cy999 Privacy Policy

Full Legal Text

cy999 Privacy Policy

Last updated: 1 January 2026. This Privacy Policy ("Policy") describes how cy999 ("cy999", "we", "us", "our"), the operator of the online gaming platform at cy999.one, collects, uses, stores, protects, and shares personal data relating to players, prospective players, and website visitors ("you", "your"). This Policy forms part of the cy999 Terms & Conditions and should be read alongside those Terms. By registering on or using the cy999 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1. Data Controller

1.1 The data controller responsible for your personal data is cy999, the operator of the Platform at cy999.one. cy999 operates under an international gaming licence and is subject to the data protection obligations imposed by that licence and applicable law.

1.2 For all privacy-related queries, data subject rights requests, or complaints relating to this Policy, you may contact the cy999 data protection team via the 24/7 live chat facility on the Platform, or by email at [email protected]. Please mark your communication clearly as a "Data Privacy Request" to ensure it is routed to the correct team.

2. Data We Collect

2.1 cy999 collects personal data in the following categories, depending on your interaction with the Platform:

Category	Data Items	When Collected
Identity Data	Full legal name, date of birth, gender, nationality, CNIC / passport number	Registration & KYC verification
Contact Data	Email address, mobile number, residential address	Registration
Financial Data	JazzCash / EasyPaisa account reference, bank account details, transaction history	Deposits & withdrawals
KYC Documents	Copies of government ID, proof of address, payment method ownership evidence	Identity verification process
Gaming Data	Game history, bet amounts, win/loss records, session duration, bonus usage	Ongoing gameplay
Technical Data	IP address, device type, browser, OS, cookies, session identifiers	Any website visit
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions
Responsible Gaming Data	Self-exclusion status, deposit/loss limit settings, cooling-off periods	Responsible gaming tool usage

2.2 cy999 does not knowingly collect sensitive personal data (such as health or biometric data) except where explicitly required by law enforcement or regulatory authority. Where such data is requested, it will be clearly identified and separate consent obtained.

2.3 cy999 does not collect personal data from individuals under the age of 21. If we become aware that an account has been created by a person under 21, that account will be closed immediately and all associated data will be deleted in accordance with our data retention procedures.

3. How We Use Your Data

3.1 cy999 uses the personal data it collects for the following purposes:

• Account management: Creating and maintaining your Player account, authenticating your identity at login, and managing account settings.
• Identity verification (KYC): Verifying that you meet the minimum age requirement and confirming your identity in accordance with anti-money-laundering obligations imposed by our gaming licence.
• Payment processing: Processing deposits and withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK. Financial data is shared with payment processors only to the extent required to complete transactions.
• Regulatory compliance: Meeting obligations under our international gaming licence, including anti-money-laundering (AML) reporting, responsible gambling monitoring, and player protection requirements.
• Customer support: Responding to your queries, resolving disputes, and maintaining support ticket records.
• Platform security and fraud prevention: Monitoring for suspicious login activity, duplicate account detection, collusion detection, and other security purposes.
• Responsible gaming monitoring: Monitoring gameplay patterns to identify players who may be showing signs of problem gambling and proactively offering responsible gaming tools or support where warranted under our licensing obligations.
• Service improvement: Analysing aggregated, anonymised usage data to improve the Platform's performance, layout, and feature set. This analysis does not involve identifiable personal data.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to registered players who have not opted out of marketing communications. You may opt out at any time via account settings or by contacting support.

4. Legal Basis for Processing

4.1 cy999 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil the contract between you and cy999 (your account, deposits, withdrawals, gameplay).
• Legal obligation: Processing required to comply with AML laws, age verification requirements, and obligations imposed by our gaming licence.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where those interests are not overridden by your rights and freedoms.
• Consent: Marketing communications, where consent has been obtained during registration or subsequently. Consent may be withdrawn at any time without affecting prior processing.

5. Cookies and Tracking

5.1 cy999 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function — session management, security tokens, login state. These cannot be disabled without impacting platform functionality.
• Performance cookies: Anonymised analytics data used to measure page load times, error rates, and usage patterns to improve Platform performance.
• Functional cookies: Storing your language preferences, display settings, and responsible gaming tool configurations between sessions.
• Marketing cookies: Used only where you have provided consent, to deliver relevant promotional content within the Platform.

5.2 You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impact your ability to use the Platform. Disabling performance and functional cookies will not prevent Platform access but may reduce your experience quality.

6. Third-Party Data Sharing

6.1 cy999 shares personal data with third parties only in the following circumstances and only to the minimum extent necessary:

• Payment processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK receive the transaction data required to process deposits and withdrawals. These processors operate under their own privacy policies and relevant financial regulation.
• KYC and identity verification providers: Third-party identity verification services may receive copies of identity documents and supporting data to complete the verification process on cy999's behalf, under strict data processing agreements.
• Game studios: Game providers such as Evolution Gaming and Pragmatic Play receive your Player account reference and game session data to deliver game content and record outcomes. Game studios do not receive your full identity or financial data.
• Regulatory and law enforcement authorities: cy999 is required to report certain transaction patterns to its licensing authority and may be compelled to provide player data to law enforcement agencies under valid legal process.
• Fraud prevention networks: Aggregated, pseudonymised risk signals may be shared with fraud prevention services to protect the Platform and its players from financial crime.

6.2 cy999 does not sell, rent, or otherwise provide your personal data to third parties for their own commercial marketing purposes. Any third-party data processor engaged by cy999 operates under a formal data processing agreement that imposes obligations equivalent to those in this Policy.

7. International Data Transfers

7.1 cy999 operates globally and some of its service providers and data processors are located outside Pakistan. Where personal data is transferred internationally, cy999 ensures that appropriate safeguards are in place — including contractual protections equivalent to recognised data protection standards — before any transfer takes place.

7.2 By using the cy999 Platform, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan. In all cases, the standard of protection applied to your data will meet or exceed the protections described in this Policy.

8. Data Retention

8.1 cy999 retains personal data for the following periods, after which data is securely deleted or anonymised:

• Account and identity data: Retained for the duration of your account and for a minimum of five years after account closure, as required by AML and gaming licence obligations.
• Financial transaction records: Retained for a minimum of five years from the date of the transaction, in accordance with financial regulatory requirements.
• KYC documents: Retained for the duration of your account and for five years following account closure.
• Gaming history: Retained for five years from the date of the session, for regulatory compliance and dispute resolution purposes.
• Support communications: Retained for three years from the date of the most recent interaction.
• Technical / log data: Retained for up to 12 months, after which it is automatically purged.
• Marketing consent records: Retained for three years from the date of consent or withdrawal of consent, for compliance evidence purposes.

8.2 Where a data retention obligation under law or licence requires a longer retention period than stated above, the longer period will apply to the affected data category.

9. Your Data Rights

9.1 Subject to applicable law and the conditions of cy999's gaming licence, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data cy999 holds about you. Requests will be responded to within 30 calendar days.
• Right to rectification: If any personal data held by cy999 is inaccurate or incomplete, you may request that it be corrected. Basic corrections (name, contact details) can be made via account settings; corrections to identity documents require contact with the support team.
• Right to erasure: You may request deletion of your personal data. This right is subject to cy999's legal and regulatory retention obligations — data that must be held under AML or gaming licence requirements cannot be deleted until the retention period has elapsed.
• Right to restriction of processing: You may request that cy999 restrict processing of your data in certain circumstances, for example while a rectification request is being reviewed.
• Right to data portability: You may request that your personal data be provided in a structured, machine-readable format for transfer to another service provider, where technically feasible.
• Right to object: You may object to processing based on legitimate interests, including direct marketing. Marketing objections will be actioned immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

9.2 To exercise any of the above rights, contact the cy999 data protection team via live chat or email to [email protected] with "Data Privacy Request" in the subject line. We will respond within 30 calendar days of receipt of a valid request. In some cases we may need to verify your identity before processing the request.

10. Security Measures

10.1 cy999 implements the following technical and organisational security measures to protect your personal data:

• AES-256 encryption for all data at rest in cy999 databases;
• TLS 1.3 for all data in transit between your device and cy999 servers;
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need;
• Multi-factor authentication required for all internal access to systems containing player personal data;
• Regular independent security audits and penetration testing;
• Automated anomaly detection to identify and respond to unusual access patterns;
• Formal incident response procedures covering data breach identification, containment, assessment, and notification.

10.2 In the event of a personal data breach that poses a risk to your rights and freedoms, cy999 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

11. Children and Minors

11.1 The cy999 Platform is strictly for individuals aged 21 and above. cy999 does not knowingly collect or process personal data relating to individuals under the age of 21. If you believe that a minor has registered on the Platform, please contact us immediately via live chat so that we can investigate and close the account.

12. Responsible Gaming and Data

12.1 Responsible gaming monitoring at cy999 necessarily involves the processing of gaming behavioural data, including session duration, betting frequency, deposit and loss patterns, and use of responsible gaming tools. This processing is conducted on the basis of cy999's legal obligations under its gaming licence and its legitimate interest in protecting players from harm.

12.2 Responsible gaming data — including self-exclusion status, active deposit limits, and loss limit settings — is treated with heightened sensitivity. It is not used for marketing purposes and is not shared with third parties except where required by law or our licensing authority.

12.3 For full details of the responsible gaming tools available, including self-exclusion, deposit limits, and external support resources, visit the Responsible Gaming page.

13. Changes to This Policy

13.1 cy999 may update this Privacy Policy from time to time to reflect changes in law, licensing requirements, or Platform operations. Material changes will be notified to registered players via account notification or email. The updated Policy will take effect from the date stated in the notification.

13.2 Continued use of the cy999 Platform after the effective date of any Policy update constitutes your acceptance of the updated Policy. If you do not agree with a material change, you may close your account in accordance with the Terms & Conditions.

14. Governing Law

14.1 This Privacy Policy is governed by the laws of the jurisdiction in which cy999 holds its international gaming licence. Any dispute arising out of or in connection with this Policy shall be subject to the jurisdiction of the courts of that territory, without prejudice to your rights under the data protection law applicable in your own country of residence.