ct999 Privacy Policy

ct999 takes the privacy and security of its players' personal data seriously. This Policy has been drafted to provide you with a clear, transparent, and legally accurate account of how your data is handled across the ct999 platform — from the moment you begin the registration process through to the closure of your account and beyond, where retention obligations apply.

ct999 operates under an internationally recognised gaming licence. As part of the obligations attached to that licence, ct999 is required to maintain robust data governance practices, including the collection and secure storage of player identity information, transaction records, and gaming activity logs. This Policy explains how those obligations are met and how they interact with your rights as a data subject.

For the purposes of this Privacy Policy, ct999 acts as the data controller in respect of personal data collected from players via the ct999 platform. As data controller, ct999 determines the purposes and means by which personal data is processed.

Where ct999 engages third-party service providers to process personal data on its behalf — such as KYC verification agencies, payment processors, or licensed game studios — those parties act as data processors and are contractually bound to process personal data only in accordance with ct999's documented instructions and applicable data protection obligations.

ct999 collects personal data from players across several categories, depending on the stage of the account lifecycle and the services being used. The following table sets out the main categories of personal data collected, along with the circumstances in which collection takes place:

In addition to data provided directly by you, ct999 may receive personal data about you from third parties, including KYC verification providers who confirm your identity against government databases, payment processors who relay transaction confirmation details, and fraud detection services that flag unusual account activity patterns. All such data is processed in accordance with this Policy.

ct999 uses the personal data described in Section 3 for the following defined purposes. Each use is tied to a specific legal basis, which is set out separately in Section 5:

• Account creation and management: Processing your registration details, maintaining your ct999 account, and sending account-related communications such as transaction confirmations and security alerts.
• Identity and age verification (KYC): Verifying that you are who you say you are and that you are at least 21 years of age, as required under ct999's licensing obligations.
• Payment processing: Facilitating deposits to and withdrawals from your PKR wallet via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, USDT TRC20, and other supported payment channels.
• Fraud prevention and anti-money laundering (AML): Monitoring account activity for signs of fraud, collusion, bonus abuse, money laundering, or other prohibited conduct as defined in the ct999 Terms and Conditions.
• Regulatory compliance: Maintaining records required under our international gaming licence, including player transaction histories, gaming session logs, and KYC documentation for the minimum statutory retention period.
• Responsible gaming monitoring: Identifying patterns of play that may indicate problem gambling behaviour, and facilitating access to self-exclusion tools, deposit limits, and other responsible gaming controls.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, optimise the gaming experience, and develop new features.
• Customer support: Responding to support queries, resolving disputes, and maintaining records of communications for quality assurance and compliance purposes.
• Marketing communications (where consented): Sending promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications via their ct999 account settings.

ct999 processes personal data only where it has a valid legal basis to do so. The legal bases applicable to ct999's processing activities are as follows:

• Contractual necessity: Processing required to fulfil the ct999 account agreement with you — including registration, payment processing, and platform access — is carried out on the basis that it is necessary for the performance of the contract between you and ct999.
• Legal obligation: Processing required to comply with ct999's obligations under its international gaming licence, including KYC, AML record-keeping, and responsible gaming monitoring, is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregated analytics is carried out on the basis of ct999's legitimate interest in operating a safe, fair, and compliant gaming platform, balanced against your rights and interests.
• Consent: Processing for marketing communications is carried out on the basis of your explicit, freely given consent. You may withdraw consent at any time via your ct999 account settings or by contacting the support team.

ct999 does not sell, rent, or commercially exploit your personal data to or with third parties. Personal data is shared only in the following limited and defined circumstances:

ct999 engages third-party service providers who process personal data on our behalf as data processors. These include KYC and identity verification agencies, payment processors (including JazzCash, EasyPaisa, and banking partners such as HBL, UBL, Meezan Bank, and Allied Bank), licensed game studio providers, fraud detection and anti-money laundering screening services, and customer support platform providers. All such providers operate under written data processing agreements that restrict the use of your data to the specific service being delivered.

ct999 may be required to disclose player data to regulatory authorities, licensing bodies, or law enforcement agencies where such disclosure is mandated by applicable law, court order, or the terms of our international gaming licence. ct999 will not disclose more data than is strictly required to satisfy the relevant legal or regulatory obligation.

In the event of a merger, acquisition, restructuring, or sale of all or part of the ct999 business, player personal data held by ct999 may be transferred to the acquiring entity as part of that transaction. ct999 will notify registered players of any such transfer via the email address associated with their account prior to their data being transferred to a new data controller.

ct999 uses cookies and similar tracking technologies on the ct999 platform to support platform functionality, maintain your logged-in session, and collect anonymised usage analytics. The following categories of cookies are used:

• Strictly necessary cookies: Required for the ct999 platform to function correctly. These include session authentication cookies that keep you logged into your ct999 account and security cookies that protect against cross-site request forgery. These cookies cannot be disabled.
• Functional cookies: Used to remember your platform preferences, such as your preferred language settings and responsible gaming tool configurations. These cookies improve the usability of the ct999 platform but are not essential to its core operation.
• Analytics cookies: Used to collect aggregated, anonymised data about how players use the ct999 platform, including which pages are visited most frequently and how players navigate between game categories. This data is used solely to improve platform performance and is not linked to individual player identities.
• Security and fraud detection cookies: Used to identify unusual access patterns, detect automated bot activity, and flag potentially fraudulent behaviour. These cookies are a core component of ct999's platform integrity framework.

You may manage non-essential cookie preferences via your browser settings. Please note that disabling certain functional cookies may impact the usability of specific ct999 platform features. Strictly necessary and security cookies cannot be disabled without preventing access to the platform entirely.

ct999 retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required under applicable law and our licensing obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, ct999 will securely delete or anonymise the relevant personal data in accordance with its data disposal procedures. Where data has been anonymised rather than deleted, it can no longer be associated with any individual player and falls outside the scope of this Policy.

ct999 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• TLS encryption for all data transmitted between your device and the ct999 platform.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial identifiers.
• Role-based access controls ensuring that personal data is accessible only to ct999 staff with a documented operational need.
• Multi-factor authentication requirements for all ct999 administrative systems that hold or process player personal data.
• Regular third-party penetration testing and vulnerability assessments of the ct999 platform and underlying infrastructure.
• 24/7 security monitoring and automated alerting for anomalous access patterns.

Subject to applicable law and ct999's regulatory obligations, you have the following rights in respect of the personal data we hold about you:

• Right of access: You may request a copy of the personal data ct999 holds about you at any time. ct999 will respond to verified access requests within 30 days.
• Right to rectification: If any personal data held by ct999 is inaccurate or incomplete, you have the right to request that it be corrected. For account-level data such as your contact details, you may update this directly in your ct999 account settings.
• Right to erasure: You may request the deletion of your personal data where ct999 no longer has a legitimate basis or legal obligation to retain it. Please note that ct999's licensing obligations require the retention of certain data categories for defined periods, even following account closure, and deletion requests cannot override these obligations.
• Right to restriction of processing: In certain circumstances — such as where you contest the accuracy of personal data held by ct999 — you may request that processing be temporarily restricted while the matter is investigated.
• Right to object: You have the right to object to personal data processing carried out on the basis of ct999's legitimate interests, including direct marketing communications. Marketing opt-outs can be actioned immediately via your ct999 account notification settings.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that ct999 provide your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

ct999 operates as an international platform. Personal data collected from players in Pakistan may be transferred to and processed in countries outside Pakistan, including the jurisdiction in which ct999 holds its gaming licence and the locations where certain third-party service providers operate.

Where personal data is transferred internationally, ct999 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections applicable in the originating jurisdiction. These safeguards may include standard contractual clauses incorporated into data processing agreements, the application of the service provider's binding corporate rules, or reliance on adequacy determinations where applicable.

If you have specific questions about the international transfer of your personal data or the safeguards in place, please contact ct999 at the support address provided in Section 14.

The ct999 platform is strictly for individuals aged 21 and above. ct999 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The ct999 registration process includes mandatory age declaration, and all accounts are subject to KYC age verification before withdrawal privileges are activated.

If you believe that a minor has registered on the ct999 platform, please contact the support team immediately at [email protected].

ct999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our licensing obligations, platform functionality, or data processing practices. The "Last Updated" date at the top of this Policy will be revised whenever material changes are made.

Where changes are material — meaning they significantly affect how ct999 uses your personal data or your rights as a data subject — ct999 will notify registered players via the email address associated with their account and/or via a prominent notice on the ct999 platform at least 14 days prior to the amended Policy taking effect.

Continued use of the ct999 platform following the effective date of any amendment to this Policy constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you should cease using the ct999 platform and contact the support team to discuss closure of your account.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way ct999 handles your personal data, please contact our dedicated data protection team using the details below. All enquiries will be acknowledged within 3 business days.

• Email: [email protected] — Please use the subject line "Privacy Enquiry" for data-related matters.
• Live Chat: Available 24/7 directly on the ct999 platform. Our support agents can handle initial privacy queries and escalate to the data team where required.
• Response Time: Acknowledgement within 3 business days; full response to data rights requests within 30 calendar days.