This Privacy Policy ("Policy") describes how 9yyyy ("9yyyy", "we", "us", "our"), the operator of the online gaming platform at https://9yyyy.app, collects, processes, stores, and protects personal data relating to users ("you", "your", "Player", "Member") who access or use any part of the 9yyyy platform, including through web browsers, mobile browsers, or any other access method.
This Policy applies to all personal data we process in connection with the provision of our services — including account registration, identity verification, deposits, withdrawals, gameplay, customer support interactions, bonus participation, and marketing communications. It should be read alongside our Terms & Conditions, which govern your use of the 9yyyy platform.
9yyyy is committed to handling your personal data responsibly, transparently, and in accordance with applicable international data protection standards. We collect only what is necessary, retain it only for as long as required, and never sell your data to third-party advertisers.
Important: By registering an account on 9yyyy, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please do not register or continue using the platform.
9yyyy is the data controller responsible for the personal data collected through the platform. As data controller, 9yyyy determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable data protection obligations.
For all data protection enquiries, requests to exercise your rights, or concerns about how 9yyyy handles your personal data, please contact our Data Protection Officer (DPO) using the details provided in Section 15 of this Policy.
9yyyy collects personal data in the following categories:
When you create a 9yyyy account, we collect: full legal name, date of birth, gender, Pakistani National Identity Card (CNIC) or NICOP number, username, and password (stored as a salted cryptographic hash — never in plain text).
Email address, Pakistani mobile number (used for OTP verification and account alerts), and residential address including city (e.g., Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, or other Pakistani cities).
As part of our Know Your Customer (KYC) obligations under applicable anti-money laundering standards, we collect: scanned or photographed copies of your CNIC or NICOP (front and back), proof of address documents (utility bills, bank statements not older than 3 months), and selfie photographs taken while holding your identity document.
Transaction records including deposit amounts, withdrawal requests, payment method types (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or other approved Pakistani payment channels), and associated account identifiers (e.g., mobile wallet numbers). We do not store full bank account credentials — payment processing is handled by encrypted third-party payment processors.
Bet history, game session data, win/loss records, bonus usage, wager amounts (in PKR), game preferences, session durations, and responsible gaming tool usage (deposit limits, self-exclusion activations, cool-off periods).
IP address, device type and model, operating system, browser type and version, screen resolution, time zone, referring URL, and session identifiers. This data is collected automatically when you access the platform.
Records of your interactions with 9yyyy customer support (live chat transcripts, support email correspondence), survey responses, and feedback submissions. Communications are retained to ensure continuity of support, resolve disputes, and for quality assurance purposes.
| Category | Examples | Required? |
|---|---|---|
| Identity & Registration | Full name, CNIC, date of birth, username | Mandatory |
| Contact | Email, mobile number, city | Mandatory |
| KYC Documents | CNIC scan, selfie, proof of address | Required for withdrawals |
| Financial | Transaction records, payment method details | Mandatory |
| Gaming & Behavioural | Bet history, session data, game preferences | Automatic |
| Technical & Device | IP address, browser, device type | Automatic |
| Communications | Support chat logs, email threads | When applicable |
9yyyy collects personal data through the following channels:
9yyyy processes your personal data for the following purposes:
To create and maintain your 9yyyy account, authenticate your identity at login, process deposits and withdrawals in PKR, deliver gameplay functionality across cricket betting, live casino, slots, Mini Baccarat, and Ludo Quick, and to personalise your platform experience based on your gaming history and preferences.
To verify your identity, confirm your age (all players must be 21 years of age or older), conduct ongoing transaction monitoring for anti-money laundering (AML) purposes, report to relevant regulatory authorities where required by law, and maintain auditable records of all financial transactions processed on the platform.
To administer and enforce responsible gaming tools including deposit limits, loss limits, session reminders, cool-off periods, and self-exclusion requests. Gaming behaviour data is also used to identify potentially problematic gambling patterns so that 9yyyy support staff can proactively reach out with responsible gaming information.
To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, unauthorised access attempts, and other violations of our Terms & Conditions. Technical and device data plays a central role in our fraud detection systems.
To respond to your enquiries, resolve disputes, process complaints through our formal dispute resolution process, and maintain records of support interactions for quality assurance and training.
Where you have provided explicit consent, to send you promotional communications about bonuses, PSL betting markets, new game launches, cashback offers, and other 9yyyy promotions via email or SMS. You may withdraw your marketing consent at any time through your account settings or by contacting support.
9yyyy does not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances. Data shared with third parties is limited strictly to what is necessary for service delivery, as detailed in Section 7.
9yyyy processes your personal data on the following legal bases, depending on the specific purpose of processing:
9yyyy shares personal data only in the following limited circumstances, and only to the extent strictly necessary for the relevant purpose:
Transaction data is shared with our approved Pakistani payment partners — including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — solely for the purpose of processing deposits and withdrawals. These partners are contractually bound to process data only on 9yyyy's instructions and in accordance with applicable security standards.
KYC documentation (CNIC scans, selfies, proof of address) is shared with accredited identity verification service providers for the purpose of validating your identity against official Pakistani government records. These providers operate under strict data processing agreements with 9yyyy.
9yyyy may disclose personal data to Pakistani or international regulatory authorities, law enforcement agencies, or gaming licensing bodies where required by law, court order, or regulatory requirement. 9yyyy will notify affected users of such disclosures where legally permitted to do so.
Anonymised or pseudonymised technical data (device fingerprints, IP addresses, risk scores) may be shared with specialist fraud prevention and cybersecurity service providers to protect the integrity of the 9yyyy platform and its members.
In the event of a merger, acquisition, restructuring, or sale of 9yyyy's business or assets, personal data may be transferred to the relevant acquirer or successor entity, subject to equivalent data protection commitments. Affected users will be notified prior to any such transfer.
All third-party data processors engaged by 9yyyy are subject to formal Data Processing Agreements (DPAs) that contractually require them to maintain equivalent data protection standards and to process personal data only for the specific purposes authorised by 9yyyy.
9yyyy retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and licensing conditions. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & identity data | 5 years after account closure | Regulatory / AML obligation |
| KYC documents | 5 years after account closure | Legal obligation |
| Financial transaction records | 7 years after transaction date | Legal / tax obligation |
| Gaming history | 3 years after last session | Legitimate interest / dispute resolution |
| Customer support records | 3 years after resolution | Legitimate interest |
| Marketing preferences | Until consent withdrawn | Consent |
| Technical / device logs | 13 months from collection | Legitimate interest / security |
| Self-exclusion records | Permanently, even post-closure | Responsible gaming obligation |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Self-exclusion records are retained permanently to prevent excluded individuals from re-registering — a non-negotiable responsible gaming commitment.
9yyyy employs a layered, defence-in-depth approach to data security that reflects the sensitivity of the financial and identity data we handle on behalf of Pakistani players. Our technical and organisational security measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 9yyyy will notify affected users without undue delay and, where required, report the breach to the relevant supervisory authority within 72 hours of becoming aware.
9yyyy uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:
Essential for the platform to function correctly. These include session authentication tokens, security cookies, and load-balancing identifiers. These cookies cannot be disabled without breaking core platform functionality.
Used to remember your preferences such as language settings, preferred game categories, and responsible gaming tool configurations. These improve your experience but are not essential to core platform operation.
Used to collect anonymised data about how players use the platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is used exclusively to improve the 9yyyy platform experience. Analytics data is not linked to your personal identity.
Device fingerprinting and risk-scoring cookies used by our fraud prevention systems to identify suspicious behaviour patterns and protect the platform and its players from fraudulent activity.
You can manage your cookie preferences through your browser settings. Please note that disabling non-essential cookies will not affect your access to core platform features, but may limit certain personalisation and analytics functions.
Subject to applicable law and the limitations described below, you have the following rights in relation to your personal data held by 9yyyy:
To exercise any of the above rights, please contact our Data Protection Officer at the details listed in Section 15. 9yyyy will respond to all valid requests within 30 calendar days. Where a request is complex or numerous, this period may be extended by a further 60 days, with notice provided to you within the initial 30-day period.
Please note that the right to erasure does not override 9yyyy's legal obligations to retain KYC and financial transaction data for mandatory retention periods under AML and gaming licensing regulations. We will always explain specifically what data we are required to retain and why.
9yyyy strictly prohibits the use of its platform by persons under 21 years of age. The 21+ age restriction is a non-negotiable condition of platform access and reflects both our responsible gaming commitments and the requirements of our international gaming licence.
9yyyy employs a mandatory age and identity verification process (KYC) for all registered accounts. No withdrawal will be processed until age verification is satisfactorily completed. Where 9yyyy has reasonable grounds to believe that a registered user is under 21, the account will be immediately suspended pending verification, and any deposits received from a minor will be refunded in full.
9yyyy does not knowingly collect personal data from individuals under 21. If you believe that a minor has registered on the platform, please notify us immediately at [email protected] and we will investigate and take appropriate action without delay.
As an internationally licensed gaming operator, some of 9yyyy's data processing activities involve the transfer of personal data to service providers and infrastructure partners located outside of Pakistan. Such transfers may occur in connection with cloud hosting, identity verification, fraud prevention, and payment processing services.
Where personal data is transferred internationally, 9yyyy ensures that adequate safeguards are in place, which may include: standard contractual clauses (SCCs) approved by relevant data protection authorities; binding corporate rules where applicable; or transfers to jurisdictions that have been assessed as providing an adequate level of data protection.
For further information about the safeguards applicable to any specific international transfer of your data, please contact our DPO using the details in Section 15.
9yyyy reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. When material changes are made, we will provide notice through a prominent banner on the 9yyyy homepage and, where possible, by email to your registered address, with a minimum of 7 days' advance notice before the revised Policy takes effect.
The "Last Updated" date at the top of this page always reflects the date of the most recent revision. Your continued use of the 9yyyy platform after the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should stop using the platform and close your account before the revised Policy comes into effect.
All prior versions of this Privacy Policy are archived and available upon written request to our DPO.
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 9yyyy, please contact us through the following channels:
When submitting a data rights request, please include your registered email address, your 9yyyy username, and a clear description of your request to enable us to locate your records and respond promptly.
Six concrete ways 9yyyy goes beyond the minimum to keep your personal data safe and your privacy respected on Pakistan's most trusted online gaming platform.
Every connection between your device and 9yyyy is secured with bank-grade 256-bit SSL encryption. Your CNIC details, PKR transactions, and login credentials are never transmitted in plain text.
9yyyy does not sell, rent, or trade your personal data to advertisers, data brokers, or marketing agencies — ever. Your information is used solely to deliver and improve your 9yyyy experience.
9yyyy has a designated Data Protection Officer (DPO) responsible for overseeing all data privacy matters. You can contact the DPO directly at any time with questions, concerns, or rights requests.
We collect only the data that is strictly necessary to deliver our services and meet our regulatory obligations. No unnecessary data categories, no speculative collection — just what is required to run your account safely.
Every category of personal data has a clearly defined retention period — published in this Policy. When data is no longer needed, it is securely deleted or irreversibly anonymised without delay.
Independent third-party penetration testing and security audits are conducted regularly. Any identified vulnerabilities are prioritised and remediated on a defined SLA — your data security is never treated as a static achievement.
As a registered 9yyyy player, you hold meaningful rights over your personal data. Here is a plain-English summary of what you can request at any time.
Request a full copy of all personal data 9yyyy holds about you, delivered within 30 days of your verified request.
Ask us to correct any inaccurate personal data — for example, a misspelled name or wrong address on your account.
Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations.
Ask 9yyyy to pause processing of your data in certain circumstances while a dispute or accuracy query is resolved.
Receive your personal data in a structured, machine-readable format so you can transfer it to another service if you choose.
Object to processing of your data based on legitimate interests, including opting out of any direct marketing at any time.
Now that you understand how 9yyyy protects your data, join thousands of Pakistani players who trust 9yyyy for cricket betting, live casino, and more — with full confidence their privacy is in safe hands.
21+ only | Play Responsibly | All data protected per this Privacy Policy