cd999 Privacy Policy

This Privacy Policy is issued by cd999 ("cd999", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://cd999.bio (the "Platform"). cd999 acts as the data controller in respect of all personal data collected from users ("you", "your", "Player") in connection with your registration, use of the Platform, and any communications you have with our support team.

cd999 operates under an international gaming license and serves players primarily based in Pakistan. Our platform is available exclusively in English and is designed to comply with the data protection standards required under our licensing jurisdiction.

This Privacy Policy applies to all personal data we process in connection with the cd999 Platform, including data collected via the website at https://cd999.bio, our live chat support system, email correspondence, and any mobile-optimised interfaces associated with the cd999 brand.

cd999 collects personal data across several categories depending on how you interact with the Platform. The categories of personal data we may collect about you are set out in the table below:

cd999 collects personal data through the following channels and mechanisms:

• Direct collection: Information you provide when you register an account, complete KYC verification, submit a deposit or withdrawal request, use live chat support, or communicate with us by email.
• Automated collection: Technical and usage data collected automatically through cookies, server logs, and similar tracking technologies when you access and navigate the cd999 Platform. See Section 9 for full cookie details.
• Third-party collection: Identity and payment verification data received from our licensed KYC and payment processing partners when they process your verification documents or payment transactions on our behalf.
• Publicly available sources: In limited circumstances, cd999 may verify information you provide against publicly available records or databases — for example, to confirm that CNIC details provided during registration are consistent with publicly available national registry records.

cd999 does not collect personal data from social media platforms, data brokers, or any advertising networks. We do not purchase customer data lists from third parties.

cd999 uses the personal data it collects for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with the original purpose for which it was collected without first obtaining your consent or establishing a separate legal basis.

• Account registration and management: To create and maintain your cd999 player account, authenticate your logins, process password resets, and ensure that only one account exists per individual.
• Identity verification (KYC): To verify your identity, age (21+), and the ownership of your registered payment methods in compliance with the requirements of our international gaming license and applicable anti-money laundering regulations.
• Payment processing: To process your deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and bank transfer channels, and to reconcile transaction records in PKR.
• Platform operation and game delivery: To deliver the games, betting markets, live casino experiences, and other features you access on cd999, including real-time sports data for cricket, PSL, and boxing markets.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance via live chat and email in English and Urdu.
• Responsible gaming compliance: To monitor your gaming activity for indicators of problem gambling, to enforce deposit limits and self-exclusion requests, and to fulfil our obligations under responsible gaming standards.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, money laundering, and other prohibited conduct as described in the cd999 Terms and Conditions.
• Legal and regulatory compliance: To meet the reporting, record-keeping, and disclosure requirements imposed by our gaming license authority and applicable laws.
• Platform analytics and improvement: To understand how players interact with cd999, identify bugs or performance issues, and continuously improve the platform experience.
• Marketing communications (where you have opted in): To send you promotional offers, bonus announcements, PSL betting promotions, and other relevant communications. You can opt out of marketing communications at any time via your account settings or by contacting live chat.

cd999 processes your personal data on the following legal bases, depending on the nature of the processing activity involved:

• Contractual necessity: Processing required to register your account, operate the Platform, process deposits and withdrawals, and provide the services you have requested. Without this processing, cd999 cannot provide its services to you.
• Legal obligation: Processing required to comply with our obligations under our international gaming license, anti-money laundering regulations, KYC requirements, and any applicable laws — including the obligation to maintain transaction records and to report suspicious activity where required.
• Legitimate interests: Processing carried out to protect the security and integrity of the Platform, prevent fraud, maintain responsible gaming standards, improve the platform, and manage our business operations — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional marketing communications. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

cd999 does not share your personal data with third parties except in the following limited and clearly defined circumstances:

• KYC and identity verification providers: Licensed third-party identity verification services that process your CNIC and supporting documents on our behalf to confirm your identity and age. These providers act as data processors under binding data processing agreements with cd999.
• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment service providers that process your deposit and withdrawal transactions. These providers receive only the financial data necessary to complete the relevant transaction.
• Gaming software and content providers: Suppliers of casino games, live dealer studios, sportsbook data feeds, and slot software whose products are offered through the cd999 Platform. Data shared with these providers is limited to session-level data necessary to operate the game.
• Fraud prevention and AML screening services: Specialist services used to screen transactions and player behaviour for indicators of money laundering, match-fixing, or fraudulent activity.
• Regulatory and licensing authorities: cd999 may be required to disclose player data to its gaming license authority or to law enforcement agencies in response to a lawful request, court order, or statutory obligation. cd999 will comply with all lawfully issued disclosure requirements.
• Professional advisers: Lawyers, auditors, accountants, and insurers who provide professional services to cd999 under obligations of confidentiality.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of cd999's business, player personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections.

In all cases where cd999 shares data with third-party processors, it does so under written data processing agreements that require those processors to protect the data in accordance with applicable privacy standards and to use it only for the specified purpose.

cd999 operates under an international gaming license and, as a result, some of the personal data we collect may be processed by our service providers in jurisdictions outside Pakistan. Where such transfers occur, cd999 ensures that appropriate safeguards are in place to protect your personal data, including:

• Transfers to jurisdictions that offer an adequate level of data protection as determined by the relevant regulatory authority;
• Standard contractual clauses or equivalent contractual safeguards that require the recipient to protect the data in accordance with standards equivalent to those applied by cd999; and
• Binding data processing agreements that restrict how the recipient may use the transferred data.

If you would like more information about the specific safeguards in place for any particular international data transfer, please contact cd999 support via live chat or at the email address provided in Section 14.

cd999 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or device and cd999 servers is encrypted using current TLS protocols. The padlock icon in your browser address bar confirms this encryption is active.
• Encrypted data storage: Sensitive personal data — including CNIC numbers, payment details, and identity verification documents — is stored in encrypted form using industry-standard encryption algorithms. Encryption keys are managed separately from the encrypted data.
• Access controls: Access to personal data within cd999's systems is restricted on a strict need-to-know basis. Staff access is role-based, logged, and subject to regular review. KYC documents are accessible only to authorised compliance personnel.
• Intrusion detection and monitoring: cd999's infrastructure is protected by active monitoring systems that detect and alert on suspicious access patterns, unusual data queries, and potential security breaches in real time.
• Third-party security assessments: cd999's platform and infrastructure undergo periodic independent security assessments to identify and remediate vulnerabilities.
• Staff training: All cd999 staff who handle personal data are trained on data protection obligations, secure data handling procedures, and how to identify and report potential security incidents.

While cd999 implements robust technical and organisational security measures, no system is completely immune to risk. You are responsible for maintaining the confidentiality of your own cd999 account credentials. Do not share your password with anyone. cd999 will never ask for your password through any channel.

cd999 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, remember your preferences, and analyse how players use the site so we can continue improving it. The following table summarises the types of cookies used on the cd999 Platform:

cd999 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform. The analytics tools used by cd999 are configured to anonymise IP addresses and do not share raw individual-level data with any third party.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling functional cookies will mean that your preferences are not saved between sessions.

cd999 retains personal data for only as long as is necessary to fulfil the purposes for which it was collected, or as required by our regulatory and licensing obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your active account relationship with cd999, plus a period of up to 5 years following account closure. This extended retention period is required under our gaming license and AML compliance obligations.
• KYC and identity documents: Retained for a minimum of 5 years from the date of account closure or the date of the last transaction, whichever is later. This is a regulatory requirement under anti-money laundering standards applicable to licensed gaming operators.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements under our gaming license.
• Customer support communications: Retained for 3 years from the date of the interaction, to support dispute resolution and quality assurance processes.
• Marketing consent records: Retained for 3 years from the date of consent, or until you withdraw your consent, whichever is earlier.
• Server logs and technical data: Retained for up to 12 months, after which they are anonymised or deleted unless required for an active security investigation.

When personal data is no longer required for any legitimate retention purpose, cd999 will either securely delete it using data-destruction standards appropriate to the sensitivity of the data, or irreversibly anonymise it so that it can no longer be attributed to you.

As a user of the cd999 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, contact cd999 support via live chat or email — details are in Section 14. cd999 will respond to all valid rights requests within a reasonable period, typically within 30 days.

• Right of access: You have the right to request a copy of the personal data cd999 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For account details, many fields can be updated directly through your account settings panel.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you believe the data is being processed unlawfully. Note that erasure requests may be declined where cd999 has a legal obligation to retain the data (e.g., KYC and AML record-keeping requirements).
• Right to restriction of processing: You may request that cd999 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing based on cd999's legitimate interests, including where data is processed for direct marketing purposes. An objection to marketing communications will always be honoured immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place before the withdrawal.

The cd999 Platform is strictly intended for users who are aged 21 years or older. cd999 does not knowingly collect personal data from individuals under the age of 21. The 21+ age restriction is enforced at the point of registration through CNIC-based identity verification and is monitored on an ongoing basis.

If cd999 becomes aware that personal data has been collected from a user who is under 21 years of age, it will take immediate steps to close the account, delete the associated personal data to the extent permitted by regulatory obligations, and handle any funds in the account in accordance with applicable licensing requirements.

If you are a parent or guardian and you believe that a minor in your household has registered an account or accessed the cd999 Platform using your device or credentials, please contact cd999 support immediately via live chat. We will investigate and act on any such report promptly. We also recommend that you configure the parental control features available through your internet service provider and device operating system to prevent underage access to online gambling platforms.

cd999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable regulations, or changes in the requirements of our gaming license. The most current version of this Privacy Policy is always accessible via the footer link on every page of the cd999 website.

The "Last Updated" date at the top of this document will be revised whenever a change is made. For material changes — those that significantly affect how we collect or use your personal data, or that affect your rights — cd999 will provide advance notice via the email address registered on your account or via a notice displayed upon your next login to the Platform.

Your continued use of the cd999 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any change to this Privacy Policy, you should stop using the Platform and may request account closure as described in the cd999 Terms and Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or have a concern about how cd999 handles your personal data, please get in touch using the channels below:

• Live Chat: Available 24/7 directly through the cd999 website. Our support team can assist in both English and Urdu and will direct your privacy query to the appropriate team member.
• Email: Contact us at [email protected] — this is a plain text address and is not a clickable link. Please include "Privacy Request" in your subject line so your message is routed correctly. Responses are typically provided within one business day.

When submitting a data rights request by email, please include your registered mobile number and a brief description of your request. You will be asked to verify your identity before any data is disclosed, modified, or deleted.