h999 Privacy Policy

1 Who We Are

h999 Casino operates the online casino and sports betting platform accessible at h999.cam. For the purposes of this Privacy Policy, h999 is the data controller — meaning h999 determines the purposes and means by which your personal data is processed. References to "h999", "we", "us", or "our" throughout this document refer to the h999 platform and its operating entity.

h999 is committed to handling personal data responsibly and in compliance with applicable data protection laws and international best-practice standards for online gaming platforms. If you have any questions about how h999 processes your data, you can reach our data protection contact at [email protected] — all data-related enquiries are handled within 5 business days.

2 Data We Collect

h999 collects personal data from you at several points throughout your interaction with the platform. The categories of data collected and the context in which they are gathered are set out in the table below:

h999 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly required for CNIC-based KYC identity verification.

3 How We Use Your Data

h999 processes your personal data for the following specific purposes. We do not use your data in any way that is incompatible with the purposes for which it was originally collected without first obtaining your consent or establishing a separate lawful basis.

• Account management: creating, maintaining, and administering your h999 player account, including password resets and session management.
• Identity verification (KYC): verifying your identity and age (21+) in accordance with anti-money-laundering obligations and responsible gaming requirements.
• Payment processing: facilitating PKR deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT, and processing withdrawal requests to verified accounts.
• Fraud prevention: detecting and investigating suspicious account activity, duplicate accounts, payment fraud, and bonus abuse using automated monitoring systems.
• Regulatory compliance: meeting legal obligations including anti-money-laundering (AML) record-keeping, tax reporting where applicable, and gaming licence conditions.
• Customer support: responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance via live chat and email.
• Responsible gaming: monitoring gaming patterns for signs of problem gambling, enforcing player-set deposit limits, and administering self-exclusion requests.
• Marketing communications: sending promotional offers and bonus notifications via SMS or email — only where you have given explicit consent to receive such communications, which can be withdrawn at any time via account settings.
• Platform improvement: analysing aggregated, anonymised usage data to improve game selection, user experience, and site performance — this analysis does not identify individual players.

4 Legal Basis for Processing

h999 relies on one or more of the following legal bases when processing your personal data, depending on the specific purpose involved:

• Contractual necessity: Processing your account data, payment details, and gaming activity is necessary for h999 to fulfil its contractual obligations to you as a registered player.
• Legal obligation: KYC verification, AML record-keeping, and regulatory reporting are required by law and are not optional for either h999 or the player.
• Legitimate interests: Fraud detection, platform security monitoring, and responsible gaming pattern analysis are conducted on the basis of h999's legitimate interest in maintaining a safe and fair gaming environment.
• Consent: Marketing communications via SMS or email are sent only where you have provided freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time through your account settings or by contacting [email protected].

5 Data Sharing & Disclosure

h999 does not sell, rent, or trade your personal information. h999 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

5.1 Service Providers

Third-party service providers that assist h999 in operating the platform — including KYC identity verification providers, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank), fraud detection systems, cloud infrastructure providers, and customer support software — may access your data only to the extent necessary to perform their contracted services. All service providers are contractually bound to confidentiality and may not use your data for any purpose beyond the contracted service.

5.2 Game Software Providers

Some game providers whose titles are hosted on h999 may receive anonymised session identifiers or game round IDs to validate game results and settle jackpots. Game providers do not receive your name, CNIC, payment details, or contact information.

5.3 Legal & Regulatory Authorities

h999 may be required to disclose your personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where such disclosure is required by law or pursuant to a valid legal order. h999 will, where legally permissible, notify you of such a disclosure request before complying.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of h999's assets, player data may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity assuming the same privacy obligations set out in this Policy.

6 Payment Data Security

h999 treats payment data with the highest level of security. The following measures are specifically applied to the handling of your PKR banking information and cryptocurrency wallet addresses:

• JazzCash and EasyPaisa transaction references are stored in encrypted form and are accessible only to the h999 payments compliance team.
• HBL, UBL, and Meezan Bank account numbers used for withdrawals are tokenised — only a masked reference is retained in the primary h999 database after the withdrawal is processed.
• USDT wallet addresses are associated with your account for withdrawal whitelisting purposes and are stored in access-restricted vault systems.
• h999 does not store full debit or credit card numbers on its servers. Card processing, where applicable, is handled entirely by PCI-DSS Level 1 certified payment processors.
• Internal staff access to payment data is role-based, logged, and audited. No employee has unrestricted access to full payment records.

7 Cookies & Tracking Technologies

h999 uses cookies and similar tracking technologies on the h999.cam platform. The following types of cookies are in use:

h999 does not use third-party advertising cookies, social media tracking pixels, or remarketing tags. You will not be tracked across other websites by h999 cookies.

8 Data Retention

h999 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention guidelines:

• Active account data: retained for the duration of your account's active status plus a post-closure period of 5 years to satisfy AML record-keeping requirements.
• KYC documents (CNIC, passport): retained for a minimum of 5 years following account closure, as required by international AML standards applicable to gaming operators.
• Transaction records: PKR deposit and withdrawal records are retained for 7 years to meet financial record-keeping obligations.
• Game round logs: retained for 12 months following the date of each game round, primarily to support dispute resolution.
• Customer support records: live chat transcripts and email correspondence retained for 24 months from the date of the interaction.
• Marketing consent records: retained for the duration of your consent plus 2 years following withdrawal, to demonstrate compliance with consent obligations.

When data is no longer required under any applicable retention period, h999 securely destroys or anonymises it in a manner that prevents reconstruction of the original personal data.

9 Your Rights

As a data subject, you hold the following rights in relation to your personal data held by h999. You may exercise any of these rights by contacting [email protected] with the subject line "Data Rights Request". h999 will respond within 30 calendar days of receiving a valid request.

10 Children's Privacy

h999 is an adults-only platform. The minimum age to register and play on h999 is 21 years. h999 does not knowingly collect personal data from individuals under the age of 21. If h999 becomes aware that personal data has been collected from an underage individual, that data will be deleted immediately and the associated account will be permanently closed.

If you are a parent or guardian and believe that your child has registered on h999, please contact us immediately at [email protected] with the subject line "Underage Account Report". h999 will investigate and take appropriate action within 24 hours of receiving such a report.

11 International Data Transfers

h999 operates infrastructure and engages service providers that may be located in jurisdictions outside Pakistan. Where personal data is transferred internationally — for example, to cloud hosting providers or KYC verification platforms operating in other countries — h999 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to what is set out in this Privacy Policy.

Safeguards used for international transfers include standard contractual clauses, data processing agreements that bind the recipient to h999's privacy standards, and transfers only to jurisdictions that provide an adequate level of data protection under recognised frameworks. h999 does not transfer personal data to jurisdictions that h999 assesses as providing insufficient data protection without first putting in place additional contractual and technical safeguards.

12 Security Measures

h999 implements a layered security architecture to protect your personal data against unauthorised access, loss, disclosure, alteration, or destruction. Key technical and organisational security measures include:

• TLS 1.3 encryption for all data in transit between your browser or mobile app and h999 servers
• AES-256 encryption for sensitive data at rest, including KYC documents and payment references
• Multi-factor authentication options for player accounts and mandatory MFA for all h999 staff accessing player data
• Role-based access controls ensuring that only authorised personnel can access specific categories of player data
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• 24/7 security monitoring and automated anomaly detection on all production systems
• Incident response procedures in place to contain and remediate data security incidents within defined timeframes

Despite these measures, no internet-based system is completely immune to security threats. h999 will notify affected players without undue delay in the event of a data breach that is likely to result in a high risk to their rights and freedoms, in accordance with applicable data breach notification requirements.

13 Responsible Gaming & Data

h999's responsible gaming programme relies on the processing of your gaming activity data to identify patterns that may indicate problem gambling behaviour. This processing is conducted in h999's legitimate interest as a responsible gaming operator and in accordance with its licensing obligations. Specifically, h999 may use your data to:

• Monitor your session duration, deposit frequency, and loss patterns to flag accounts that may benefit from responsible gaming interventions
• Enforce the deposit limits, loss limits, and session reminders you have set through your account settings
• Process and enforce self-exclusion requests, including sharing your self-exclusion status with h999's platform systems to prevent login
• Prevent you from creating a new h999 account during an active self-exclusion period by matching registration details against the self-exclusion register

Responsible gaming data processing is a non-negotiable part of operating a safe and compliant gaming platform. This processing cannot be opted out of while you hold an active h999 account. For more information about h999's responsible gaming tools, visit the Responsible Gaming page. 21+ only.

14 Changes to This Privacy Policy

h999 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform functionality. Where changes are material — meaning they affect your privacy rights in a significant way — h999 will provide at least 7 days' prior notice by email to your registered address before the updated Policy takes effect.

The effective date at the top of this page will be updated each time the Policy is revised. Your continued use of the h999 platform after the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not accept the updated Policy, you should cease using the platform and contact h999 to exercise your data rights.

Previous versions of this Privacy Policy are archived and available on request by contacting [email protected] with the subject line "Previous Privacy Policy Version".

15 Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the way h999 processes your personal data, please contact us through the following channels. All privacy-related enquiries are handled by h999's data protection contact and will receive a response within 5 business days.

• Email : [email protected] — Subject line: "Privacy Policy Enquiry"
• Live Chat: Available 24 hours / 7 days via the h999 platform
• Website: h999.cam — data subject rights requests can be submitted via your account dashboard

When contacting h999 about privacy matters, please include your account username and a clear description of your enquiry or request. For data rights requests (access, rectification, erasure, portability), h999 will verify your identity before processing the request to protect your privacy.