CS999 Privacy Policy — How We Handle Your Data in Pakistan

This Privacy Policy applies to the CS999 platform, accessible at cs999.biz and through any associated mobile interface. CS999 is an online betting and gaming platform operated exclusively for registered members in Pakistan. When this policy refers to "CS999", "we", "us" or "our", it refers to the operator of the cs999.biz platform.

CS999 is the data controller responsible for the personal data collected through the platform. This means CS999 determines how and why your data is collected and processed. If you have any questions about how CS999 handles your personal information, you can contact our data support team at any time by emailing support@cs999.biz.

By registering an account and using the CS999 platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this policy, you should not register an account or use the platform.

CS999 collects personal data in several ways — directly from you when you register or interact with the platform, automatically through your use of the website, and from trusted third parties in limited circumstances. Here is a clear breakdown of what we collect and why:

Registration and Account Data

• Full legal name, date of birth and gender — required to verify your identity and confirm that you meet the minimum age requirement of 18 years.
• Email address and phone number — used for account notifications, security alerts, withdrawal confirmations and (where you have opted in) promotional communications.
• Username and password — used to authenticate your CS999 account. Passwords are stored in hashed form and are not visible to CS999 staff.
• Residential address — collected where required for identity verification or compliance purposes.

Identity Verification Documents

• National Identity Card (CNIC) number and/or scan, passport, or other government-issued ID — collected when CS999 is required to verify your identity before processing a first withdrawal or in response to a compliance request. This data is stored securely and is only accessed by authorised CS999 compliance staff.

Financial and Transactional Data

• Deposit and withdrawal amounts, dates and payment methods used (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT reference numbers and partial card details where applicable).
• CS999 does not store full card numbers, CVV codes or full bank account numbers. All card transactions are processed by compliant third-party payment gateways that hold full card data under their own security standards.
• Transaction history within your CS999 account — maintained for account management, dispute resolution and regulatory compliance purposes.

Betting and Gaming Activity

• Bets placed, markets selected, stake amounts, odds accepted and outcomes — maintained for account management, responsible gaming monitoring and dispute resolution.
• Session duration and frequency of play — used to identify responsible gaming risk signals and to improve the CS999 platform experience.

Technical and Device Data

• IP address, browser type and version, operating system, device type and screen resolution — collected automatically through standard web server logs and analytics tools.
• Pages visited on cs999.biz, links clicked, time spent on specific pages — collected via cookies and analytics tools to help CS999 improve the platform and understand how members use it.

CS999 processes your personal data only for specific, legitimate purposes. The following table sets out the primary purposes for which we use your data and the legal basis for each:

CS999 does not use your personal data to make automated decisions that have significant legal or similarly significant effects on you without human review. Responsible gaming alerts generated automatically by the CS999 system are always reviewed by a human member of our team before any account-level action is taken.

Given that all CS999 transactions are conducted in Pakistani Rupees, and that Pakistani payment methods — including Easypaisa, JazzCash, NayaPay and SadaPay — are the primary deposit and withdrawal channels, CS999 takes payment data security especially seriously. The following practices govern how your financial data is handled:

• No card storage by CS999: When you use a debit or credit card to deposit at CS999, full card details are processed exclusively by our third-party payment gateway partners. CS999 stores only a masked reference (e.g., last four digits and card type) sufficient for your own records and dispute resolution. CS999 cannot view, access or retrieve your full card number.
• Mobile wallet references: When you transact via Easypaisa or JazzCash, CS999 stores the transaction reference number and your registered mobile number. This allows us to verify payments, process withdrawals and handle disputes. Your full wallet credentials are never stored or visible to CS999 systems.
• IBFT transfers: For bank IBFT deposits, CS999 stores the transaction reference and the partial account details necessary to verify the transfer origin. Full bank account numbers are not stored by CS999.
• Transaction records: A full record of your deposit and withdrawal history within CS999 is maintained for account management, dispute resolution and regulatory compliance. You can view your own transaction history at any time within your CS999 account.
• PKR-only operations: Since CS999 does not convert currencies, there is no currency exchange data associated with your account. Your PKR balance is always displayed and recorded in rupees without conversion overhead.

CS999 does not sell, rent or trade your personal data to third parties for any commercial purpose. Your data is not a product at CS999. The following are the limited circumstances under which CS999 may share your personal information with external parties:

• Payment processors: CS999 shares the minimum transactional data necessary with our authorised payment gateway partners to process deposits and withdrawals. These partners are contractually required to handle your data securely and may not use it for their own marketing purposes.
• Identity verification providers: CS999 may use third-party identity verification services to confirm the validity of CNIC documents or other identification materials you provide. These providers process your data under strict data processing agreements.
• Regulatory and legal authorities: CS999 may disclose personal data to regulatory authorities or law enforcement agencies where we are legally required to do so — for example, in connection with a fraud investigation, anti-money laundering compliance or a court order. CS999 will not disclose more data than is legally required in such circumstances.
• Responsible gaming organisations: In cases where CS999 has concerns about a member's wellbeing based on their platform activity, we may share limited information with responsible gaming support organisations, where this is required under applicable regulations or where the member has consented to such sharing.
• Analytics and platform improvement: CS999 may share anonymised, aggregated usage data with analytics providers to help improve the platform. This data does not identify individual members and cannot be used to reconstruct your personal information.

Outside of the circumstances listed above, CS999 does not share your personal data with any third party. If this policy changes in the future, CS999 will notify all registered members in advance and obtain fresh consent where required.

Security is not an afterthought at CS999 — it is a core part of how the platform is built and operated. The following technical and organisational measures are in place to protect your personal data:

• Encryption in transit: All data transmitted between your device and the CS999 platform is encrypted using TLS (Transport Layer Security). The padlock icon in your browser confirms this connection is active whenever you access cs999.biz.
• Encryption at rest: Sensitive data stored in CS999 systems — including identity documents and hashed passwords — is encrypted at rest using industry-standard encryption protocols.
• Access controls: Access to personal data within CS999 is restricted on a strict need-to-know basis. CS999 staff members only access the data necessary to perform their specific role. All access is logged and regularly audited.
• Password security: CS999 stores passwords in hashed, salted form. This means CS999 staff cannot view your password — and in the event of a data breach, your raw password would not be exposed.
• Two-factor authentication: CS999 offers optional two-factor authentication for member account logins. We strongly recommend enabling this feature to add a second layer of protection to your account.
• Penetration testing and security reviews: CS999 conducts regular security assessments to identify and address potential vulnerabilities in the platform before they can be exploited.
• Breach response: In the event of a data security breach that poses a risk to your rights, CS999 will notify affected members promptly and take immediate steps to contain the breach and prevent further exposure.

While CS999 takes all reasonable steps to protect your data, no internet-based platform can guarantee absolute security. You also play a role in keeping your account secure — by using a strong, unique password, enabling two-factor authentication, and never sharing your CS999 credentials with anyone.

CS999 does not keep your personal data for longer than is necessary for the purpose for which it was collected. The following retention guidelines apply:

• Active account data: Personal data associated with your CS999 account is retained for the duration of your membership. If you close your account, CS999 will begin the data deletion process as described below.
• Financial and transaction records: Transaction records — including deposit history, withdrawal records and bet settlement data — are retained for a minimum of five years after the relevant transaction, in line with standard financial record-keeping obligations. This data may be required for regulatory compliance, fraud investigation or dispute resolution.
• Identity verification documents: CNIC or passport data submitted for identity verification is retained for the period required by applicable compliance obligations, which is typically five years from the date of submission or from the date your account is closed, whichever is later.
• Marketing preferences: Your opt-in or opt-out preferences for marketing communications are retained until you update them or close your account.
• Deleted accounts: When a CS999 account is voluntarily closed, personal data is anonymised or deleted within 90 days, except where CS999 is legally obligated to retain specific records for a defined period.

As a CS999 member, you have meaningful rights over your personal data. CS999 is committed to respecting and facilitating these rights in a straightforward way — no need for complicated legal requests or third-party intermediaries. You can exercise any of the following rights by contacting support@cs999.biz:

CS999 will respond to all data rights requests within 30 days. In complex cases, we may extend this by an additional 60 days — but we will notify you within the initial 30-day period if an extension is needed and explain why.

CS999 uses cookies — small text files placed on your device — to make the platform work correctly, to remember your preferences, and to understand how members use the site. Here is a clear summary of the cookies CS999 uses and what each type does:

CS999 does not use advertising or tracking cookies to build profiles for third-party advertising networks. You will not find third-party retargeting pixels on cs999.biz. Your CS999 browsing activity is not shared with advertising platforms.

You can manage cookie preferences through your browser settings at any time. Deleting or disabling essential cookies may prevent the CS999 platform from functioning correctly, including logging in to your account or placing bets.

CS999 sends promotional communications — including information about new games, upcoming cricket markets, VIP Club benefits and deposit bonuses — only to members who have opted in to receive them. You are never automatically enrolled in marketing emails when you register; you choose whether to receive them.

• You can opt in to marketing communications during registration or at any time via your CS999 account settings.
• You can opt out of all marketing communications at any time by clicking the unsubscribe link in any CS999 email, by updating your communication preferences in your account settings, or by contacting support@cs999.biz.
• Opting out of marketing communications does not affect transactional messages — you will still receive security alerts, withdrawal confirmations, account notifications and important updates regardless of your marketing preferences.
• CS999 does not send unsolicited bulk messages via WhatsApp or SMS without explicit consent.

CS999 is strictly an adults-only platform and is not directed at or intended for individuals under the age of 18 years. CS999 does not knowingly collect personal data from minors. If a person under 18 registers an account — whether by misrepresenting their age or by using another person's identity — their account will be closed immediately upon discovery and any funds returned, in accordance with the CS999 Terms and Conditions.

If you are a parent or guardian and believe that a minor in your household has accessed or registered at CS999 using your device or personal details, please contact us immediately at support@cs999.biz. CS999 will investigate and take appropriate action promptly.

We recommend that parents and guardians use parental control software to restrict access to online betting and gaming websites from devices used by children in the household.

CS999 may update this Privacy Policy from time to time to reflect changes in how we handle data, changes in applicable laws or regulations, or changes to the platform itself. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this policy.
• Display a prominent notice on the CS999 platform informing members of the change.
• Send a notification to your registered email address if the change materially affects how we use your personal data.

CS999 commits to providing at least seven days notice before material privacy policy changes take effect, giving you time to review the updated policy. Continued use of the CS999 platform after a policy update has taken effect constitutes acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically — particularly when you make a deposit or withdrawal, or when CS999 notifies you of an update. The current version is always available at cs999.biz/privacy-policy.

If you have any questions, concerns or requests related to this Privacy Policy or to how CS999 handles your personal data, please get in touch. Our data and privacy support team is available around the clock and will respond to all privacy-related enquiries within five business days.

• Email: support@cs999.biz — use the subject line "Privacy Request" for fastest routing to our data team.
• Live Chat: Available 24/7 from within your CS999 account. For data rights requests, our support team will log your request and escalate it to the data team with a reference number.

CS999 takes all privacy enquiries seriously. Whether you want to know what data we hold about you, request a correction, opt out of marketing or raise a concern about how your data has been handled — you will receive a thorough, prompt response from a real member of our team.