SA999 Privacy Policy – How We Protect Your Data in Pakistan

This Privacy Policy sets out how SA999 (referred to as "SA999", "we", "us", or "the platform") collects, stores, uses, and protects the personal data of individuals who register and use the SA999 platform at sa999.click. It applies to all SA999 registered players, visitors to the SA999 website, and anyone who contacts SA999 support.

SA999 operates an online casino and sportsbook. The nature of that service means we need to collect certain personal information — to verify your identity, process your payments, prevent fraud, and ensure we meet our responsible gaming obligations. None of that is optional on a licensed gaming platform. What is within our control is how carefully we handle that data, and that's what this document is about.

By registering an SA999 account or using the SA999 platform, you acknowledge that you have read and understood this Privacy Policy. If there is anything in this policy that you are not comfortable with, please contact SA999 support before registering so we can address your concerns directly.

This Privacy Policy is reviewed regularly and updated when there are changes to the way SA999 processes data or when there are changes in applicable privacy regulations. The effective date at the top of this document reflects the most recent version. Continued use of SA999 after an updated policy is published constitutes acceptance of the revised version.

SA999 collects personal data in three ways: information you provide directly, information generated by your use of the platform, and information received from trusted third parties involved in operating the service.

SA999 uses your personal data for specific, legitimate purposes. We do not use your data for purposes that go beyond what is reasonable and necessary for operating a safe gaming platform.

• Account creation and management: Your identity and contact information is used to create and maintain your SA999 account, verify your login, and keep your account details current.
• Identity and age verification (KYC): SA999 is legally and operationally required to verify that you are who you say you are and that you are over 18. Your identity documents are used exclusively for this purpose.
• Payment processing: Financial data is used to process deposits and withdrawals in PKR through your chosen payment method (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, Visa, Mastercard).
• Fraud prevention and security: Behavioural and technical data is used to detect suspicious activity, multiple account attempts, automated bot access, money laundering patterns, and other forms of abuse that could harm SA999 or other players.
• Responsible gaming: SA999 monitors your playing and deposit behaviour to identify indicators of problem gambling. This is a protective use of your data — it helps SA999 intervene where patterns suggest a player may need support.
• Customer support: When you contact SA999 support, your account and communication history is accessed by the support team to provide accurate, contextual assistance.
• Legal compliance: SA999 may use and retain your data to comply with financial regulations, anti-money laundering (AML) requirements, and any lawful requests from Pakistani authorities.
• Platform improvement: Aggregated, anonymised behavioural data is used to understand how players use SA999 and to improve the platform's design, performance, and game offering.
• Marketing communications: With your consent, SA999 sends promotional offers, bonus notifications, and platform updates via email or SMS to your registered contact details. You can withdraw this consent at any time.

SA999 processes your personal data on the following legal grounds:

• Contract performance: Processing your identity, payment, and account data is necessary for SA999 to fulfil its obligations to you as a registered player — delivering games, processing transactions, and maintaining your account.
• Legal obligation: KYC verification, AML monitoring, and data retention for regulatory audit are required by applicable law. SA999 must comply with these obligations regardless of your preferences.
• Legitimate interests: Fraud prevention, platform security, responsible gaming monitoring, and platform improvement represent SA999's legitimate business interests, balanced against your privacy rights.
• Consent: Marketing communications and optional personalisation features are processed only where you have given explicit consent. You can withdraw consent for marketing at any time via your SA999 account settings or by contacting SA999 support.

SA999 does not sell your personal data. We share data only with trusted parties where it is necessary for operating the platform, complying with the law, or protecting the rights and safety of SA999 and its players.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and card processing partners receive the financial and identity information required to process your deposits and withdrawals. These providers operate under their own privacy policies and data protection obligations.
• Identity verification (KYC) providers: A third-party KYC service processes your identity documents to verify your age and identity. This provider is bound by strict data processing agreements with SA999 and does not use your data for any other purpose.
• Game software providers: Third-party game developers whose titles are hosted on SA999 may receive anonymised session data for game performance monitoring. These providers do not receive your identity or financial data.
• Customer support platforms: SA999 uses a secure support ticketing system. Support staff access your account data in the context of resolving your query. Support data is not shared beyond SA999's internal team.
• Law enforcement and regulators: SA999 will share data with Pakistani authorities, financial intelligence units, or other regulators where legally required to do so. SA999 will not voluntarily disclose data to authorities without a valid legal basis.
• Fraud and AML screening services: SA999 may use third-party screening services to verify that deposits are not linked to financial crime. These services receive only the minimum data necessary for the screening check.

Financial data requires particular care and SA999 treats it accordingly. Here is specifically how your payment information is handled on SA999:

• SA999 does not store full card numbers, CVV codes, or Easypaisa/JazzCash PIN numbers. Card transactions are processed by PCI-DSS compliant payment processors who tokenise card data before passing it to SA999.
• SA999 records transaction metadata — the amount, date, time, and payment method type — for account management, bonus tracking, and regulatory compliance. This is the minimum required to run your account.
• Withdrawal requests are matched against your deposit history to ensure funds are returned to the same payment method they came from. This is an anti-money laundering control, not a restriction on your right to withdraw.
• SA999 maintains transaction records for a minimum of 5 years from the date of the transaction to satisfy AML and regulatory audit requirements. This retention is a legal obligation.
• All PKR transactions on SA999 are transmitted over encrypted connections. No financial data passes between your device and SA999's servers in plain text.

SA999 uses cookies and similar technologies to make the platform function correctly, understand how it is used, and improve the player experience. Here is a breakdown of the types of cookies SA999 uses:

SA999 does not use third-party advertising cookies or share cookie data with advertising networks. The analytics cookies used on SA999 are configured to anonymise IP addresses before any data is processed. You can manage your cookie preferences at any time through your SA999 account settings or your browser's built-in cookie controls.

SA999 retains personal data only for as long as it is needed for the purpose it was collected, or as required by applicable law. Specific retention periods are as follows:

• Active account data: Retained for the duration of your SA999 account plus 5 years following account closure.
• Financial transaction records: Retained for a minimum of 5 years from the transaction date, in line with AML regulatory requirements.
• KYC and identity verification documents: Retained for 5 years from account closure or the date of the KYC check, whichever is later.
• Customer support records: Retained for 2 years from the date of the support interaction unless the matter involves ongoing legal or compliance proceedings.
• Marketing preferences and communications: Retained until you withdraw consent plus 1 year for audit purposes.
• Behavioural and session data: Aggregated, anonymised data may be retained indefinitely for platform improvement purposes. Personally identifiable behavioural data is retained for 2 years from generation.

When data reaches the end of its retention period, SA999 securely deletes or anonymises it. Secure deletion involves overwriting the data such that it cannot be recovered. Anonymisation means removing all personally identifiable components from the data so that it can no longer be linked to any individual.

SA999 implements multiple layers of technical and operational security to protect your personal data from unauthorised access, disclosure, alteration, or destruction.

• SSL/TLS encryption: All data transmitted between your device and SA999's servers is encrypted using current TLS standards. No personal or financial data passes in plain text at any point.
• Encrypted data storage: Personally identifiable data stored on SA999's servers is encrypted at rest. This means that even in the event of a server breach, raw personal data is not directly accessible.
• Access controls: SA999 staff access to player data is role-based and limited to what is necessary for each team member's specific function. A customer support agent can access what is needed to resolve your query — they do not have access to payment processing systems.
• Two-factor authentication: SA999 offers two-factor authentication for player logins. SA999 strongly recommends enabling 2FA on your account — it is the single most effective step you can take to protect your own SA999 account.
• Regular security audits: SA999's platform and infrastructure undergo regular third-party security assessments to identify and address vulnerabilities before they can be exploited.
• Incident response: SA999 maintains a formal data breach response procedure. In the event of a breach affecting player data, SA999 will notify affected players and relevant authorities within the timeframes required by applicable regulations.

As an SA999 player, you have the following rights regarding your personal data. To exercise any of these rights, contact SA999 at privacy@sa999.click. SA999 will respond within 30 days of receiving a valid request.

SA999 is strictly an 18+ platform. SA999 does not knowingly collect personal data from anyone under the age of 18. If SA999 becomes aware that a registered player is under 18, the account will be closed immediately, identity and payment data will be retained only for the period required by AML regulations, and any remaining balance will be returned to the original deposit source.

If you believe a minor has registered an SA999 account, please contact SA999 support immediately at support@sa999.click. SA999 takes these reports seriously and will investigate and act promptly.

SA999 sends promotional communications — bonus offers, new game announcements, PSL special markets, tournament notifications — only to players who have opted in to receive them. This consent is collected during registration and can be managed at any time in your SA999 account settings under Communication Preferences.

SA999 sends marketing communications via:

• Email (to your registered SA999 email address)
• SMS (to your registered mobile number, if opted in)
• In-platform notifications (within your SA999 dashboard)

SA999 does not send marketing communications via WhatsApp or any other messaging platform unless you have specifically opted in to that channel. SA999 will never send marketing communications to contacts that have not been voluntarily provided by you as part of your SA999 registration.

To stop receiving marketing communications from SA999, use the unsubscribe link in any SA999 marketing email, update your preferences in your SA999 account settings, or contact support@sa999.click. Opt-out requests are processed within 48 hours. Note that opting out of marketing does not affect transactional communications — SA999 will still send you account security alerts, deposit confirmations, withdrawal notifications, and other service-related messages regardless of your marketing preference.

The SA999 website does not include outbound links to third-party websites. However, if any such links are added in future content, SA999 is not responsible for the privacy practices of those third-party sites. This Privacy Policy applies only to sa999.click and the SA999 platform. Any external site you visit independently of SA999 is governed by that site's own privacy policy.

SA999 reviews this Privacy Policy regularly and updates it when necessary. When material changes are made — for example, if SA999 begins collecting a new category of data or changes the way existing data is used — registered players will be notified via email at least 7 days before the change takes effect. Minor clarifications or formatting updates may be made without advance notice.

The effective date at the top of this Privacy Policy always reflects when the current version came into force. You can request a copy of any previous version of SA999's Privacy Policy by contacting privacy@sa999.click.

For all privacy-related enquiries, data access requests, or to report a privacy concern, contact the SA999 privacy team directly:

• Privacy email: privacy@sa999.click
• General support: support@sa999.click
• Live chat: Available in your SA999 account dashboard, 24/7

SA999 will acknowledge all privacy enquiries within 24 hours and provide a substantive response within 30 days. For complex data access requests, SA999 may request identity verification before releasing the requested data — this is to ensure your data is only disclosed to you and not to a third party impersonating you.