u899 Privacy Policy — Your Data, Protected

u899 ("we", "us", "our") is an online gaming and sports betting platform operating at u899.app. u899 is operated by the u899 operating entity, which holds an international gaming licence authorising the provision of online casino games and sports betting services to players in applicable markets, including Pakistani players accessing the Platform from within Pakistan.

For the purposes of applicable data protection law, u899 is the data controller in respect of personal data collected from players and site visitors through the u899 Platform. This means u899 determines the purposes for which and the means by which your personal data is processed.

u899 is committed to handling personal data in accordance with applicable data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

u899 collects the following categories of personal data:

Data We Do Not Collect: u899 does not collect or store full payment card numbers (PAN). Payment card transactions are processed by PCI-DSS compliant payment processors; u899 only receives a masked card reference for record-keeping purposes. u899 does not collect biometric data beyond the liveness check photographs used for identity verification, which are processed by our KYC partner and are not stored on u899 servers beyond the verification period.

u899 uses your personal data for the following purposes:

• Account Management: Creating and maintaining your u899 account, authenticating your identity at login, and enabling access to Platform features;
• Service Delivery: Processing deposits and withdrawals in PKR, providing access to casino games and sports betting markets, crediting bonuses and promotional rewards;
• Identity Verification (KYC/AML): Verifying your identity and age (21+) as required by our licensing obligations, and monitoring transactions for anti-money laundering compliance;
• Responsible Gaming: Monitoring gaming activity to identify potential problem gambling indicators, applying player-set limits and self-exclusion restrictions, and providing welfare interventions where appropriate;
• Customer Support: Responding to your support requests, resolving disputes, investigating complaints, and maintaining communication records for quality assurance;
• Platform Security: Detecting and preventing fraud, unauthorised account access, bonus abuse, and other prohibited conduct described in the u899 Terms & Conditions;
• Legal & Regulatory Compliance: Meeting our obligations under applicable gaming regulations, anti-money laundering laws, and the requirements of our licensing authority;
• Product Improvement: Analysing aggregated usage data (not personal data) to understand platform performance, game popularity, and user experience trends;
• Marketing Communications: Sending you promotional offers, bonus notifications, and product updates — subject to your marketing preferences and only where we have a lawful basis to do so.

For each use of your personal data described in Section 3, u899 relies on one of the following legal bases:

• Contract Performance: Processing necessary to deliver the services you have contracted for when creating your u899 account — including account management, payment processing, and game access;
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC/AML requirements, age verification, licensing conditions, and mandatory record-keeping;
• Legitimate Interests: Processing for purposes that represent a legitimate interest of u899 or a third party, where that interest is not overridden by your rights and interests — including fraud prevention, platform security, and responsible gaming monitoring;
• Consent: Processing for which u899 has obtained your prior informed consent — primarily marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where u899 processes special category data (such as information about your health relevant to a responsible gaming referral), we rely on explicit consent or applicable regulatory necessity as the legal basis for that processing.

u899 does not sell your personal data. We share personal data only in the following limited circumstances and only to the extent necessary:

• Payment Processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, Visa, Mastercard, and 1LINK — for processing your deposits and withdrawals. These providers handle your financial data under their own privacy and security frameworks;
• Identity Verification Providers: KYC and AML compliance partners who assist with age verification, identity document checks, and sanctions screening as required by our licensing obligations;
• Game Content Providers: Third-party game studios whose software is hosted on the u899 Platform. These providers may receive anonymised session identifiers for technical integration purposes but do not receive your personal identity data;
• Fraud Prevention Services: Third-party fraud detection and risk management services that analyse transaction and behavioural data to identify suspicious activity;
• Legal and Regulatory Authorities: Government bodies, regulators, law enforcement agencies, and our licensing authority, where disclosure is required by law or by a valid legal process;
• Professional Advisors: Legal counsel, auditors, and accountants bound by confidentiality obligations, where required for legitimate business and compliance purposes.

All third parties with whom u899 shares personal data are contractually required to implement appropriate data security measures and to use the data only for the specified purpose. u899 does not permit third-party service providers to use your personal data for their own marketing purposes.

u899 uses cookies and similar tracking technologies to operate core Platform functions and to understand how the Platform is used. The cookies deployed by u899 fall into the following categories:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and cookies that remember your language and currency preferences. These cannot be disabled without breaking Platform functionality;
• Functional Cookies: Enhance your experience by remembering personalisation settings, game preferences, and responsible gaming tool configurations you have applied to your account;
• Analytics Cookies: Used to understand aggregate usage patterns — for example, which games are most popular or where users encounter technical issues. Analytics data is processed in aggregated, anonymised form;
• Security Cookies: Help detect and prevent fraudulent logins, bot activity, and other security threats by analysing session behaviour patterns.

u899 does not deploy third-party advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to use the Platform normally.

u899 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or our licensing authority. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of 5 years following account closure, as required for AML compliance and gaming regulatory record-keeping;
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping requirements;
• KYC Documents (CNIC images, selfies): Retained for the duration of your account plus 5 years post-closure. Verification photographs processed by our KYC partner for liveness checks are deleted within 30 days of verification;
• Gaming Activity Logs: Retained for 5 years from the date of each session to support dispute resolution and regulatory compliance;
• Support Communications: Retained for 2 years from the date of each interaction for quality assurance and complaint management purposes;
• Marketing Consent Records: Retained for the duration of your account to provide evidence of consent and opt-out status.

Where u899 no longer has a lawful basis to retain personal data, it is securely deleted or anonymised in accordance with u899's data disposal procedures.

u899 implements a multi-layered approach to data security, encompassing technical, organisational, and procedural controls designed to protect your personal information from unauthorised access, loss, or misuse.

Technical Measures include:

• TLS/SSL 256-bit encryption for all data in transit between your device and u899 servers;
• AES-256 encryption for sensitive data stored in u899 databases;
• Multi-factor authentication options for Player account access;
• Automated intrusion detection and prevention systems monitoring for anomalous activity;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Segregated server architecture ensuring Player funds and Player data are held in systems separate from u899's operational infrastructure.

Organisational Measures include:

• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Mandatory data privacy training for all personnel with access to personal data;
• Confidentiality obligations in all staff and contractor agreements;
• A documented data breach response procedure with regulatory notification protocols.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, u899 will notify you without undue delay in accordance with applicable data protection law.

Subject to applicable data protection law, you have the following rights in respect of your personal data held by u899:

• Right of Access: You may request a copy of the personal data u899 holds about you, together with information about how it is processed;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data u899 holds about you;
• Right to Erasure: You may request deletion of your personal data where u899 no longer has a lawful basis to retain it. Note that certain data must be retained for legal and regulatory compliance and cannot be deleted on request;
• Right to Restriction: You may request that u899 restrict the processing of your personal data in certain circumstances, for example while an accuracy dispute is resolved;
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your personal data in a commonly used, machine-readable format;
• Right to Object: You may object to u899's processing of your personal data where that processing is based on legitimate interests, including objecting to direct marketing at any time;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please submit a written request to u899 support at the contact details in Section 14. u899 will respond within 30 days of receipt. For complex or multiple requests, this period may be extended by a further 60 days with notification.

u899 may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to, or amended at the request of, an unauthorised party.

u899 may send you promotional communications about bonuses, new games, seasonal promotions, and platform updates where you have provided consent to receive such communications or where u899 has a legitimate interest to do so (for example, informing existing registered players of material platform updates).

u899 may use the following channels for marketing communications: email to your registered email address; SMS to your registered mobile number; and in-platform notification banners visible when you are logged in.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email;
• Replying STOP to any marketing SMS;
• Updating your notification preferences in your u899 account settings under "Communications";
• Contacting u899 support with a written request to remove you from marketing lists.

Opting out of marketing communications does not affect transactional communications, which include payment confirmations, security alerts, KYC requests, and responsible gaming notifications. These are part of your account service and cannot be disabled.

u899 is strictly an adult platform. Registration and use of u899 is prohibited for individuals under the age of 21. u899 does not knowingly collect, process, or retain personal data relating to individuals under 21 years of age.

If u899 discovers or is notified that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, all personal data associated with the account will be deleted (subject to any mandatory legal retention obligations), and any funds held in the account will be returned via the original deposit method following identity verification of the account holder.

If you are a parent or guardian and believe that a minor under your care has registered an account with u899, please contact u899 support immediately at the details provided in Section 14. u899 will investigate and take appropriate action without delay.

u899 operates internationally and your personal data may be transferred to, stored, or processed in countries outside Pakistan. These countries may have data protection laws that differ from those applicable in Pakistan.

Where u899 transfers personal data internationally, we ensure that appropriate safeguards are in place to protect that data. These safeguards may include:

• Transferring data only to countries or organisations that provide an adequate level of data protection as recognised by applicable data protection frameworks;
• Implementing standard contractual clauses or equivalent contractual protections with the receiving party;
• Ensuring that recipients are bound by data processing agreements that require them to apply security measures equivalent to those applied by u899.

The primary categories of international transfers made by u899 are to KYC and identity verification partners, payment processor technology providers, and cloud infrastructure providers hosting u899's gaming platform. All such transfers are subject to the safeguards described above.

You may request further information about the specific safeguards applied to international transfers of your personal data by contacting u899 support at the details in Section 14.

u899 may update this Privacy Policy from time to time to reflect changes in our data practices, platform functionality, or applicable legal requirements. The effective date at the top of this page will be updated whenever material changes are made.

Where changes are material — meaning they significantly affect how u899 processes your personal data or the rights available to you — u899 will notify registered players by email to their registered address and/or by a prominent in-platform notification at least 14 days before the changes take effect.

For minor or administrative updates (such as clarifying existing language without changing the substance of our practices), u899 may update the policy without advance notification, though the effective date will always reflect when the update was made.

Continued use of the u899 Platform after the effective date of any Privacy Policy update constitutes acceptance of the revised policy. If you do not agree with changes to this Privacy Policy, you should cease using the Platform and may close your account by contacting u899 support.

The current version of this Privacy Policy is always accessible at u899.app/privacy-policy. We recommend reviewing it periodically to stay informed of how your data is handled.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or want to raise a concern about how u899 has handled your personal data, please contact u899 using the following details:

• Email: [email protected]
• Live Chat: Available 24/7 via the Platform at u899.app
• Subject line for data requests: "Data Subject Request – [Your Registered Name]"

u899 will acknowledge your request within 3 business days and will respond in full within 30 days. If your request is complex or involves multiple data points, u899 may extend this period by up to 60 days with advance notification to you.

If you are not satisfied with u899's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction, or to the supervisory authority in the country in which u899's licensing authority operates.