Privacy Policy — How st999 Collects, Uses and Protects Your Data

1.1 This Privacy Policy applies to all personal data processed by st999 in connection with your use of the st999 platform, including the sportsbook, casino games, instant games, VIP rewards program, and any customer support or account management services provided by st999.

1.2 This Policy applies to players who access st999 from Pakistan, including those in Karachi, Lahore, Islamabad, Faisalabad and all other Pakistani cities and regions. It also applies to players accessing the platform from any other jurisdiction where st999 makes its services available.

1.3 This Policy should be read in conjunction with the st999 Terms and Conditions, which together govern your use of the st999 platform. Defined terms used in this Policy carry the same meaning as in the Terms and Conditions unless the context requires otherwise.

1.4 st999 acts as the data controller in respect of personal data collected directly from players through the platform. Where st999 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification services and game providers — those parties act as data processors under written agreements with st999 that impose binding data protection obligations consistent with this Policy.

2.1 st999 collects the following categories of personal data from players in the course of operating the platform:

2.2 st999 does not knowingly collect sensitive personal data beyond what is strictly necessary for identity verification, age verification, anti-money laundering compliance and responsible gaming obligations. Where the collection of additional sensitive data is required by applicable regulatory requirements, st999 will notify you at the point of collection and obtain appropriate consent where required.

3.1 st999 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when registering your st999 account, completing KYC verification, making deposits or withdrawal requests, updating your account profile, or contacting st999 support.
• Automated collection: Technical and usage data collected automatically through cookies, log files, and similar tracking technologies when you access and interact with the st999 platform.
• Third-party sources: Identity and fraud screening data from third-party KYC verification providers, credit reference agencies and anti-money laundering screening services engaged by st999 to fulfil its regulatory obligations. st999 verifies the legitimacy and accuracy of data from third-party sources before acting on it.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank and other authorised payment channels when you make deposits or receive withdrawals on st999.
• Gaming platform logs: Data generated automatically by the st999 gaming engine when you place bets, play casino games, or interact with the sportsbook, instant games or VIP program features.

4.1 st999 processes personal data for the following defined purposes:

• Account management: To create, maintain and administer your st999 account, including processing st999 login authentication, managing your PKR balance, and maintaining your VIP tier status and transaction history.
• Identity and age verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity as required under st999's international gaming license obligations. Age verification is a mandatory regulatory requirement and cannot be waived.
• Payment processing: To process PKR deposits via JazzCash, EasyPaisa, HBL, UBL and Meezan Bank, to process withdrawal requests, and to maintain accurate financial records for your st999 account.
• Anti-money laundering and fraud prevention: To screen transactions and account activity for indicators of money laundering, payment fraud, account takeover, and other financial crimes. This processing is mandatory under st999's international gaming license and applicable anti-money laundering frameworks.
• Responsible gaming compliance: To monitor gaming behaviour for indicators of problem gambling, to administer deposit limits and self-exclusion tools, and to flag accounts that may require additional responsible gaming interventions under the platform's license obligations.
• Customer support: To respond to and resolve queries, complaints, account recovery requests and technical issues raised by Pakistani players and other st999 account holders.
• Platform improvement: To analyse usage patterns, game performance, navigation flows and technical metrics in aggregate or pseudonymised form to improve the st999 platform experience for players in Pakistan and other markets.
• Direct marketing: To send promotional communications, bonus offers and VIP program updates to your registered email address or mobile number, where you have consented to receive such communications from st999. You may withdraw this consent at any time through your account settings or by contacting st999 support.
• Legal and regulatory compliance: To retain records, respond to regulatory inquiries, and fulfil other legal obligations applicable to st999 under its international gaming license and any other applicable legal frameworks.

5.1 st999 relies on the following legal bases to process your personal data, depending on the specific processing activity concerned:

• Performance of a contract: Processing necessary to fulfil the contractual relationship established when you register and use your st999 account, including account management, payment processing and gaming service delivery.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC verification, age verification, anti-money laundering screening and responsible gaming compliance under st999's gaming license conditions.
• Legitimate interests: Processing carried out for st999's legitimate business interests where those interests are not overridden by your fundamental rights and interests, including fraud prevention, platform security, and platform performance analytics.
• Consent: Processing of personal data for direct marketing communications, where your prior consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6.1 st999 does not sell, rent or trade your personal data to third parties for their own marketing or commercial purposes.

6.2 st999 may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank and other authorised payment processors, to the extent necessary to process your PKR deposits and withdrawals on st999.
• Identity verification providers: Third-party KYC and age verification service providers engaged by st999 to fulfil its gaming license obligations. These providers process identification documents and biometric or documentary data solely for the purpose of completing verification checks on behalf of st999.
• Anti-money laundering screening services: Fraud prevention and AML screening providers used by st999 to screen accounts and transactions against applicable watchlists and risk indicators.
• Game content providers: Third-party casino game developers and live dealer studio operators whose games are hosted on the st999 platform. These providers may receive gaming session data necessary to operate the relevant game in the context of your st999 account.
• Technology and hosting providers: Cloud hosting, platform infrastructure and cybersecurity service providers who process data solely for the purpose of operating and securing the st999 platform environment.
• Regulatory and law enforcement authorities: Where st999 is legally obligated to disclose personal data to gaming regulators, financial intelligence units, courts, law enforcement agencies or other public authorities under applicable law or pursuant to a valid legal order.

6.3 All third-party service providers to whom st999 discloses personal data are subject to written data processing agreements that impose binding confidentiality, security and data protection obligations. st999 conducts due diligence on service providers before engaging them and monitors compliance on an ongoing basis.

7.1 st999 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting and reporting requirements applicable under the platform's international gaming license.

7.2 The following general retention periods apply to personal data held by st999, unless a longer period is required by applicable law or regulatory obligation:

• Account data and transaction records: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction on the account, whichever is later. This period reflects standard anti-money laundering record-keeping requirements applicable to online gaming operators.
• KYC verification documents: Retained for a minimum of five (5) years following the conclusion of the business relationship with the relevant player, in accordance with applicable AML record-keeping obligations.
• Customer support records: Retained for a minimum of three (3) years from the date of the relevant interaction, or longer where the interaction relates to an ongoing dispute or regulatory inquiry.
• Marketing consent records: Retained for as long as the relevant consent is active and for a period of three (3) years following withdrawal of consent, to evidence the lawfulness of marketing communications sent prior to withdrawal.
• Technical and log data: Retained for a maximum of twelve (12) months from collection in identifiable form, after which it is aggregated or deleted.

7.3 Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identified or identifiable individual.

8.1 st999 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption applied to all data transmitted between your device and the st999 platform during every st999 login session and gaming interaction.
• Encryption of personal data and financial data at rest within the st999 database infrastructure, using industry-standard encryption protocols.
• Role-based access controls ensuring that st999 personnel can access personal data only to the extent strictly necessary for their specific professional function.
• Two-factor authentication requirements for administrative access to st999 backend systems containing personal data.
• Regular penetration testing and security audits of the st999 platform infrastructure, conducted by qualified independent security specialists.
• Incident response protocols for detecting, reporting and responding to personal data breaches, including timely notification to affected players where required.

8.2 Whilst st999 takes all reasonable steps to protect your personal data, no system can guarantee absolute security. You also have a responsibility to protect your st999 login credentials and to notify st999 promptly if you become aware of any unauthorised access to your account or any suspected compromise of your login details.

9.1 Subject to applicable legal and regulatory limitations, st999 recognises the following rights in relation to personal data we hold about you:

9.2 To exercise any of the rights listed above, contact st999 support using the email address displayed in the Contact & Payments section of this platform. All requests will be assessed individually. st999 reserves the right to verify your identity before fulfilling any data subject request, and to decline requests where compliance would conflict with a mandatory legal obligation.

10.1 The st999 platform uses cookies and similar technologies — including session tokens, local storage objects and analytics scripts — to operate the platform, personalise your experience, and analyse platform usage patterns. The following categories of cookies are used on st999:

• Essential cookies: Strictly necessary for the operation of the st999 platform, including maintaining your authenticated st999 login session, storing your language and currency preferences, and enabling core platform functionality. These cookies cannot be disabled without impairing core platform operation.
• Functional cookies: Used to remember your preferences and customisation choices across st999 login sessions, including your preferred game categories, notification settings and responsible gaming configuration.
• Analytics cookies: Used to collect anonymised or pseudonymised data about how players navigate and interact with the st999 platform, enabling the team to identify and address usability issues and improve the platform experience for players in Pakistan and other markets.
• Security cookies: Used to detect and prevent fraudulent or abusive access patterns on the st999 platform, including bot activity and credential stuffing attempts targeting the st999 login interface.

10.2 You can manage cookie preferences through your browser settings. Disabling essential cookies will impair your ability to use the st999 platform, including your ability to maintain an authenticated st999 login session. Non-essential cookies may be disabled without affecting core platform functionality.

11.1 st999 does not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in the st999 account registration process, and accounts where age verification has not been successfully completed are restricted from accessing any real-money gaming features on the platform.

11.2 Where st999 becomes aware that personal data of an individual under 21 has been collected — whether through a registration made with false date of birth information or through any other means — st999 will immediately suspend the relevant account, initiate a formal age verification review, and, if the individual is confirmed to be under 21, delete all personal data associated with the account to the extent permitted by applicable legal retention obligations.

11.3 Parents and guardians in Pakistan who are concerned that a minor in their household has accessed or registered on st999 are encouraged to contact support immediately. st999 takes such reports seriously and will act promptly to investigate and, where confirmed, close the relevant account.

12.1 st999 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform operations or data processing practices. The revised Policy will be published on this page with an updated effective date.

12.2 Where changes to this Policy are material — meaning they substantially affect the nature or scope of personal data processing in a manner that may impact your rights or reasonable expectations — st999 will notify registered players via a platform notification displayed upon next st999 login or via email to the registered address, at least fourteen (14) days prior to the changes taking effect where practicable.

12.3 Your continued use of the st999 platform following publication of a revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with the revised Policy, you should cease using the st999 platform and contact support to request account closure in accordance with the Terms and Conditions.

12.4 For any queries about this Privacy Policy or about how st999 handles your personal data, please contact the st999 support team at the email address displayed in the Contact & Payments section of this platform. All privacy-related queries are handled by the st999 compliance and data team and responded to within a reasonable timeframe.