up999 Privacy Policy —
How We Protect Your Data

1 Who We Are & How to Reach Us

up999 is an online casino and sports betting platform operated under an international gaming licence, serving players across Pakistan including major cities such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, and Multan. For the purposes of this Privacy Policy, up999 is the data controller responsible for your personal information collected through the Platform.

We are committed to handling your personal data with integrity, transparency, and full respect for your privacy rights. Our Data Protection Officer (DPO) oversees all data protection matters and can be contacted directly for any privacy-related enquiry, request, or complaint:

• Data Protection Officer Email: support@up999.bet (subject line: "Privacy / DPO Request")
• Support Hours: 9:00 AM – 12:00 AM PKT, 7 days a week
• Languages: English and Urdu
• Platform URL: up999.bet

This Policy was last reviewed and updated in January 2026. The effective date is 1 January 2026. All previous versions of this Policy are superseded by this document.

2 Personal Data We Collect

up999 collects personal data from you through several channels: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and occasionally from trusted third-party sources for the purpose of identity verification and fraud prevention. The categories of personal data we collect are detailed below.

3 How We Use Your Personal Data

up999 uses your personal data for specific, legitimate purposes only. We do not process your data in any manner that is incompatible with the purposes for which it was originally collected. The primary purposes for which we use your data are as follows:

• Account Management: To create, maintain, and administer your up999 player account, including processing your registration details, managing your login credentials, and verifying your identity in accordance with our KYC obligations.
• Payment Processing: To facilitate deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and general bank transfer in Pakistani Rupees (PKR), and to maintain an accurate record of all financial transactions on your account.
• Regulatory Compliance: To fulfil our legal obligations under international anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and the terms of our international gaming licence, including reporting obligations where applicable.
• Responsible Gaming: To monitor gameplay patterns for signs of problem gambling behaviour, to administer deposit limits, self-exclusion requests, and cool-off periods, and to provide targeted support where concerns are identified.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, account takeovers, money laundering, and other prohibited conduct on the Platform, including through automated monitoring systems.
• Platform Improvement: To analyse aggregate usage patterns and improve the functionality, performance, and content of the up999 Platform, including personalising game recommendations where you have consented to this.
• Customer Support: To respond to enquiries, resolve disputes, process complaints, and provide ongoing support in English and Urdu to players across Pakistan.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided your consent to receive such communications. You may withdraw this consent at any time.

4 Legal Basis for Processing

For each category of personal data processing conducted by up999, we rely on one or more of the following legal bases, in accordance with internationally recognised data protection principles:

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms. Where we rely on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

5 Sharing & Disclosure of Your Data

up999 does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Service Providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment processors receive the financial information necessary to execute your deposit and withdrawal requests. These parties are contractually bound to process your data only as instructed by up999.
• Identity Verification Partners: Third-party KYC and AML compliance service providers receive identity documents and personal details solely for the purpose of fulfilling our regulatory verification obligations. All such providers operate under strict data processing agreements.
• Game Software Providers: Licensed game software providers (whose titles appear in the up999 Casino lobby) may receive your player ID and gameplay data for the purpose of delivering, recording, and auditing game rounds. They do not receive your full identity or financial data.
• Regulatory Authorities: up999 may be legally required to disclose certain player data to our licensing authority, anti-money laundering regulators, or law enforcement agencies. Such disclosures are made only to the extent required by applicable law and are never voluntary.
• IT Infrastructure & Security Providers: Cloud hosting, cybersecurity, and analytics infrastructure providers may process technical and usage data on our behalf as data processors. All such providers are contractually bound by data processing agreements that prohibit secondary use of your data.

6 Cookies & Tracking Technologies

up999 uses cookies and similar tracking technologies to operate and improve the Platform, personalise your experience, and analyse usage patterns. A cookie is a small text file placed on your device when you visit the Platform. Cookies do not contain executable code and cannot access other data stored on your device.

The following categories of cookies are used on up999:

You can manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies may prevent you from accessing certain features of the Platform, including your account login. Disabling analytics and marketing cookies will not affect your ability to use core Platform functionality.

7 Data Retention

up999 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by AML and gaming licence regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in accordance with anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following account closure or the completion of the business relationship to which they relate.
• Communications and Support Records: Retained for three (3) years following the resolution of the relevant enquiry or complaint, to enable us to respond to any follow-up or regulatory query.
• Technical and Usage Data: Retained in identifiable form for up to twenty-four (24) months, after which data is anonymised and may be retained indefinitely for aggregate analytics purposes.
• Marketing Preference Records: Retained for as long as your account is active plus three (3) years, or until you withdraw consent, whichever is earlier. Records of consent withdrawal are retained indefinitely to demonstrate compliance.

Upon expiry of the applicable retention period, up999 will securely delete or anonymise your personal data in a manner that prevents reconstruction or recovery. Where deletion is not immediately technically feasible (for example, data held in backup systems), the data will be isolated from active processing until it can be securely deleted.

8 Data Security Measures

up999 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. While no system can guarantee absolute security, we take our obligation to protect your data extremely seriously and invest continuously in our security infrastructure.

Our security measures include, but are not limited to, the following:

• Encryption at Rest: All personal data stored on up999 servers is encrypted using AES-256 encryption, the same standard used by leading financial institutions worldwide.
• Encryption in Transit: All data transmitted between your device and the up999 Platform is protected using TLS 1.3, preventing interception by third parties during transmission.
• Access Controls: Access to personal data within up999 is strictly limited on a need-to-know basis. Staff members are granted only the minimum level of data access required to perform their role, and all access is logged and audited.
• Two-Factor Authentication: up999 supports two-factor authentication (2FA) for player accounts to provide an additional layer of protection against unauthorised login attempts. We strongly encourage all Pakistani players to enable 2FA in their account security settings.
• Intrusion Detection: Our systems are monitored continuously using automated intrusion detection and prevention tools that alert our security team to anomalous activity in real time.
• Regular Security Audits: up999 conducts periodic independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, up999 will notify affected players and relevant authorities in a timely manner in accordance with applicable obligations.

You also have a role to play in keeping your account secure. Please use a strong, unique password for your up999 account, enable two-factor authentication, and never share your login credentials with anyone. If you suspect your account has been compromised, contact our support team immediately at support@up999.bet.

9 Your Privacy Rights

As a player on the up999 Platform, you have a number of important rights in relation to your personal data. up999 is committed to honouring these rights promptly and without unnecessary barriers. The following rights are available to you:

• Right of Access: You have the right to request a copy of all personal data that up999 holds about you. We will provide this information within thirty (30) days of a verified request, free of charge for the first request in any twelve-month period.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Many basic details — such as your contact number or email address — can be updated directly within your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent, or where you object to processing based on legitimate interests. Note that erasure requests cannot override our legal obligations to retain certain data under AML and gaming licence regulations.
• Right to Restrict Processing: You may request that up999 restrict processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or where you have contested the legal basis for processing.
• Right to Data Portability: Where processing is carried out by automated means on the basis of your consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where up999 relies on legitimate interests as the legal basis, including profiling for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications or personalised recommendations — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right Not to Be Subject to Automated Decisions: up999 may use automated processes to flag accounts for fraud or responsible gaming review. You have the right to request human review of any decision that significantly affects you and that was made solely on the basis of automated processing.

To exercise any of the above rights, please contact our Data Protection Officer at support@up999.bet with the subject line "Privacy Rights Request". We will acknowledge your request within 72 hours and provide a full response within 30 days. In exceptional cases involving complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

10 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way up999 handles your personal data, please do not hesitate to get in touch. Our team is here to help — whether you are a first-time player in Karachi or a long-standing member from Lahore.

• Privacy & DPO Email: support@up999.bet (subject: "Privacy / DPO Request")
• General Support Email: support@up999.bet
• Live Chat: Available within your up999 account, 9:00 AM – 12:00 AM PKT, 7 days a week
• Languages Supported: English and Urdu

If you are not satisfied with up999's response to a privacy concern, you have the right to escalate the matter to the relevant data protection supervisory authority or to the dispute resolution body designated by up999's licensing authority. Details of the applicable supervisory body are available on request from our DPO.

up999 takes all privacy complaints seriously and will investigate every concern raised in good faith. We aim to resolve privacy complaints within 14 business days of receipt, though complex matters may take longer. We will keep you updated on the progress of your complaint throughout the process.