Privacy Policy — 22y999

This Privacy Policy ("Policy") is issued by 22y999 ("the Operator", "we", "us", "our") and applies to all personal data processed in connection with the website located at https://22y999.cam and any related services, applications or communications (collectively, "the Platform").

22y999 is an international online betting and gaming platform. It does not hold a gambling licence issued by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan or any Pakistani provincial authority. The Operator processes personal data in accordance with the data protection laws applicable in its operating jurisdiction. This Policy is provided to users in Pakistan and all other regions as a matter of transparency and good practice.

This Policy should be read in conjunction with the Terms & Conditions and the Responsible Gambling Policy, which together form the complete agreement between you and the Operator.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including name, email address, date of birth, national identity number and IP address.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, deletion or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, the Operator of 22y999.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller under a written agreement.
• "KYC" (Know Your Customer) means the identity and address verification process required under AML/CFT obligations before withdrawal requests are processed.
• "AML" (Anti-Money Laundering) means legal obligations and internal procedures designed to detect and prevent the use of the Platform to launder money or finance terrorism.
• "Consent" means a freely given, specific, informed and unambiguous indication of agreement to the processing of Personal Data for a specified purpose.
• "Cookie" means a small text file placed on your device by the Platform for session management, analytics or preference storage.
• "User" / "you" means any individual who accesses, registers on or uses the Platform.

22y999 collects Personal Data through the following channels and in the following categories:

3.1 Data You Provide Directly

• Registration data: Full name, date of birth, email address, username and password (stored as a hashed value, not in plain text).
• Contact and address data: Residential address, city (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar) and country of residence.
• Identity documents (KYC): Scanned or photographed copies of government-issued identification (e.g., CNIC, passport), proof-of-address documents and, where required, source-of-funds documentation.
• Payment data: Payment method details necessary to process deposits and withdrawals. We do not store full card numbers; payment method references (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah and cryptocurrency wallet addresses where applicable) are retained as references for transaction reconciliation only. These payment providers are independent services and do not endorse gambling.
• Communications data: The content of messages sent to support via Live Chat or email, including any attachments you provide.

3.2 Data Collected Automatically

• Technical data: IP address, device type, operating system, browser type and version, screen resolution and time zone.
• Usage data: Pages visited, features accessed, bet histories, session durations, click paths and error logs.
• Location data: Approximate geographic location inferred from IP address for the purpose of geolocation compliance checks (not GPS-level precision).
• Cookie and tracking data: See Section 8 for full details of cookies and similar technologies used on the Platform.

3.3 Data from Third Parties

• Identity verification providers: We may receive identity verification results from third-party KYC service providers who check identity documents against official databases.
• Fraud and AML screening providers: We may receive risk-scoring data related to your transaction history and identity from specialist AML and fraud-detection services.
• Payment processors: Transaction status confirmations, declined transaction codes and chargeback notifications from payment processing partners.

22y999 processes Personal Data only for defined, legitimate purposes. The primary purposes for which your data is used are set out below:

4.1 Account Registration & Management

We use registration data to create and maintain your account, authenticate your identity at login, manage account preferences and communicate account-related notifications to your registered email address.

4.2 KYC & AML Compliance

Identity, address and financial data are processed to comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations. KYC verification is required before withdrawal requests are approved. AML monitoring analyses transaction patterns to identify and report suspicious activity as required by applicable law.

4.3 Payment Processing

Payment method data is used to process deposits and withdrawals via the cashier. We pass necessary data to payment processors to execute transactions. We do not store complete payment credentials beyond what is required for transaction reconciliation.

4.4 Platform Operation & Improvement

Technical and usage data is used to diagnose technical issues, monitor Platform performance, analyse user behaviour in aggregate for product improvement and develop new features. Individual user profiles are not built for the purpose of selling advertising to third parties.

4.5 Responsible Gambling Monitoring

Behavioural and financial data is analysed to identify patterns consistent with problem gambling — such as rapid increases in deposit frequency, session length spikes or self-reported distress signals. Where such patterns are detected, the Platform may apply responsible gambling interventions, including deposit limit suggestions, cooling-off notifications or mandatory support contact.

4.6 Fraud Prevention & Security

Technical data, device fingerprints and behavioural patterns are used to detect and prevent fraudulent activity, account takeover, multi-accounting and bonus abuse. Where fraud is confirmed, data may be shared with law enforcement or other operators through approved industry fraud-prevention networks.

4.7 Marketing Communications

Where you have provided consent, we may send promotional communications about offers, new features and events relevant to your betting preferences. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting support. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal.

Personal data is processed by 22y999 on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil the agreement between you and the Operator — including account registration, deposit processing, bet placement and withdrawal — falls under this basis. Without this processing, the contractual service cannot be provided.
• Legal obligation: KYC, AML and fraud-prevention processing is carried out to comply with applicable legal requirements in the Operator's operating jurisdiction. This processing cannot be waived by the User.
• Legitimate interests: Processing for Platform security, fraud detection, technical performance monitoring and responsible gambling monitoring is carried out on the basis of the Operator's legitimate interests, provided those interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your explicit consent. You may withdraw consent at any time without detriment to your account.

22y999 does not sell your Personal Data to third parties. Data is shared only in the limited circumstances described below:

6.1 KYC & Identity Verification Providers

Identity documents and verification data are shared with specialist third-party KYC providers to complete identity and address checks. These providers act as Data Processors bound by data-processing agreements with the Operator.

6.2 Payment Processors

Transaction data is shared with payment processing partners — which may include providers associated with methods such as Easypaisa, JazzCash, Raast, bank transfer services (HBL, UBL, Meezan Bank, Bank Alfalah) and cryptocurrency payment gateways where applicable — solely for the purpose of processing deposits and withdrawals. These providers are independent of the Operator and subject to their own terms. Their inclusion here is contextual and does not imply endorsement of gambling activity by any named provider.

6.3 Regulatory & Law-Enforcement Authorities

Where required by applicable law or a valid court order, the Operator will disclose Personal Data to regulatory authorities, law enforcement agencies or other public bodies. Disclosures will be limited to what is strictly required and documented appropriately.

6.4 Fraud Prevention Networks

Where fraud has been confirmed, data relevant to the fraudulent activity may be shared with specialist fraud-prevention organisations or, where applicable, with other operators operating under the same regulatory framework, strictly for fraud-prevention purposes.

6.5 Technology Service Providers

Infrastructure providers, hosting services, analytics platforms, email delivery services and customer support software vendors may process Personal Data on the Operator's behalf under written data-processing agreements. These parties are prohibited from using your data for any purpose other than performing services for 22y999.

6.6 Corporate Transactions

In the event of a merger, acquisition, restructuring or sale of all or part of the Operator's business, Personal Data may be disclosed to prospective or actual acquirers under appropriate confidentiality obligations. You will be notified of any such transfer and any resulting change to this Policy.

22y999 implements a range of technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, alteration or destruction. These include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the Platform is encrypted in transit using industry-standard TLS/SSL protocols.
• Password hashing: Account passwords are stored as cryptographic hashes, not in plain text. Even in the event of a data breach, stored passwords would not be directly readable.
• Access controls: Access to Personal Data within the Operator's systems is restricted on a need-to-know basis. Employees and contractors with access to Personal Data are subject to confidentiality obligations.
• Two-factor authentication (2FA): 2FA is available for user accounts and is enforced for internal administrator access to production systems.
• Data minimisation: We collect and retain only the minimum data necessary to fulfil the purposes described in this Policy.
• Incident response: The Operator maintains data-breach response procedures. In the event of a breach that is likely to result in a high risk to your rights, we will notify affected users without undue delay, consistent with applicable legal requirements.

22y999 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They enable session management (keeping you logged in during your visit), security token validation and load balancing. These cookies cannot be disabled without impacting Platform functionality.

8.2 Analytics Cookies

Analytics cookies allow us to understand how users interact with the Platform in aggregate — which pages are most visited, where users drop off in a registration flow, and how features are used. This data is anonymised or pseudonymised where possible. Analytics processing is carried out on the basis of legitimate interests.

8.3 Functional Cookies

Functional cookies remember your preferences — such as language selection, display settings and responsible gambling tool configurations — so you do not need to re-enter them on each visit.

8.4 Marketing & Remarketing Cookies

With your consent, marketing cookies may be used to measure the effectiveness of promotional communications. These cookies do not enable third-party advertisers to build profiles on you for the purpose of selling unrelated advertising.

8.5 Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to use the Platform. Instructions for managing cookies in commonly used browsers are available in the respective browser's help documentation. Withdrawing cookie consent does not affect the lawfulness of cookie-based processing carried out prior to withdrawal.

Subject to applicable law and certain conditions, you have the following rights in relation to your Personal Data held by 22y999. These rights may be exercised by contacting us using the details in Section 15.

22y999 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. Specific retention periods are guided by the following principles:

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised. Residual copies in backup systems are overwritten in accordance with the Operator's data destruction schedule.

As an international platform, 22y999 may process and store Personal Data in countries outside Pakistan and, depending on your location, outside the jurisdiction in which you reside. Data may be transferred to countries where the Operator, its parent entities, Data Processors or technology partners maintain infrastructure.

Where Personal Data is transferred internationally, the Operator ensures that appropriate safeguards are in place to protect your data to a standard consistent with the protections described in this Policy. These safeguards may include:

• Standard contractual clauses approved by applicable supervisory authorities;
• Binding corporate rules where transfers are made within a corporate group;
• Adequacy decisions where the receiving country provides equivalent data protection standards.

Pakistan does not currently have a comprehensive data protection statute of equivalent scope to European data protection law. Players in Pakistan should be aware that their data may be processed under the regulatory framework applicable in the Operator's operating jurisdiction, which may differ from Pakistani law.

22y999 does not knowingly collect Personal Data from persons under the age of 18, or under the higher minimum age required by the Operator's licence jurisdiction. The Platform is strictly an adults-only service.

Age verification is conducted as part of the KYC process. Where the Operator has reasonable suspicion that a User is under the required minimum age, the Account will be suspended pending age verification, and no winnings or deposits will be released until identity and age are confirmed.

If a parent or guardian becomes aware that a minor has provided Personal Data to 22y999 without their knowledge, they should contact us immediately using the details in Section 15. We will take prompt steps to delete the data and close the account upon verification of the circumstances.

The Platform may reference third-party services — for example, payment providers such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — in a contextual capacity. 22y999 does not control the privacy practices of these third parties and is not responsible for their privacy policies or data-handling practices.

When you interact with a third-party payment provider to initiate a deposit or withdrawal, that interaction is governed by the third party's own terms and privacy policy. We encourage you to review the privacy policies of any third-party service you use in connection with your 22y999 account.

This Policy applies only to data collected and processed directly by 22y999 in connection with the Platform.

22y999 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, changes to sharing practices or changes to your rights — we will provide notice via the Platform or to your registered email address before the changes take effect.

The "Last Updated" date at the top of this page indicates when the most recent version was published. We encourage you to review this Policy periodically to stay informed about how we handle your Personal Data.

Your continued use of the Platform following notification of changes constitutes acceptance of the updated Policy. If you do not agree to the revised Policy, you may request Account closure in accordance with the Terms & Conditions.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the 22y999 support team through the following channels:

• Live Chat: Available 24/7 through the Platform's support widget. Recommended for urgent requests.
• Email: [email protected] — This address is displayed as plain text. Please copy it manually if needed. It is not a clickable link.

When submitting a data rights request, please include your full name, registered email address and a description of your request. We may ask you to provide proof of identity before processing requests that involve access to or deletion of Personal Data.

We aim to acknowledge all data-related requests within 5 business days and to provide a substantive response within the timeframe required by applicable law (typically 30 days for access requests).