sd999 Privacy Policy
Your Data. Your Rights.

sd999 is committed to protecting the privacy of every player who accesses our platform. Whether you are based in Karachi, Lahore, Islamabad, Faisalabad, or any other part of Pakistan, the same high standard of data protection applies to your account and all personal information associated with it.

This Privacy Policy sets out in clear, plain language exactly what personal data sd999 collects, how that data is processed and stored, who it may be shared with, and what rights you have in relation to your own information. This policy applies to all services and features available on the sd999 platform, including account registration, deposits and withdrawals, casino gaming, sports betting, live chat support, bonus claims, and any other interaction you have with sd999.

This policy should be read alongside the sd999 Terms & Conditions, which form part of the overall agreement between sd999 and its players. Where this Privacy Policy conflicts with any other document, the Privacy Policy takes precedence in relation to matters of data handling and player privacy rights.

sd999 operates under an international gaming licence, and our data handling practices are structured to meet the obligations imposed by that licence as well as internationally recognised privacy frameworks including the General Data Protection Regulation (GDPR) as a guiding standard. Players are encouraged to read this policy carefully and contact us if any part of it is unclear.

For the purposes of this Privacy Policy, sd999 — the operator of the online casino and sports betting platform available at sd999.bio — acts as the data controller in respect of all personal data collected from registered players and site visitors.

As the data controller, sd999 determines the purposes for which personal data is collected and the means by which that data is processed. sd999 is responsible for ensuring that personal data is handled in a lawful, fair, and transparent manner at all times, and for maintaining appropriate technical and organisational security measures to protect your information against unauthorised access, loss, or disclosure.

If you have any questions, concerns, or requests relating to how sd999 handles your personal data, you may contact the sd999 data protection team directly at the contact details provided in Section 13 of this policy.

sd999 collects personal data from players through several channels: directly from you when you register, make a deposit, contact support, or interact with platform features; automatically from your device and browser when you use the platform; and from third-party identity verification and payment processing partners where necessary to complete a transaction or satisfy KYC requirements.

The categories of personal data we collect include the following:

sd999 does not collect special category data — such as health information, racial or ethnic origin, political opinions, or religious beliefs — unless it is voluntarily provided in the context of a responsible gaming support interaction, in which case it is handled with the highest level of care and confidentiality.

sd999 uses the personal data it collects for specific, clearly defined purposes. We do not process your data beyond what is necessary for these stated purposes. The following table summarises what we use your data for and the legal basis under which each processing activity takes place:

• Account creation and management: We use your identity and contact data to create and administer your sd999 account, verify your identity, and keep your account information up to date.
• Processing deposits and withdrawals: Financial data and identity data are used to process PKR transactions via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency networks accurately and securely.
• KYC and anti-money laundering compliance: We process identity documents and financial data to satisfy the KYC obligations imposed under our international gaming licence and to detect, investigate, and prevent money laundering, fraud, and other financial crimes.
• Delivering gaming and betting services: Gaming data is used to operate the games and sports betting markets you participate in, to settle bets correctly, and to maintain the integrity of all platform outcomes.
• Customer support: Communications data is used to respond to your support queries, resolve disputes, and improve the quality of our support services.
• Responsible gaming: We analyse gaming and account data to identify patterns that may indicate problem gambling behaviour. This allows sd999 to proactively offer responsible gaming tools and intervention support where appropriate.
• Bonus and promotional administration: Account and gaming data is used to determine bonus eligibility, calculate wagering progress, and detect promotional abuse.
• Platform improvement and security: Technical data is used to monitor platform performance, identify and resolve technical issues, and protect the platform against fraud, unauthorised access, and denial-of-service attacks.
• Direct communications: Where you have opted in to receive promotional communications from sd999, we use your contact data to send you relevant offers, bonuses, and platform updates. You may opt out of marketing communications at any time through your account settings or by contacting support.

sd999 processes your personal data only where a lawful basis for doing so exists. The legal bases we rely on are as follows:

• Contractual necessity: The majority of data processing carried out by sd999 is necessary for the performance of the contract between sd999 and you as a registered player. This includes account management, payment processing, and the delivery of gaming and betting services.
• Legal obligation: Certain processing activities — particularly KYC verification, anti-money laundering screening, and the reporting of suspicious activity to relevant authorities — are carried out because sd999 is legally required to do so under the terms of its international gaming licence and applicable financial crime prevention standards.
• Legitimate interests: sd999 processes technical data and gaming behaviour data on the basis of legitimate interests, including the interest in maintaining a secure and fair platform, detecting fraud, preventing abuse of bonuses and promotions, and improving the overall player experience. These legitimate interests are balanced against your privacy rights, and we ensure that no undue intrusion occurs.
• Consent: Where sd999 sends you optional marketing communications or uses non-essential cookies, we do so only on the basis of your freely given, specific, and informed consent. You may withdraw consent for these activities at any time without affecting any other aspect of your account or your access to sd999 services.

sd999 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. Your information is shared only in the following limited and controlled circumstances:

• Payment processors: Financial data is shared with our approved payment processing partners — including the operators of the JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank payment channels — solely for the purpose of processing your deposits and withdrawals securely and accurately.
• KYC and identity verification providers: Identity data and documentation submitted during the verification process is shared with regulated third-party KYC service providers who conduct identity checks on sd999's behalf under strict data processing agreements.
• Game software providers: Limited gaming session data may be shared with the licensed third-party software providers whose games are available on the sd999 platform, for the purpose of game operation, fairness auditing, and technical support. These providers are prohibited from using this data for any other purpose.
• Regulatory and law enforcement authorities: sd999 is obligated under its gaming licence to report suspicious account activity, potential money laundering, and fraud to the relevant regulatory authorities. In such cases, personal data may be disclosed without prior notice to the account holder.
• Professional advisers: Personal data may be disclosed to sd999's legal, financial, or compliance advisers on a strictly need-to-know basis where required to defend or pursue legal claims or to obtain professional advice.
• Business transfers: In the event that sd999 undergoes a corporate restructure, merger, or change of ownership, player data may be transferred to the new operating entity as part of that transaction, subject to equivalent privacy protections being maintained.

All third parties to whom sd999 discloses personal data are required to handle that data in accordance with applicable privacy law and are prohibited from processing it for any purpose beyond that for which it was disclosed.

sd999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory and legal obligations. The following retention periods apply as a general guide:

• Account data: Retained for the duration of the account's active status plus a minimum of five years following permanent account closure, in order to satisfy anti-money laundering record-keeping requirements under the gaming licence.
• KYC documentation: Retained for a minimum of five years from the date of submission, in accordance with international financial crime prevention standards applicable to licensed gaming operators.
• Transaction records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of five years following the date of the transaction.
• Support communications: Live chat transcripts and support ticket records are retained for three years following the resolution of the relevant interaction.
• Technical and device data: Log data and technical session records are retained for a period of twelve months, after which they are anonymised or deleted.
• Marketing consent records: Records of your consent to receive marketing communications — and any subsequent withdrawal of that consent — are retained for as long as your account remains active and for a period of three years thereafter.

Where sd999 is no longer required to retain personal data under its legal obligations and where the data is no longer needed for the purposes set out in this policy, the data will be securely deleted or irreversibly anonymised.

sd999 takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. The key security measures in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the sd999 platform, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Encrypted storage of sensitive data at rest, including KYC documentation, financial records, and identity information held in sd999's secure data infrastructure.
• Access controls that restrict access to personal data to only those sd999 employees, contractors, and service providers who have a genuine operational need to access it in the performance of their duties.
• Two-factor authentication is strongly recommended for all player accounts and is mandatory for withdrawals above specified thresholds. Players are encouraged to enable two-factor authentication via their account security settings.
• Regular security audits and penetration testing conducted by independent information security specialists to identify and remediate vulnerabilities in the sd999 platform infrastructure.
• Fraud detection systems that monitor account activity in real time for patterns consistent with account takeover, payment fraud, and other security threats.

While sd999 employs robust security measures, no online platform can guarantee absolute security. Players are responsible for maintaining the security of their own login credentials and for notifying sd999 immediately at [email protected] if they suspect that their account has been accessed without their authorisation.

sd999 uses cookies and similar tracking technologies on its platform. Cookies are small text files placed on your device by the sd999 website when you visit. They serve a number of functions that are important to the operation of the platform and to your experience as a player.

The types of cookies used by sd999 are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function correctly. They enable features such as maintaining your login session, remembering your account preferences, and processing transactions securely. These cookies cannot be disabled without affecting core platform functionality.
• Functional cookies: These cookies allow sd999 to remember choices you have made — such as your preferred language settings and responsible gaming tool configurations — and to personalise your experience accordingly. They do not track your activity on other websites.
• Analytics cookies: sd999 uses analytics tools to understand how players interact with the platform, which pages are most visited, and where technical issues arise. This data is used in aggregate and anonymised form to improve the platform. Analytics cookies are placed only with your consent.
• Marketing cookies: Where you have given consent, sd999 may use cookies to deliver relevant promotional content to you on the sd999 platform. sd999 does not use third-party advertising networks to track you across external websites.

You may manage your cookie preferences through your browser settings at any time. Note that disabling certain categories of cookies may affect your ability to use some features of the sd999 platform. A detailed cookie settings panel is accessible through the sd999 account dashboard.

As a player on sd999, you have a number of rights in relation to the personal data we hold about you. sd999 will respond to all valid rights requests within 30 calendar days of receipt. Your rights are as follows:

• Right of access: You may request a copy of all personal data sd999 holds about you, along with information about how that data is being processed. This is sometimes called a Subject Access Request (SAR).
• Right to rectification: If any personal data sd999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many details directly through your account settings without needing to submit a formal request.
• Right to erasure: In certain circumstances, you may request that sd999 delete the personal data we hold about you. This right is not absolute — sd999 may be legally required to retain certain data for the minimum periods set out in Section 7, and erasure requests that conflict with these obligations may be refused on that basis.
• Right to restriction: You may request that sd999 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of your data is being verified following a rectification request.
• Right to data portability: You may request that sd999 provide a copy of your personal data in a structured, commonly used, machine-readable format that you can transfer to another service provider where this is technically feasible.
• Right to object: You have the right to object to the processing of your personal data where sd999 relies on legitimate interests as its legal basis. You may also object to the use of your data for direct marketing purposes at any time, without needing to provide a reason.
• Right to withdraw consent: Where sd999 processes your data based on your consent — for example, for optional marketing communications — you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing that took place before you withdrew your consent.

To exercise any of these rights, contact the sd999 data protection team at [email protected] with the subject line "Data Rights Request" and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request.

sd999 strictly enforces a minimum age requirement of 21 years across all account types, gaming categories, and platform features. The sd999 platform is not intended for, and must not be used by, any person under the age of 21.

sd999 does not knowingly collect personal data from any person under the age of 21. All accounts are subject to age verification as part of the KYC process, and accounts where the holder is found to be under 21 at any point will be immediately suspended, with any associated balance subject to forfeiture pending investigation.

If you believe that sd999 has inadvertently collected personal data from a person under the age of 21, please notify us immediately at [email protected]. We will investigate and delete any such data without delay.

Parents and guardians in Pakistan who are concerned about a minor accessing online gambling platforms are encouraged to make use of parental control software and internet filtering tools. sd999 supports national and international efforts to prevent underage gambling and cooperates fully with any regulatory investigation into underage access.

sd999 reserves the right to update, amend, or replace this Privacy Policy at any time. Changes may be required to reflect updates to the sd999 platform, changes in applicable law or regulatory requirements, or improvements to our data handling practices based on player feedback and internal review.

When material changes are made to this Privacy Policy, sd999 will notify registered players via email to the address associated with their account, and a prominent notice will be displayed on the sd999 platform for a period of at least 14 days following publication of the updated policy. The "Last Updated" date at the top of this page will be revised to reflect the date on which the most recent version came into effect.

Your continued use of the sd999 platform following notification of any changes to this Privacy Policy constitutes your acceptance of those changes. If you do not agree with the updated policy, you should cease using the sd999 platform and may request account closure by contacting [email protected]. Account closure requests submitted on this basis will be processed in accordance with the withdrawal and balance settlement procedures described in the sd999 Terms & Conditions.

We encourage all players to review this Privacy Policy periodically to stay informed about how sd999 protects their personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way sd999 handles your personal data, please get in touch with the sd999 data protection team using the contact details below. We aim to respond to all data-related enquiries within five business days and to complete all formal rights requests within 30 calendar days.

When contacting sd999 about a data rights request, please include your registered account username and email address, along with a clear description of your request. To protect your account security, sd999 may ask you to complete an identity verification step before processing your request.