cx999 Privacy
Policy

Who We Are — Data Controller

This Privacy Policy is issued by cx999 ("cx999", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at cx999.org. cx999 acts as the data controller in respect of all personal data collected from players and visitors via the cx999 platform. As data controller, cx999 determines the purposes and means by which personal data is processed.

cx999 is the primary online casino and sports betting platform serving Pakistani players, with a player base across Karachi, Lahore, Faisalabad, Islamabad, and other cities throughout Pakistan. All data processing described in this Policy is conducted in the context of providing online gaming and sports betting services to adult players aged 21 and above.

For any questions, requests, or concerns relating to this Privacy Policy or cx999's handling of your personal data, please contact cx999's data support team via the contact details set out in Section 14 of this Policy.

Personal Data We Collect

cx999 collects personal data in several categories depending on your relationship with the platform. The data collected is limited to what is necessary for the specific purposes described in Section 5 of this Policy.

cx999 does not collect sensitive personal data such as medical records, biometric data (beyond selfie KYC verification), religious beliefs, or political opinions. Where cx999 requests KYC documents containing sensitive information (such as a CNIC which includes religion), only the identity-relevant portions are processed.

How We Collect Personal Data

cx999 collects personal data through the following channels and mechanisms:

Data you provide directly to cx999 when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, respond to a survey, or participate in a promotion. This is the primary source of personal data cx999 holds about you.

Data collected automatically when you access or use the cx999 platform, including technical data such as your IP address, device identifiers, browser type, and session information. This data is collected through server logs, cookies, and similar tracking technologies described in Section 7.

In certain circumstances, cx999 may receive personal data about you from third parties, including:

• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) confirming the status of your transactions.
• Identity verification service providers used to authenticate CNIC documents during the KYC process.
• Fraud prevention and anti-money-laundering screening services that cross-reference account information against watchlists.
• Responsible gaming organisations where a player has requested self-exclusion through a third-party programme.

Legal Basis for Processing

cx999 processes personal data only where a valid legal basis exists for doing so. The primary legal bases cx999 relies upon are as follows:

• Contractual Necessity: Processing required to perform the contract between cx999 and the player — including operating your account, processing transactions, providing games, and handling withdrawals.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering obligations, Know Your Customer requirements, age verification mandates, and financial record-keeping requirements.
• Legitimate Interests: Processing conducted on the basis of cx999's legitimate business interests, including fraud prevention, platform security monitoring, responsible gaming monitoring, and platform analytics — where these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and certain cookie placements, which cx999 conducts only where you have given explicit prior consent. You may withdraw consent at any time by contacting cx999 support.

How cx999 Uses Your Personal Data

cx999 uses the personal data it collects for the following specific purposes:

To create and manage your cx999 Account, authenticate your identity at login, maintain your account balance in PKR, process your deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, and provide you with access to all platform features.

To fulfil cx999's legal obligations, including age verification (confirming you are 21+), identity verification (KYC using CNIC or passport), anti-money-laundering (AML) checks, source-of-funds verification, and record-keeping obligations. These processing activities are mandatory and cx999 cannot provide services without conducting them.

To detect, investigate, and prevent fraudulent activity, unauthorised account access, duplicate account creation, bonus abuse, and other prohibited activities as defined in the cx999 Terms & Conditions. cx999's security systems analyse patterns in account activity, transaction data, and login behaviour for this purpose.

To monitor gaming activity for signs of problem gambling behaviour, enforce self-exclusion and cooling-off requests, apply deposit and loss limits set by the player, and proactively reach out to players whose activity patterns suggest gambling-related harm. This processing is conducted in your interest and forms part of cx999's responsible gaming obligations.

To respond to your inquiries, resolve complaints, and provide assistance via cx999's 24/7 live chat and email support channels in Urdu and English. Support communications are logged for quality assurance and training purposes.

To personalise your cx999 experience, including displaying relevant bonus offers, game recommendations, and PSL-related promotions. Marketing communications are sent only where you have consented to receive them and always include a clear opt-out mechanism.

Data Sharing & Disclosure

cx999 does not sell your personal data to any third party for commercial purposes. cx999 shares personal data only in the following specific and limited circumstances:

cx999 shares the minimum financial data necessary with payment processing partners — including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — to execute deposit and withdrawal transactions requested by you. These providers act as data processors under contractual arrangements that restrict their use of your data to transaction processing only.

cx999 may share your identity documents and personal details with third-party KYC and identity verification service providers for the purpose of authenticating your identity and age. These providers are contractually obligated to maintain strict confidentiality and to process your data only for the verification purpose specified.

cx999 may share data with fraud prevention, anti-money-laundering, and financial crime prevention services and databases where required by cx999's compliance obligations or where cx999 reasonably suspects fraudulent activity.

Third-party game providers whose games are hosted on the cx999 platform may receive limited data — typically session tokens and account identifiers — necessary to deliver the game experience. Game providers do not receive your full personal profile, financial details, or KYC information.

cx999 will disclose personal data to regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law, court order, or regulatory direction. cx999 will, where legally permitted, notify affected players of such disclosures.

Cookies & Tracking Technologies

cx999 uses cookies and similar tracking technologies on the cx999 platform to deliver a functional, secure, and personalised experience. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the cx999 platform to function. They enable your login session to persist, your PKR balance to display correctly, and core security functions to operate. These cookies cannot be disabled without breaking platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how visitors use the cx999 platform, including which games are played most, how players navigate the lobby, and where errors occur. This data helps cx999 improve the platform for Pakistani players. These cookies are set only with your consent.
• Functionality Cookies: These cookies remember your preferences, such as preferred language, display settings, and last-accessed game categories, to provide a more personalised cx999 experience.
• Marketing & Retargeting Cookies: cx999 may use marketing cookies to measure the effectiveness of promotional campaigns. These cookies are set only with explicit consent and can be withdrawn at any time.

You can manage cookie preferences through the cx999 cookie settings panel available on the platform, or by adjusting the cookie settings in your web browser. Note that disabling strictly necessary cookies will prevent access to the cx999 Account dashboard and gameplay features.

Data Security Measures

cx999 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-Bit SSL Encryption: All data transmitted between your device and cx999 servers is protected by 256-bit SSL/TLS encryption. The cx999 login process, deposit flows, and KYC document uploads all operate over encrypted connections.
• Encrypted Data Storage: Personal data and financial records stored in cx999's databases are encrypted at rest using AES-256 encryption. Passwords are stored exclusively as one-way cryptographic hashes — cx999 staff cannot read your password.
• Access Controls: Access to personal data within cx999 is restricted on a strict need-to-know basis. Staff with access to player data are subject to confidentiality obligations and receive regular data protection training.
• Multi-Factor Authentication: cx999's internal systems use multi-factor authentication for staff access. Players are also encouraged to enable two-factor authentication (2FA) on their cx999 accounts for additional protection.
• Intrusion Detection & Monitoring: cx999 operates 24/7 monitoring of its infrastructure for unusual access patterns, potential breaches, or security incidents. Automated alerts and manual review processes are in place.
• Data Breach Response: In the event of a confirmed data breach affecting player personal data, cx999 will notify affected players without undue delay, providing details of the breach, data affected, and steps cx999 has taken to contain and remediate the incident.

Data Retention Periods

cx999 retains personal data for the periods set out below. Retention periods are determined by the purpose for which data was collected and by applicable legal, regulatory, and financial record-keeping obligations.

Upon expiry of the relevant retention period, cx999 will securely delete or anonymise personal data. Anonymised data — from which no individual can be identified — may be retained indefinitely for platform analytics and responsible gaming research purposes.

Your Data Rights

cx999 recognises the following rights in respect of your personal data. To exercise any of these rights, contact cx999's data support team via the channels in Section 14. cx999 will respond to all rights requests within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data cx999 holds about you, along with information about how that data is being used and shared.
• Right to Rectification: You have the right to request that cx999 correct any inaccurate personal data it holds about you. You may update certain account details directly through your cx999 Account settings.
• Right to Erasure ("Right to Be Forgotten"): In certain circumstances, you may request that cx999 delete your personal data. Note that cx999 may be unable to delete data that is required for regulatory compliance, ongoing legal proceedings, or fraud prevention purposes.
• Right to Restriction of Processing: You may request that cx999 restrict the processing of your personal data in certain circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to cx999 in a structured, commonly used, machine-readable format, and to request that cx999 transmit this data to another service provider where technically feasible.
• Right to Object: You have the right to object to cx999's processing of your personal data where that processing is based on legitimate interests. cx999 will review the objection and cease processing if no compelling legitimate grounds override your rights.
• Right to Withdraw Consent: Where cx999 processes your data on the basis of consent (such as for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

Children's Privacy — Under-21 Protection

The cx999 platform is strictly for individuals aged 21 years and above. cx999 does not knowingly collect personal data from individuals under the age of 21. Age verification through CNIC-based KYC is mandatory before any withdrawal is processed, and cx999's registration process includes age declaration requirements.

If cx999 becomes aware that personal data has been collected from an individual who is under 21 years of age, cx999 will immediately:

• Suspend the associated cx999 Account pending investigation.
• Delete all personal data associated with the underage account as soon as practicable.
• Refund any real-money deposits made by the underage individual, subject to verification.
• Take appropriate action in accordance with cx999's responsible gaming and regulatory obligations.

International Data Transfers

cx999 primarily processes personal data within the systems and infrastructure supporting its operations. In the course of operating the cx999 platform — including through third-party game providers, KYC verification services, and fraud prevention providers — your personal data may be transferred to or processed in jurisdictions outside Pakistan.

Where such transfers occur, cx999 ensures that appropriate safeguards are in place to protect your personal data, including:

• Contractual data processing agreements requiring receiving parties to maintain data protection standards equivalent to those applied by cx999.
• Use of third-party providers that are certified under internationally recognised data security standards.
• Transfer only of the minimum personal data necessary for the specific processing purpose.

cx999 does not transfer personal data to jurisdictions that have been identified as presenting unacceptable data protection risks without implementing additional protective measures.

Updates to This Privacy Policy

cx999 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in cx999's data processing practices, applicable law, or the structure of cx999's operations. The "Last Revised" date at the top of this document will be updated to reflect the date of any change.

For material changes to this Privacy Policy — specifically changes that significantly affect the way cx999 processes your personal data or your rights — cx999 will notify registered players directly via their registered mobile number or email address prior to the change taking effect. For minor updates or clarifications, publication of the updated Policy on cx999.org constitutes sufficient notice.

Your continued use of the cx999 platform following any published update to this Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any update to this Policy, please contact cx999 support to discuss your options, including account closure.

Contact Us — Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or cx999's handling of your personal data, please contact cx999's support and data team through any of the following channels:

• Live Chat: Available 24/7 within the cx999 platform. Urdu and English agents are available throughout the day and night. Live chat is the fastest channel for data enquiries.
• Email: [email protected] — For data rights requests, use the subject line "Data Rights Request" and include your registered mobile number. cx999 targets a 24-hour initial response for data enquiries.

When submitting a data-related request, please provide your registered mobile number and account username so cx999 can verify your identity before accessing or disclosing any personal data. This identity verification step is a security measure to protect your data from unauthorised disclosure — it is not a barrier to exercising your rights.