Introduction
This Privacy Policy ("Policy") describes how 99abba ("we", "us", "our") collects, uses, discloses, stores and protects personal information relating to individuals ("you", "your", "User") who access or use the 99abba platform at https://99abba.cam ("Platform").
We are committed to handling personal data responsibly, transparently and in compliance with applicable data protection principles. This Policy applies to all users of the Platform, including users accessing the Platform from Pakistan and other jurisdictions.
By registering an account, making a deposit or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform.
Pakistani Users: Pakistan's data protection landscape is evolving. The Personal Data Protection Bill and related regulations may apply to processing activities involving Pakistani residents. 99abba is committed to processing personal data in a manner consistent with internationally recognised data protection principles, regardless of the specific regulatory framework applicable in your jurisdiction. This Policy does not constitute legal advice — if you have concerns about your specific rights under Pakistani law, we recommend consulting a qualified legal professional.
Definitions
In this Policy, the following terms carry the meanings set out below:
- "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, CNIC number, IP address and financial information.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion or any other form of handling.
- "Data Controller" means 99abba, as the entity that determines the purposes and means of processing Personal Data.
- "Data Processor" means a third party that processes Personal Data on behalf of 99abba in accordance with our instructions and subject to appropriate contractual safeguards.
- "KYC Data" means identity verification documents and information submitted as part of the Know Your Customer process, including CNIC or passport copies, proof of address and liveness verification images.
- "Sensitive Data" means a special category of Personal Data that warrants heightened protection, including identity document numbers, financial account details and health-related information (e.g., responsible-gambling self-disclosures).
- "Cookie" means a small text file stored on your device by a web browser in connection with your use of the Platform.
Data We Collect
We collect Personal Data in the following categories, depending on how you interact with the Platform:
| Data Category | Examples | When Collected |
|---|---|---|
| Registration Data | Full name, date of birth, email address, residential address, username, password (hashed) | At account creation |
| Identity & KYC Data | CNIC or passport copy, proof of address (utility bill, bank statement), selfie or liveness check image | During KYC verification |
| Financial Data | Deposit and withdrawal amounts, payment method identifiers (partial account or wallet reference numbers), transaction history | On deposit/withdrawal |
| Gameplay Data | Games played, bets placed, odds accepted, win/loss history, session duration, game preferences | During active gameplay |
| Technical & Device Data | IP address, browser type, operating system, device identifiers, screen resolution, time zone, referring URL | Automatically on site access |
| Communications Data | Support chat transcripts, email correspondence, feedback submissions | When you contact support |
| Responsible Gambling Data | Limit settings, self-exclusion requests, session time alerts, reality-check acknowledgements | When tools are used |
We do not intentionally collect Sensitive Data beyond what is strictly required for KYC compliance and responsible gambling management. We do not request or store full payment card numbers, CVV codes or banking passwords.
How We Collect Data
We collect Personal Data through the following channels:
4.1 Direct Collection
You provide data directly when you: register an account; complete identity verification; make a deposit or request a withdrawal; contact our support team via live chat or email; set responsible gambling limits or self-exclusion preferences; or submit feedback about the Platform.
4.2 Automated Collection
We collect certain Technical & Device Data automatically when you access the Platform, through cookies, web beacons, server logs and similar technologies. This includes your IP address (which may indicate your approximate location, such as whether you are accessing from Karachi, Lahore or another city), browser configuration and session activity patterns.
4.3 Third-Party Sources
We may receive supplementary verification data from third-party identity verification service providers engaged to assist with KYC processing. We may also receive fraud-detection signals from payment processors. Any such data received from third parties is subject to the same protections applied to data collected directly from you.
Legal Basis for Processing
Where data protection law requires us to identify a legal basis for each processing activity, we rely on one or more of the following:
- Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Terms & Conditions, including account management, game provision, deposit processing and withdrawal handling.
- Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, age verification requirements and fraud prevention obligations imposed on operators in our licensing jurisdiction.
- Legitimate Interests: Processing conducted in pursuit of our legitimate business interests where those interests are not overridden by your rights, including fraud detection, platform security, responsible gambling monitoring and service improvement activities.
- Consent: Where we rely on consent (e.g., for certain marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Purposes of Processing
We process your Personal Data for the following specific purposes:
- Creating, maintaining and managing your account on the Platform.
- Verifying your identity, age and eligibility under our KYC procedures prior to processing withdrawals or as otherwise required.
- Processing deposits and withdrawals through available payment methods, which may include familiar Pakistani payment rails such as Easypaisa, JazzCash and Raast as context — not as an endorsement of gambling by those providers.
- Administering bonus offers, promotions and loyalty programme benefits in accordance with applicable Bonus Terms.
- Detecting, preventing and investigating fraud, money laundering, identity theft, collusion and other prohibited conduct.
- Monitoring gameplay activity to identify signs of problem gambling behaviour and administering responsible gambling tools including deposit limits, loss limits and self-exclusion.
- Providing customer support via live chat, email and other communication channels.
- Complying with legal and regulatory obligations imposed by our licensing jurisdiction, including AML and counter-terrorism financing requirements.
- Improving and personalising the Platform experience through aggregate analysis of user behaviour and technical performance data.
- Sending service communications, including account notifications, security alerts and policy update notices.
We do not use your Personal Data for automated decision-making that produces legal or similarly significant effects without human review, except where such processing is required to comply with legal obligations or is consented to by you.
Data Sharing & Disclosure
99abba does not sell your Personal Data. We may share your data with the following categories of recipients only where necessary and subject to appropriate safeguards:
- Identity Verification Providers: Third-party KYC service providers engaged to assist with document verification, liveness checks and fraud screening. These providers act as Data Processors under contract with 99abba.
- Payment Service Providers: Payment processors and gateway providers involved in facilitating your deposits and withdrawals. Only the minimum data necessary to complete a transaction is shared.
- Gaming Software Providers: Game content suppliers may receive anonymised or pseudonymised session data required for game provision, RNG certification or regulatory reporting, depending on the specific game type.
- Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies or courts where required to do so by applicable law, court order or to protect the rights and safety of 99abba or other users.
- Anti-Money Laundering and Fraud Prevention Agencies: Where we are legally required or otherwise permitted to share data with industry bodies or government agencies for AML or fraud prevention purposes.
No Third-Party Marketing: We will not share your Personal Data with third-party marketing companies, data brokers or advertising networks for their independent marketing purposes. Any marketing communications from 99abba are sent by us directly, not through third-party marketing data arrangements.
International Data Transfers
As an online platform serving users globally, including users accessing the Platform from Pakistan, your Personal Data may be transferred to and processed in countries other than your country of residence. This may include countries where data protection laws differ from those in Pakistan or your home jurisdiction.
Where such transfers occur, 99abba will implement appropriate safeguards to ensure that your Personal Data continues to receive a level of protection consistent with internationally recognised data protection principles, including through contractual arrangements with our service providers that incorporate appropriate data transfer protections.
By using the Platform, you acknowledge that your Personal Data may be transferred and processed in jurisdictions outside Pakistan in connection with the provision of our services.
Data Retention
We retain Personal Data for as long as is necessary to fulfil the purposes for which it was collected, as required by applicable law or as set out below:
- Account Data: Retained for the duration of your account and for a minimum period following account closure as required by applicable AML regulations (typically five years in most licensing jurisdictions).
- KYC Documents: Retained for the minimum period mandated by the AML/CTF regulatory requirements of the operator's licensing jurisdiction, typically five years from account closure or last transaction date.
- Transaction Records: Financial transaction records are retained for the period required by the applicable regulatory framework, typically five to seven years.
- Communications Data: Support chat and email correspondence is retained for as long as reasonably necessary for dispute resolution purposes and then deleted.
- Technical & Device Data: Log data is retained for a shorter period (typically 90 days to 12 months) unless specific data points are required for ongoing fraud or security investigations.
Upon expiry of the applicable retention period, data is securely deleted or anonymised such that it can no longer be linked to any individual.
Data Security
We implement appropriate technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction or disclosure. Our security measures include, but are not limited to:
- SSL/TLS encryption for all data transmitted between your device and our servers.
- Encryption of sensitive data at rest, including KYC documents and financial identifiers.
- Access controls limiting staff access to Personal Data on a strictly need-to-know basis.
- Two-factor authentication options for user accounts.
- Regular security assessments and penetration testing of platform infrastructure.
- Secure deletion protocols for data that has reached the end of its retention period.
While we employ robust security measures, no system can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with applicable breach notification obligations.
Your Responsibility: You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account. If you suspect your account has been compromised, contact our support team immediately at [email protected]. Do not share your password with anyone, including 99abba staff — we will never ask for your password.
Your Rights
Subject to applicable data protection law and certain exceptions, you have the following rights in relation to your Personal Data held by 99abba:
Right of Access
Request a copy of the Personal Data we hold about you and information about how it is being processed.
Right to Rectification
Request correction of inaccurate or incomplete Personal Data held about you.
Right to Erasure
Request deletion of your Personal Data where there is no longer a lawful basis for us to hold it, subject to our legal retention obligations.
Right to Restriction
Request that we restrict the processing of your Personal Data in certain circumstances (e.g., while accuracy is disputed).
Right to Portability
Receive a copy of data you have provided to us in a structured, commonly used, machine-readable format where technically feasible.
Right to Object
Object to processing based on our legitimate interests or for direct marketing purposes. Where you object to marketing, we will stop immediately.
Withdraw Consent
Where processing is based on your consent, withdraw that consent at any time without affecting prior lawful processing.
Right to Complain
Lodge a complaint with the relevant supervisory authority in the jurisdiction where the alleged breach occurred.
To exercise any of these rights, please contact us using the details in Section 16. We will respond to your request within 30 days where practicable, and will notify you if a longer period is required due to the complexity or volume of requests. We may ask for verification of your identity before processing a rights request.
Please note that certain rights are subject to limitations and exceptions under applicable law, particularly where processing is required for legal compliance, fraud prevention or the defence of legal claims.
Minors & Age Verification
The 99abba Platform is strictly intended for adults aged 18 years or above, or the higher minimum age required by the operator's licensing jurisdiction. We do not knowingly collect Personal Data from individuals under the minimum eligible age.
Age verification is enforced as a mandatory step during the KYC process. Where we discover that a minor has accessed the Platform or provided Personal Data, we will:
- Immediately close the relevant account.
- Refund any net deposits made in accordance with our legal obligations.
- Permanently delete or anonymise all Personal Data associated with the underage user, except where retention is required by law.
If you are a parent or guardian and believe your child may have accessed this Platform, please contact our support team immediately at [email protected].
Third-Party Links & Services
The Platform may contain references to third-party payment services, gaming software providers or informational resources. 99abba is not responsible for the privacy practices or content of any third-party services. This Policy applies solely to Personal Data collected through the 99abba Platform.
Payment method names referenced on the Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are cited as familiar context for Pakistani users only. Interactions with these providers' own platforms, apps or customer service channels are governed by those providers' own privacy policies, not this one.
Policy Amendments
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform features. Where a material change is made, we will notify registered users via email or a prominent on-Platform notice at least 14 days before the change takes effect, where practicable.
The "Last Updated" date at the top of this page will be revised to reflect the date of each new version. Your continued use of the Platform following the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept a material change, you should cease using the Platform and request account closure before the change takes effect.
Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 11, please contact our team using the details below:
- Email (plain text — not a clickable link): [email protected]
- Subject Line for Data Requests: "Privacy / Data Rights Request — [Your Full Name]"
- Support Hours: 24 hours a day, 7 days a week
- Response Time Target: Within 30 days of receiving your request
- Languages: English and Urdu
When submitting a data rights request, please include: your full name, the email address associated with your account, a clear description of the right you wish to exercise and any relevant details. We may ask for additional identity verification before processing your request to protect your data from unauthorised access.
Do Not Send Documents by Email: If your request relates to KYC documents or other sensitive Personal Data, please do not attach original documents to unsecured emails. Our support team will provide you with a secure, HTTPS-encrypted upload link for any document submission required as part of a data rights request.