cr999 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how cr999 ("cr999", "we", "us", "our") collects, uses, stores, and shares personal data about individuals ("you", "Player", "User") who access and use the cr999 website, mobile interface, and related services available at cr999.app.

This Policy applies to all cr999 users including registered account holders, visitors who browse the cr999 website without registering, and individuals who contact cr999 support. By creating a cr999 account or continuing to use the cr999 Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read in conjunction with the cr999 Terms and Conditions. In the event of any conflict between this Policy and the Terms and Conditions on a privacy matter, this Policy shall prevail.

2. Data Controller

cr999 is the data controller responsible for your personal data collected through the cr999 Platform. As data controller, cr999 determines the purposes and means of processing your personal information. Questions and requests relating to the exercise of your data rights should be directed to cr999 via the contact details set out in Section 16 of this Policy.

3. Personal Data We Collect

cr999 collects the following categories of personal data:

cr999 does not collect special categories of personal data (such as racial or ethnic origin, political opinions, health data, or biometric data) except where strictly necessary for identity verification and where you have explicitly provided such information.

4. How We Collect Your Data

cr999 collects your personal data through the following means:

• Direct submission: Information you provide when registering your cr999 account, completing KYC verification, making deposits or withdrawal requests, contacting cr999 support, or updating your account profile.
• Automated collection: Technical and usage data collected automatically when you access the cr999 Platform, including via cookies, server logs, and device fingerprinting technologies described in Section 7.
• Third-party payment processors: Transaction confirmation data received from JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and other payment partners when you initiate a deposit or withdrawal.
• Identity verification services: Where cr999 uses third-party KYC or identity verification providers, those providers may return data to cr999 confirming your identity against official documents.
• Fraud and security tools: Risk scoring and fraud detection services may provide cr999 with signals about the legitimacy of account activity based on behavioural and technical data.

5. Purposes and Legal Bases for Processing

cr999 processes your personal data for the following purposes and on the following legal bases:

• Account operation and contractual performance: Processing your registration, managing your cr999 account balance, processing deposits and withdrawals, delivering games and betting services. Legal basis: performance of the contract between you and cr999.
• Identity verification and KYC compliance: Verifying your age (18+), identity, and source of funds where required. Legal basis: legal obligation and legitimate interests in preventing fraud and financial crime.
• Security and fraud prevention: Monitoring platform activity for suspicious behaviour, protecting cr999 and its players from fraud, money laundering, and account takeover. Legal basis: legitimate interests.
• Responsible gaming: Monitoring gaming behaviour to identify potential problem gambling indicators and providing access to responsible gaming tools. Legal basis: legitimate interests and, in some cases, legal obligation.
• Customer support: Responding to your enquiries, complaints, and support requests. Legal basis: contractual performance and legitimate interests.
• Marketing communications: Sending you promotional offers, bonus announcements, and platform updates where you have opted in. Legal basis: consent (which may be withdrawn at any time).
• Platform analytics and improvement: Analysing how players use cr999 to improve platform performance, game selection, and user experience. Legal basis: legitimate interests.
• Legal and regulatory compliance: Meeting cr999's obligations under applicable gaming standards, anti-money laundering frameworks, and other regulatory requirements. Legal basis: legal obligation.

6. Payment Data and Financial Transactions

cr999 processes payment data to facilitate PKR deposits and withdrawals via JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and other accepted methods. cr999 does not store full payment card numbers or mobile wallet PINs. Payment credentials are processed directly by certified third-party payment gateways using PCI DSS-compliant or equivalent security protocols.

Transaction history — including deposit amounts, withdrawal requests, and payment method references — is retained in your cr999 account records for the duration of your account and for such period thereafter as is required by applicable financial record-keeping standards.

In accordance with cr999's anti-money laundering obligations, cr999 may request documentation of the source of funds deposited into your cr999 account. Failure to provide such documentation where reasonably requested may result in suspension of withdrawal processing pending resolution.

7. Cookies and Tracking Technologies

cr999 uses cookies and similar tracking technologies on its Platform for the following purposes:

• Essential cookies: Required for the cr999 Platform to function, including maintaining your login session and remembering your account preferences. These cannot be disabled without preventing use of the Platform.
• Analytics cookies: Used to understand how players interact with the cr999 Platform — which pages are visited most frequently, how long sessions last, and where players exit. This data is aggregated and anonymised where possible.
• Security cookies: Used by cr999's fraud detection and bot-prevention systems to distinguish legitimate players from automated scripts or malicious actors.
• Preference cookies: Used to remember your interface preferences, such as language settings and responsible gaming tool configurations.

Most web browsers allow you to control cookie behaviour through browser settings. Blocking essential cookies will impair your ability to use the cr999 Platform, including the cr999 login function. Blocking non-essential cookies will not prevent use of the Platform's core features.

8. Third-Party Data Sharing

cr999 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. cr999 shares personal data with third parties only in the following limited circumstances:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Skrill, Neteller, and USDT gateway operators receive the minimum data necessary to process your transactions.
• Identity verification providers: KYC service providers receive identity document data for the purpose of verifying your eligibility to hold a cr999 account.
• Game content providers: Casino game studios and live dealer platforms may receive anonymised or pseudonymised player session data to facilitate game delivery and audit trail requirements.
• IT and security service providers: Cloud hosting providers, CDN operators, and security monitoring services that support cr999's Platform infrastructure under contractual data processing agreements.
• Legal and regulatory authorities: cr999 will disclose personal data to law enforcement agencies, gaming regulators, or financial intelligence units where required to do so by applicable law or valid legal process.
• Fraud prevention networks: cr999 may share fraud indicators (not full identity data) with industry fraud prevention organisations to protect the platform and other players.

All third parties with whom cr999 shares personal data are required to process that data in accordance with applicable data protection standards and cr999's contractual requirements.

9. International Data Transfers

cr999 operates internationally and your personal data may be transferred to and processed in countries outside Pakistan. Where personal data is transferred internationally, cr999 implements appropriate safeguards to ensure your data receives a level of protection consistent with this Policy, including contractual data transfer protections with receiving parties.

By using the cr999 Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

10. Data Retention

cr999 retains your personal data for as long as your cr999 account is active and for such period thereafter as is required or permitted by applicable law and cr999's operational requirements. The general retention principles applied by cr999 are:

• Active account data: Retained for the lifetime of your cr999 account.
• Identity and KYC records: Retained for a minimum of five years following account closure, in accordance with applicable anti-money laundering standards.
• Transaction records: Retained for a minimum of five years following each transaction.
• Support communications: Retained for a minimum of three years following closure of the relevant support case.
• Marketing data: Retained until you withdraw your marketing consent or for a maximum of two years following your last engagement with cr999 marketing communications, whichever is earlier.
• Technical and log data: Typically retained for 12 months for security and audit purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised.

11. Data Security

cr999 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the cr999 Platform;
• Encryption at rest for sensitive personal and financial data stored in cr999's systems;
• Industry-standard password hashing using bcrypt or equivalent algorithms — cr999 does not store passwords in plain text;
• Role-based access controls ensuring that cr999 staff can only access personal data necessary for their specific function;
• Regular security audits and penetration testing of the cr999 Platform infrastructure;
• Incident response procedures for detecting, assessing, and responding to personal data breaches.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. cr999 cannot guarantee the absolute security of your personal data. You are encouraged to use a strong, unique password for your cr999 account and to enable two-factor authentication.

12. Your Rights Over Your Personal Data

Subject to applicable law, cr999 players hold the following rights in relation to their personal data:

• Right of access: You may request a copy of the personal data that cr999 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data held in your cr999 account.
• Right to erasure: You may request deletion of your personal data where cr999 no longer has a legitimate or legal basis for retaining it. Note that cr999 is subject to mandatory data retention obligations (see Section 10) which may limit the extent to which erasure requests can be fulfilled.
• Right to restrict processing: You may request that cr999 restrict its processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its use.
• Right to data portability: Where cr999 processes your data by automated means on the basis of your consent or contractual performance, you may request receipt of your data in a structured, machine-readable format.
• Right to withdraw consent: Where cr999 processes your data on the basis of your consent (e.g. marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to cr999's processing of your personal data on the basis of legitimate interests, including objecting to the use of your data for marketing or profiling purposes.

To exercise any of these rights, please contact cr999 support. cr999 will respond to valid data rights requests within 30 days of receipt. cr999 may require you to verify your identity before processing a data rights request.

13. Children and Minors

The cr999 Platform is strictly for adults aged 18 years and above. cr999 does not knowingly collect personal data from individuals under the age of 18. If cr999 becomes aware that personal data has been collected from a minor, that data will be deleted and the associated account closed immediately.

If you believe that a minor has registered a cr999 account, please contact cr999 support immediately.

14. Responsible Gaming and Data Use

cr999 uses your account activity data — including betting frequency, session duration, deposit patterns, and loss history — to support responsible gaming monitoring. This data processing is conducted in cr999's legitimate interest and, in certain circumstances, under applicable gaming standards requiring operators to monitor for signs of problem gambling.

Where cr999's responsible gaming systems identify patterns consistent with problematic gambling behaviour, cr999 may proactively contact you to offer support or apply account restrictions, including deposit limits or temporary account cooling-off periods. The use of your data for responsible gaming purposes is not a commercial activity — it is a player protection measure that cr999 considers a core platform responsibility.

Self-exclusion elections and responsible gaming tool configurations are recorded against your cr999 account and retained in accordance with Section 10 to ensure that re-registration restrictions are maintained where applicable.

15. Changes to This Privacy Policy

cr999 reserves the right to update this Privacy Policy at any time. The updated Policy will be published on the cr999 website with a revised "Last Updated" date. Where a change materially affects your rights or the way cr999 processes your personal data, cr999 will provide reasonable advance notice via your registered email address or in-platform notification.

Your continued use of the cr999 Platform following the effective date of any Policy update constitutes your acknowledgement of the revised Policy. If you do not accept the revised Policy, you should close your cr999 account before the updated Policy takes effect.

16. Contact and Complaints

For any questions, requests, or complaints relating to this Privacy Policy or cr999's handling of your personal data, please contact the cr999 support team via live chat on the Platform or via the email address listed in the footer of the cr999 website. cr999 will acknowledge privacy enquiries within 2 business days and provide a substantive response within 30 days.

When submitting a data rights request or privacy complaint, please include your cr999 account username, a clear description of your request or concern, and — where relevant — the specific personal data to which your request relates. This will help cr999 handle your request efficiently and accurately.