Privacy Policy — sz9999 Platform

sz9999 ("we", "us", "our", "the Platform") is an English-language online gaming information platform accessible at https://sz9999.cam, designed primarily for Pakistani users. We are committed to protecting the privacy and personal data of all individuals who access or use our Platform, whether from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar or elsewhere.

This Privacy Policy ("Policy") describes how sz9999 collects, uses, stores, shares, protects and processes personal data in connection with the operation of the Platform. It also sets out the rights available to users regarding their personal data and explains how those rights may be exercised.

sz9999 acts as the data controller for personal data collected directly through the Platform. Where we engage third-party processors — for example, payment technology providers, KYC verification services or analytics platforms — we do so under contractual arrangements that require those processors to handle your data in accordance with applicable data protection standards.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which contain additional provisions relevant to the use of personal data.

sz9999 collects personal data through multiple channels and for clearly defined purposes. The categories of personal data we collect are set out below:

We process your personal data for the following purposes:

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without a human review step, except where required by law or explicitly consented to by you.

sz9999 processes personal data only where a lawful basis exists. The applicable bases are:

• Contractual necessity: Processing required to perform the contract between you and sz9999 — including account registration, payment processing and withdrawal fulfilment;
• Legal obligation: Processing required to comply with applicable law — including KYC identity verification, AML transaction monitoring and regulatory reporting obligations;
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection and business analytics, where those interests are not overridden by your privacy rights;
• Consent: Where we rely on your consent — for example, for optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing. Consent withdrawal does not affect processing carried out on other legal bases.

sz9999 does not sell, rent, trade or share your personal data with third parties for their own marketing purposes. We may share personal data with third parties only in the following circumstances:

• Service providers and processors: We engage third-party data processors — including KYC verification technology providers, payment processing infrastructure, cloud hosting services, fraud detection services and analytics providers — under strict data processing agreements that prohibit secondary use of your data;
• Legal and regulatory authorities: Where required by applicable law, court order, regulatory mandate or AML reporting obligations, we may disclose personal data to competent authorities. We will notify you of any such disclosure where legally permitted to do so;
• Business transfers: In the event of a merger, acquisition, restructuring or sale of all or part of sz9999's business assets, personal data may be transferred as part of that transaction. You will be notified of any material change to the data controller's identity;
• Responsible gambling enforcement: Where applicable, we may share limited account data with third-party responsible gambling schemes or self-exclusion registries to enforce exclusion orders across operators.

In all cases of third-party sharing, we apply appropriate contractual, technical and organisational safeguards to protect your personal data.

sz9999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The general retention framework is as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.

sz9999 uses cookies and similar tracking technologies (such as local storage and session tokens) to operate the platform, maintain session security and understand how users interact with our content. We do not use cookies for cross-site behavioural advertising or to build third-party marketing profiles.

The categories of cookies used on sz9999 are as follows:

You may manage cookie preferences through your browser settings. Disabling essential cookies will impair platform functionality, including login and payment processing. Disabling analytics cookies will not affect your ability to use the platform.

sz9999 implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Key measures include:

• TLS/HTTPS encryption: All data in transit between your device and our servers is encrypted using current Transport Layer Security (TLS) protocols;
• Password hashing: User passwords are stored exclusively as salted cryptographic hashes. Plain-text passwords are never stored or transmitted by sz9999;
• Access controls: Access to personal data within sz9999 is restricted to authorised personnel on a need-to-know basis, subject to formal access management procedures and logging;
• KYC document security: Identity documents submitted for verification are processed through an isolated, access-controlled secure verification system. Documents must never be shared via unsecured email or messaging applications;
• Incident response: sz9999 maintains a data breach incident response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users within applicable legal timeframes;
• Vendor due diligence: Third-party processors are assessed for data security practices before engagement and are contractually required to maintain appropriate security standards.

sz9999 operates internationally and may transfer your personal data to servers and processors located outside Pakistan. Where personal data is transferred to third countries — that is, jurisdictions that may have different data protection standards — sz9999 applies appropriate transfer safeguards, which may include:

• Standard contractual clauses approved by the relevant data protection authority;
• Transfers to processors in jurisdictions with an applicable adequacy finding;
• Contractual obligations requiring the recipient to maintain data protection standards equivalent to those applied by sz9999.

Pakistani users should be aware that Pakistan's data protection landscape continues to evolve. The Personal Data Protection Bill (or any subsequently enacted data protection legislation) may impose additional obligations or rights. sz9999 will update this Policy if and when applicable Pakistani data protection legislation comes into force and affects our data practices.

As a user of sz9999, you have the following rights in relation to your personal data. These are genuine, exercisable rights — not symbolic policy language.

To exercise any of the above rights, please contact us using the details in Section 16. We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests and will respond within 30 calendar days. We may extend this period by a further 60 days where requests are complex or numerous, with notification.

sz9999 is strictly an adults-only platform. Access is limited to users aged 18 years or above, or the higher minimum age required by the applicable operator or licence jurisdiction. We do not knowingly collect or process personal data from individuals below the applicable minimum age.

Age verification is enforced through our KYC process. If we become aware that personal data has been collected from a minor — whether through false registration information, a circumvented verification process or any other means — we will immediately suspend the associated account, delete the personal data and, where applicable, report the matter to relevant authorities.

If you are a parent or guardian and believe that a minor has created an account on sz9999, please contact us immediately at the details in Section 16 so that we can take prompt action.

Identity verification documents submitted for KYC purposes — including Pakistani CNIC copies, passport scans, proof of address and liveness images — are subject to the following specific handling rules:

• KYC documents must only be submitted through the sz9999 secure HTTPS verification portal. Never submit identity documents via standard email, WhatsApp or any unsecured channel not explicitly designated as the official KYC submission portal;
• KYC document data is processed by sz9999 and, where applicable, by contracted third-party identity verification service providers operating under data processing agreements;
• Identity documents are retained for the period required by applicable AML regulations — typically five years from the date of verification — and are then securely deleted;
• KYC data is not used for marketing purposes, shared with advertisers or combined with behavioural data to create commercial user profiles;
• Submission of falsified, altered or third-party identity documents constitutes fraud. sz9999 will report confirmed document fraud to relevant law enforcement authorities.

sz9999's platform is designed for and primarily used by Pakistani users in cities including Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. The following specific points are relevant to Pakistani users accessing this platform:

• sz9999 does not claim to be regulated, licensed or endorsed by the Government of Pakistan, the PTA, the State Bank of Pakistan, any Pakistani provincial authority or any Pakistani financial institution. Our data practices are governed by the laws of our operating jurisdiction;
• References to Pakistani payment providers — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are used solely as contextual payment method references for Pakistani users. None of these providers are data controllers or data processors of your sz9999 personal data, and no affiliation with or endorsement by these providers is implied;
• Pakistan's national identification number (CNIC) is treated as a sensitive identifier. It is collected only for KYC purposes, stored with encryption, and never displayed in plain text in your account interface or support communications;
• Pakistani data protection legislation continues to develop. If new Pakistani data protection laws come into force that materially affect your rights under this Policy, sz9999 will update this Policy accordingly and notify registered users.

sz9999 reserves the right to update, revise or replace this Privacy Policy at any time. Where amendments are material — for example, a change to the categories of data we collect, a new data sharing arrangement or a change to your rights — we will provide advance notice via on-platform notification and/or email to your registered address.

The "Effective Date" at the top of this page reflects the date of the most recent revision. We recommend reviewing this Policy periodically, particularly before making any significant account activity such as a deposit, withdrawal or KYC submission.

Your continued use of the sz9999 Platform after any amendment has been published constitutes acceptance of the revised Policy. If you do not accept a revised Policy, you must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

For all privacy-related enquiries — including data access requests, rectification requests, erasure requests, consent withdrawal, data portability requests and complaints regarding our data practices — please contact the sz9999 Data Team:

We will respond to all verified data rights requests within 30 calendar days. We may request proof of identity before acting on a request. For complex requests, we may extend the response period by up to 60 days with notification.

Do not include your CNIC number, passport details or financial account numbers in standard support messages or emails. Sensitive documents must only be submitted through the Platform's designated secure HTTPS verification portal.