sx999 Privacy Policy — How We Collect, Use & Protect Your Data

1.1 This Privacy Policy ("Policy") applies to all personal data collected, processed, and stored by sx999 in connection with the operation of the sx999 online gaming and sports betting platform, accessible at sx999.org and all associated digital properties, mobile-optimized interfaces, and communication channels.

1.2 This Policy applies to all registered players of sx999, all visitors to the sx999 website irrespective of whether they have created an account, all individuals who communicate with sx999 support channels, and all individuals whose personal data sx999 processes in connection with KYC, AML, or regulatory compliance obligations.

1.3 This Policy must be read alongside the sx999 Terms & Conditions and the sx999 Responsible Gaming Policy, all of which form part of the complete legal framework governing the relationship between sx999 and its players. In the event of any conflict between this Policy and the Terms & Conditions on a data protection matter, this Policy will prevail.

1.4 By registering an account on sx999, accessing the platform, or providing personal data to sx999 through any channel, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein, subject to the legal bases set out in Section 5.

2.1 For the purposes of this Privacy Policy, sx999 is the Data Controller in respect of all personal data collected from Pakistani players and website visitors. As Data Controller, sx999 determines the purposes for which personal data is collected and the means by which it is processed.

2.2 sx999 operates as a Data Controller under the requirements of its international gaming license, which imposes specific data protection, retention, and security obligations that form part of the licensing conditions reviewed annually by independent auditors.

2.3 Where sx999 engages third-party service providers to process personal data on its behalf — including payment processors, KYC verification services, game software providers, and customer support platforms — those parties act as Data Processors under the direction of sx999 as Data Controller. Appropriate data processing agreements are in place with all such third-party processors.

sx999 collects the following categories of personal data from players and website visitors. Data collection is limited to what is necessary for the purposes identified in Section 6 of this Policy.

3.1 Special Category Data. sx999 does not seek to collect special category personal data (such as data regarding health, religion, or political opinions) from players. In limited circumstances, responsible gaming disclosures made by a player may incidentally reveal information about personal circumstances — such data is handled with strict confidentiality and used only for the purpose of providing appropriate responsible gaming support, never for profiling or marketing purposes.

sx999 collects personal data through the following means:

• Direct submission by players: Data provided when completing the sx999 registration form, submitting KYC documentation, making deposits via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, contacting support via live chat or email, or updating account settings.
• Automated technical collection: Technical and gaming data collected automatically by sx999 platform systems during each session — including IP address, device fingerprint, login timestamps, game session logs, and bet records. This data collection is necessary for platform security and game integrity purposes.
• KYC service providers: Where sx999 employs third-party identity verification services to assist with CNIC verification and age confirmation, those providers may supply supplementary verification data to sx999. Players are informed when third-party verification services are engaged.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, and banking partners when deposit and withdrawal transactions are processed. This data is used solely for transaction reconciliation and AML monitoring purposes.

sx999 processes personal data only where a valid legal basis exists for doing so. The primary legal bases on which sx999 relies are as follows:

• Contractual necessity: Processing required to perform the contract between sx999 and the player — specifically, to operate the player's account, process deposits and withdrawals in PKR, make gaming services available, and administer bonuses. Without this processing, sx999 cannot deliver its services.
• Legal obligation: Processing required to comply with legal and regulatory obligations under sx999's international gaming license — including mandatory KYC verification, age verification (21+), AML transaction monitoring, and regulatory reporting. This processing is non-optional and cannot be refused without affecting account status.
• Legitimate interests: Processing performed in pursuit of sx999's legitimate business interests where those interests are not overridden by the rights and interests of players — including fraud prevention, platform security monitoring, abuse detection, responsible gaming pattern identification, and analytics to improve platform performance.
• Consent: Processing for marketing communications — email newsletters, promotional SMS, and in-platform promotional notifications — is performed only on the basis of the player's explicit opt-in consent, which may be withdrawn at any time through account settings without affecting account status or access to gaming services.

sx999 uses the personal data it collects for the following specific purposes:

• Account management: Creating and maintaining your sx999 account, processing login authentication, managing your PKR wallet balance, and communicating essential account information including security alerts and policy updates.
• Identity and age verification: Confirming that all players are aged 21 or above through CNIC-based verification, and confirming that players are who they claim to be for KYC compliance purposes.
• Payment processing: Processing deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank; processing withdrawal requests; reconciling transaction records; and investigating payment disputes.
• Gaming and betting services: Making available the full range of sx999 gaming products including cricket betting (PSL and international fixtures), live casino, slots, crash games, and virtual sports; recording game outcomes; calculating and crediting winnings.
• Responsible gaming: Monitoring gaming patterns to identify indicators of problematic play; making responsible gaming tools available; actioning self-exclusion, cooling-off, and deposit limit requests; complying with responsible gaming obligations under sx999's licensing conditions.
• Fraud prevention and security: Detecting and preventing fraudulent account activity, bonus abuse, money laundering, collusion, and unauthorized access; monitoring login patterns for anomalies; maintaining platform integrity.
• Regulatory compliance: Meeting reporting, record-keeping, and data retention obligations required by sx999's international gaming license and applicable AML regulations.
• Marketing (consent only): Sending promotional offers, bonus alerts, PSL betting promotions, new game announcements, and other marketing communications to players who have opted in. Frequency and content preferences are managed from account settings.
• Platform improvement: Analysing aggregated, anonymised player data to understand platform performance, identify technical issues, prioritise feature development, and improve the overall player experience at sx999.

7.1 What Cookies sx999 Uses. sx999 uses cookies and similar tracking technologies on its platform for the following purposes: (a) Essential cookies — required for the platform to function, including session authentication, security token management, and login state persistence; (b) Analytics cookies — used to understand how players navigate the sx999 platform, which games are accessed most frequently, and where technical friction points occur, using anonymised session data; (c) Preference cookies — used to remember player preferences such as language settings, display options, and responsible gaming reminder configurations.

7.2 Third-Party Cookies. Certain game providers and payment processing partners whose services are integrated into the sx999 platform may set their own cookies on your device in connection with service delivery. sx999 does not control the cookie practices of third-party partners and recommends reviewing each partner's privacy policy where relevant.

7.3 Cookie Management. Essential cookies cannot be disabled without affecting platform functionality. Analytics and preference cookies may be managed through your browser's cookie settings. On supported browsers, sx999 presents a cookie preference panel on first visit. Disabling non-essential cookies does not affect your ability to access your sx999 account or place bets.

8.1 No Sale of Personal Data. sx999 does not sell, rent, or otherwise commercially transfer player personal data to third parties for their own commercial use under any circumstances and without exception.

8.2 Sharing with Service Providers. sx999 shares personal data with the following categories of third-party service providers, strictly on a need-to-know basis and under data processing agreements that bind those providers to equivalent data protection standards:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — receive the transaction data necessary to process deposits and withdrawals. No gaming history or identity data beyond what is required for transaction processing is shared with payment partners.
• KYC verification providers: Third-party identity verification services receive CNIC images and player-supplied identity data for the purpose of verifying identity and age. These providers are contractually prohibited from using that data for any purpose other than verification delivery to sx999.
• Game software providers: Casino game and sports betting technology providers whose games are hosted on the sx999 platform may receive anonymised session identifiers and bet data necessary to operate their software within the sx999 environment. No directly identifying personal data is shared with game providers unless technically unavoidable and disclosed to the player.
• Customer support platforms: Live chat and email support platforms used by sx999 process communications data (chat transcripts, email content) in the course of support delivery. These platforms are contractually prohibited from using support communications for any purpose beyond sx999 service delivery.

8.3 Regulatory and Legal Disclosure. sx999 may disclose personal data to regulatory authorities, law enforcement agencies, gaming licensing bodies, financial intelligence units, or courts where required to do so by law, by the terms of sx999's gaming license, or by a valid legal order. sx999 will not disclose player data in response to informal requests without legal compulsion, except where doing so is necessary to protect the safety of a player or a third party.

9.1 As an internationally licensed gaming operator serving Pakistani players, sx999 processes some personal data on servers located outside Pakistan. Where personal data is transferred outside the country in which it was originally collected, sx999 implements appropriate safeguards to ensure that data protection standards equivalent to those described in this Policy are maintained in the destination jurisdiction.

9.2 Safeguards applied to international data transfers include: contractual clauses binding recipient entities to data protection standards consistent with those required by sx999's gaming license; transfer to jurisdictions with established data protection frameworks reviewed and approved by our compliance team; and technical measures including end-to-end encryption of data in transit between jurisdictions.

9.3 Players may request information about the specific safeguards applied to the international transfer of their personal data by contacting sx999 support via live chat or email. Such requests are responded to within 14 business days.

sx999 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Data that has reached the end of its applicable retention period is deleted securely or anonymised using industry-standard data destruction methods on a quarterly scheduled basis. Anonymised data may be retained indefinitely for aggregated statistical analysis without limitation, as it is no longer personal data.

11.1 sx999 applies a comprehensive information security framework to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Security measures in place include:

• 256-bit AES encryption of all personal data at rest across all sx999 production database systems
• 256-bit SSL/TLS encryption for all data transmitted between player devices and sx999 servers
• Bcrypt hashing of all account passwords — plain-text passwords are never stored on sx999 systems
• Multi-factor authentication required for all administrative access to systems holding personal data
• Role-based access controls limiting internal access to personal data to the minimum personnel necessary for each operational function
• Regular penetration testing and vulnerability scanning performed by external security specialists
• 24/7 security monitoring with automated alerts for anomalous access patterns
• Annual independent security audits covering all systems handling player personal data

11.2 Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights of players, sx999 will notify affected players via their registered email address within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of data records affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

Players whose personal data is held by sx999 hold the following rights in respect of that data. These rights may be exercised by contacting sx999 via live chat or email at any time. sx999 will respond to all rights requests within 30 calendar days of receipt.

13.1 sx999 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The platform is not directed at, and does not seek to engage, individuals below the minimum legal age for gaming participation on the sx999 platform.

13.2 Where sx999 discovers or is notified that personal data has been collected from an individual under the age of 21, all such data will be deleted immediately and any associated account permanently closed. If you are a parent or guardian and believe your child has registered on sx999, please contact support immediately so the matter can be addressed without delay.

13.3 sx999 employs CNIC-based age verification at the account level specifically to prevent underage access. This verification process serves as both an age gate and a personal data protection measure for minors.

14.1 sx999 sends marketing communications — including promotional bonus offers, cricket betting specials for PSL season, new game announcements, and VIP program updates — only to players who have provided explicit opt-in consent to receive such communications at registration or subsequently through account settings.

14.2 Marketing communications may be delivered by email to the registered account email address, by SMS to the registered Pakistani mobile number, or by in-platform notification within the sx999 account dashboard.

14.3 Withdrawing Marketing Consent. Consent to receive marketing communications may be withdrawn at any time through the Communication Preferences section of your sx999 account settings, or by replying STOP to any marketing SMS, or by clicking the unsubscribe link in any marketing email. Withdrawal of marketing consent takes effect within 48 hours. Withdrawal of marketing consent has no effect on your account status, your ability to access sx999 games, or any other aspect of your relationship with sx999.

14.4 Account-related communications — including security alerts, withdrawal confirmations, KYC requests, and policy update notices — are not marketing communications and are sent regardless of marketing consent status. These communications are necessary for account operation and cannot be opted out of while an account remains active.

The sx999 platform may from time to time contain references to third-party websites, services, or content. Where such references are present, sx999 has no control over the privacy practices of those third parties and accepts no responsibility for the privacy policies, data handling practices, or security standards of any third-party website or service. Players who follow links to third-party sites do so at their own risk and are advised to review the privacy policy of each third-party site they visit.

16.1 sx999 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, licensing conditions, or applicable law. The date of the most recent revision is displayed at the top of this document and in the platform notification system.

16.2 Where amendments to this Policy are material — meaning they introduce new categories of data collection, new third-party sharing arrangements, new processing purposes, or changes to player rights — sx999 will notify all registered players via their registered email address and via in-platform notification at least 14 calendar days before the amended Policy takes effect.

16.3 Continued use of the sx999 platform following the effective date of any Policy amendment constitutes acceptance of the updated Policy. If you do not accept an amendment, you should cease using the platform and contact support to arrange account closure and return of any withdrawable balance.

For any questions, concerns, or rights requests relating to this Privacy Policy or the processing of your personal data by sx999, please contact us through the following channels:

• Live Chat: Available 24/7 from within your sx999 account. Average response time for privacy-related queries is under 10 minutes. Live chat support is available in both English and Urdu.
• Email: [email protected] — Privacy requests submitted by email are acknowledged within 24 hours and responded to in full within 30 calendar days.

When submitting a data rights request, please include: (a) your registered sx999 email address; (b) a description of the specific right you wish to exercise or the nature of your privacy concern; and (c) where relevant, the approximate date range to which your request relates. Providing this information helps sx999 locate and process your request accurately within the 30-day response window.