wc99 Privacy Policy — How We Collect, Use, and Protect Your Personal Data on Pakistan's Most Trusted Gaming Platform

This Privacy Policy ("Policy") describes how wc99 ("wc99", "we", "us", "the Operator") collects, uses, stores, shares, and protects the personal information of individuals ("Members", "you") who access and use the wc99 online gaming platform, including the sports betting sportsbook, casino games lobby, slot titles, promotional systems, wallet and payment interfaces, and customer support channels.

This Policy applies to all data processing activities carried out by wc99 in connection with the operation of the Platform, regardless of the device or browser used to access it. It applies equally to registered Members and to visitors who access the Platform without completing registration.

This Policy should be read in conjunction with wc99's Terms & Conditions and Responsible Gaming Policy, all of which together govern your relationship with wc99.

For the purposes of applicable data protection law, the data controller responsible for your personal information is the wc99 operating entity holding the platform's international gaming license. As an internationally licensed operator, wc99 is required to maintain a designated data protection officer or equivalent compliance function within its organisational structure, responsible for overseeing data protection obligations and handling Member data rights requests.

All data rights requests, privacy complaints, and data protection enquiries should be directed to the wc99 Data Protection contact via the customer support channels listed in Section 15 of this Policy.

wc99 collects personal data across several categories. The following table summarises the principal categories of data collected, the specific data items within each category, and the primary purpose for collection:

wc99 does not collect sensitive categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data beyond CNIC photograph, or health data) unless directly and unavoidably relevant to a responsible gaming assessment or regulatory compliance requirement.

wc99 collects personal data through the following mechanisms:

• Direct provision by you — when you register an Account, complete KYC verification, make a deposit, submit a withdrawal request, contact customer support, or respond to a survey;
• Automated collection — through the use of cookies, session tracking technologies, server access logs, and device fingerprinting as you navigate and use the Platform;
• Payment processor data — transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and blockchain network confirmations for USDT;
• Third-party identity verification services — where wc99 uses licensed KYC verification providers to cross-reference CNIC data and confirm identity document authenticity;
• Fraud prevention networks — data shared within licensed anti-fraud consortia to identify Members associated with fraudulent activity on other licensed gaming platforms.

wc99 processes personal data only where a valid legal basis exists. The following legal bases apply to wc99's data processing activities:

• Contractual necessity — processing required to perform the contract between wc99 and the Member (i.e., the Terms and Conditions), including account management, bet settlement, payment processing, and customer support;
• Legal obligation — processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, age verification requirements, and regulatory reporting mandated by wc99's international gaming license;
• Legitimate interests — processing carried out for wc99's legitimate business interests where those interests are not overridden by the Member's rights, including fraud prevention, platform security, responsible gaming monitoring, and service improvement;
• Consent — where wc99 relies on explicit consent for specific processing activities (such as optional marketing communications), consent may be withdrawn at any time by contacting customer support without affecting the lawfulness of processing carried out before withdrawal.

wc99 uses the personal data it collects for the following principal purposes:

• Account creation and management — registering your Account, maintaining your PKR wallet balance, processing login authentication, and managing Account settings including responsible gaming tool configurations;
• KYC and age verification — verifying your identity using CNIC data to confirm you are aged 21 or above and to satisfy the identity verification requirements of wc99's international gaming license;
• Payment processing — facilitating deposits and withdrawals via JazzCash, EasyPaisa, and other payment methods; reconciling transaction records; and detecting and preventing payment fraud;
• Bet and game management — recording bet placement and settlement, managing bonus fund allocation and wagering progress, and providing game play history in your Account dashboard;
• Regulatory and AML compliance — monitoring transactions and activity for indicators of money laundering, match fixing, or other regulated activities, and filing reports with relevant authorities where legally required;
• Responsible gaming — identifying patterns of play that may indicate the development of a gambling problem and initiating responsible gaming outreach consistent with our obligations under the gaming license;
• Customer support — responding to queries, resolving disputes, and maintaining records of support interactions for quality and compliance purposes;
• Platform security — detecting and preventing unauthorised account access, multiple account creation, and other security threats to the Platform and its Members;
• Service improvement — analysing anonymised usage patterns to improve Platform performance, user interface design, and game content selection for the Pakistani market.

wc99 does not use personal data for automated decision-making that produces solely automated legal effects against a Member's interests without human review and a right of appeal to the wc99 compliance team.

wc99 does not sell personal data to third parties. wc99 may share personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment service providers — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT blockchain networks receive the minimum transaction data necessary to process deposits and withdrawals. These providers operate under their own privacy policies and are bound by financial services data protection obligations;
• KYC and identity verification providers — licensed third-party identity verification services receive CNIC data solely for the purpose of document authenticity verification. Data shared for this purpose is not retained by the verification provider beyond the period required for the verification process;
• Casino game software providers — game providers (including Evolution, Pragmatic Play, PG Soft, and others) receive session and wagering data necessary to deliver game content and RTP audit functions. These providers are contractually bound to data protection standards consistent with this Policy;
• Regulatory authorities — wc99's international gaming license authority and relevant financial crime prevention bodies may receive Member data where disclosure is required by applicable law, court order, or regulatory direction;
• Fraud prevention networks — aggregated, pseudonymised risk indicators may be shared with licensed anti-fraud industry networks to protect the gaming industry against organised fraud;
• Professional advisors — legal advisors, auditors, and insurers may access Member data on a confidential, need-to-know basis where required for the exercise of their professional services to wc99.

wc99 operates as an internationally licensed gaming platform. Your personal data may be transferred to and stored in countries or jurisdictions outside Pakistan in connection with wc99's server infrastructure, third-party KYC providers, casino game software providers, and payment processing partners.

Where such international transfers occur, wc99 takes appropriate safeguards to ensure that your personal data receives a level of protection consistent with the principles set out in this Policy. These safeguards include: contractual data processing agreements with third-party recipients that impose data protection standards; transfers to providers located in jurisdictions whose data protection frameworks have been assessed as adequate; and technical encryption measures applied to data in transit and at rest.

By using the wc99 Platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards described above.

wc99 retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as general guidance:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with wc99's data disposal procedures. Anonymised data (from which all identifying information has been irreversibly removed) may be retained for statistical and analytical purposes beyond these periods.

wc99 uses cookies and similar tracking technologies to provide, maintain, and improve the Platform. Cookies are small text files stored on your device that enable the Platform to recognise your browser session, maintain your login state, and record your preferences.

wc99 uses the following categories of cookies:

• Strictly Necessary Cookies — essential for the Platform to function; these enable your login session, maintain your wallet state, and support secure navigation. These cannot be disabled without preventing use of the Platform;
• Functional Cookies — remember your preferences such as language settings, display options, and responsible gaming configurations, so they persist across sessions;
• Analytics Cookies — collect anonymised data about how Members use the Platform (pages visited, time spent, error encounters) to help wc99 identify and resolve performance issues and improve the user experience;
• Security Cookies — support fraud detection and session security functions, including detection of unusual login patterns and enforcement of account session timeouts.

wc99 does not use third-party advertising or tracking cookies that share your behaviour data with external advertising networks or data brokers. You may configure your browser settings to refuse or delete cookies; however, doing so may affect the functionality of the Platform, including your ability to maintain a logged-in session.

Subject to applicable law and the limitations arising from wc99's regulatory obligations (including AML requirements that may restrict deletion of certain records), wc99 Members hold the following rights in respect of their personal data:

To exercise any of these rights, contact wc99 customer support via live chat or email. wc99 will verify your identity before processing any data rights request to prevent unauthorised data disclosure. Responses are provided within 30 calendar days; complex requests may require an extension of up to a further 60 days, of which you will be informed in advance.

The wc99 Platform is strictly restricted to individuals aged 21 years and above. wc99 does not knowingly collect personal data from any person under the age of 21. Age is verified as part of the mandatory KYC process using CNIC data.

If you have reason to believe that a person under 21 has registered an Account on wc99, please contact our customer support team immediately so that appropriate action can be taken.

wc99 implements a multi-layered technical and organisational security framework to protect Member personal data against unauthorised access, disclosure, alteration, or destruction. This framework includes:

• Encryption in transit — all data transmitted between Member devices and wc99 servers is encrypted using 256-bit SSL/TLS protocols;
• Encryption at rest — sensitive data fields (including CNIC numbers, financial account identifiers, and authentication credentials) are stored in encrypted form in wc99's database systems;
• Access controls — internal access to personal data is restricted on a strict need-to-know basis, with role-based permission systems and full audit logging of all data access events;
• Two-factor authentication — available to all Members for account access and mandatory for all wc99 staff accessing Member data systems;
• Penetration testing — wc99's systems undergo periodic security penetration testing by independent security specialists to identify and remediate vulnerabilities;
• Incident response procedures — wc99 maintains documented data breach response procedures including notification obligations to affected Members and regulatory authorities where applicable.

Despite these measures, no internet-based platform can guarantee absolute security against all possible threats. Members are encouraged to maintain strong, unique passwords for their wc99 Account and to enable two-factor authentication to maximise their personal account security.

wc99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory requirements, or improvements to our Platform services. Material changes to this Policy will be notified to Members via the Platform, by SMS to the registered mobile number, or by email, with a minimum of 7 days' advance notice before the changes take effect.

The effective date displayed at the top of this Policy identifies the current version. All previous versions of the Privacy Policy are archived and available upon request from wc99 customer support. Your continued use of the wc99 Platform following the effective date of any updated Policy constitutes your acknowledgment of the changes.