nr999 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how nr999 ("Company", "Platform", "we", "us", "our") collects, uses, stores, shares, and protects personal data about users ("Player", "User", "you") who access or use the nr999 website at nr999.pro and any associated mobile applications, games, or related services (collectively, the "Platform").

nr999 is committed to protecting the privacy of all registered players, including those based in Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan. We process personal data only for the purposes described in this Policy and only to the extent necessary to operate the Platform lawfully, safely, and fairly.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, which together form the full agreement governing your use of nr999. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.

2 Data Controller

nr999 is the data controller responsible for your personal data collected through the Platform. As data controller, nr999 determines the purposes and means of processing your personal information in connection with the services it provides.

For all privacy-related queries, requests, or complaints, you may contact our designated Data Protection contact directly:

• Email: [email protected]
• Subject Line: Privacy / Data Protection Request
• Response Time: Within 30 calendar days of receipt

3 Data We Collect

nr999 collects personal data in the following categories, depending on your interactions with the Platform:

nr999 does not intentionally collect special category data (such as health, religious, or political information). If you voluntarily provide such data in a support interaction, it will be handled with appropriate additional safeguards.

4 How We Collect Data

nr999 collects personal data through the following channels:

• Direct Interactions: Data you provide when registering an nr999 account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or completing a survey or promotion.
• Automated Technologies: Technical and usage data collected automatically via cookies, server logs, and analytics tools as you navigate the nr999 Platform.
• Third-Party Providers: Identity verification data from KYC/AML compliance partners; payment confirmation data from JazzCash, EasyPaisa, HBL, UBL, SadaPay, and other payment processors; fraud detection signals from security service providers.
• Publicly Available Sources: In limited circumstances, publicly available records may be consulted to verify account information or investigate fraud, in line with our licensing obligations.

5 Purposes & Legal Basis for Processing

nr999 processes your personal data only where a lawful basis exists. The table below maps each processing purpose to its corresponding legal basis:

6 Data Sharing & Disclosure

nr999 does not sell, rent, or otherwise trade your personal data for commercial gain. We share personal data only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, SadaPay, and USDT TRC20 processing partners receive only the minimum transaction data necessary to complete your deposit or withdrawal.
• Identity Verification Providers: Licensed KYC and AML compliance partners may receive identity documents to verify your age (21+), identity, and source of funds in accordance with our licensing obligations.
• Fraud Prevention Services: Anonymised or pseudonymised transactional patterns may be shared with fraud detection service providers to identify suspicious activity.
• Regulatory Authorities: nr999 is required by its licensing authority and applicable law to disclose player data to regulatory bodies, law enforcement, or financial intelligence units upon receipt of a lawful request. We cannot notify affected players of such disclosures in all circumstances.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of nr999's assets, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.
• Professional Advisers: Legal, accounting, and auditing firms engaged by nr999 may access limited personal data subject to strict confidentiality obligations.

All third parties with whom nr999 shares personal data are required to implement appropriate technical and organisational security measures and are prohibited from using your data for any purpose beyond what is necessary to fulfil their service to nr999.

7 Data Retention

nr999 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by our licensing authority and applicable law:

• Active Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure.
• Financial Transaction Records: Retained for a minimum of seven (7) years following each transaction to satisfy AML and financial regulatory obligations.
• KYC & Verification Documents: Retained for a minimum of five (5) years from the date of account closure or the date of the last regulated transaction, whichever is later.
• Customer Support Communications: Retained for two (2) years from the date of the last interaction, unless the subject matter relates to an active dispute or regulatory investigation.
• Marketing Preferences: Retained until you withdraw consent or for three (3) years of inactivity, whichever comes first.

When data is no longer required, nr999 will securely delete or anonymise it in accordance with its data disposal procedures.

8 Data Security

nr999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Transport Security: All data transmitted between your browser or app and nr999 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Data at Rest: Personal data stored in nr999 databases is encrypted at rest using industry-standard AES-256 encryption.
• Access Controls: Access to personal data is restricted to nr999 employees and contractors who have a legitimate need to process it for the purposes described in this Policy. All staff with access to personal data are subject to confidentiality obligations and regular privacy training.
• Two-Factor Authentication: nr999 offers 2FA on player accounts to reduce the risk of unauthorised access following credential compromise.
• Penetration Testing: The nr999 Platform undergoes periodic third-party security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident Response: In the event of a personal data breach that poses a risk to your rights, nr999 will notify affected players and relevant regulatory authorities within the timeframe required by our licensing obligations.

9 Cookies & Tracking Technologies

nr999 uses cookies and similar technologies (collectively, "Cookies") on the Platform. Cookies are small text files placed on your device that help the Platform function correctly and enable us to understand how the Platform is used.

The following categories of cookies are used by nr999:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in to your nr999 account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as preferred game language, responsible gaming settings, and last visited sections. Disabling these cookies may reduce your experience quality.
• Analytics Cookies: Collect anonymised data about how players navigate nr999 — which pages are most visited, where users drop off, and how long sessions last. This data is used to improve the Platform. nr999 uses privacy-friendly analytics configurations that do not share identifiable data with third parties.
• Security Cookies: Used by fraud detection systems to identify unusual access patterns that may indicate account compromise or automated bot activity.

nr999 does not use third-party advertising or social media tracking cookies. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly.

10 Your Data Protection Rights

As an nr999 player, you have the following rights in respect of the personal data we hold about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request".

nr999 will respond to all data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you within the initial 30-day period and explain the reason for the extension.

Please note that certain rights are subject to limitations where processing is required for us to fulfil our legal obligations — including AML, KYC, and licensing requirements — or to establish, exercise, or defend legal claims.

11 Minors

The nr999 Platform is strictly intended for players who are 21 years of age or older. nr999 does not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by or on behalf of an underage individual, we will immediately suspend that account, delete all associated personal data to the extent permitted by law, and forfeit all account balances in accordance with our Terms and Conditions.

If you believe that a minor has created an nr999 account, please notify us immediately at [email protected] with the subject line "Underage Account Report".

12 International Data Transfers

As an internationally licensed gaming operator, nr999 may transfer your personal data to countries outside of Pakistan for processing by our service providers — including cloud infrastructure providers, KYC vendors, and payment processors. In all cases, nr999 ensures that:

• Any transfer is made only to recipients in countries that provide an adequate level of data protection, or
• Appropriate contractual safeguards are in place, such as standard contractual clauses, binding corporate rules, or equivalent mechanisms that require the recipient to protect your data to the standard described in this Policy.

You may request information about the safeguards applicable to a specific international transfer by contacting us at [email protected].

13 Third-Party Links

The nr999 Platform may contain references or links to third-party content such as game provider documentation or payment method information pages. nr999 is not responsible for the privacy practices of any third-party websites or services and encourages you to review the privacy policies of any external sites you visit independently of nr999.

14 Changes to This Privacy Policy

nr999 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our licensing obligations, or our data processing practices. When material changes are made, we will:

• Update the effective date displayed at the top of this Policy.
• Notify registered players via email and/or a prominent on-site notification banner.
• Where required by applicable law, seek renewed consent for any new processing activities that require it.

We encourage you to review this Policy periodically. Your continued use of the nr999 Platform following the publication of a revised Policy constitutes your acceptance of the updated terms.

15 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which nr999 handles your personal data, please contact us through any of the following channels:

• Email: [email protected] (for all privacy and data protection matters, use the subject line "Privacy Enquiry")
• Live Chat: Available 24/7 via the live chat widget on nr999.pro
• Support Hours: 24 hours a day, 7 days a week, including during PSL match nights and Pakistani public holidays

We take all privacy complaints seriously and will acknowledge your query within 5 business days, with a substantive response within 30 calendar days. Where you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.