kp999 Privacy Policy —
How We Collect, Use, and Protect Your Personal Data

Definitions

The following definitions apply throughout this Privacy Policy:

• "kp999," "we," "us," or "our" refers to the online gaming and sports betting platform operating at kp999.onl and all associated services, interfaces, and support channels.
• "Personal Data" means any information relating to an identified or identifiable natural person — including but not limited to name, CNIC number, date of birth, mobile number, email address, payment account details, IP address, device identifiers, and gameplay history.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, use, disclosure, transmission, deletion, or destruction, whether automated or manual.
• "Account Holder" or "you" refers to any individual who has registered, or is in the process of registering, a kp999 Account, or who is accessing the kp999 platform in any capacity.
• "KYC" refers to the Know Your Customer identity verification process, including CNIC document submission and verification required to grant full Account privileges including withdrawal access.
• "Third Party" means any individual, organisation, or legal entity other than kp999 and the Account Holder.
• "Data Controller" means kp999, which determines the purposes and means of processing Personal Data collected via the kp999 platform.

Scope & Application

This Privacy Policy applies to all Personal Data collected, processed, or stored by kp999 in connection with the kp999 platform, including data collected via the website kp999.onl, any mobile-optimised interface, live chat and support communications, email correspondence, KYC verification processes, and payment transaction processing.

This Policy applies to all current Account Holders, prospective registrants who have initiated but not completed registration, visitors to the kp999 website who have not registered an Account, and former Account Holders whose data kp999 is required to retain under applicable legal and regulatory obligations.

Data We Collect

kp999 collects the following categories of Personal Data from Account Holders and platform users:

kp999 does not collect sensitive personal data beyond that required for age verification (date of birth and CNIC) and applicable AML obligations. kp999 does not collect biometric data, health data, religious or political affiliation, or any data relating to racial or ethnic origin.

How We Collect Your Data

kp999 collects Personal Data through the following mechanisms:

• Direct provision by you: Information you enter during Account registration, KYC document upload, deposit and withdrawal requests, live chat interactions, and email correspondence with kp999 support.
• Automated technical collection: Technical data including IP addresses, device identifiers, session duration, and browser characteristics collected automatically when you access the kp999 platform, via server logs and first-party cookies.
• Payment processor data: Transaction reference data provided to kp999 by JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and Visa/Mastercard processing partners as part of payment confirmation and reconciliation processes.
• KYC verification provider: Verification status and identity confirmation data returned by kp999's KYC verification partner upon review of CNIC documents submitted by the Account Holder.
• Game and sportsbook platform providers: Aggregated gameplay event data — game session identifiers, bet event records, and RNG certification data — provided by kp999's licensed software and sportsbook platform partners.

Legal Basis for Processing

kp999 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to register your Account, verify your identity, process deposits and withdrawals, and provide gaming and sportsbook services — all of which are necessary to perform the contract between you and kp999.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML) regulations, age verification requirements, financial transaction reporting obligations, and any lawful regulatory or law-enforcement request.
• Legitimate interests: Processing for fraud detection and prevention, platform security, responsible gaming monitoring, and improvement of kp999 services — where these legitimate interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing communications and optional personalisation features — where you have freely given, specific, informed, and unambiguous consent that you may withdraw at any time without detriment.

How We Use Your Data

kp999 uses the Personal Data described in Section 3 for the following specific purposes:

• To create, verify, and administer your kp999 Account, including identity verification via CNIC and ongoing KYC compliance monitoring.
• To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, USDT TRC20, and Visa/Mastercard.
• To provide access to the kp999 gaming platform, including casino games, PSL cricket betting, sports sportsbook, live dealer tables, and all associated features.
• To administer bonus offers, promotions, VIP programme rewards, and wagering requirement tracking, and to detect and prevent bonus abuse.
• To detect, investigate, and prevent fraudulent activity, money laundering, identity theft, prohibited multi-accounting, and other security threats to the platform and to individual Account Holders.
• To monitor gameplay patterns for responsible gaming indicators and, where applicable, to proactively contact players and apply responsible gaming controls as described in the kp999 Responsible Gaming Policy.
• To respond to Account Holder support requests, complaints, and dispute resolution processes.
• To send transactional communications — deposit confirmations, withdrawal notifications, security alerts, and important Account updates — which are not subject to marketing opt-out as they are necessary for Account management.
• To send marketing communications to Account Holders who have opted in, including details of promotions, new game launches, and PSL betting offers. Marketing communications are always opt-in and may be withdrawn at any time.
• To meet our legal and regulatory obligations including AML reporting, data retention requirements, and responses to lawful orders from competent regulatory or law-enforcement authorities.
• To analyse aggregated, anonymised platform usage data for the purpose of improving kp999 services, game offerings, payment processing performance, and user experience. Aggregated data does not identify individual Account Holders.

Data Sharing & Disclosure

kp999 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Personal Data is disclosed to third parties only in the following strictly defined circumstances:

• KYC Verification Providers: CNIC document images and identity data are shared with kp999's contracted identity verification partner solely for the purpose of age and identity verification. The KYC provider is prohibited from using this data for any purpose other than verification services for kp999.
• Payment Processors: Financial transaction data — including account numbers, transaction amounts, and payment reference identifiers — is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and card processing partners as required to execute and confirm payment transactions.
• Fraud Prevention Services: Transaction metadata and account activity patterns may be shared with specialist fraud detection service providers for the purpose of identifying and preventing fraudulent activity. Such providers are bound by strict data processing agreements.
• Gaming & Software Platform Providers: Account identifiers and session data are shared with kp999's licensed game platform and sportsbook providers as necessary to provide game access, process bet settlements, and maintain RNG certification compliance.
• Regulatory and Law Enforcement Authorities: kp999 will disclose Personal Data to competent regulatory authorities, financial intelligence units, or law enforcement agencies where required by a lawful order, legal obligation, or where kp999 believes disclosure is necessary to prevent serious harm or criminal activity.
• Professional Advisers: Legal counsel, auditors, and compliance advisers engaged by kp999 may access Personal Data on a strictly need-to-know basis for the purposes of providing professional services. All such advisers are bound by professional confidentiality obligations.

Cookies & Tracking Technologies

kp999 uses first-party cookies and similar browser storage technologies to operate the platform, maintain session security, and provide a consistent Account experience across page navigation. kp999 does not deploy third-party advertising cookies or tracking pixels that transmit your data to unaffiliated commercial entities.

• Session Cookies: Temporary cookies that maintain your logged-in session state during a single browsing session. These cookies are deleted automatically when you close your browser or when your kp999 session expires due to inactivity.
• Authentication Cookies: Cookies that store your encrypted session token, enabling the "remember me" functionality where you have opted in. These cookies expire after a maximum of thirty (30) days from the date of last activity.
• Preference Cookies: Cookies that store your selected platform preferences — such as language settings and responsible gaming configuration — so that your preferences are applied consistently across sessions.
• Security Cookies: Cookies used by kp999's fraud detection and session integrity systems to identify anomalous login patterns and protect against session hijacking attacks.

You may manage or delete cookies through your browser settings. Please be aware that disabling session and authentication cookies will prevent you from logging in to your kp999 Account and using core platform features. kp999 does not operate on the basis of cookie consent banners because no third-party tracking cookies are deployed.

Data Retention

kp999 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised so that it can no longer be associated with any individual Account Holder. Where deletion is not immediately practicable for technical reasons, the data is placed beyond active use and deleted at the earliest practicable opportunity.

Data Security

kp999 implements technical and organisational security measures appropriate to the nature of the Personal Data processed and the risks associated with its processing. These measures include, without limitation:

• 256-bit SSL/TLS encryption applied to all data in transit between Account Holder devices and kp999 servers, covering login, payment, KYC document upload, and all other data transmissions.
• Encryption of Personal Data at rest in kp999's database infrastructure, including encrypted storage of KYC documents, financial records, and Account data.
• Industry-standard cryptographic hashing of account passwords — plaintext passwords are never stored and are not accessible to kp999 staff or systems.
• Role-based access controls ensuring that kp999 staff can access Personal Data only to the extent necessary for their specific function, with all access logged and auditable.
• Regular security assessments, vulnerability scanning, and penetration testing of kp999 platform infrastructure.
• Automated anomaly detection systems that flag unusual account activity patterns for investigation by the kp999 security team.

Notwithstanding these measures, no internet-based platform can guarantee absolute security. kp999 strongly encourages Account Holders to maintain a strong, unique password for their kp999 Account, to log out when using shared devices, and to notify kp999 immediately via [email protected] if they suspect any unauthorised access to their Account.

Your Rights

kp999 recognises the following rights in respect of Personal Data held about you, and commits to facilitating the exercise of these rights promptly and without undue restriction:

• Right of Access: You have the right to request a copy of all Personal Data kp999 holds about you. kp999 will respond to verified access requests within thirty (30) calendar days of receipt.
• Right of Rectification: You have the right to request correction of any Personal Data that is inaccurate or incomplete. Account Holders may update basic contact and preference data directly via Account settings; identity data corrections require submission of updated documentation to the kp999 KYC team.
• Right of Erasure: You have the right to request deletion of Personal Data that is no longer necessary for the purposes for which it was collected, subject to kp999's legal retention obligations under AML and other applicable regulations. Data required to be retained for regulatory purposes cannot be deleted prior to the expiry of the mandatory retention period.
• Right to Restrict Processing: You have the right to request restriction of processing of your Personal Data in specific circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of kp999's legitimate grounds.
• Right to Object: You have the right to object to processing of your Personal Data based on kp999's legitimate interests at any time. kp999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent — including marketing communications — you have the right to withdraw consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

To exercise any of the above rights, please contact kp999 at [email protected] with the subject line "Privacy Rights Request," including your Account username and a description of the specific right you wish to exercise. kp999 may require identity verification before processing any request to protect against unauthorised access to Account Holder data.

Children's Privacy — Strictly 21+

The kp999 platform is strictly intended for adults aged twenty-one (21) years and above. kp999 does not knowingly collect Personal Data from individuals under the age of 21. Registration by persons under 21 is prohibited and constitutes a breach of the kp999 Terms and Conditions.

Where kp999 identifies, through KYC verification or other means, that an Account Holder is under the age of 21, the Account will be immediately suspended, all Personal Data collected in relation to that Account will be scheduled for deletion in accordance with legal obligations, and the matter may be referred to relevant authorities. Any funds deposited by an underage Account Holder will be managed in accordance with applicable law.

International Data Transfers

kp999 operates as an international online gaming platform and, as a consequence, some Personal Data may be processed by kp999's contracted service providers — including KYC verification, gaming platform, and payment technology partners — in jurisdictions outside Pakistan. Where such international transfers occur, kp999 ensures that appropriate contractual safeguards are in place to protect the transferred data to a standard equivalent to that applied within Pakistan.

All third-party data processors engaged by kp999 for the purposes described in this Privacy Policy are bound by data processing agreements that require them to: process Personal Data only for the purposes specified by kp999; implement appropriate technical and organisational security measures; not transfer Personal Data to further third parties without kp999's prior written authorisation; and cooperate with kp999's requests to facilitate the exercise of Account Holder privacy rights.

Marketing Communications

kp999 sends promotional communications — including bonus offers, PSL cricket betting promotions, new game announcements, and VIP programme updates — only to Account Holders who have expressly opted in to receive such communications. Opt-in is requested at the point of Account registration and may be adjusted at any time via Account settings.

• Marketing communications are sent via the registered email address and/or mobile number associated with your kp999 Account.
• You may opt out of all marketing communications at any time by updating your notification preferences in Account settings, or by contacting kp999 support at [email protected] with the subject line "Unsubscribe."
• Opt-out requests are processed within forty-eight (48) hours. You may continue to receive transactional communications — such as deposit confirmations and security alerts — after opting out of marketing, as these are necessary for Account management and are not subject to marketing opt-out.
• kp999 does not engage in unsolicited SMS marketing or cold calling. All kp999 communications originate from verified kp999.onl addresses and channels.

Third-Party Links & Platform References

The kp999 platform may, from time to time, reference or provide navigational context relating to third-party organisations — including payment providers such as JazzCash and EasyPaisa, banking institutions including HBL, UBL, and Meezan Bank, and gaming software providers. kp999 has no control over the privacy practices or data handling of these third-party organisations.

kp999 is not responsible for the content, privacy policies, or data security practices of any third-party platform or service. Account Holders who access third-party services — including mobile wallet platforms, banking applications, or payment portals — in connection with their use of kp999 do so subject to the privacy policies of those respective services. kp999 encourages Account Holders to review the privacy policies of all third-party services they use.

Policy Amendments

kp999 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform features, or data processing practices. Material amendments — that is, changes that significantly affect the rights of Account Holders or the manner in which their Personal Data is processed — will be communicated to registered Account Holders via the contact details associated with their Account a minimum of fourteen (14) days prior to the effective date of the change.

For non-material amendments — such as clarifications of existing language, correction of typographical errors, or updates to contact information — no advance notice period is required. The amended Policy will be published at kp999.onl/privacy-policy with the "Last Updated" date revised accordingly.

Continued use of the kp999 platform following the effective date of any amendment to this Privacy Policy constitutes acceptance of the revised Policy. If you do not agree to any amended version of this Policy, you must cease using the kp999 platform and request Account closure via the support team.

Contact & Privacy Complaints

For any questions, requests, or concerns relating to this Privacy Policy or kp999's processing of your Personal Data, please contact the kp999 privacy team using the following details — provided as plain text only, not as clickable links:

• Email: [email protected] (plain text — not a hyperlink). For privacy-specific enquiries, use the subject line "Privacy Enquiry."
• Live Chat: Available 24 hours a day, 7 days a week via the kp999 website — average first response in under 90 seconds.
• Support Languages: Urdu and English — agents are available to assist in both languages at all times.
• Rights Requests: To exercise any of your data rights described in Section 11, email [email protected] with subject line "Privacy Rights Request," including your Account username and the specific right you wish to exercise.

kp999 is committed to resolving all privacy complaints promptly and fairly. Initial responses to privacy complaints are provided within forty-eight (48) hours. Complex complaints — particularly those involving data breach notifications, erasure requests subject to legal retention obligations, or disputes regarding the lawfulness of specific processing — may require up to ten (10) business days for full investigation and response.