YK999 Privacy Policy

This Privacy Policy ("Policy") is issued by YK999 ("we", "us", "our" or "the Platform") and applies to all personal data collected, processed and stored in connection with your use of the YK999 website at https://yk999.cam/ and any associated services, features and applications (collectively, "the Platform").

YK999 is an English-language online gaming information and entertainment platform targeting users in Pakistan. We are committed to protecting the privacy and security of all personal data entrusted to us. This Policy describes our data processing practices in a transparent, accessible manner so that you — as a user — can make informed decisions about your privacy.

This Policy should be read alongside the YK999 Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

The following terms, when used in this Policy, have the meanings set out below:

"Personal Data"

Any information relating to an identified or identifiable natural person — including name, email address, date of birth, IP address, device identifiers, account credentials, financial transaction records and behavioral data — that can be used directly or indirectly to identify that individual.

"Processing"

Any operation or set of operations performed on personal data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment, restriction or erasure.

"Data Controller"

The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, YK999 acts as Data Controller in respect of personal data collected through the Platform.

"Data Processor"

A third party that processes personal data on behalf of the Data Controller under a binding data processing agreement. Examples include payment processing providers, identity verification services and cloud hosting providers.

"Cookies"

Small text files placed on your device by a website to store information about your preferences, session state, browsing behaviour and related technical data. See Section 10 for full cookie details.

"KYC"

Know Your Customer — the regulatory process of verifying a user's identity and, where required, the source of funds, to meet anti-money laundering obligations.

"Consent"

A freely given, specific, informed and unambiguous indication of agreement to the processing of your personal data for a defined purpose, expressed by a clear affirmative action.

YK999 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

We do not intentionally collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs or biometric data) unless specifically required for regulatory compliance in circumstances we would disclose separately.

YK999 collects personal data through three primary channels:

• Direct Collection: Information you provide actively — such as during account registration, KYC document submission, deposit initiation, support contact, or completion of preference settings. This includes any details you voluntarily enter into forms on the Platform.
• Automated Collection: Technical and usage data collected automatically as you interact with the Platform, primarily through cookies, server logs, pixel tags and similar technologies. This data is collected even where you have not created an account, from the moment you first land on the site.
• Third-Party Sources: Identity and fraud-screening information received from KYC verification service providers, sanctions screening databases, payment processing platforms and, where applicable, responsible gambling self-exclusion registers. This data supplements information you have provided directly to ensure compliance with regulatory obligations.

YK999 processes personal data for the purposes listed below. Each processing activity is supported by a legitimate legal basis:

Where we rely on legitimate interests as the legal basis, we have conducted a balancing assessment to confirm that our interests do not override your privacy rights and freedoms. You may request further information about these assessments by contacting support.

YK999 does not sell personal data. We share personal data with third parties only in the following circumstances and categories:

• Service Providers (Data Processors): Third-party vendors who process data on our behalf under binding data processing agreements — including payment processing providers, cloud hosting and infrastructure services, identity verification and KYC platforms, customer support tooling, and fraud detection systems. These processors are contractually prohibited from using your data for their own purposes.
• Game Content Providers: Licensed game suppliers whose software powers casino games and sports betting markets on the Platform. These providers may receive technical session data necessary for game operation and fairness verification.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, regulatory direction or to investigate or prevent fraud, money laundering, or other criminal activity.
• Responsible Gambling Registers: Where required under the Platform's license obligations, self-exclusion data may be shared with relevant inter-operator exclusion schemes operated by licensing authorities.
• Business Transfers: In the event of a merger, acquisition, asset sale or restructuring involving YK999, your personal data may be transferred to the successor entity, subject to equivalent data protection commitments.

YK999 operates internationally. As a result, your personal data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where personal data is transferred internationally, YK999 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by the applicable regulatory authority;
• Transfers to jurisdictions recognised as providing adequate data protection by the relevant supervisory authority;
• Binding corporate rules where the recipient is part of the same corporate group;
• Other legally recognized transfer mechanisms in accordance with applicable data protection law.

You may request information about the specific safeguards applied to any international transfer of your data by contacting [email protected].

YK999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal retention obligations. The following general retention periods apply:

Where data is retained solely to comply with legal obligations, it will be stored securely with restricted access and will not be used for any other purpose. When data is no longer required, it is securely deleted or anonymised in accordance with our data destruction policy.

Subject to applicable law and certain limited exceptions, you have the following rights in respect of your personal data held by YK999. These rights are genuine and enforceable — we do not treat them as procedural formalities.

• Right of Access (Subject Access Request): You may request a copy of all personal data we hold about you, the purposes for which it is processed, the categories of data held and details of any third parties to whom it has been disclosed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. For basic account details, you may be able to update these directly via your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no legitimate legal or contractual basis for continued retention. Note that certain data must be retained to comply with AML, fraud prevention and regulatory obligations — erasure requests in respect of such data will be declined with an explanation.
• Right to Restriction of Processing: You may request that we restrict processing of your data in circumstances such as: while a data accuracy dispute is being resolved; where processing is unlawful but you prefer restriction to deletion; or where we no longer need the data but you require it for legal claims.
• Right to Data Portability: Where processing is carried out by automated means and based on contract or consent, you may request receipt of your personal data in a structured, commonly used, machine-readable format, and request that it be transmitted directly to another controller where technically feasible.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately. For other legitimate interest processing, we will assess whether our interests are overridden by your rights and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, submit your request to [email protected] with the subject line "Data Rights Request — [Type of Request]". We will acknowledge receipt within three (3) business days and respond in full within thirty (30) calendar days, extendable by a further two months in complex cases with prior notice.

Where we decline a request, we will explain the reason and inform you of your right to lodge a complaint with the relevant data protection supervisory authority.

YK999 uses cookies and similar tracking technologies — including pixel tags, web beacons and local storage — to operate the Platform, improve user experience, analyse usage patterns and support security controls. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable session management, authentication, security controls and load balancing. They cannot be disabled without disrupting core platform functionality.
• Functional Cookies: Store your preferences — such as language settings, display preferences and responsible gambling limits — to personalise your experience across sessions.
• Analytics Cookies: Collect anonymised or aggregated data about how users navigate the Platform, which pages are most visited and where users encounter friction. This helps us improve platform design and content. Where consent is required for analytics cookies, we obtain it prior to placement.
• Marketing and Retargeting Cookies: Used only where you have given explicit consent. These cookies enable personalised promotional content and track engagement with marketing campaigns. You may withdraw consent at any time via the cookie preference centre.

You can manage your cookie preferences at any time through your browser settings or via the Platform's cookie consent tool. Blocking strictly necessary cookies may impair Platform functionality. All other cookie categories can be disabled without loss of core access.

The YK999 Platform is strictly intended for adults aged 18 years and above — or the higher minimum age required by the applicable operator/license jurisdiction. We do not knowingly collect, process or retain personal data from persons under the age of 18.

If you are a parent or guardian and believe that a minor has provided personal data to YK999 — whether through account registration or any other means — please contact us immediately at [email protected]. Upon receiving credible notification, we will conduct an investigation and, where confirmed, will delete all data associated with the minor's use of the Platform and close any associated account without delay.

YK999 implements a comprehensive set of technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• Encryption: All data in transit between your device and YK999 servers is encrypted using TLS (Transport Layer Security). Sensitive data at rest — including financial records and identity documents — is encrypted using AES-256 or equivalent standards.
• Access Controls: Personal data is accessible only to staff and systems with a documented, role-based need. Administrative access to production systems requires multi-factor authentication.
• Security Monitoring: Continuous monitoring for anomalous access patterns, intrusion attempts and data exfiltration activity. Security incidents are investigated and remediated promptly in accordance with our incident response procedures.
• Penetration Testing: Regular third-party penetration tests and vulnerability assessments are conducted to identify and address security weaknesses proactively.
• Data Minimisation: We apply data minimisation principles — collecting only what is necessary — to reduce the volume of personal data at risk in the event of a security incident.

Despite these measures, no digital platform can guarantee absolute security. If you become aware of any security vulnerability affecting your account, please notify us immediately at [email protected].

YK999 is designed specifically for English-speaking Pakistani users. This section provides additional context relevant to users accessing the Platform from Pakistan.

Regulatory Context: Pakistan does not currently have a comprehensive standalone data protection law equivalent to GDPR. The Prevention of Electronic Crimes Act, 2016 (PECA) and the Personal Data Protection Bill (in legislative development as of the date of this Policy) are relevant domestic frameworks. YK999 endeavours to meet internationally recognised data protection standards regardless of whether they are strictly mandated under current Pakistani law.

Payment Data: When you use payment methods familiar to Pakistani users — such as Easypaisa, JazzCash, Raast or bank transfers through institutions such as HBL, UBL, Meezan Bank and Bank Alfalah — transaction metadata necessary for settlement and compliance screening may be shared with the relevant payment service providers. These providers have their own privacy policies governing their use of your data, and YK999 does not control those practices. References to these payment brands are for contextual familiarity only; they do not imply that these providers support, endorse or are affiliated with gambling operations on YK999.

Geolocation: YK999 uses country-level geolocation data derived from your IP address to apply jurisdiction-appropriate content and responsible gambling controls. This geolocation is approximate and does not constitute precise location tracking.

Language: This Platform and all associated privacy communications are maintained in English. Where you contact support in Urdu, we will endeavour to provide assistance — but the official, binding version of this Privacy Policy is the English-language text on this page.

YK999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance or Platform functionality. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

Where changes are material — such as changes to the categories of data we collect, the purposes for which we process it, or the rights available to you — we will provide advance notice to registered users by email or via a prominent Platform notification prior to the changes taking effect.

Continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree to the revised Policy, you should discontinue your use of the Platform and may request account closure in accordance with the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise your data rights, have a concern about how your personal data has been handled, or wish to make a formal privacy complaint, please contact the YK999 privacy team using the details below:

Email: [email protected]

Please use the subject line "Privacy Enquiry — [Nature of Query]" so your message can be routed to the appropriate team promptly. We aim to acknowledge all privacy-related enquiries within three (3) business days and to resolve substantive requests within thirty (30) calendar days, extendable with prior notice in complex cases.

For formal data rights requests — including Subject Access Requests or erasure requests — please include your registered email address, account username (if applicable) and a clear description of the right you wish to exercise. We may need to verify your identity before processing the request.