by99 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy applies to all personal data processed by by99 in connection with the operation of by99.one, including all games, sports betting markets, payment services, customer support interactions, promotional communications, and account management functions. It applies to all registered Players, prospective users who browse the platform without registering, and individuals who contact by99 support.

by99 acts as the data controller in respect of personal data collected and processed through the by99 platform. This means by99 determines the purposes for which, and the means by which, your personal data is processed. Where by99 engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual obligations consistent with this Policy.

by99 collects the minimum personal data necessary to operate the platform, verify Player identity and age, process financial transactions, and meet applicable regulatory obligations. The categories of personal data collected are described below.

by99 collects personal data through several distinct channels, each serving a specific operational function:

• Direct Registration: Data you provide when creating your by99 account, including your mobile number, name, and date of birth.
• Financial Transactions: Data generated when you make a deposit or request a withdrawal, including transaction reference numbers and payment method identifiers confirmed by the payment processor.
• Platform Usage: Data generated automatically as you navigate and interact with by99.one, including technical and usage data captured through server logs and analytics tools.
• Customer Support: Data provided during live chat sessions, support ticket submissions, or any other communication with the by99 support team.
• Identity Verification: Where by99 requests identity documents to verify age or comply with anti-money-laundering obligations, the data contained in those documents is collected and processed for that purpose.
• Cookies and Tracking Technologies: As described in Section 9 of this Policy, by99 uses cookies and similar technologies to collect certain technical and usage data automatically.

by99 processes your personal data for the following purposes. Where more than one purpose applies to a specific category of data, all applicable purposes are pursued under appropriate legal bases as described in Section 5.

• Account Management: Creating, maintaining, and administering your by99 Player account, including processing login, managing preferences, and handling account closure requests.
• Identity and Age Verification: Confirming that registered Players are at least 21 years of age and are who they represent themselves to be, in compliance with responsible gaming obligations and regulatory requirements.
• Payment Processing: Facilitating PKR deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other supported payment methods.
• Game and Betting Operations: Recording bets, calculating and crediting winnings, settling sporting markets, and maintaining accurate game history for Player reference and dispute resolution.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraud, money laundering, cheating, multi-accounting, and other prohibited conduct described in the by99 Terms and Conditions.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential problem gambling behaviour and ensuring that responsible gaming tools — including deposit limits and self-exclusion — operate correctly.
• Legal and Regulatory Compliance: Meeting obligations imposed by applicable international gaming regulatory standards, anti-money-laundering frameworks, and other legal requirements applicable to by99's operations.
• Customer Support: Responding to Player queries, resolving disputes, and maintaining support quality through interaction records.
• Platform Improvement: Analysing aggregated usage data to improve by99's products, user interface, game selection, and overall Player experience.
• Promotional Communications: Where you have consented or where it is otherwise permitted, sending you information about by99 promotions, bonuses, and platform updates. You may opt out at any time.

by99 processes personal data only where a valid legal basis exists. The primary legal bases applicable to by99's data processing activities are as follows:

• Performance of Contract: Processing necessary to create and manage your Player account, process payments, operate games, and provide the services you have contracted for when registering on by99.
• Legal Obligation: Processing required to comply with anti-money-laundering regulations, age verification requirements, gaming regulatory obligations, and other applicable legal duties.
• Legitimate Interests: Processing carried out for by99's legitimate business interests where those interests are not overridden by your rights and interests, including fraud prevention, platform security, responsible gaming monitoring, and general platform improvement.
• Consent: Processing for optional purposes — primarily marketing and promotional communications — where your explicit consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

by99 does not sell, rent, or trade your personal data to third parties for marketing purposes. Personal data is shared only in the following limited circumstances, each of which is governed by appropriate contractual or legal safeguards:

• Payment Processors: Financial data necessary to process your deposits and withdrawals is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and any other payment service providers operating on the by99 platform. These providers process data under their own privacy policies and applicable financial regulations.
• Game and Technology Providers: Technical data and gaming activity may be shared with by99's game software providers and platform technology partners to the extent necessary for game operation, RNG certification, and technical support.
• Identity Verification Services: Where by99 employs third-party KYC (Know Your Customer) or age verification providers, identity data may be shared with those providers solely for the purposes of completing verification.
• Fraud and AML Services: Transaction data and behavioural signals may be shared with anti-fraud and anti-money-laundering screening services to protect the platform and its Players.
• Regulatory and Law Enforcement Authorities: by99 may be required to disclose personal data to relevant regulatory bodies, law enforcement agencies, or courts where required by law or in response to a valid legal process. by99 will, where legally permitted, notify affected Players of such disclosures.
• Professional Advisers: Legal, financial, and compliance advisers engaged by by99 may have access to personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.

by99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory obligations. The general retention principles applied by by99 are as follows:

• Active Account Data: Personal and financial data associated with an active by99 account is retained for the duration of the account's existence and for a reasonable period following account closure to handle any post-closure queries or disputes.
• Financial Transaction Records: Payment and transaction records are retained for a minimum period in accordance with anti-money-laundering and financial record-keeping obligations applicable to gaming operators. This period is typically a minimum of five years following the transaction date.
• Identity Verification Documents: KYC documentation is retained for the minimum period required by applicable regulatory standards, after which it is securely deleted or anonymised.
• Customer Support Records: Communications records are retained for a period sufficient to resolve any disputes that may arise and for quality assurance purposes, typically up to three years from the date of the interaction.
• Marketing Data: Data held solely for marketing purposes is retained until you withdraw consent or opt out, at which point it is promptly removed from active marketing systems.

by99 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Security measures include, but are not limited to:

• Encryption of data in transit using industry-standard TLS protocols across the by99 platform.
• Encryption of sensitive data at rest, including financial and identity data held in by99's systems.
• Access controls ensuring that by99 staff can only access personal data necessary for their specific role.
• Regular internal security reviews and monitoring for unusual access patterns or potential breaches.
• Two-factor authentication options available for Player accounts to reduce the risk of unauthorised access.
• Staff training on data protection obligations and secure data handling procedures.

While by99 takes commercially reasonable steps to protect your data, no online platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own account credentials and should contact by99 support immediately upon suspecting unauthorised account access.

by99.one uses cookies and similar tracking technologies to support platform functionality, improve user experience, and gather aggregated usage analytics. The categories of cookies used are described below:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cannot be disabled without affecting platform functionality.
• Functional Cookies: Store your preferences such as language settings, display preferences, and responsible gaming tool configurations so they persist between sessions.
• Analytics Cookies: Collect aggregated, anonymised data about how Players use by99.one — which pages are visited most frequently, how long sessions last, and where Players navigate from. This data helps by99 improve the platform.
• Performance Cookies: Help by99 identify technical issues by monitoring platform performance, error rates, and load times.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the by99 platform. by99 does not use third-party advertising or retargeting cookies.

by99 respects your rights in relation to your personal data. Depending on applicable data protection principles, you may have the following rights:

• Right of Access: You may request a copy of the personal data by99 holds about you. by99 will respond to verified access requests within a reasonable timeframe.
• Right to Rectification: If personal data held by by99 is inaccurate or incomplete, you may request that it be corrected. Account profile details can be updated via your account settings or by contacting support.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to by99's legal obligations to retain certain data — for example, financial transaction records retained for AML compliance — which may limit or delay erasure of specific data categories.
• Right to Restrict Processing: You may request that by99 restrict the processing of your data while a dispute regarding accuracy or legitimate purpose is being resolved.
• Right to Data Portability: Where technically feasible and legally required, you may request your personal data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your personal data where by99 relies on legitimate interests as its legal basis, subject to by99's overriding legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact the by99 support team via live chat or at the email address listed in Section 14. by99 may need to verify your identity before processing rights requests.

by99 strictly prohibits the registration or use of the platform by individuals under 21 years of age. by99 does not knowingly collect personal data from anyone under 21. If by99 becomes aware that personal data has been collected from an individual under 21, that data will be deleted and the associated account will be permanently closed.

by99 employs age verification procedures — including documentary verification where required — to enforce this restriction. Parents and guardians who believe their child may have accessed by99 are encouraged to contact the support team immediately at the address provided in Section 14 so that the matter can be investigated and resolved promptly.

by99 operates internationally and may transfer personal data to third-party service providers located outside Pakistan. Where such transfers occur, by99 takes reasonable steps to ensure that appropriate safeguards are in place, consistent with internationally recognised data transfer principles, to protect the personal data being transferred.

Transfers to payment processors, game providers, and technology partners are governed by contractual data protection clauses that require those parties to maintain data security standards consistent with those described in this Policy. by99 will not transfer personal data to jurisdictions that do not provide adequate data protection without implementing appropriate contractual protections.

by99 may update this Privacy Policy from time to time to reflect changes in data processing practices, regulatory requirements, or platform features. Material changes will be communicated to registered Players via notification through the by99 platform or to the registered mobile number associated with your account prior to the changes taking effect.

The current effective version of this Privacy Policy is always available at by99.one/privacy-policy, with the effective date displayed at the top of the document. Continued use of by99 following publication of an updated Privacy Policy constitutes your acceptance of the changes.

If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how by99 is handling your personal data, please contact the by99 support team through the following channels:

• Live Chat: Available 24/7 directly on by99.one. Peak support hours are 9:00 AM to 2:00 AM Pakistan Standard Time (PST).
• Email: [email protected] — please include "Privacy Enquiry" in the subject line for routing purposes. Email is not a clickable link — please copy and paste the address into your email client.

by99 will acknowledge privacy-related enquiries promptly and aim to resolve substantive requests within a reasonable period. Where an enquiry requires verification of your identity before it can be processed, by99 will communicate the verification requirements clearly and without unnecessary delay.