cf999 Casino — Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected and processed by cf999 in connection with your registration, use of, and interaction with the cf999 platform — including the website, mobile interface, live chat support, and any other cf999 digital touchpoint (collectively, "the Platform").

By registering a cf999 account or by continuing to use the Platform after this Policy has been updated, you confirm that you have read and understood how cf999 handles your personal data. If you do not agree with this Policy, you should not use the cf999 Platform and may close your account in accordance with the Terms & Conditions.

This Policy should be read together with the cf999 Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions on data-related matters, this Privacy Policy prevails.

For the purposes of data protection law, the data controller responsible for your personal information is cf999, the operator of the Platform at cf999.bid. As the data controller, cf999 determines the purposes for which your personal data is collected and the means by which it is processed.

cf999 operates under an international gaming licence and is subject to the data protection and anti-money laundering requirements associated with that regulatory framework. Our compliance obligations include maintaining accurate player records, conducting identity verification, and retaining certain transaction data for defined legal periods.

cf999 collects the following categories of personal data from users of the Platform:

cf999 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — except insofar as your CNIC document may incidentally contain some of this information, in which case it is used exclusively for age and identity verification and is not further processed.

cf999 collects personal data through the following methods:

• Direct collection: Data you provide when registering your account, completing KYC, making deposits or withdrawals, contacting support, or updating your account settings;
• Automated collection: Technical and behavioural data collected automatically through server logs, session tracking, and platform analytics tools when you use the cf999 Platform;
• Cookie-based collection: Data collected via cookies and similar technologies as described in Section 8 of this Policy;
• Third-party collection: Data received from payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan, SadaPay, Raast) to confirm transaction status, and from identity verification service providers during KYC processing;
• Publicly available sources: In limited circumstances, data from publicly available sources may be cross-referenced to support fraud prevention or AML compliance checks.

cf999 uses your personal data for the following specific purposes:

cf999 processes your personal data only where a valid legal basis exists. The applicable legal bases are as follows:

• Contractual necessity: Processing required to perform the contract represented by your cf999 account — including account creation, game access, payment processing, and withdrawal — is carried out on the basis that it is necessary to fulfil our obligations to you under the Terms & Conditions;
• Legal obligation: Processing required to comply with applicable legal requirements, including AML laws, regulatory reporting obligations, and age verification requirements, is carried out on the basis of legal obligation;
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement is carried out on the basis of cf999's legitimate interests in operating a safe and fair gaming platform, provided those interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications is carried out only on the basis of your freely given, informed, and unambiguous consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

cf999 does not sell your personal data. We share your personal data only with the following categories of third parties, and only to the extent strictly necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, Raast, and USDT wallet providers — to process your deposit and withdrawal transactions. These providers receive only the financial transaction data required to complete the operation;
• KYC and identity verification providers: Third-party identity verification services that assist in verifying your CNIC and age for regulatory compliance. These providers act as data processors under contract with cf999 and may not use your data for their own purposes;
• Game software providers: Game providers whose titles appear on the cf999 Platform receive anonymised session and bet data necessary to operate their games and resolve disputes. They do not receive your personal identity or payment data;
• Platform technology providers: Cloud hosting, cybersecurity, and platform infrastructure providers that support the operation of cf999. These are engaged under data processing agreements with appropriate security obligations;
• Regulatory and law enforcement authorities: Where cf999 is required by law, court order, or regulatory obligation to disclose personal data — including for AML reporting. cf999 will notify you of any such disclosure where legally permitted to do so;
• Fraud prevention agencies: Where necessary to prevent or detect fraud, collusion, or other prohibited conduct as defined in the Terms & Conditions.

cf999 uses cookies and similar tracking technologies to operate certain Platform features, remember your preferences, maintain your login session, and gather aggregated analytics data about how the Platform is used. The following categories of cookies may be active on your device when you visit cf999:

• Strictly necessary cookies: Essential for the Platform to function. These include session management cookies that keep you logged in to your cf999 account during a session. These cannot be disabled without disrupting core platform functionality;
• Functional cookies: Remember your language preferences, display settings, and recently played game selections. These improve your experience but are not essential to platform operation;
• Analytics cookies: Collect anonymised information about how users interact with cf999 — pages visited, time spent, navigation paths — to help us improve the platform for Pakistani players. This data is aggregated and does not identify individuals;
• Security cookies: Support fraud detection and platform security functions, including identifying unusual login patterns and verifying session authenticity.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the cf999 Platform, particularly features that require session continuity. Most Pakistani mobile browsers support cookie management through their settings menus.

cf999 retains your personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, cf999 will securely delete or anonymise your personal data in a manner that prevents its reconstruction. Where anonymisation is not possible (for example, due to backup system architecture), data will be isolated from active processing until secure deletion is completed.

cf999 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and cf999 servers is protected by 256-bit TLS/SSL encryption;
• Encryption at rest: Sensitive personal and financial data stored in cf999 databases is encrypted at rest using AES-256;
• Password security: User passwords are never stored in plain text — they are stored as salted cryptographic hashes using industry-standard algorithms;
• Access controls: Access to personal data is restricted to authorised cf999 personnel on a strict need-to-know basis. All internal data access is logged and audited;
• Infrastructure security: cf999 servers are hosted in secure, certified data centres with physical access controls, intrusion detection systems, and regular penetration testing;
• Two-Factor Authentication: cf999 offers 2FA for all player accounts and strongly encourages its activation to add a second layer of protection to your login;
• Security monitoring: Automated security monitoring systems run 24/7 to detect and respond to anomalous access patterns, potential breaches, and fraud indicators.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, cf999 will notify affected users without undue delay through the contact information on file for your account.

As a cf999 user, you hold the following rights in relation to your personal data. These rights may be subject to exceptions required by applicable law (for example, cf999 may be legally required to retain certain records regardless of a deletion request):

cf999 is strictly intended for users aged 21 years and above. cf999 does not knowingly collect personal data from individuals under the age of 21. Age verification via CNIC is required before any withdrawal is processed, and serves as the primary control against underage account use.

If cf999 becomes aware that personal data has been collected from an individual under the age of 21 — whether through account review, complaint, or any other means — the following actions will be taken immediately:

• The account will be suspended pending investigation;
• All personal data associated with the underage user will be securely deleted to the extent legally permissible;
• Any balance or winnings in the account will be handled in accordance with legal requirements;
• The matter will be reported to the relevant regulatory authority as required.

As an international gaming platform serving Pakistani players, certain aspects of cf999's technical infrastructure — including server hosting, game provision, and KYC verification — involve the transfer of personal data to third parties operating outside Pakistan. Where such transfers occur, cf999 ensures that:

• Transfers are made only to recipients in jurisdictions that provide an adequate level of data protection, or under contractual arrangements that impose equivalent data protection obligations on the recipient;
• All third-party data processors receive only the minimum personal data necessary for their specific function;
• Data processing agreements are in place with all third-party processors, incorporating appropriate security, confidentiality, and deletion obligations;
• No transfer of Pakistani player data occurs to recipients whose data handling practices have not been reviewed and approved by cf999's compliance team.

cf999 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, legal obligations, and the services we offer. When material changes are made to this Policy, cf999 will:

• Update the "Last Updated" date at the top of this page;
• Notify registered users via SMS to their registered Pakistani mobile number, or via a prominent notice on the Platform, not less than 7 days before the revised Policy takes effect — except where immediate changes are required for legal or security reasons;
• Maintain access to the previous version of this Policy upon request through cf999 support.

Your continued use of cf999 following the effective date of any revised Policy constitutes your acceptance of those revisions. If you do not agree with any material change, you may close your account in accordance with the Terms & Conditions.

For any questions, concerns, or formal complaints regarding this Privacy Policy or cf999's handling of your personal data, please contact our support team. We commit to acknowledging all privacy-related enquiries within 5 business days and resolving complaints within 30 calendar days wherever possible.

If you are not satisfied with cf999's response to a privacy complaint, you have the right to escalate your complaint to the relevant regulatory authority under whose oversight cf999 operates. Details of the applicable regulatory authority are available on request from cf999 support.