Privacy Policy

1Introduction

CR999 ("CR999", "Platform", "we", "us", "our") operates the website located at https://cr999.cam and all associated services. This Privacy Policy ("Policy") describes how CR999 collects, uses, stores, shares and protects personal data obtained from users ("you", "your") who access or use the Platform.

CR999 is an English-language online gaming information and entertainment platform targeting adult users in Pakistan and internationally. We understand that the privacy of our users — particularly those accessing the Platform from Pakistan, including major cities such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — is a matter of significant importance.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall legal relationship between you and CR999. By registering with or using the Platform, you confirm that you have read and understood this Policy and consent to the data practices described herein.

2Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — Any information that identifies or can identify a natural person, directly or indirectly, including name, email address, IP address, device identifier and financial account details.
• "Processing" — Any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, transmission, restriction, erasure or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, CR999 and its associated Operator act as joint data controllers in respect of user account data.
• "Data Processor" — A third party that processes personal data on behalf of the Data Controller under a data processing agreement.
• "Consent" — A freely given, specific, informed and unambiguous indication of the data subject's wishes by which they agree to the processing of their personal data.
• "KYC" — Know Your Customer: identity and address verification procedures required by the Operator for account maintenance and financial transactions.
• "Cookie" — A small data file placed on your device by the Platform for the purpose of session management, security, analytics or personalisation.
• "Third Party" — Any natural or legal person other than you, CR999 or the Operator.

3Data We Collect

CR999 collects personal data through various interactions with the Platform. The categories of data collected are described below.

3.1 Registration Data

When you create an account, we collect: full legal name, date of birth, email address, residential address (including city and country), username, and account password (stored in encrypted form).

3.2 Identity Verification (KYC) Data

To satisfy KYC and AML obligations, we may collect copies of government-issued identity documents (national identity card, passport), proof of residential address (utility bill, bank statement) and, where required, source-of-funds documentation.

3.3 Financial & Transaction Data

We collect records of deposits, withdrawals and betting/gaming activity associated with your account. Payment method identifiers — such as mobile wallet account references for Easypaisa or JazzCash, Raast identifiers, or bank account details for HBL, UBL, Meezan Bank or Bank Alfalah transfers — may be recorded for transaction processing and AML compliance purposes.

3.4 Technical & Usage Data

We automatically collect technical data when you access the Platform, including: IP address, device type and operating system, browser type and version, pages visited, session duration, referring URLs, and error logs. This data is used for security monitoring, fraud detection and platform performance optimisation.

3.5 Communication Data

When you contact CR999 support by email or live chat, we retain records of those communications, including the content of messages, timestamps and the resolutions applied. This data is used for quality assurance, training and dispute resolution.

3.6 Voluntary Data

You may voluntarily provide additional information, for example when completing responsible gambling self-assessment questionnaires or when responding to optional surveys. Voluntary data is collected only with your explicit consent and you are under no obligation to provide it.

4Lawful Basis for Processing

CR999 processes personal data only where a lawful basis for doing so exists. The applicable bases are set out in the table below:

5How We Process Your Data

Personal data collected by CR999 is processed for the following specific purposes:

5.1 Account Administration

We use registration and identity data to create and maintain your account, authenticate your identity at login, enforce the single-account policy, and apply responsible gambling controls associated with your account profile.

5.2 KYC & AML Compliance

Identity and financial data is processed to comply with the Operator's Know Your Customer and Anti-Money Laundering obligations under its licensing jurisdiction. This processing is mandatory — failure to provide satisfactory KYC data may result in restricted account functionality or account closure.

5.3 Transaction Processing

Financial data is processed to execute deposits, withdrawals and internal account transfers. Payment method identifiers are used for transaction verification, fraud prevention and withdrawal routing. Currency conversion to Pakistani Rupees (PKR) where applicable is handled by the relevant payment processor.

5.4 Security & Fraud Prevention

Technical and behavioural data is analysed to detect and prevent fraudulent activity, account takeovers, bonus abuse, money laundering, multi-accounting and other prohibited conduct. This processing is a legitimate interest of CR999 and its user community.

5.5 Customer Support

Communication data is used to respond to your support inquiries, process complaints, and maintain records for dispute resolution. Support interactions may be reviewed for quality assurance and staff training purposes.

5.6 Platform Improvement

Aggregated and anonymised usage data is processed to understand how users interact with the Platform, identify areas for improvement, and optimise the performance of the mobile and desktop interfaces.

5.7 Marketing (Opt-In Only)

Where you have provided explicit consent, we may use your email address or account contact details to send promotional communications about CR999 bonuses, seasonal offers (including those tied to PSL or ICC cricket schedules) and platform updates. You may withdraw marketing consent at any time through your account settings or by contacting support.

6Data Sharing & Third Parties

CR999 does not sell your personal data to third parties. We share personal data only in the circumstances described below, and only to the extent strictly necessary.

6.1 The Operator

CR999 shares account, KYC and transaction data with the licensed gaming Operator whose products are accessible via the Platform. The Operator processes this data as a joint data controller for purposes including account management, KYC compliance, withdrawal processing and responsible gambling interventions.

6.2 Payment Processors

Financial transaction data is shared with payment service providers to facilitate deposit and withdrawal processing. These providers operate under data processing agreements and process your data solely for the purpose of executing the requested transaction. References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah as payment channels are navigational; actual data sharing with any specific provider occurs only during live transaction processing.

6.3 Identity Verification Providers

Where CR999 uses third-party KYC and identity verification services, document and identity data may be shared with such providers under binding data processing agreements. These providers are selected on the basis of data security standards and applicable regulatory approvals.

6.4 Fraud Prevention & Analytics

Technical and behavioural data may be shared with fraud prevention and analytics service providers for the purpose of detecting prohibited conduct and improving platform security. Providers in this category process data as data processors under CR999's instructions.

6.5 Legal Authorities

CR999 will disclose personal data to regulatory authorities, law enforcement agencies or courts where required to do so by applicable law, a valid court order, or a legitimate regulatory request. We will notify you of such disclosure where legally permitted to do so.

7Cookies & Tracking Technologies

CR999 uses cookies and similar tracking technologies to operate the Platform effectively. The categories of cookies we use are described below.

You can manage your cookie preferences by adjusting your browser settings to block or delete cookies. Please note that disabling strictly necessary or functional cookies may impair your ability to use the Platform. Withdrawing consent for analytics or marketing cookies does not affect previously collected data.

8Data Retention

CR999 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The general retention principles are as follows:

• Active Account Data — Retained for the duration of your account relationship with CR999 plus any legally mandated post-closure retention period.
• KYC Documentation — Retained for a minimum period of five (5) years following account closure, or longer where required by the Operator's licensing jurisdiction and AML regulations.
• Transaction Records — Financial transaction records are retained for a minimum of five (5) years for AML compliance and audit purposes.
• Support Communications — Retained for a minimum of two (2) years for quality assurance and dispute resolution purposes.
• Technical Logs — Server and security logs are retained for up to twelve (12) months unless a longer period is required for active fraud or security investigations.
• Marketing Consent Records — Records of marketing consents are retained for the duration of your account and for a reasonable period following consent withdrawal, to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the individual.

9International Data Transfers

CR999 operates internationally and your personal data may be transferred to, stored in and processed in countries outside Pakistan. The data protection laws of those countries may differ from those applicable in Pakistan.

Where personal data is transferred internationally, CR999 implements appropriate safeguards to protect your data, including reliance on adequacy decisions, standard contractual clauses or binding corporate rules as applicable under the governing data protection framework of the Operator's licensing jurisdiction.

10Your Data Rights

Subject to applicable law and the Operator's regulatory obligations, you have the following rights in respect of your personal data held by CR999. To exercise any of these rights, contact our support team using the details in Section 15.

CR999 will respond to data rights requests within thirty (30) calendar days. Complex requests may require an extension of up to a further sixty (60) days, in which case you will be notified. Requests are handled free of charge unless manifestly unfounded or excessive.

11Minors & Under-Age Protection

CR999 is strictly intended for adults aged 18 years and over — or the higher minimum age required by the Operator's licensing jurisdiction. We do not knowingly collect, store or process personal data relating to individuals under the age of 18.

If CR999 becomes aware that personal data has been collected from a minor without appropriate parental or guardian consent, that data will be deleted promptly and the associated account closed. If you believe that CR999 has inadvertently collected data from a minor, please contact us immediately at [email protected].

Parents and guardians are encouraged to install parental control and content-filtering software on shared devices to prevent minors from accessing gambling-related content.

12Security Measures

CR999 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration or destruction. These measures include:

• HTTPS/TLS encryption for all data transmitted between your device and the Platform
• Industry-standard password hashing for account credential storage
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Regular security assessments and vulnerability testing of Platform infrastructure
• Intrusion detection and anomaly-monitoring systems
• Data processing agreements with all third-party processors containing security requirements
• Incident response procedures for managing data breaches

While CR999 applies robust security measures, no system is completely impenetrable. You are also responsible for maintaining the security of your account credentials and for using strong, unique passwords. If you suspect your account has been compromised, contact support immediately.

13Third-Party Links & External Services

The CR999 Platform may contain references to or integrations with third-party services, including payment processors, identity verification providers and game studios. These third parties operate their own independent privacy policies and data practices, for which CR999 is not responsible.

CR999 does not publish external links to third-party websites within its informational content. However, the act of initiating a transaction using a payment method (such as Easypaisa, JazzCash, Raast or bank transfer services) will involve interaction with those third-party providers' own systems. Users should review the privacy policies of any payment provider they choose to use.

14Amendments to This Policy

CR999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices or Platform functionality. Material changes will be communicated to registered users via the email address associated with their account or by prominent notice on the Platform prior to the changes taking effect.

Your continued use of the Platform following notification of any amendments constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you should cease using the Platform and contact support to close your account.

The current version of this Policy is always accessible at https://cr999.cam/privacy-policy. The "Last reviewed" date at the top of this page indicates the date of the most recent revision.

15Contact Us

If you have questions, concerns or complaints about this Privacy Policy, wish to exercise any of your data rights, or need to report a data protection issue, please contact CR999 using the following details:

CR999 will acknowledge privacy-related inquiries within five (5) business days and provide a substantive response within thirty (30) calendar days. Complex requests may take longer — you will be informed of any extension within the initial thirty-day period.