Section 1
Who We Are
This Privacy Policy applies to why 999, the online betting and casino platform accessible at why999.bet ("the Platform", "we", "us", "our"). Why 999 is the data controller for all personal information collected from players who access or register on the platform from Pakistan.
This policy applies to all players and visitors, including registered account holders, prospective players who browse the site without registering, and anyone who contacts us through support channels. By using why 999 or registering an account, you acknowledge that you have read and understood how we handle your personal data as described in this policy.
If you have questions about any aspect of this policy or how your data is managed, please contact us at support@why999.bet. We aim to respond to all data-related enquiries within 72 hours.
In plain terms: Why 999 is responsible for your data. We decide what to collect and how to use it. This policy is our commitment to you about how we do that.
Section 2
What Personal Data We Collect
Why 999 collects personal data through three main channels: information you provide directly during registration and account use, information generated automatically by your use of the platform, and information received from third parties such as payment processors.
Information You Provide Directly
| Data Category | Specific Data Points | When Collected |
|---|
| Identity | Full name, date of birth, CNIC number | Registration / KYC |
| Contact | Email address, mobile number | Registration |
| Financial | Mobile wallet IDs (Easypaisa / JazzCash / NayaPay / SadaPay), bank account details for IBFT, card details (masked) | First deposit / withdrawal |
| Verification | CNIC scan or photograph, selfie for liveness check (when requested) | KYC review |
| Communications | Support messages, chat transcripts, email correspondence | Ongoing |
| Preferences | Responsible gaming limits you set, notification preferences, language settings | Account settings |
Information Collected Automatically
- Device data: Device type, operating system version, browser type and version, screen resolution.
- Network data: IP address, approximate geographic location derived from IP, internet service provider name.
- Session data: Login timestamps, session duration, pages and games accessed, bet placement and settlement records.
- Performance data: Page load times, error logs, feature usage frequency — used to identify and fix technical issues.
- Cookie data: As described in Section 8 below.
Information Received from Third Parties
When you make a deposit or withdrawal through Easypaisa, JazzCash, NayaPay, SadaPay, an IBFT bank transfer or a Visa/Mastercard transaction, the payment processor confirms the transaction status and provides a transaction reference to why 999. We receive confirmation data but do not store your full mobile wallet PIN, bank password or full card number — these remain with the payment provider.
Section 3
Why We Collect Your Data — Our Legal Bases
Why 999 only processes personal data where there is a valid legal basis for doing so. For each processing activity, that basis is one of the following:
Contractual Necessity
Processing your name, contact details and payment information to run your account, process deposits and pay out winnings. Without this we cannot provide the service.
Legal Obligation
Identity verification (KYC), transaction records and suspicious activity reporting are required by applicable anti-money laundering and financial compliance obligations.
Legitimate Interests
Fraud detection, security monitoring, platform analytics and improving the why 999 product experience — balanced against your privacy interests.
Consent
Optional marketing communications and non-essential analytics cookies — only where you have given explicit consent, which can be withdrawn at any time.
What this means for you: Why 999 does not use your data for purposes beyond what is described here. We do not use your betting history to build third-party advertising profiles. We do not sell your mobile number or email to external marketers.
Section 4
How We Store and Protect Your Data
All personal data collected by why 999 is stored on secure servers protected by multiple layers of technical and organisational security measures:
- Encryption at rest: All stored personal data and payment records are encrypted using AES-256 or equivalent standard encryption. Database files are not accessible in plain text even to server-level administrators without authorised key access.
- Encryption in transit: All data transmitted between your device and the why 999 platform is protected by TLS (Transport Layer Security). The padlock icon in your browser confirms this connection is active.
- Access controls: Employee access to personal data is role-based and granted on a need-to-know basis. Access to sensitive player records requires two-factor authentication and is logged. Logs are reviewed regularly.
- Intrusion detection: Automated systems monitor for unusual database access patterns, brute-force attempts and other indicators of unauthorised access in real time.
- Data backups: Regular encrypted backups are maintained to prevent data loss. Backup media is subject to the same access controls as primary data.
In the event of a data breach that poses a significant risk to your rights, why 999 will notify affected players through the registered email address on their account within 72 hours of the breach being confirmed.
Section 5
Who We Share Your Data With
Why 999 does not sell your personal data. We share it only in the specific circumstances listed below, and only the minimum information necessary for the stated purpose:
Payment Processors
To process deposits and withdrawals, why 999 shares transaction data with Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking partners and Visa/Mastercard networks as applicable. These processors receive transaction amounts and the identifying details required to complete the transfer. They operate under their own privacy policies and are subject to applicable Pakistani financial regulations.
Identity Verification Services
When why 999 requests KYC documentation, the verification process may be handled by a certified third-party identity verification provider. Your identity documents are shared with this provider solely for the purpose of verifying authenticity. Results are communicated back to why 999 as a pass/fail outcome along with a reference number.
Fraud and Security Providers
To protect players from fraud and maintain platform security, why 999 shares limited technical data (device fingerprints, IP addresses, behavioural patterns) with specialised fraud detection services. This data sharing is subject to strict contractual data processing agreements.
Legal and Regulatory Authorities
Why 999 will disclose personal data to law enforcement or regulatory authorities where required by applicable law, court order or official investigation. We will notify you of such disclosure where we are legally permitted to do so.
Not shared: Your personal data is never shared with social media platforms, advertising networks, data brokers, or any third party for marketing purposes without your explicit consent.
Section 6
Your Data Rights
As a player at why 999, you have the following rights over your personal data. These can be exercised by contacting support@why999.bet or through your account settings where the option is available:
Right to Access
Request a full copy of all personal data why 999 holds about you. We will respond within 30 days.
Right to Rectification
Request correction of inaccurate or incomplete personal data. Contact support with the correction required.
Right to Erasure
Request deletion of your data where no legal obligation requires its retention. Note: KYC and transaction records must be retained for regulatory compliance periods.
Right to Restrict Processing
Request that we limit how we use your data while a correction or objection request is being reviewed.
Right to Data Portability
Request your personal data in a structured, machine-readable format (CSV or JSON) for transfer to another provider.
Right to Object
Object to processing based on legitimate interests, including direct marketing. Objections to marketing will be honoured immediately.
To exercise any of these rights, email support@why999.bet with the subject line "Data Rights Request" and describe what you are requesting. We will acknowledge your request within 48 hours and resolve it within 30 days.
Section 7
Data Retention Periods
Why 999 retains personal data only for as long as it is necessary for the purpose it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply:
| Data Type | Retention Period | Reason |
|---|
| Account registration data | Duration of account + 5 years after closure | Legal compliance / audit |
| KYC documents (CNIC, etc.) | 5 years after account closure | AML regulatory requirement |
| Transaction records | 7 years from transaction date | Financial records obligation |
| Betting history | 5 years from bet settlement | Dispute resolution / compliance |
| Support communications | 3 years from last interaction | Service quality / disputes |
| Session / device logs | 12 months | Security monitoring |
| Analytics cookies | Up to 13 months | Platform improvement |
| Marketing consent records | Until consent withdrawn + 3 years | Consent audit trail |
After the applicable retention period, data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised, aggregated data (for example, total monthly betting volumes) may be retained indefinitely for statistical purposes.
Section 8
Cookies and Similar Technologies
Why 999 uses cookies and similar client-side storage technologies on the platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies help the platform function correctly, remember your preferences and understand how players use the site.
Cookie Categories
| Category | Purpose | Examples | Control |
|---|
| Essential | Login sessions, security tokens, CSRF protection, basket/bet-slip state | session_id, csrf_token | Always active |
| Functional | Language preference, responsible gaming settings, odds format memory | lang_pref, odds_fmt | Always active |
| Analytics | Page views, feature usage, error reporting — aggregated and anonymised | _ga, _gid | Optional (consent) |
| Performance | Load time monitoring, A/B testing for platform improvements | perf_tracking | Optional (consent) |
Why 999 does not use advertising or tracking cookies that follow you across other websites. All optional cookies are disabled by default and activated only if you provide consent through the cookie preferences panel on the platform.
You can also control cookies through your browser settings. Disabling all cookies will prevent login from functioning, as session cookies are essential for authentication. The browser settings approach affects all cookies including essential ones, which is why we recommend using the in-platform cookie preferences panel for selective control.
Section 9
Children's Privacy
Why 999 is strictly for adults aged 18 and above. The platform does not knowingly collect personal data from anyone under 18 years of age. If why 999 discovers or reasonably suspects that an account belongs to a person under 18, the account will be immediately closed, all balances forfeited and any personal data collected will be deleted as soon as is practicable following confirmation of the player's age.
Parents and guardians who believe their child may have registered an account at why 999 without authorisation should contact support@why999.bet immediately. Please include "Underage Account" in the subject line and provide as much identifying information as possible. Why 999 will investigate and act on the report promptly.
Age verification: Why 999 may request proof of age at any point during account use. This is a protective measure — not an inconvenience — and helps ensure the platform remains a safe space for adults only.
Section 10
Security Measures at why 999
Beyond the technical protections described in Section 4, why 999 maintains the following organisational security practices that directly protect your personal data:
- Staff training: All team members with access to player data complete data protection training before gaining access and receive annual refreshers. Understanding privacy obligations is a condition of employment at why 999.
- Third-party contracts: Every third party that processes personal data on behalf of why 999 is bound by a written data processing agreement specifying what data they may process, for what purpose and the security standards they must maintain.
- Penetration testing: The why 999 platform undergoes regular security testing by independent professionals to identify and remediate vulnerabilities before they can be exploited.
- Incident response: A documented incident response plan is in place covering detection, containment, assessment and notification procedures for security incidents involving personal data.
While why 999 takes every reasonable precaution, no digital platform can guarantee absolute security. Players should use strong, unique passwords for their why 999 account and enable two-factor authentication where available. Do not share your login credentials with anyone. Why 999 will never ask for your password through email or support chat.
Section 11
Updates to This Privacy Policy
Why 999 may update this Privacy Policy from time to time. Changes might be required by new legal obligations, new features on the platform or changes in how we process data. When we make material changes — those that significantly affect your rights or how we process your data — we will notify you by email to the address registered on your account, and by a notice displayed on the platform, at least 7 days before the changes take effect.
Minor revisions, such as clarifications that do not change the substance of how data is processed, may take effect immediately. The "Last updated" date at the top of this page always reflects the current version. We recommend bookmarking this page and checking it periodically, particularly before depositing for the first time or after receiving an update notification.
Your continued use of why 999 after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to an update, you may request account closure before the new policy takes effect and why 999 will process your remaining balance subject to standard withdrawal procedures. Related policies: Terms and Conditions · Responsible Gaming
Section 12
Contact Us — Data and Privacy Enquiries
For any questions, concerns or requests relating to this Privacy Policy or the personal data why 999 holds about you, please get in touch through one of the following channels:
Email
support@why999.bet
Subject: "Privacy / Data Request"
Response within 72 hours
Live Chat
Available 24/7 through the why 999 platform. Ask to be connected to the privacy team for data-specific queries.
When contacting us about a data rights request, please include your registered email address and account username (if known) so we can locate your records efficiently. We will acknowledge all requests within 48 hours and aim to resolve them fully within 30 days. For complex requests, we may require additional verification to confirm your identity before processing the request.
