Privacy Policy for 99coco — Your Data, Protected

This Privacy Policy ("Policy") is published by 99coco ("we", "us", "our", "the Platform"), the operator of the online casino and sports betting website located at https://99coco.net. It describes how 99coco collects, processes, stores, shares, and protects the personal data of individuals who visit the website, create a player account, or otherwise interact with our Services.

By accessing the 99coco platform, creating an account, or using any of the Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please do not use the 99coco platform.

This Policy should be read together with 99coco's Terms and Conditions, available at /terms-conditions, and our Responsible Gaming Policy, available at /responsible-gaming. In the event of a conflict between this Policy and the Terms and Conditions, the Terms and Conditions shall prevail with respect to matters of account conduct, and this Policy shall prevail with respect to data processing matters.

99coco collects personal data in the following categories, depending on how you interact with the platform:

99coco does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request, in which case such data is handled with heightened confidentiality.

99coco collects personal data through the following methods:

• Direct Submission: Information you provide when creating an account, completing KYC verification, making deposits, submitting support requests, or corresponding with our team.
• Automated Technologies: Data collected automatically as you browse and use the platform, including via cookies, server logs, and analytics tools. This includes IP addresses, device identifiers, and session activity data.
• Third-Party Verification Providers: Identity verification data received from KYC and AML screening providers in connection with our regulatory obligations.
• Payment Processors: Transaction confirmation data received from payment gateway providers including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank integrations.
• Game Providers: Gameplay data transmitted by our licensed game software providers, including bet history, round results, and session information.

99coco uses the personal data we collect for the following purposes:

• Account Creation and Management: To register your account, verify your identity, and maintain your player profile throughout the duration of our relationship.
• Provision of Services: To enable you to access casino games, place sports bets on cricket and other markets, deposit and withdraw funds in PKR, and use all platform features.
• KYC and Regulatory Compliance: To comply with our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and responsible gaming regulations, including the mandatory verification of age (21+) and identity.
• Payment Processing: To process your deposits and withdrawal requests, match transactions to your account, and prevent unauthorised financial activity.
• Security and Fraud Prevention: To monitor account activity for signs of fraudulent behaviour, unauthorised access, bot usage, collusion, and other prohibited conduct as defined in our Terms and Conditions.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance purposes.
• Responsible Gaming: To monitor gameplay patterns for signs of problem gambling behaviour, implement deposit limits and self-exclusion requests, and ensure compliance with our responsible gaming obligations.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have opted in to receive such communications. You may withdraw consent at any time.
• Platform Improvement: To analyse aggregate usage data and improve the functionality, performance, and user experience of the 99coco platform.

99coco processes your personal data on the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing required to perform the contract between you and 99coco — including account registration, game access, and payment processing — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal Obligation: Processing required to comply with AML legislation, KYC requirements, age verification regulations, and other applicable legal obligations is carried out on the basis of legal compliance.
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement is carried out on the basis of 99coco's legitimate business interests, where those interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

99coco does not sell your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC and Identity Verification Providers: Third-party providers who assist us in verifying your identity and CNIC details as part of our regulatory obligations.
• Payment Processors: JazzCash, EasyPaisa, partner banks (HBL, UBL, Meezan Bank), card networks, and cryptocurrency gateway operators, to the extent necessary to process your deposits and withdrawals.
• Game Software Providers: Licensed game content providers whose software is integrated into the 99coco platform, who may receive limited gameplay and session data for technical and integrity purposes.
• Regulatory and Law Enforcement Authorities: Where required by law, court order, or lawful request from a competent authority — including financial intelligence units and gaming regulators — 99coco will disclose your data without prior notice to you.
• IT and Security Service Providers: Cloud hosting providers, cybersecurity vendors, and platform infrastructure partners who process data on our behalf under strict data processing agreements.
• Professional Advisers: Legal counsel, auditors, and accountants who require access to data in the performance of their professional services to 99coco, subject to confidentiality obligations.

All third parties with whom 99coco shares personal data are contractually required to handle that data in accordance with applicable data protection law and to use it solely for the specified purpose for which it was shared.

99coco uses cookies and similar tracking technologies on the platform. Cookies are small text files stored on your device that help us deliver a functional, secure, and personalised experience. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing your ability to use the platform.
• Performance and Analytics Cookies: Used to collect anonymised data about how visitors navigate the platform, which pages are most visited, and where technical errors occur. This data helps us improve the platform experience.
• Functional Cookies: Used to remember your preferences such as language settings, preferred payment method, and display configurations.
• Marketing Cookies: Used to track whether you arrived at 99coco via a promotional link. These are only deployed with your consent and do not track your activity on external websites.

99coco does not deploy third-party advertising networks or behavioural tracking cookies that follow you across unrelated websites.

99coco retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as required by applicable law, or as needed to defend against potential legal claims. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account's active status plus five (5) years following account closure, in compliance with AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years in accordance with applicable financial record-keeping regulations.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing Data: Retained until you withdraw your consent to receive marketing communications, at which point your data will be suppressed from marketing lists within 30 days.
• Technical and Log Data: Retained for up to twelve (12) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with you as an identifiable individual.

As a user of 99coco, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at support@99coco.net with a clear description of your request. We will respond within thirty (30) days of receipt.

• Right of Access: You have the right to request a copy of all personal data that 99coco holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data be corrected or updated. You may update basic account information directly through your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent on which processing was based. Note that we may be unable to delete data that we are legally required to retain under AML or gaming regulations.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is contested or while an objection is being considered.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another data controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time, and to processing carried out on the basis of legitimate interests where you believe your rights and freedoms override those interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place prior to withdrawal.

The 99coco platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. If you are under 21, you must not use 99coco's Services, create an account, or submit any personal data to the platform.

If 99coco discovers or is notified that personal data has been collected from a user who is under 21 years of age, we will immediately suspend the relevant account, delete the personal data in question, return any deposited funds in accordance with our Terms and Conditions, and void any winnings accrued on the account.

99coco implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or app and our servers is encrypted in transit using the latest TLS protocol.
• AES-256 Encryption at Rest: Sensitive data stored in our databases — including CNIC details, financial account numbers, and password hashes — is encrypted using AES-256 standard.
• Two-Factor Authentication (2FA): Available to all registered players and enforced for all internal administrative accounts. We strongly encourage all Pakistani players to enable 2FA via the account settings page.
• Access Controls: Personal data is accessible only to 99coco staff who require it to perform their job functions. Access is role-based, logged, and regularly audited.
• Vulnerability Assessments: Our platform undergoes regular security audits, penetration testing, and vulnerability scanning by qualified cybersecurity professionals.
• Incident Response: In the event of a data breach that is likely to result in risk to your rights and freedoms, 99coco will notify affected users and relevant authorities within the timeframes required by applicable law.

While 99coco takes every reasonable precaution to protect your data, no internet-based platform can guarantee absolute security. You are encouraged to use a strong, unique password for your 99coco account, enable 2FA, and avoid accessing the platform on public or shared Wi-Fi networks without a VPN.

99coco operates internationally and may transfer your personal data to servers or service providers located outside Pakistan. Where such transfers occur, 99coco takes appropriate steps to ensure that your data receives a level of protection consistent with this Policy and applicable data protection standards.

Safeguards for international transfers may include:

• Contractual clauses requiring the recipient to protect your data to standards equivalent to those applied by 99coco
• Transfers to jurisdictions that provide an adequate level of data protection as recognised by applicable international standards
• Data processing agreements with cloud and infrastructure providers that include binding data protection obligations

By using the 99coco platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Pakistan as described in this section, subject to the safeguards outlined above.

99coco reserves the right to update or modify this Privacy Policy at any time. Material changes — such as changes to the categories of data collected, new sharing arrangements with third parties, or changes to your rights — will be communicated to you by email to your registered address at least seven (7) days before the changes take effect.

Minor updates, such as clarifications of existing practices or corrections of typographical errors, may be made without prior notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how 99coco protects your data.

Continued use of the 99coco platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the platform and may request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 99coco handles your personal data, please contact our Data Protection team through the following channel:

Email: support@99coco.net

Please include your registered username and a clear description of your query in all correspondence. Our team will acknowledge receipt of your privacy-related request within 48 hours and aim to provide a substantive response within 30 calendar days.

Complaints: If you are not satisfied with how 99coco has handled your personal data or responded to a data subject rights request, you have the right to lodge a complaint with the relevant supervisory or data protection authority in your jurisdiction. Contact our support team for guidance on identifying the appropriate authority applicable to your situation.