Privacy Policy — dr999 Data Protection & Your Rights

1Introduction

dr999 ("we", "us", "our", or "the Platform") operates the online casino and sports betting platform accessible at dr999.app, serving players primarily based in Pakistan. We are committed to protecting the privacy and personal data of every user who registers, deposits, plays, or otherwise interacts with our platform.

This Privacy Policy sets out in clear, legal-standard terms exactly what personal data dr999 collects from you, the lawful basis on which we process it, how long we keep it, who we may share it with, and the rights available to you as a data subject. This document forms part of dr999's broader Terms and Conditions and should be read alongside them.

By creating an account on dr999 or by continuing to use the platform after this Privacy Policy has been published or updated, you acknowledge that you have read and understood these practices. If you do not agree with any aspect of this Privacy Policy, you must discontinue use of the dr999 platform and close your account.

2Data Controller

For the purposes of applicable data protection law, dr999 is the data controller responsible for personal data collected through dr999.app. As data controller, dr999 determines the purposes for which and the means by which your personal data is processed.

All data protection queries, subject access requests, and complaints should be directed to our dedicated data protection contact:

• Email: [email protected]
• Response time: Within 30 days of receipt of a valid written request.
• Languages accepted: English and Urdu.

3Personal Data We Collect

dr999 collects personal data across several categories depending on your level of interaction with the platform. The table below summarises the main categories of data collected and the context in which each arises:

4How We Collect Your Data

dr999 collects personal data through the following channels and mechanisms:

• Direct provision: Data you actively provide when completing the registration form, submitting KYC documents, filling in payment details, or communicating with our support team via live chat or email.
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and analytics tools when you access and interact with the dr999 platform.
• Payment providers: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK when you initiate deposits or withdrawals.
• Identity verification providers: Data returned by third-party KYC and anti-fraud service providers engaged to verify the authenticity of identity documents.
• Fraud prevention agencies: Where legally permitted, dr999 may cross-reference your data against fraud-prevention and sanctions screening databases as part of our compliance obligations.

5How We Use Your Personal Data

dr999 processes personal data only for specific, clearly defined, and legitimate purposes. We do not use your data in ways that are incompatible with the original purpose of collection. The primary purposes for which we process your data are:

• Account management: Creating and maintaining your player account, verifying your identity, and managing your account settings and preferences.
• Service delivery: Enabling you to access casino games, place cricket and sports bets, participate in crash games and W Live sessions, and use all features of the dr999 platform.
• Payment processing: Processing deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK in PKR, and maintaining accurate financial records of all transactions.
• KYC and regulatory compliance: Fulfilling our Know Your Customer obligations, verifying player age (21+), and meeting anti-money laundering requirements applicable to online gambling platforms.
• Fraud prevention and platform security: Detecting, investigating, and preventing fraudulent activity, money laundering, account takeovers, bonus abuse, and other prohibited conduct described in our Terms and Conditions.
• Customer support: Responding to your queries, complaints, and account-related requests via live chat or email in Urdu and English.
• Responsible gaming: Monitoring gaming behaviour to identify patterns that may indicate problematic gambling and proactively engaging players where appropriate, in compliance with responsible gaming obligations.
• Marketing and promotions: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. You may opt out at any time.
• Analytics and platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, user experience, and technical infrastructure.
• Legal compliance and dispute resolution: Maintaining records required by applicable law, responding to regulatory enquiries, and resolving disputes raised through our internal complaints process.

6Legal Basis for Processing

Every instance of personal data processing at dr999 rests on a recognised legal basis. The primary legal bases we rely on are:

• Contractual necessity: Processing required to enter into and perform the contract with you as a registered player — including account creation, game access, payment processing, and customer support.
• Legal obligation: Processing necessary to comply with applicable legal requirements, including KYC, anti-money laundering, and record-keeping obligations relevant to online gaming operations.
• Legitimate interests: Processing carried out for our legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and general analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7Data Sharing & Third Parties

dr999 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK receive the transaction data required to process your deposits and withdrawals. These providers are bound by their own data protection obligations and regulatory frameworks.
• KYC and identity verification providers: Specialist third-party providers engaged to verify the authenticity of identity documents submitted during the KYC process. These providers process data strictly under our instructions and may not use it for any other purpose.
• Fraud prevention and sanctions screening services: Where legally required, we may share data with fraud-prevention agencies and sanctions databases to detect and prevent financial crime.
• Game studios and technology providers: Game providers such as Pragmatic Play, PG Soft, and Hacksaw Gaming receive anonymised session and gameplay data to facilitate game delivery, RTP reporting, and technical support. They do not receive personally identifiable information unless strictly required for dispute resolution.
• Legal and regulatory authorities: dr999 will disclose personal data to law enforcement agencies, regulatory bodies, or courts if required to do so by applicable law, valid legal process, or enforceable governmental request.
• Professional advisers: Legal counsel, accountants, and compliance consultants who are bound by professional confidentiality obligations, where necessary for legal or regulatory advice.

8Data Retention

dr999 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account data: Retained for the lifetime of your active account plus a minimum of five years following account closure, as required for anti-money laundering compliance and potential dispute resolution.
• KYC documents: Retained for a minimum of five years from the date of submission, in line with standard financial crime prevention record-keeping requirements.
• Transaction records: All deposit, withdrawal, and gameplay transaction records are retained for a minimum of five years from the date of the transaction.
• Support communications: Live chat transcripts and email correspondence are retained for up to three years from the date of the interaction, after which they are securely deleted unless subject to an active dispute or legal hold.
• Marketing data: Retained until you withdraw consent or opt out of marketing communications, plus 12 months for suppression-list management purposes.
• Technical and server logs: Retained for up to 12 months for security monitoring and fraud investigation purposes, then automatically purged.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

9Cookies & Tracking Technologies

dr999 uses cookies and similar tracking technologies on the dr999.app platform. Cookies are small data files placed on your device that allow the platform to recognise you across sessions, maintain your login state, and collect basic usage data.

The categories of cookies used by dr999 are:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies, security tokens, and cookies required to process payments. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences such as language selection, responsible gaming settings, and display preferences across sessions.
• Analytics cookies: Collect anonymised data about how players navigate and use the platform — such as pages visited, time spent, and features interacted with — to help us improve the user experience. No personally identifiable information is collected via analytics cookies.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and other security threats.

dr999 does not use third-party advertising cookies or behavioural retargeting cookies that track your activity across other websites.

10Data Security

dr999 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key security measures include:

• Encryption: All data transmitted between your device and dr999's servers is protected by TLS 1.2 or higher encryption. All personal data and KYC documents stored on dr999 servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within dr999's systems is restricted on a strict need-to-know basis. Staff with access to player data undergo background screening and are bound by confidentiality obligations.
• Two-factor authentication: dr999 encourages all players to enable two-factor authentication on their accounts as an additional layer of protection against unauthorised access.
• Penetration testing: dr999's platform infrastructure undergoes regular security assessments and penetration testing to identify and address vulnerabilities before they can be exploited.
• Incident response: dr999 maintains a documented data breach response plan. In the event of a breach that poses a material risk to your rights and freedoms, we will notify affected players without undue delay.

11Your Data Rights

As a data subject, you hold the following rights in relation to personal data that dr999 holds about you. To exercise any of these rights, contact us at [email protected] with your full name, registered email address, and a description of your request. We will respond within 30 days.

12Children's Privacy & Age Restriction

dr999 is strictly an adult platform. The minimum age to register and use dr999 is 21 years of age. dr999 does not knowingly collect personal data from individuals under the age of 21.

As part of our registration and KYC process, all players are required to provide date of birth information and, upon withdrawal, government-issued identity documentation confirming their age. Any account found to belong to an individual under 21 will be immediately suspended and permanently closed. Any funds held in such an account will be managed in accordance with our Terms and Conditions and applicable regulatory obligations.

If you are a parent or guardian and believe a minor has created a dr999 account, please contact us immediately at [email protected] with the relevant account details so we can investigate and act promptly.

13Changes to This Privacy Policy

dr999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When we make material changes to this Privacy Policy, we will notify registered players via email to their registered address and/or via a prominent notice on the dr999.app platform at least 14 days before the changes take effect.

The "Last Revised" date at the top of this Privacy Policy will be updated each time a new version is published. We encourage you to review this Privacy Policy periodically to stay informed about how dr999 protects your personal data.

Your continued use of the dr999 platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with the updated Privacy Policy, you must stop using the platform and may request account closure by contacting [email protected].

14Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way dr999 processes your personal data, please reach out to us through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the dr999.app platform
• Response Language: English and Urdu
• Response Time: We aim to respond to all data protection requests within 30 calendar days of receipt.

For subject access requests, rights exercises, or formal data protection complaints, please include your full name, registered email address, and a clear description of your request or complaint. This helps us locate your records and respond accurately and efficiently.