1 Who We Are
This Privacy Policy applies to o999, operated at o999.click ("o999", "we", "us", "the Platform"). o999 is an online sports betting and casino platform built specifically for Pakistani players, offering cricket betting, esports markets, slots, live casino games, and more — all in Pakistani Rupees (PKR).
For the purposes of this policy, o999 acts as the data controller for all personal information you provide when registering, depositing, betting, or otherwise interacting with the Platform. If you have any questions about this policy or about how your data is handled, the contact details are provided in Section 14.
Plain Language Summary: o999 is the company responsible for your data. This policy tells you exactly what we do with it. If anything here isn't clear, just get in touch — we'll walk you through it.
2 What Data We Collect
o999 collects personal data in three ways: information you provide directly, information collected automatically when you use the Platform, and information received from trusted third-party verification services.
Information you provide directly to o999:
- Full legal name as it appears on your CNIC;
- Date of birth (for age verification);
- CNIC number and copies of identity documents uploaded during KYC;
- Mobile phone number and email address;
- Residential address and proof of address documents;
- Payment method details (Easypaisa/JazzCash account number, bank account details, card details where applicable — stored in tokenised form only);
- Communication history with o999 customer support;
- Responsible gaming preferences and self-exclusion requests.
Information collected automatically:
- IP address and approximate geographic location;
- Device type, operating system, browser type and version;
- Session data: pages visited on o999, time spent, click patterns, bet history, game play history;
- Cookie and local storage data (see Section 5);
- Login timestamps and authentication logs.
Information from third parties:
- Identity verification results from CNIC validation providers;
- Transaction confirmation data from Easypaisa, JazzCash, NayaPay, SadaPay, and bank IBFT processors;
- Fraud and risk signals from payment security partners.
3 How We Use Your Data
o999 uses your personal data for specific, clearly defined purposes. We do not use your data for anything not listed here without first obtaining your explicit consent.
| Purpose |
Data Used |
Legal Basis |
| Account creation & management | Name, DOB, email, phone, CNIC | Contract performance |
| Age & identity verification (KYC) | CNIC, DOB, identity documents | Legal obligation |
| Processing deposits & withdrawals | Payment method details, transaction history | Contract performance |
| Fraud detection & security | IP, device data, session behaviour | Legitimate interests |
| Responsible gaming monitoring | Bet history, session data, deposit/loss patterns | Legal obligation & legitimate interests |
| Customer support | Communication history, account details | Contract performance |
| Platform improvement & analytics | Anonymised session data, device data | Legitimate interests |
| Regulatory reporting (AML) | Transaction data, identity data | Legal obligation |
| Marketing communications (opt-in only) | Email, phone number | Consent |
o999 processes your betting and gaming activity data for responsible gaming purposes — specifically to identify patterns that may indicate problematic play, such as escalating bet sizes after losses, session lengths exceeding set limits, or requests to withdraw shortly after large deposits. This processing protects you and is required under our operating obligations.
4 Legal Basis for Processing
o999 processes your personal data on the following legal grounds, consistent with internationally recognised data protection principles:
- Contract Performance: Processing necessary to provide the o999 service to you — account management, bet settlement, payments.
- Legal Obligation: Processing required by applicable regulations — KYC/AML identity verification, age verification, regulatory reporting.
- Legitimate Interests: Processing where o999's operational interests do not override your rights — fraud prevention, platform security, service improvement using anonymised analytics.
- Consent: Processing you have explicitly agreed to — marketing emails or SMS messages from o999. You can withdraw this consent at any time by emailing support@o999.click or updating your communication preferences in your account settings.
Where o999 relies on legitimate interests, we conduct a balancing test to ensure that your fundamental privacy rights are not overridden. If you want more information about any specific legitimate interests assessment, you can request this from our team.
5 Cookies & Tracking Technologies
o999 uses cookies and similar tracking technologies to operate the Platform correctly, maintain your logged-in session, and understand how players use the site so we can improve it.
Essential Cookies: Required for o999 to function. These maintain your login session, remember your odds format preference, and secure your account. They cannot be disabled without breaking core Platform functionality.
Functional Cookies: Remember your preferences — language, notification settings, responsible gaming reminders you have set. Stored for the duration of your session or up to 30 days for persistent preferences.
Analytics Cookies: o999 uses anonymised, aggregated analytics to understand which features are most used, how long players spend on different sections, and where technical problems occur. No individual player is identifiable from this data.
Security Cookies: Used for fraud detection and account security — for example, flagging login attempts from an unusual device or location so we can alert you.
o999 does not use third-party advertising cookies or retargeting pixels. You will never see o999 adverts following you around other websites as a result of cookies set on our Platform.
Managing Cookies: You can control or delete cookies through your browser settings. Disabling essential cookies will affect your ability to log in and use o999's core features. Disabling analytics cookies will not affect your betting or account access.
6 Who We Share Your Data With
o999 shares personal data with third parties only where strictly necessary and only in the categories listed below. All third parties with access to your data are contractually bound to handle it securely and use it only for the specific purpose for which it was shared.
- Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, and IBFT banking partners receive the transaction data necessary to process your deposits and withdrawals. They do not receive your betting history or full identity documents.
- KYC Verification Providers: Third-party identity verification services receive your CNIC and documents for the sole purpose of confirming your identity and age. They may not retain this data beyond the verification period.
- Game Providers: Slot and live casino providers (such as Pragmatic Play, Evolution, NetEnt) receive a pseudonymous player identifier to operate game rounds and calculate RTP. They do not receive your name, CNIC, or payment details.
- Regulatory Authorities: o999 may be required to share transaction or identity data with financial intelligence or gaming regulatory bodies when required by applicable law. o999 will notify you of any such disclosure where legally permitted to do so.
- Fraud Prevention Services: Anonymised device and session signals may be shared with fraud detection partners to identify and prevent fraudulent account activity.
7 Data We Will Never Share
To be completely transparent, the following categories of data are never shared by o999 under any circumstances:
- Your full name, CNIC number, or identity documents shared with advertisers, marketing agencies, or data brokers;
- Your betting or gaming history sold to or shared with any commercial third party;
- Your mobile number or email address shared with any party for their independent marketing use;
- Your payment method credentials shared with any party beyond what is required for the specific transaction;
- Your personal data transferred to any country that does not provide an adequate level of data protection without appropriate safeguards in place.
If you ever receive a communication claiming to be from o999 that references selling or sharing your data for marketing purposes, please report it to support@o999.click — it is not from us.
8 How We Protect Your Data
Data security at o999 is an operational priority, not a compliance checkbox. The following technical and organisational measures are in place to protect your personal information:
- Encryption in Transit: All data transmitted between your device and o999's servers uses TLS 1.3 / 256-bit SSL encryption. Your login credentials and payment details are never sent in plain text.
- Encryption at Rest: Sensitive data fields — including CNIC numbers, payment account identifiers, and identity documents — are stored in encrypted form on o999's servers. Even if a server were accessed without authorisation, the raw data would not be readable.
- Payment Tokenisation: o999 does not store full card numbers or mobile wallet credentials. Payment details are tokenised — replaced with a non-sensitive reference — by our PCI-DSS compliant payment partners at the point of entry.
- Access Controls: Access to player personal data within o999 is restricted on a strict need-to-know basis. Customer support agents can see what is necessary to assist you. They cannot see your full CNIC number or payment credentials.
- Two-Factor Authentication (2FA): o999 offers optional 2FA for player accounts and enforces 2FA for all internal staff with access to production systems and player data.
- Security Monitoring: o999 employs continuous security monitoring across its infrastructure to detect and respond to anomalies, intrusion attempts, and unusual access patterns in real time.
In the unlikely event of a data breach that affects your personal information, o999 will notify you promptly by email to your registered address with details of what occurred, what data was affected, and what steps we are taking.
9 Data Retention
o999 retains your personal data for as long as it is required for the purpose it was collected, or as required by applicable law. The table below sets out the standard retention periods for each major data category.
| Data Category |
Retention Period |
Reason |
| Account registration data (name, DOB, CNIC) | 5 years after account closure | AML / regulatory requirement |
| KYC identity documents | 5 years after account closure | Legal obligation |
| Transaction and payment records | 5 years after transaction date | Financial record-keeping |
| Betting and gaming history | 3 years after last activity | Responsible gaming monitoring & disputes |
| Customer support communications | 2 years after ticket closure | Dispute resolution |
| Session and analytics data (anonymised) | 13 months rolling | Platform improvement |
| Marketing consent records | Until consent withdrawn + 1 year | Compliance evidence |
Once retention periods expire, o999 securely deletes or irreversibly anonymises the relevant data. You may request early deletion of certain data categories — see Section 10 for your rights and the process to exercise them.
10 Your Rights Over Your Personal Data
As an o999 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact support@o999.click with the subject line "Data Rights Request" from your registered email address.
Right to Access
Request a copy of all personal data o999 holds about you. We will provide this within 30 days in a readable format at no charge.
Right to Correction
If any personal data o999 holds is inaccurate or incomplete, you can request that it be corrected. Updates to name or CNIC require supporting documentation.
Right to Deletion
Request deletion of your personal data. Note that data subject to legal retention obligations (KYC, transaction records) cannot be deleted until those periods expire.
Right to Portability
Request your personal data in a structured, machine-readable format (JSON or CSV) so you can transfer it to another service provider.
Right to Restrict Processing
Request that o999 limits how it uses your data while a correction or objection request is being resolved.
Right to Object
Object to processing based on legitimate interests — including analytics and fraud detection profiling. o999 will cease such processing unless it can demonstrate compelling legitimate grounds.
11 Children's Privacy
o999 is an adult platform strictly for persons aged 18 years and over. We do not knowingly collect personal data from anyone under the age of 18. Every registration on o999 is subject to mandatory age verification against the applicant's CNIC, which contains date of birth.
If o999 discovers or is informed that personal data has been collected from an individual under 18, the account will be immediately suspended, all funds (including any winnings) will be frozen pending investigation, and the data will be securely deleted once the investigation is complete. Any winnings generated on an underage account are forfeited in full.
If you are a parent or guardian and believe your child may have registered on o999, please contact support@o999.click immediately.
12 Third-Party Links
The o999 Platform does not contain links to external third-party websites. All navigation within o999.click stays within the Platform. If you arrive at o999 from an external source — a search engine, a referral link — this Privacy Policy applies from the moment you are on o999.click. The privacy practices of any external site that referred you to o999 are the responsibility of that site and are not covered by this policy.
13 Changes to This Privacy Policy
o999 reviews this Privacy Policy at least annually and whenever there is a material change to how we handle personal data. When changes are made, the version number and effective date at the top of this page will be updated, and registered players will be notified by email to their registered address at least 7 days before material changes take effect.
Your continued use of o999 after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to a material change, you may close your account before the effective date — contact support@o999.click to initiate this process.
Tip: Bookmark this page and check back periodically. The effective date and version number at the top will always tell you whether you're reading the current version.
14 Contact & Data Rights Requests
For all privacy queries, data rights requests, or concerns about how o999 handles your personal information, please contact us using the following:
Email: support@o999.click
Subject Line for Data Requests: "Data Rights Request"
Response Time: Within 5 working days for acknowledgement; substantive response within 30 days
Languages: English (en-PK)
Hours: 24/7
When submitting a data rights request, please include your registered mobile number or account username so we can locate your record quickly and process your request without delay. We may need to verify your identity before actioning any request that involves accessing or deleting your personal data.
