st999 Privacy Policy

1. About This Privacy Policy

This Privacy Policy (hereinafter "Policy") describes how st999 (hereinafter "st999", "we", "us", or "our") collects, uses, stores, discloses, and protects the personal data of individuals (hereinafter "Player", "User", or "you") who register an account, access, or otherwise interact with the st999 online gaming and sports betting platform, accessible at st999.ws.

This Policy forms part of and should be read alongside the st999 Terms & Conditions. Where there is any conflict between this Policy and the Terms & Conditions regarding a data protection matter, this Policy shall govern.

This Policy is written in English. In the event of any translation being made available, the English version shall be the authoritative text in all circumstances.

2. Who We Are

st999 is an internationally licensed online casino and sports betting operator serving players across Pakistan and other permitted jurisdictions. For the purposes of applicable data protection legislation, st999 acts as the Data Controller in respect of your personal data — meaning that we determine the purposes and means by which your personal data is processed.

Our designated Data Protection contact can be reached via the support channels listed in Section 15 of this Policy. We take our obligations as Data Controller seriously and have implemented comprehensive internal data governance procedures to ensure ongoing compliance.

3. Personal Data We Collect

Depending on how you interact with the st999 platform, we may collect the following categories of personal data:

3.1 Identity & Contact Data

• Full legal name (as it appears on your CNIC or passport)
• Date of birth (used to verify you are aged 21 or above)
• Residential address (city, province, postal code — e.g., Karachi, Lahore, Faisalabad, Islamabad)
• Email address registered to your st999 account
• Pakistani mobile number used for OTP verification and account communications
• Government-issued identity document number (CNIC/SNIC/passport), collected during KYC

3.2 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment method references
• JazzCash or EasyPaisa mobile wallet identifiers (registered mobile numbers) where used for transactions
• HBL, UBL, Meezan Bank, Raast, 1LINK, or GrabPay account references where applicable
• Transaction history maintained for AML compliance and dispute resolution purposes

3.3 Technical & Device Data

• IP address and approximate geographic location at time of login
• Device type, operating system, and browser version
• Session duration and login timestamps
• Cookies and similar tracking technologies (see Section 10)

3.4 Gaming & Behavioural Data

• Game history including titles played, stakes, outcomes, and session durations
• Sports betting selections, odds accepted, and bet settlement records
• Responsible gaming tool settings and activation history (deposit limits, self-exclusion events)
• Bonus and promotional offer redemption records

3.5 Communication Data

• Records of live chat conversations with the st999 support team
• Email correspondence sent to or received from st999
• Feedback, survey responses, or complaint submissions

4. How We Collect Your Data

We collect personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or submit a form on the Platform
• Automatically — through cookies, server logs, and analytics tools as you navigate and interact with the st999 website
• From third-party verification providers — identity verification and fraud screening services that st999 engages to meet its licensing obligations
• From payment processors — transaction confirmation and status data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and other integrated payment partners

5. Why We Use Your Personal Data

The table below sets out each primary purpose for which st999 processes personal data, along with the type of data involved and the legal basis relied upon (detailed further in Section 6):

6. Legal Bases for Processing

st999 relies on the following legal bases when processing your personal data:

• Contract Performance: Processing is necessary to fulfil our obligations under the st999 Terms & Conditions that you agreed to upon registration — including maintaining your account, processing transactions, and delivering gaming services.
• Legal Obligation: Processing is required to comply with applicable laws and our international gaming licence obligations, including KYC, AML monitoring, and regulatory reporting.
• Legitimate Interests: Processing serves the legitimate interests of st999 or third parties — such as fraud prevention, platform security, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: For optional data uses such as receiving marketing communications or enabling non-essential cookies, we will obtain your explicit consent beforehand. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

7. Sharing Your Personal Data

st999 does not sell, rent, or trade your personal data. We may, however, share your data with the following categories of third parties where necessary for the purposes described in this Policy:

• Payment Processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, GrabPay, and other integrated payment partners — solely for the purpose of processing your deposits and withdrawals
• Identity Verification Providers: Third-party KYC service providers engaged to verify the identity and age of st999 account holders as required by our licensing obligations
• Fraud Prevention Services: Specialist fraud screening and risk management providers who help st999 identify and prevent fraudulent activity on the Platform
• Game Content Providers: Software studios and live dealer content providers whose games are available on the st999 platform — these providers may receive limited session and game history data necessary to deliver their services
• Regulatory Authorities: Gaming regulators, financial intelligence units, and law enforcement agencies — where we are required by law or our licensing terms to disclose data
• IT and Cloud Infrastructure Providers: Hosting, security, and data storage vendors who process data on our behalf under strict contractual data processing obligations

8. International Data Transfers

As an internationally licensed operator, st999 may transfer your personal data to countries outside of Pakistan for storage, processing, or service delivery purposes. Such transfers may include transfers to our hosting infrastructure, game content providers, and KYC service providers operating in other jurisdictions.

Where personal data is transferred internationally, st999 ensures that appropriate safeguards are in place to protect your data, including contractual protections equivalent to or exceeding those applicable in Pakistan. By accepting this Privacy Policy, you consent to such international transfers of your personal data as described herein.

9. Data Retention Periods

st999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our international gaming licence and applicable law. The following general retention guidelines apply:

• Account data and KYC documents: Retained for the duration of the account relationship, plus a minimum of 5 years following permanent account closure — in accordance with AML and gaming licence retention obligations
• Transaction and financial records: Retained for a minimum of 5 years from the date of the transaction
• Customer support and communication records: Retained for 3 years from the date of the last interaction, or longer where the record relates to a dispute that is unresolved
• Marketing preference records: Retained until consent is withdrawn, plus a reasonable period thereafter to evidence prior consent
• Technical and session logs: Typically retained for 12 months, unless required for longer in connection with a fraud investigation or legal proceeding

Following the expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

10. Cookies & Tracking Technologies

The st999 website uses cookies and similar tracking technologies to operate the Platform, improve your experience, and support our security and analytics functions. Cookies are small text files placed on your device by your web browser when you visit the st999 website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing basic functionality.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming tool configurations to improve your experience on return visits.
• Analytics Cookies: Collect aggregated, anonymised data about how players use the st999 website — including pages visited, session duration, and error events — to help us improve platform performance.
• Marketing Cookies: Used only where you have provided consent, to deliver relevant promotional content relating to st999 products and services.

Most web browsers allow you to control cookie settings through the browser's settings menu. However, restricting cookies at the browser level may impair certain features of the st999 platform, including the ability to maintain an authenticated session.

11. Your Data Rights

As a st999 player, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team using the details provided in Section 15. We will respond to all verified requests within 30 calendar days.

• Right of Access: You may request a copy of the personal data st999 holds about you, together with information about how it is being used.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request that st999 delete your personal data. This right is subject to exceptions where retention is required by law or our licensing obligations — for example, we cannot erase AML-related transaction records during the mandatory retention period.
• Right to Restriction of Processing: You may request that st999 restrict the processing of your data in specific circumstances — for example, while a dispute about the accuracy of the data is being resolved.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that you may transfer it to another service provider where technically feasible.
• Right to Object: Where we rely on legitimate interests as the legal basis for processing, you have the right to object. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

12. Children's Privacy

The st999 platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process described in the st999 Terms & Conditions.

If st999 discovers or has reason to believe that personal data has been collected from a person under the age of 21, the associated account will be suspended immediately, the data will be deleted as soon as practicable, and any funds held in the account will be dealt with in accordance with our underage gambling policy and applicable regulatory guidance.

If you are a parent or guardian and believe that your child may have accessed the st999 platform, please contact our support team immediately. We take underage gambling concerns with the utmost seriousness.

13. Third-Party Links

The st999 website may contain links to third-party websites or services — for example, responsible gaming resource pages. This Privacy Policy applies solely to data collected and processed by st999. st999 is not responsible for the privacy practices of third-party websites and we encourage you to review the privacy policy of any external website you visit.

Our payment partner interfaces — such as the JazzCash or EasyPaisa payment screens you may be redirected to when making a deposit — are operated by those third parties and are subject to their own privacy terms. st999 receives only the transaction reference and confirmation data necessary to credit your account.

14. Changes to This Privacy Policy

st999 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or the services we offer. Where changes are material, we will notify registered players via email or an in-platform notification at least 14 days before the updated Policy takes effect.

The "Last Reviewed" date displayed at the top of this page will be updated each time the Policy is revised. We encourage you to review this Policy periodically. Your continued use of the st999 platform after the effective date of any revised Policy constitutes acceptance of the updated terms.

Prior versions of this Policy are available on request by contacting our support team.

15. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how st999 has handled your personal data, please reach out using one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, from within your st999 account dashboard — the fastest way to reach our team
• Email: [email protected] (plain text only — not a clickable link; please copy and paste into your email client)

We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days. For complex requests, we may need additional time, in which case we will inform you of the expected response timeline.

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority or the dispute resolution body designated under st999's international gaming licence. Further details on the applicable escalation process are available from our support team upon request.