ct99 Privacy Policy

1. Introduction & Scope

ct99 ("ct99", "we", "us", "our") operates the online gaming and sports betting platform at ct99.one ("the Platform"). This Privacy Policy ("Policy") applies to all personal data processed by ct99 in connection with the operation of the Platform, including data collected when you visit the Platform, register an account, make a deposit or withdrawal, place a wager, contact support, or otherwise interact with ct99 services.

This Policy should be read alongside the ct99 Terms & Conditions and Responsible Gaming Policy, both of which form part of your agreement with ct99. By accessing or using the Platform you confirm that you have read this Policy and that you agree to the collection and use of your personal data as described herein.

If you do not agree to this Policy, you must not use the ct99 Platform. If you have any questions about how ct99 handles your personal data, please contact us at [email protected] before proceeding.

2. Data Controller

For the purposes of applicable data protection legislation, ct99 is the data controller responsible for the personal data collected and processed through the Platform. ct99 determines the purposes and means of processing your personal data and is accountable for ensuring that your data is handled in accordance with this Policy and applicable law.

All data protection enquiries should be directed to ct99 at [email protected]. We aim to acknowledge all privacy-related enquiries within five (5) business days and to resolve substantive requests within thirty (30) days of receipt.

3. Personal Data We Collect

ct99 collects the following categories of personal data in connection with the operation of the Platform:

3.1 Registration & Identity Data

• Full legal name
• Date of birth
• Pakistani mobile number
• Email address
• Username and encrypted password
• Preferred language and currency settings

3.2 Identity Verification (KYC) Data

• CNIC (Computerised National Identity Card) number and copy
• Selfie photograph (for facial match verification against CNIC)
• Proof of payment method ownership (e.g., JazzCash or Easypaisa account screenshot)
• Proof of address (where required for enhanced due diligence)

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment methods (JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah)
• Account wallet balance history
• Bonus account activity and wagering history
• Transaction reference numbers

3.4 Gaming & Betting Activity Data

• Sports bets placed, stakes, odds, outcomes, and settlement records
• Casino game sessions including game title, stakes, and outcomes
• Session duration and login/logout timestamps
• Responsible gaming limits set and self-exclusion history

3.5 Technical & Usage Data

• IP address and approximate geolocation at login
• Device type, operating system, browser type and version
• Pages visited on the Platform, clickstream data, and session duration
• Referral source (how you arrived at the Platform)
• Cookie identifiers (see Section 6)

3.6 Communications Data

• Content of support tickets, live chat transcripts, and email correspondence
• Responses to surveys or feedback forms
• Marketing preference records (opt-in / opt-out status)

4. How We Collect Your Data

ct99 collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact support, or set responsible gaming limits on your ct99 account;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you browse or use the Platform (see Section 6);
• From third-party payment processors — confirmation data from JazzCash, Easypaisa, HBL, UBL, Meezan Bank, and Bank Alfalah when you initiate a transaction;
• From identity verification services — where ct99 uses third-party KYC providers to assist with document verification and age confirmation;
• From fraud prevention services — where third-party tools flag unusual activity patterns for review by the ct99 compliance team.

5. Purposes & Legal Bases for Processing

ct99 processes your personal data for the following purposes and on the following legal bases:

• Contract performance — to create and manage your ct99 account, process deposits and withdrawals, settle bets and casino games, and provide platform support. This processing is necessary to fulfil our contractual obligations to you.
• Legal obligation — to conduct identity verification (KYC), comply with anti-money laundering obligations, detect and prevent fraud, and meet applicable regulatory requirements. Processing is required by law.
• Legitimate interests — to operate and improve the Platform, prevent abuse, maintain platform security, conduct analytics, and personalise your gaming experience. We balance these interests against your data protection rights.
• Responsible gaming — to monitor gaming patterns, enforce responsible gaming limits, identify players who may be at risk of harm, and administer self-exclusion. Processing serves ct99's commitment to player safety.
• Consent — to send you marketing communications about promotions, new games, and offers relevant to Pakistani players. You may withdraw consent at any time through your account settings or by contacting support.

6. Cookies & Tracking Technologies

ct99 uses cookies and similar technologies to operate the Platform effectively. Cookies are small text files stored on your device that help ct99 recognise returning users, maintain session state, and understand how players interact with the Platform.

ct99 uses the following categories of cookies:

• Strictly necessary cookies — required for the Platform to function. These cannot be disabled and include session authentication tokens and security cookies;
• Functional cookies — remember your preferences such as language settings, responsible gaming limit configurations, and game lobby display options;
• Analytics cookies — collect aggregate usage data to help ct99 understand how players navigate the Platform and identify areas for improvement. Data is processed in aggregate form and is not used to identify individual players;
• Marketing cookies — used to track the effectiveness of promotional campaigns and, where you have consented, to deliver relevant offers. You can opt out of marketing cookies through your browser settings.

Most browsers allow you to manage or delete cookies through their settings. Disabling strictly necessary cookies may impair your ability to use certain Platform features, including login functionality.

7. Sharing of Personal Data

ct99 does not sell your personal data to third parties. ct99 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment processors — JazzCash, Easypaisa, HBL, UBL, Meezan Bank, and Bank Alfalah, for the purpose of processing deposits and withdrawals;
• KYC and identity verification providers — to verify your identity and age in connection with account registration and withdrawal processing;
• Fraud prevention and security providers — to detect and prevent fraudulent activity, money laundering, and other illegal conduct on the Platform;
• Game content providers — live dealer studios and RNG game studios may receive limited session data required to operate their games on the ct99 Platform;
• Technology infrastructure providers — cloud hosting, content delivery network, and platform software providers who process data on ct99's behalf under data processing agreements;
• Legal and regulatory authorities — where ct99 is required to disclose data by applicable law, court order, or regulatory direction.

All third parties who process personal data on ct99's behalf are required to implement appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than the specific service they provide to ct99.

8. International Data Transfers

Some of ct99's technology and service providers operate outside Pakistan. Where personal data is transferred to recipients in other jurisdictions, ct99 ensures that appropriate safeguards are in place — including contractual protections equivalent to applicable data protection standards — to protect your data during and after transfer. By using the ct99 Platform you acknowledge that your data may be transferred to and processed in jurisdictions outside Pakistan in accordance with this Policy.

9. Data Retention

ct99 retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal obligations:

• Account data — retained for the duration of your account relationship with ct99 and for a minimum of five (5) years after account closure, to meet anti-money laundering and record-keeping obligations;
• KYC documents — retained for a minimum of five (5) years after the last transaction on your account;
• Transaction records — retained for a minimum of seven (7) years from the transaction date;
• Support communications — retained for three (3) years from the date of the last communication;
• Analytics data — retained in aggregate, anonymised form indefinitely for Platform improvement purposes. Individual-level analytics data is retained for a maximum of twenty-four (24) months.

When personal data is no longer required, ct99 securely deletes or anonymises it in accordance with applicable data destruction standards.

10. Security Measures

ct99 implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the ct99 Platform;
• Encrypted storage of passwords (using one-way cryptographic hashing — passwords are never stored in plain text);
• Restricted access controls ensuring that personal data is accessible only to ct99 staff and service providers who require it for their specific function;
• Regular security audits and penetration testing of Platform infrastructure;
• Two-factor authentication (2FA) available to all players to protect account access;
• Incident response procedures for the detection, investigation, and reporting of data security incidents.

Despite these measures, no data transmission over the internet or electronic storage system is completely secure. ct99 cannot guarantee absolute security but commits to promptly notifying affected players of any data breach that poses a significant risk to their rights and interests, in accordance with applicable law.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ct99:

• Right of access — to request a copy of the personal data ct99 holds about you;
• Right to rectification — to request correction of inaccurate or incomplete personal data;
• Right to erasure — to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ct99's legal retention obligations;
• Right to restriction — to request that ct99 restrict processing of your data in certain circumstances;
• Right to data portability — to receive your personal data in a structured, machine-readable format and transfer it to another controller, where technically feasible;
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications), to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact ct99 support at [email protected]. ct99 will respond within thirty (30) days. Note that some rights are subject to limitations under applicable law — for example, ct99 may be required to retain certain data to meet its anti-money laundering obligations even following a deletion request.

12. Children's Privacy

The ct99 Platform is strictly for adults aged 18 years and older. 18+ ct99 does not knowingly collect personal data from individuals under the age of 18. If ct99 becomes aware that personal data has been collected from a person under 18, that data will be deleted and the associated account closed. If you believe that a person under 18 has registered a ct99 account, please notify us immediately at [email protected].

13. Responsible Gaming & Data Use

ct99 uses gaming and session data — including bet frequency, stake levels, session duration, and deposit patterns — to identify players who may be showing signs of problematic gambling behaviour. Where such patterns are identified, ct99 may make responsible gaming interventions including: proactive outreach encouraging use of deposit and session limit tools; temporary account restrictions; or referral to self-exclusion options.

This use of your data is an integral part of ct99's commitment to operating a responsible gaming platform. The data is not shared with third parties for commercial profiling purposes — it is used solely for player protection and platform integrity purposes. For full details of the responsible gaming tools available on ct99, please visit the Responsible Gaming page.

14. Changes to This Policy

ct99 may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or Platform features. When changes are made, the "Last updated" date at the top of this page will be revised. Where changes are material, ct99 will notify registered players via email or in-account notification prior to the changes taking effect. Your continued use of the Platform after notification of changes constitutes acceptance of the updated Policy.

15. Contact & Complaints

For all privacy-related enquiries, data access requests, or complaints, please contact the ct99 privacy team at: [email protected]. We aim to acknowledge all privacy enquiries within five (5) business days and to resolve them within thirty (30) days. If you are not satisfied with ct99's response to your privacy complaint, you may seek further recourse through the applicable data protection authority or court of competent jurisdiction in your area.