q999 Privacy Policy —
How We Protect Your Data

This Privacy Policy is published by q999 ("q999", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at q999.buzz. This Policy describes how q999 collects, uses, stores, shares, and protects personal data relating to registered players, visitors to q999.buzz, and individuals who interact with q999 through any supported channel.

This Privacy Policy applies to all personal data processing activities carried out by q999 in connection with the q999 platform, regardless of whether that processing occurs in Pakistan or in the jurisdiction of q999's international gaming licence. By registering an account on q999 or by continuing to use q999.buzz after this Policy has been published or updated, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy should be read alongside q999's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of a conflict between this Policy and any other document, this Privacy Policy governs data protection matters.

q999 collects the following categories of personal data in connection with your use of the platform:

q999 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data (except where voluntarily disclosed in a responsible gaming context), or biometric data beyond CNIC verification photography.

q999 collects personal data through the following methods:

3.1 Direct Collection

Data you actively provide to q999 during account registration, identity verification (KYC), payment processing, support interactions, and responsible gaming tool configuration. This is the primary method through which identity, contact, and financial data is collected.

3.2 Automated Collection

Technical and usage data is collected automatically when you access q999.buzz. This includes your IP address, device identifiers, browser information, session data, and behavioural data captured by q999's analytics systems. This collection occurs regardless of whether you are logged into your q999 account.

3.3 Third-Party Sources

q999 may receive data from third parties in limited circumstances, including:

• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) — transaction confirmation data only.
• Identity verification service providers — data confirming CNIC authenticity.
• Fraud prevention and AML screening service providers — risk signals and flag notifications.
• q999's licensing authority — communications and compliance data where applicable.

q999 processes personal data for the following defined purposes only. Data collected for one purpose will not be repurposed for unrelated activities without your knowledge.

q999 processes personal data on the following legal bases, consistent with internationally recognised data protection standards including GDPR-aligned principles adopted by q999's licensing framework:

• Contractual Necessity — Processing required to perform the contract between you and q999 (i.e., operating your account, processing deposits and withdrawals, providing access to games and betting markets).
• Legal Obligation — Processing required to comply with q999's obligations under its international gaming licence, including KYC verification, AML reporting, age verification, and responsible gaming obligations.
• Legitimate Interests — Processing carried out for q999's legitimate business interests, including fraud prevention, platform security, customer support operations, and product analytics, where these interests are not overridden by your privacy rights.
• Consent — Processing for promotional communications (marketing emails, bonus notifications) where you have given explicit, informed consent. You may withdraw this consent at any time by contacting support.

q999 does not sell personal data. Personal data may be shared with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual data protection obligations:

6.1 Payment Processors

When you make a PKR deposit or withdrawal via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, the minimum necessary financial and identity data is shared with the relevant payment processor to facilitate the transaction. These processors are independent data controllers for their own processing activities.

6.2 Identity Verification Providers

CNIC data submitted during KYC is processed by q999's authorised identity verification service provider for the sole purpose of confirming your identity. This provider operates under strict data processing agreements and may not use your CNIC data for any other purpose.

6.3 Licensing Authority

q999's licensing authority has the right to request and receive player data, transaction records, and compliance documentation as part of its regulatory oversight of q999. Disclosure to the licensing authority is a legal obligation and does not require your consent.

6.4 Law Enforcement & Legal Proceedings

q999 will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by a legally valid order, warrant, or court direction, or where q999 is legally obligated to report suspected criminal activity (including money laundering or fraud) under applicable law.

6.5 Service Providers

q999 engages third-party service providers to support platform operations — including cloud hosting, customer support software, fraud detection, and analytics. These providers process personal data solely on q999's instructions and under data processing agreements that prohibit independent use of your data.

q999 uses cookies and similar tracking technologies on q999.buzz. Cookies are small text files stored on your device when you visit a website. q999 uses the following categories of cookies:

• Strictly Necessary Cookies — Essential to the functioning of q999.buzz. These include session cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cannot be disabled without impairing platform functionality.
• Functional Cookies — Remember your preferences (e.g., language, display settings) to provide a personalised platform experience. These improve usability but are not strictly required.
• Analytics Cookies — Collect anonymised data about how users interact with q999.buzz — which pages are visited most, session durations, navigation flows — to help q999 identify and fix user experience issues. The data collected is aggregated and does not identify individual users.
• Security & Fraud Detection Cookies — Used by q999's fraud detection systems to identify unusual device behaviour, account anomalies, and potential security threats.

You can manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of q999.buzz, particularly features that require session management. q999 does not use third-party advertising or social media tracking cookies.

q999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data cannot be immediately deleted due to backup cycle constraints, it will be isolated from active processing until deletion is completed.

q999 implements a multi-layered information security framework to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Transport Layer Security (TLS/SSL) — All data in transit between your browser and q999's servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed continuously.
• Data Encryption at Rest — Sensitive data stored in q999's databases — including CNIC data and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls — Access to personal data within q999's infrastructure is restricted on a strict need-to-know basis, with role-based access controls and multi-factor authentication enforced for all staff with data access privileges.
• Intrusion Detection & Monitoring — q999's systems are monitored 24/7 for anomalous activity, intrusion attempts, and security events using automated detection tools and human security review.
• Penetration Testing — q999 conducts regular third-party penetration testing of its platform infrastructure and remediates identified vulnerabilities within defined SLAs.
• Staff Training — All q999 staff with access to personal data undergo data protection training and are bound by contractual confidentiality obligations.

q999 operates under an international gaming licence and its infrastructure, data processors, and licensing authority may be located outside Pakistan. As a result, personal data collected from Pakistani players may be transferred to and processed in countries outside Pakistan.

Where personal data is transferred internationally, q999 ensures that appropriate safeguards are in place, including:

• Contractual clauses in data processing agreements with third-party processors that require equivalent data protection standards to those applied by q999.
• Transfer only to countries or processors that meet recognised international data protection adequacy standards.
• Restriction of transferred data to the minimum necessary for the processing purpose.

By registering an account on q999, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards outlined above.

As a q999 player, you hold the following rights regarding your personal data. These rights are exercisable by contacting q999 via live chat or email at [email protected]:

Key Limitations

The right to erasure does not apply to data that q999 is legally obligated to retain under its licensing or AML obligations (e.g., KYC records and transaction logs). q999 will inform you of any applicable limitation when responding to your data rights request.

Requests will be responded to within 30 days of receipt. If your request is complex or if q999 receives multiple requests from you, we may extend this period by a further 60 days, in which case we will notify you and explain the reason for the extension.

q999 does not knowingly collect personal data from individuals under the age of 21. The q999 platform is intended solely for use by adults aged 21 and above. Registration on q999 requires confirmation that you meet this age requirement.

If q999 becomes aware that personal data has been collected from an individual under 21, the account will be immediately suspended, all collected data will be deleted, and any funds will be forfeited pending parental or guardian review in accordance with q999's licensing obligations.

The q999 platform may contain links to third-party websites (such as payment processor sites or responsible gaming support organisations). q999 is not responsible for the privacy practices or content of these third-party sites. When you leave q999.buzz and visit a third-party site, you are subject to that site's own privacy policy.

q999 recommends reviewing the privacy policies of any third-party sites you visit. This Privacy Policy applies solely to personal data collected by q999 on q999.buzz and through q999's direct channels.

q999 reserves the right to amend or update this Privacy Policy at any time to reflect changes in data processing practices, legal obligations, or platform features. Material changes to this Policy will be communicated to registered players via email to the address on file and/or via a prominent notice on q999.buzz.

The "Last Updated" date at the top of this document reflects the most recent revision. Your continued use of q999 following publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree with an updated Policy, you must cease using the platform and may request account closure.

If you have questions, concerns, or complaints regarding this Privacy Policy or q999's data processing practices, or if you wish to exercise any of your privacy rights, please contact q999 using the following methods:

• Live Chat: Available 24/7 via the chat widget in your account dashboard.
• Email: [email protected] (plain text — not a clickable link). Mark your email subject line "Privacy Rights Request" or "Data Protection Query" for priority routing.

q999 commits to investigating and responding to all data protection queries and rights requests within 30 days of receipt. If you are not satisfied with q999's response to a data protection complaint, you may have the right to lodge a complaint with q999's licensing authority or the relevant data protection authority in your jurisdiction.