rolling basis, after which aggregate or anonymised reporting replaces identifiable log data.

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be attributed to you. We periodically review data holdings to ensure we do not retain personal data beyond what is necessary.

9 Security Measures

pi999 takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• Encryption in transit: All data exchanged between your browser or mobile device and the Platform is encrypted using TLS (Transport Layer Security) with modern cipher suites.
• Encryption at rest: Sensitive data fields — including identity document scans, financial records and KYC data — are encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to systems holding personal data is restricted to authorised personnel on a need-to-know basis. Access rights are reviewed regularly and revoked promptly upon role changes.
• Multi-factor authentication: Internal systems holding personal data are protected by multi-factor authentication for all administrative access.
• Penetration testing: We conduct periodic security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident response: We maintain a documented data-breach response procedure. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable law.

10 Your Rights

Depending on the data protection laws applicable in the operator's jurisdiction and, where recognised, your jurisdiction of residence, you may have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 14.

We will respond to verified data-subject requests within a reasonable timeframe and in any event within the period required by applicable law. We may need to verify your identity before processing a request. In certain circumstances — for example, where AML retention obligations apply — we may be unable to fulfil an erasure request in full; we will explain the relevant legal basis in our response.

11 International Data Transfers

pi999 operates internationally and your personal data may be transferred to, stored in or processed in countries other than your country of residence. This may include countries whose data protection laws differ from those in your jurisdiction.

Where personal data is transferred outside the operator's primary jurisdiction, we implement appropriate safeguards to ensure that your data remains protected to an equivalent standard. These safeguards may include standard contractual clauses approved by competent data protection authorities, binding corporate rules for intra-group transfers, or reliance on adequacy decisions where the destination country is recognised as providing an adequate level of data protection.

Players accessing the Platform from Pakistan should be aware that their data may be processed outside Pakistan. Pakistan does not currently have a comprehensive standalone data-protection law equivalent to some international frameworks; however, pi999 applies its own data-handling standards consistently regardless of the processing location.

12 Minors

The pi999 Platform is strictly intended for adults aged 18 years or older, or the higher minimum age required by the operator's licence jurisdiction or the laws of your country of residence. We do not knowingly collect personal data from individuals under the applicable minimum age.

If you are a parent or guardian and believe that a minor has registered an Account or provided personal data to pi999 without your consent, please contact us immediately at [email protected] (plain text — not a clickable link). We will investigate and, if confirmed, delete the relevant Account and associated personal data promptly.

Account holders must not share their login credentials with, or permit access to the Platform by, any person under the applicable minimum age. Doing so constitutes a serious breach of our Terms and Conditions and may have legal consequences under applicable law.

13 Amendments to This Policy

pi999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing activities, applicable law or Platform functionality. The "Last updated" date at the top of this document indicates when the most recent revision was made.

Material changes — those that significantly affect your rights or the way we process your data — will be communicated to registered Players via the email address on their Account or via a prominent notice on the Platform, at least fourteen (14) days before the change takes effect, where practicable.

Your continued use of the Platform after a revised Policy has been published constitutes your acceptance of the updated terms. If you disagree with a material change, you may close your Account and request the return of your Real Money Funds balance before the change takes effect.

14 Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the way pi999 processes your personal data, please contact our Data Protection team in writing. Written requests create a documented record and allow us to respond accurately and within required timeframes.

Email (plain text — not a clickable link):
[email protected]

Our team handles privacy-related enquiries in English and Urdu. We aim to acknowledge all data-subject requests and privacy complaints within 72 hours and to provide a substantive response within 30 days of receipt of a verified request. Complex requests involving large volumes of data or requiring regulatory consultation may take longer; we will notify you if an extension is necessary.

This Privacy Policy was last reviewed and updated on 1 January 2026. All previous versions of this Policy are superseded by this document.