cr999 Privacy
Policy

This Privacy Policy governs the collection, use, storage, and disclosure of personal data by the cr999 online gaming platform, accessible at https://cr999.bio. cr999 is committed to protecting the personal data of all registered users — the overwhelming majority of whom are Pakistani players in cities including Karachi, Lahore, Islamabad, and Faisalabad.

cr999 takes data privacy seriously, not merely as a regulatory obligation, but because the trust of our players depends on it. A platform that handles financial transactions in PKR, stores identity documents for KYC verification, and manages betting histories for hundreds of thousands of registered accounts has an unambiguous duty to manage that data with rigour and transparency.

By creating a cr999 account and using any part of the cr999 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should not use the cr999 platform.

cr999 is the data controller responsible for the personal data collected through the cr999 platform. cr999 operates under an internationally recognised gaming licence, and the data controller entity is the licenced operator of the cr999 brand at the domain https://cr999.bio.

As data controller, cr999 determines the purposes for which personal data is collected and the means by which it is processed. cr999 engages certain third-party data processors — including payment providers and KYC verification services — who process data exclusively on cr999's instructions and subject to contractual data processing agreements.

All formal data-related correspondence, including subject access requests, rectification requests, and complaints, should be directed to cr999 using the contact details provided in Section 16 of this Privacy Policy.

cr999 collects personal data from players through three primary channels: data you provide directly during registration and account use; data collected automatically through your use of the cr999 platform; and data received from third parties in connection with payment processing and identity verification.

3.1 Data Provided Directly by You

• Registration data: Full legal name, date of birth, Pakistani mobile number, and email address (where provided).
• Identity documents: Scanned copies or photographs of your Pakistan National Identity Card (CNIC), NICOP (for overseas Pakistanis), or other government-issued identity documentation submitted during KYC verification.
• Address documentation: Utility bills, bank statements, or other official address-confirming documents submitted during enhanced verification procedures.
• Payment information: JazzCash mobile wallet number, EasyPaisa account details, bank account information (HBL, UBL, Meezan Bank), and records of all deposit and withdrawal transactions processed through your cr999 account.
• Support communications: Records of any communications you have with cr999's customer support team, including live chat transcripts and emails sent to [email protected].
• Responsible gaming preferences: Deposit limits, session time preferences, self-exclusion requests, and cooling-off period activations made through your cr999 account.

3.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Network data: Mobile network operator (Jazz, Telenor, Zong, Ufone), approximate geographic location derived from IP address, and connection type.
• Platform usage data: Pages viewed, games accessed, time spent on each section of the cr999 platform, bet and game history, session duration, and clickstream data.
• Cookie and tracking data: Data collected through cookies and similar tracking technologies as further described in Section 7 of this Privacy Policy.

3.3 Data Received from Third Parties

• Identity and age verification data returned by cr999's KYC verification service providers.
• Transaction confirmation data from payment providers including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.
• Fraud and risk screening data from anti-fraud and AML service providers engaged by cr999.

cr999 uses the personal data described in Section 3 for the following purposes:

cr999 relies on one or more of the following legal bases for each category of personal data processing described in Section 4:

• Contract performance: Processing that is necessary to deliver the cr999 service you have signed up for — including account management, game delivery, and payment processing.
• Legal obligation: Processing required to comply with cr999's gaming licence conditions, anti-money laundering regulations, and applicable law — including KYC verification, AML reporting, and responsible gaming mandates.
• Legitimate interests: Processing for purposes where cr999 has a legitimate business interest that does not override your privacy rights — including fraud detection, platform security, and anonymised analytics.
• Consent: Processing based on your explicit, freely given consent — primarily for marketing communications. Consent can be withdrawn at any time by updating your cr999 account communication preferences.

cr999 does not sell your personal data. cr999 shares personal data with third parties only in the limited circumstances described below, and only to the minimum extent necessary for each stated purpose.

6.1 Service Providers and Data Processors

cr999 engages third-party service providers who process personal data on cr999's behalf under contractual data processing agreements. These providers include:

• KYC and identity verification providers — who receive identity document data to verify your age and identity on cr999's behalf.
• Payment processors — including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, who receive the payment data necessary to process your cr999 deposits and withdrawals.
• Fraud and AML screening providers — who receive transaction data to detect suspicious patterns and assist cr999 in meeting its anti-money laundering obligations.
• Platform hosting and infrastructure providers — who hold cr999 account data on secured servers as part of the technical infrastructure of the cr999 platform.
• Customer support technology providers — who provide the live chat and support ticketing systems through which cr999 communicates with Pakistani players.

6.2 Regulatory and Legal Disclosure

cr999 may be required to disclose personal data to its gaming licence authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where such disclosure is required by law, court order, or regulatory direction. cr999 will notify you of such disclosures where legally permitted to do so.

cr999 uses cookies and similar tracking technologies on its platform to support essential site functionality, improve platform performance, and — where you have provided consent — to deliver relevant promotional content.

7.1 Types of Cookies Used by cr999

• Essential cookies: These cookies are strictly necessary for the cr999 platform to function. They maintain your login session, store your authentication token, and enable secure navigation. Without essential cookies, cr999 cannot operate. These cookies cannot be disabled.
• Performance and analytics cookies: These cookies allow cr999 to understand how Pakistani players navigate the platform — which sections are visited most, where players encounter friction, and how the platform performs across different devices and networks. Data collected by these cookies is aggregated and anonymised before analysis.
• Functional cookies: These cookies remember your preferences — such as your cr999 account language settings and responsible gaming display preferences — so that they persist between sessions without requiring you to re-enter them each time.
• Marketing cookies (consent-dependent): Where you have given explicit consent, cr999 may use cookies to understand your interest areas and tailor promotional communications accordingly. You can withdraw consent for marketing cookies at any time through the cookie management panel on the cr999 platform.

7.2 Managing Cookies

You can control non-essential cookies through the cookie preference settings accessible from the cr999 platform. Note that disabling performance or functional cookies may affect the quality of your cr999 experience. Disabling essential cookies will prevent cr999 from functioning entirely.

cr999 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the minimum retention requirements imposed by cr999's gaming licence and applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, cr999 will securely delete or irreversibly anonymise personal data in accordance with established data disposal procedures. Account closure does not result in immediate data deletion where retention is required by law.

cr999 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data transmitted between your device and the cr999 platform — including cr999 login sessions, deposit and withdrawal transactions, and support communications.
• Encryption at rest for sensitive personal data, including KYC documentation and payment records, stored on cr999's servers.
• Role-based access controls limiting cr999 staff access to personal data to only those with a legitimate operational need.
• Regular penetration testing and security audits of the cr999 platform infrastructure by qualified third-party security professionals.
• Anomaly detection and monitoring systems that flag unusual access patterns or potential data security incidents in real time.
• Formal data breach response procedures, including notification processes where a data breach results in a risk to your rights and interests.

As a cr999 player, you hold a number of rights in relation to the personal data cr999 holds about you. These rights are summarised below. To exercise any of these rights, contact cr999 at [email protected] with your request and sufficient information to verify your identity.

cr999 operates an absolute prohibition on access by individuals under the age of 21 years. cr999 does not knowingly collect personal data from any individual under 21 years of age. Age is verified through the KYC process during cr999 account registration, and accounts where age verification fails or is not completed are suspended pending resolution.

If cr999 discovers that personal data has been collected from an individual who is under 21 years of age, that data will be deleted immediately and the associated cr999 account will be permanently closed. Any funds deposited by an account holder subsequently found to be under 21 will be returned to the source payment method following an investigation.

Parents and guardians who believe that a minor in their household has created a cr999 account should contact cr999 support immediately at [email protected]. cr999 will investigate and take appropriate action without delay.

cr999 is an internationally licensed gaming operator. Some of the personal data cr999 collects may be processed by cr999 infrastructure, service providers, or gaming technology partners located outside Pakistan. Where personal data is transferred internationally, cr999 ensures that appropriate safeguards are in place to protect that data in accordance with standards equivalent to those applied to data processed within Pakistan.

These safeguards may include contractual data processing agreements incorporating standard data protection clauses, adequacy assessments of the recipient jurisdiction, or reliance on the certified security frameworks maintained by cr999's international service providers. Players may request information about the specific safeguards applicable to their data by contacting cr999 support.

cr999 may send you promotional communications — including information about cr999 bonuses, PSL season offers, new game launches, and exclusive player promotions — where you have provided explicit consent to receive such communications at the time of cr999 account registration.

You may withdraw consent for marketing communications at any time by updating your notification preferences within your cr999 account settings, or by contacting cr999 support at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of marketing communications sent before the withdrawal.

Withdrawing consent for marketing communications does not affect your ability to use the cr999 platform. You will continue to receive transactional communications essential to your cr999 account — including deposit confirmations, withdrawal notifications, and account security alerts — regardless of your marketing communication preferences.

The cr999 platform may contain references to third-party services — such as game providers, payment services, or sporting event information — that operate independently of cr999. cr999 is not responsible for the privacy practices or data handling of any third-party service, and this Privacy Policy applies only to data collected by cr999 directly.

Players who access third-party services in connection with their cr999 account — including making deposits through JazzCash or EasyPaisa — should review the privacy policies of those third-party services independently, as cr999 cannot control or be held responsible for third-party data practices.

cr999 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, updates to our gaming licence obligations, or developments in applicable law. The version number and effective date published at the top of this page identify the currently operative version.

Where changes to this Privacy Policy are material — meaning they significantly affect the way cr999 processes your personal data or the rights you hold over that data — cr999 will notify you via your registered email address or through a notice displayed in your cr999 account dashboard prior to the changes taking effect.

We encourage cr999 players to review this Privacy Policy periodically. Continued use of the cr999 platform following notification of changes constitutes acceptance of the updated Privacy Policy.

For any questions, requests, or complaints relating to this Privacy Policy or cr999's handling of your personal data, please contact cr999's support team using the following channels:

• Live Chat: Available 24/7 directly from your cr999 account dashboard. Best for general questions about your account data.
• Email: [email protected] — for formal subject access requests, erasure requests, objection notices, and data-related complaints. Please use the subject line "Data Privacy Request" for all formal data submissions. cr999 will acknowledge receipt within 48 hours and respond in full within 30 days.

This Privacy Policy was last reviewed and updated on 1 January 2026. cr999 — Privacy Policy Version 1.4.