Privacy Policy

This Privacy Policy (the "Policy") describes how cd999 (the "Platform", "Operator", "we", "us" or "our"), accessible at https://cd999.cam, collects, uses, discloses, stores and protects personal data relating to individuals who access or use our Services (each a "User", "Player" or "you"). This Policy forms part of and should be read alongside our Terms & Conditions.

cd999 is an English-language online gaming platform designed for Pakistani users, offering sports betting, live casino games and related entertainment services. In operating these Services, we necessarily process certain personal data. We are committed to handling that data responsibly, transparently and in accordance with applicable data protection obligations under our licensing jurisdiction.

By registering an Account on cd999 or otherwise using the Services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not accept this Policy, you must not register an Account or use the Services.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifiers or factors specific to physical, economic, cultural or social identity.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is the Operator of cd999.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, in accordance with documented instructions.
• "Sensitive Data" — a category of personal data attracting enhanced protection, including racial or ethnic origin, health data, biometric data and financial data processed for identity-verification purposes.
• "KYC Data" — identity and address verification documentation collected as part of the Operator's Know Your Customer obligations, including but not limited to CNIC copies, passport scans and proof-of-address documents.
• "Cookie" — a small text file placed on a User's device by the Platform for purposes of session management, functionality, analytics or personalisation.

We collect personal data through several channels: directly from you when you register, deposit or contact support; automatically through your use of the platform; and, in limited circumstances, from third-party identity-verification and payment-processing partners. The categories of personal data we collect include, but are not limited to, those set out in the table below.

We process your personal data only where we have a valid lawful basis to do so. The primary bases on which we rely are as follows:

• Contractual necessity: Processing required to perform the contract between you and the Operator — including operating your Account, processing deposits and withdrawals, and providing the Services you have requested.
• Legal obligation: Processing required to comply with applicable legal obligations, including KYC verification, anti-money laundering (AML) checks, and responsible-gambling record-keeping as required under our licensing terms.
• Legitimate interests: Processing necessary for purposes of fraud prevention, platform security, internal analytics and service improvement, where these interests are not overridden by your own rights and interests.
• Consent: Processing based on your freely given, specific and informed consent, including the use of non-essential cookies and the sending of direct marketing communications (where applicable). You may withdraw consent at any time without affecting the lawfulness of prior processing.

We use the personal data we collect for the following purposes:

• Account management: Creating, verifying, operating and maintaining your cd999 account, including processing your registration and keeping account records accurate and up to date.
• Service delivery: Providing access to the sportsbook, live casino, slots and other gaming features; processing bets and wagers; calculating and paying winnings; and managing promotions and bonuses including those related to PSL, ICC cricket and other sporting events.
• Payment processing: Handling deposits and withdrawals in PKR (where supported), verifying payment method ownership, and maintaining transaction records for audit purposes.
• Regulatory compliance: Conducting KYC and AML checks, verifying user age (18+ as a minimum, or higher where required), maintaining mandatory records, and reporting to licensing authorities as required.
• Responsible gambling: Monitoring for signs of problematic gambling behaviour, enforcing self-exclusion and limit settings, and applying player-protection interventions as appropriate.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent transactions, account takeovers, money laundering and other prohibited conduct; maintaining platform security.
• Customer support: Responding to enquiries, resolving complaints, and maintaining records of support interactions for quality and regulatory purposes.
• Analytics and improvement: Analysing usage patterns to improve platform performance, user experience and content relevance — including understanding how users from cities such as Karachi, Lahore, Islamabad, Rawalpindi and Peshawar interact with the platform.
• Communications: Sending transactional messages (account verification, deposit confirmations, withdrawal notifications) and, where you have consented, marketing communications about promotions and offers.

We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects without providing you with a means to request human review.

We do not sell your personal data to third parties. We may share your personal data only in the following circumstances and only to the extent strictly necessary for the stated purpose:

• Service providers and processors: Third-party suppliers engaged by us under data-processing agreements to provide services including payment processing, identity verification, fraud detection, cloud hosting, customer-support software and analytics. All processors are contractually obligated to handle your data in accordance with our instructions and applicable data protection requirements.
• Licensing authorities and regulators: Competent regulatory and licensing authorities in the Operator's jurisdiction, where disclosure is required by law or our licensing conditions.
• Law enforcement and legal process: Where required by applicable law, court order or lawful request from a public authority having jurisdiction over the Operator, we may disclose personal data to the extent required by that legal obligation.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of the Operator's business, your personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.
• Fraud and AML investigations: With other regulated operators or industry bodies in connection with fraud prevention and anti-money laundering obligations, where permitted under applicable law.

We do not share your personal data with advertisers, data brokers or unaffiliated third parties for commercial purposes.

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any applicable legal, regulatory, accounting or reporting requirements. The retention periods applicable to principal categories of data are as follows:

• Account and identity data: For the duration of the account relationship and for a minimum of five (5) years following account closure, as required by anti-money laundering and licensing regulations.
• Financial and transaction records: A minimum of five (5) years from the date of the relevant transaction, or such longer period as required by the Operator's licensing obligations.
• KYC documentation: Retained for a minimum of five (5) years following completion of the business relationship, in accordance with AML regulatory requirements.
• Responsible gambling records: Self-exclusion and limit-setting records are retained for the duration of the exclusion or limit period plus a minimum of two (2) years to prevent inadvertent re-registration.
• Technical and usage data: Typically retained for up to thirteen (13) months for analytical and security purposes, unless a longer retention period is required for a specific investigation.
• Support correspondence: Retained for up to three (3) years following the resolution of the relevant support interaction, or longer where required for legal proceedings.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with an identified individual.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure or alteration. These measures include, but are not limited to:

• End-to-end TLS/SSL encryption for all data transmitted between your device and our servers;
• Encryption of sensitive data at rest, including stored KYC documents and financial records;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Two-factor authentication available for all user accounts;
• Regular security audits and penetration testing of platform infrastructure;
• Incident response procedures for detecting, containing and notifying affected parties of any personal data breach in accordance with our licensing obligations.

While we apply industry-standard security practices, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your Account credentials. If you believe your Account has been compromised, you must contact our support team immediately.

cd999 uses cookies and similar tracking technologies to operate the platform effectively, improve user experience and analyse usage. The categories of cookies we use are:

• Essential cookies are required for the platform to function and cannot be disabled. They include session management tokens, login authentication cookies and security tokens. No consent is required for these cookies.
• Functional cookies remember your preferences, such as language settings (English) and display options. These cookies can be disabled through your browser settings, though doing so may impair some platform features.
• Analytics cookies collect anonymous or pseudonymous data about how users navigate and interact with the platform. This data helps us identify performance issues and improve the user experience. These cookies are only deployed where you have provided valid consent.

You may manage or delete cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the platform. Detailed cookie information, including cookie names, durations and purposes, is available on request via our support team.

Subject to the conditions and limitations set out in applicable data protection law and our regulatory obligations, you have the following rights in respect of your personal data held by cd999:

To exercise any of the above rights, please submit a written request to our support team at the email address set out in Section 14 of this Policy. We will respond within the timeframe required by applicable law, and in any event within thirty (30) days of receipt of a valid request. We may require identity verification before processing certain requests.

cd999 is an internationally operated platform. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Such transfers occur in connection with our use of third-party service providers for hosting, payment processing, KYC verification and other operational functions.

Where personal data is transferred internationally, we take appropriate steps to ensure that adequate safeguards are in place, including contractual protections such as standard data-protection clauses incorporated into our agreements with processors. By using cd999, you acknowledge and consent to the transfer of your personal data to our servers and processors located outside Pakistan, subject to the protections described in this Policy.

cd999 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 18, or such higher minimum age as is required by the Operator's licence jurisdiction. Registration on this platform requires confirmation that the user meets the applicable minimum age requirement.

If we become aware that personal data has been collected from an individual who does not meet the minimum age requirement, we will take immediate steps to delete that data and close the relevant Account. If you are a parent or guardian and believe that a minor has provided their personal data to us, please contact our support team immediately so that we can take appropriate action.

We reserve the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law or our Services. Material changes to this Policy will be communicated to registered users via email or through a prominent notice on the platform prior to the changes taking effect. The date of the most recent review is displayed at the top of this page.

Your continued use of the Services following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must stop using the Services and request closure of your Account.

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Protection team using the following details:

• Support & Data Requests Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please include "Privacy Request" or "Data Subject Request" in your email subject line to ensure prompt routing.
• Response time: We aim to acknowledge all privacy-related requests within five (5) business days and to resolve them within thirty (30) days, or such shorter period as may be required by applicable law.
• Identity verification: To protect the security of your personal data, we may require you to verify your identity before processing certain data-subject requests.

This Privacy Policy was last reviewed in January 2026. If you wish to raise a formal complaint about our data-handling practices, you may also contact the relevant data protection supervisory authority in the Operator's licensing jurisdiction.