99ba Privacy Policy

99ba ("the Company", "we", "us", "our") operates the online sports betting and casino platform accessible at 99ba.im. We are committed to protecting the privacy and personal data of every individual who visits, registers on, or uses our platform ("you", "the User", "the Player").

This Privacy Policy explains in clear terms what personal data we collect from you, the purposes for which that data is processed, how long we retain it, with whom we may share it, and the rights available to you in relation to your personal data. It applies to all services offered under the 99ba brand, including sports betting, live casino, slot games, crash games, and all related support and account management functions.

By registering a 99ba account or continuing to use our platform after this policy has been published or updated, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, which together form the complete agreement between you and 99ba.

99ba collects personal data through several channels: directly from you during registration and account management, automatically through your use of the platform, and — in limited circumstances — from trusted third-party verification and fraud prevention partners.

2.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, residential address (including city — for example, Karachi, Lahore, Islamabad, or Faisalabad), email address, and phone number.
• Identity verification (KYC): Government-issued identity documents such as your CNIC, passport, or driver's licence; selfie photographs for facial verification; proof of address documentation.
• Payment information: Mobile wallet identifiers (JazzCash, EasyPaisa), bank account details (HBL, UBL, Meezan Bank), and cryptocurrency wallet addresses. Full card numbers are never stored on 99ba's servers — payment tokenisation is handled by our regulated payment processors.
• Account preferences: Responsible gaming limits, communication preferences, and language settings.
• Support correspondence: Messages sent to our support team via live chat or email, including any attachments you submit as part of a dispute or complaint.

2.2 Information Collected Automatically

• Device & technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, bets placed, session duration, click paths, and feature interactions within the platform.
• Location data: General geographic location derived from your IP address. 99ba does not collect precise GPS location data.
• Cookies and similar technologies: See Section 6 for full details on our cookie practices.

2.3 Information from Third Parties

• Identity verification providers: Results of document verification checks and sanctions screening performed by our regulated KYC partners.
• Fraud prevention services: Risk scores, device fingerprint signals, and fraud flags generated by third-party fraud detection systems.
• Payment processors: Transaction status, payment method validity, and chargeback notifications from our payment service providers.

99ba uses the personal data we collect for the following purposes. Each purpose is grounded in a legitimate legal basis, as described in Section 4:

Marketing Communications. If you have opted in to receive promotional communications from 99ba, we may use your email address and phone number to send you information about bonuses, promotions, and platform updates. You may withdraw your consent to marketing communications at any time by updating your notification preferences in your account settings or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to that withdrawal.

99ba processes your personal data only where we have a valid legal basis to do so. The primary legal bases we rely upon are as follows:

• Contract performance: Processing is necessary to fulfil our contractual obligations to you as a registered 99ba account holder — including operating your account, processing transactions, and delivering the services you have signed up for.
• Legal obligation: Processing is required for compliance with applicable laws and regulations, including anti-money laundering (AML) legislation, counter-terrorism financing (CTF) obligations, and any reporting requirements imposed by regulatory authorities.
• Legitimate interest: Processing is necessary for the purposes of 99ba's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, platform security, and general business analytics.
• Consent: In certain circumstances — particularly in relation to optional marketing communications — we will ask for your explicit consent before processing your data for that purpose. You have the right to withdraw this consent at any time.

99ba does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. We share personal data only in the limited circumstances described below, and only with parties who are contractually bound to handle your data with appropriate security and confidentiality:

• KYC and identity verification providers: We share identity documents and personal details with regulated verification partners to fulfil our AML and responsible gaming obligations. These providers operate under binding data processing agreements.
• Payment processors: Payment data is shared with our regulated payment service providers — including the operators of JazzCash, EasyPaisa, HBL, UBL, Meezan Bank integrations, and cryptocurrency payment gateways — solely for the purpose of processing your financial transactions.
• Fraud prevention and security services: We share device identifiers, IP addresses, and behavioural signals with specialist fraud detection providers to protect the integrity of the platform and safeguard all users.
• Game content providers: Third-party game studios whose titles are hosted on the 99ba platform may receive anonymised session data necessary to deliver and support their games. They do not receive your name, contact details, or payment information.
• Legal and regulatory authorities: We are legally required to disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies when required by law, court order, or equivalent legal process. We will notify you of such disclosures where we are legally permitted to do so.
• Professional advisers: Our legal, audit, and compliance advisers may access personal data on a strictly need-to-know basis, subject to binding professional confidentiality obligations.

99ba uses cookies and similar tracking technologies to operate and improve the platform, authenticate users, detect fraudulent activity, and — where you have consented — to personalise your experience and deliver relevant promotional content.

6.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the platform to function. These include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences — such as your preferred language, responsible gaming limit settings, and game display preferences — so you do not need to re-enter them on each visit.
• Analytics cookies: Help us understand how users interact with the 99ba platform. Data collected is aggregated and anonymised wherever possible. We use this information to improve platform navigation, game discovery, and support response quality.
• Marketing cookies: Used only where you have provided explicit consent. These cookies help us deliver promotional content relevant to your interests and measure the effectiveness of our campaigns.

6.2 Managing Cookies. You can control and manage cookies through your browser settings. Most modern browsers allow you to refuse, delete, or get notified before a cookie is stored. Note that disabling strictly necessary cookies will prevent you from logging in and using core platform features. Disabling analytics or marketing cookies will not affect your ability to bet or play games on 99ba.

99ba retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable law or regulation. The following retention guidelines apply:

• Active account data: Retained for the duration of your account with 99ba, plus any additional period required by our legal and regulatory obligations.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, in compliance with international anti-money laundering standards and the applicable regulatory framework under which 99ba operates.
• Transaction records: Financial transaction data is retained for a minimum of five (5) years following the date of the transaction, or such longer period as may be required by applicable financial regulations.
• Support and communication records: Retained for three (3) years from the date of the last interaction, unless the communication is related to an unresolved dispute or regulatory matter.
• Marketing data: If you withdraw your consent to marketing, your contact details will be removed from active marketing lists within thirty (30) days, though a suppression record may be retained to ensure the preference is respected going forward.

Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual.

99ba implements a layered, defence-in-depth approach to data security. The following technical and organisational measures are applied to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption: All data in transit between your browser or mobile device and 99ba's servers is encrypted using TLS 1.2 or higher. Sensitive data fields — including passwords, payment tokens, and identity document references — are encrypted at rest using AES-256.
• Access controls: Access to personal data within 99ba's internal systems is restricted on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Penetration testing: 99ba's platform undergoes regular security assessments, including third-party penetration testing, to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that may affect your personal data, 99ba has procedures in place to detect, contain, and respond to the incident. Affected users will be notified as required by applicable law.
• Staff training: All 99ba personnel who handle personal data receive regular data protection and security awareness training.

As a 99ba account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or email at [email protected] (plain text — not a clickable link):

• Right of access: You may request a copy of the personal data 99ba holds about you. We will respond to verified access requests within thirty (30) days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Accounts flagged for active AML or fraud investigations are not eligible for immediate erasure.
• Right to restriction of processing: You may request that we restrict processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is based on your consent or contract performance, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interest, including profiling for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

We will not charge a fee for handling a data rights request unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or decline the request.

The 99ba platform is strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process, and 99ba employs additional checks to detect and prevent underage access.

If we become aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and — where required — report the matter to the appropriate authorities. Any winnings or balances associated with an underage account will be forfeited.

Parents and guardians who believe that a minor in their care may have registered on the 99ba platform are encouraged to contact our support team immediately via live chat, which is available 24/7.

99ba operates internationally and your personal data may be transferred to, stored in, or processed in countries outside of Pakistan. Some of these countries may not offer the same level of data protection as Pakistan's domestic law provides.

Where such transfers occur, 99ba ensures that appropriate safeguards are in place to protect your data, including:

• Transfers only to countries or organisations that maintain adequate data protection standards as assessed by 99ba's compliance team.
• The use of binding contractual clauses with all international data processors that impose data protection obligations equivalent to those described in this Privacy Policy.
• Application of technical security measures — including end-to-end encryption — to all cross-border data transmissions regardless of destination.

By registering on the 99ba platform, you acknowledge and consent to the international transfer of your personal data under the safeguards described above.

99ba reviews and updates this Privacy Policy periodically to reflect changes in our data practices, platform features, applicable law, or regulatory requirements. The effective date at the top of this document indicates when the current version took effect.

Where changes are material — meaning they affect how we collect, use, share, or retain your personal data in a manner that could impact your privacy rights — we will notify you via your registered email address and display a prominent notice on the 99ba platform at least fourteen (14) days before the changes take effect.

For non-material changes (such as clarifications of existing language or corrections of typographical errors), the updated policy will be published without advance notice, though the effective date will be updated accordingly. Your continued use of the 99ba platform following publication of any updated Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 99ba handles your personal data, please get in touch with us through the following channels:

• Live Chat: Available 24/7 directly within the 99ba platform. Average response time is 3–5 minutes.
• Email: [email protected] (plain text — not a clickable link). We aim to respond to all privacy-related inquiries within 48 hours on business days.

Formal data protection requests — including access requests, erasure requests, and objections to processing — should be submitted in writing via email and should include your full name, registered account username, and a clear description of your request. We will acknowledge receipt within 5 business days and aim to resolve all requests within 30 calendar days.

If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the relevant data protection or regulatory authority in your jurisdiction.