sz999
Privacy Policy

The data controller responsible for personal data collected through the sz999 platform is the operator of sz999, acting under its international gaming license. By "data controller" we mean the entity that determines the purposes and means of processing your personal data — that entity is sz999, operating the platform accessible at sz999.bio.

sz999 processes personal data in accordance with the requirements of its international gaming license, which mandates specific data protection standards as a condition of the license. These standards are independently audited by the licensing authority.

sz999 collects personal data in two principal categories: data you provide directly to us, and data we collect automatically as a result of your use of the platform. The following table summarises the categories of personal data sz999 collects and the purposes for which each category is used.

sz999 collects personal data through the following channels and methods:

• Direct registration: When you create an sz999 account, you provide identity data, contact data, and marketing preferences directly through the registration form.
• KYC submission: Identity documentation (CNIC scan, address proof) is collected when you submit KYC verification, either proactively or upon reaching transaction thresholds that trigger a verification requirement.
• Payment transactions: Financial data is collected each time you initiate a deposit or withdrawal through JazzCash, EasyPaisa, or any other accepted payment method.
• Platform usage: Technical data including IP address, device fingerprint, and session data is collected automatically through standard platform operation whenever you access the sz999 site or casino games.
• Cookies and similar technologies: Session cookies and persistent cookies collect browsing behaviour data as described in Section 7 of this Privacy Policy.
• Support interactions: Communications data is generated whenever you contact sz999 via email, live chat, or any other support channel.
• Third-party KYC providers: In some cases, identity verification data may be supplemented by data obtained from licensed third-party identity verification services engaged by sz999 for KYC purposes.

sz999 processes your personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to perform the contract between you and sz999 — including account creation, game access, deposit processing, withdrawal processing, and customer support — is carried out on the basis of contractual necessity.
• Legal obligation: sz999 is subject to mandatory data processing requirements under its international gaming license, including KYC data collection, AML transaction monitoring, and data retention obligations. Processing carried out to satisfy these requirements is based on legal obligation.
• Legitimate interests: sz999 processes certain technical and gaming activity data on the basis of legitimate interests, including fraud detection, platform security, responsible gaming monitoring, and abuse prevention.
• Consent: Marketing communications are sent only where you have separately and explicitly consented to receive them. Consent is freely given, specific, informed, and revocable at any time without penalty.

sz999 uses your personal data for the following specific purposes:

• Creating and maintaining your sz999 account, including your PKR wallet balance and transaction history.
• Authenticating your identity at login, including supporting two-factor authentication (2FA) delivery to your registered Pakistani mobile number.
• Processing your PKR deposits and withdrawals through JazzCash, EasyPaisa, and other accepted payment methods.
• Administering bonuses, promotions, and loyalty programme participation in accordance with applicable terms.

• Verifying your identity through the KYC process as required by sz999's gaming license.
• Monitoring account and transaction activity for indicators of money laundering, fraud, or other financial crime, as required by the licensing authority.
• Maintaining required regulatory records of transactions, KYC data, and gaming activity for the mandatory retention periods specified by the licensing authority.

• Monitoring gaming behaviour patterns to identify indicators of potential problem gambling and applying responsible gaming interventions where appropriate, in fulfilment of sz999's licensing obligations.
• Administering self-exclusion, deposit limit, loss limit, and session time tools at your request.

• Responding to account enquiries, disputes, withdrawal requests, and complaint escalations.
• Maintaining records of support interactions for quality assurance and regulatory dispute resolution purposes.

• Sending promotional communications about sz999 offers, PSL cricket betting promotions, casino bonuses, and platform news — only to users who have separately and explicitly opted in to marketing communications.
• Marketing communications are never sent on the basis of inferred or assumed consent.

sz999 does not sell, rent, or share your personal data with third parties for their own marketing purposes. We disclose personal data only in the following circumstances and only on a minimum-necessary basis:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processing partners receive the minimum transaction data required to process your deposits and withdrawals. These providers are bound by their own regulatory frameworks and data protection obligations.
• Identity verification providers: Licensed KYC and AML compliance service providers may receive identity data to verify your CNIC and supporting documentation. These providers act as data processors under written agreements with sz999.
• Regulatory authorities: sz999 is required by its gaming license to provide transaction data, player data, and compliance reports to the licensing authority upon request. This disclosure is a legal obligation, not a voluntary decision.
• Law enforcement: Personal data may be disclosed to law enforcement authorities in response to a valid legal process, court order, or where sz999 has a good-faith belief that disclosure is necessary to prevent serious harm or illegal activity.
• Platform infrastructure providers: Cloud hosting, server infrastructure, and cybersecurity service providers may process data on sz999's behalf under strict data processing agreements that prohibit independent use of the data.

sz999 uses cookies and similar tracking technologies to operate the platform, maintain your login session, detect fraud, and — where you have consented — improve your experience through preference-based functionality.

• Strictly necessary cookies: Required for the sz999 platform to function. These include session authentication cookies that keep you logged in during your gaming session. These cookies cannot be disabled without preventing platform access. No consent is required for strictly necessary cookies.
• Security cookies: Used to detect and prevent fraud, unauthorized access, and bot activity. These are operational requirements and cannot be disabled.
• Functional cookies: Store your stated preferences (e.g., language settings, last game lobby position). These are active by default but can be disabled through your browser settings, though this may reduce platform convenience.
• Analytics cookies: Used to understand aggregate platform usage patterns — which game categories are most visited, average session length, technical error rates. These cookies use anonymised or pseudonymised data. You may opt out of analytics cookies.
• Marketing cookies: Active only where you have explicitly consented to marketing communications. These cookies support the delivery of relevant promotional content about sz999 offers. They may be withdrawn at any time through account settings.

You may control cookie settings through your browser preferences at any time. Note that disabling certain cookie categories may impair platform functionality, including your ability to maintain a logged-in session during a gaming session.

sz999 retains personal data for defined periods based on the purpose of processing and the mandatory retention requirements of our gaming license. The key retention periods applicable to sz999 user data are as follows:

• KYC and identity documents: Retained for a minimum of 5 years from the date of account closure, as required by anti-money-laundering regulations applicable under sz999's gaming license.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, for financial crime compliance purposes.
• Gaming activity records: Retained for a minimum of 5 years from the date of account closure for regulatory audit purposes.
• Account data (non-KYC): Retained for the duration of the active account relationship plus 2 years post-closure for dispute resolution purposes, unless a longer retention period is required by law.
• Marketing consent records: Retained for 3 years from the date of last marketing interaction, or until consent is withdrawn, whichever is earlier.
• Support communication records: Retained for 2 years from the close of each support case for quality assurance and regulatory dispute evidence purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked to your identity. Anonymised aggregate data (e.g., platform usage statistics) may be retained indefinitely as it no longer constitutes personal data.

sz999 implements a multi-layered data security framework designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. The key security measures in place include:

• AES-256 encryption at rest: All personal data stored on sz999 servers is encrypted using AES-256 encryption, including database records, document storage, and backup systems.
• TLS 1.3 in transit: All data transmitted between your device and the sz999 platform is protected by TLS 1.3, ensuring that data cannot be intercepted in transit.
• Access controls: Access to personal data within sz999 is restricted on a strict need-to-know basis. Only staff members with a specific operational need to access personal data are granted access, and all access is logged and auditable.
• Two-factor authentication: sz999's internal systems require multi-factor authentication for all staff access to personal data systems.
• Penetration testing: sz999 commissions periodic independent penetration tests of its platform infrastructure to identify and remediate security vulnerabilities before they can be exploited.
• Data breach response: In the event of a personal data breach, sz999 is required by its licensing authority to notify the regulator within 72 hours. Affected users will be notified without undue delay where the breach presents a high risk to their rights and freedoms.

sz999 operates under an international gaming license and utilises cloud infrastructure and service providers that may process personal data in jurisdictions outside Pakistan. When personal data is transferred internationally, sz999 ensures that appropriate safeguards are in place to protect that data to the same standard required by our licensing authority's data protection framework.

Safeguards used for international transfers include contractual data protection clauses in all service provider agreements, with obligations equivalent to those imposed on sz999 under its licensing requirements. Payment processors such as JazzCash and EasyPaisa operate within Pakistan and are subject to Pakistani financial regulation. Any international processor receives only the minimum data necessary for the specific service they provide.

The sz999 platform is strictly restricted to persons aged 21 years or older. sz999 does not knowingly collect personal data from individuals under the age of 21. All account registrations are subject to mandatory CNIC-based age verification as part of the KYC process.

If sz999 becomes aware that personal data has been collected from a person under 21 — whether through a missed verification or false documentation — that account will be permanently suspended immediately, all data associated with the account will be flagged for mandatory regulatory retention in line with the applicable compliance requirements, and any funds in the account will be handled in accordance with sz999's underage account policy as specified in the Terms & Conditions.

If you believe an account may have been created by a person under 21, please report this to sz999 support immediately at [email protected].

You may exercise any of the data rights described in this Privacy Policy by submitting a written request to sz999 at [email protected] with the subject line "Data Protection Request". Please include your registered email address and a description of the right you wish to exercise in your request.

sz999 will acknowledge your request within 72 hours. Requests are fulfilled within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case sz999 will notify you of the extension and the reasons for it within the initial 30-day period.

sz999 will not charge a fee for processing data subject requests unless the request is manifestly unfounded or excessive, in which case sz999 may charge a reasonable fee or decline to act on the request, with a written explanation provided to you.

sz999 sends marketing communications — including promotional offers, cricket betting bonus alerts, PSL season promotions, and platform news — only to registered users who have explicitly opted in to receiving such communications during or after the registration process.

You may withdraw your consent to receive marketing communications at any time by updating your communication preferences in your sz999 account settings, or by contacting sz999 support directly. Withdrawal of marketing consent does not affect the delivery of account-related operational communications, which are sent irrespective of marketing preferences (e.g., deposit confirmations, withdrawal notifications, account security alerts).

Marketing consent is specific to each channel — email, SMS, and in-platform notifications are managed separately. You may opt out of one channel while remaining opted in to others.

sz999 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in our licensing requirements, or updates in applicable law. When material amendments are made to this policy, sz999 will notify registered users by prominently displaying a notice on the platform and, where the change materially affects your rights, by email notification to your registered address.

The effective date of the current version of this Privacy Policy is displayed at the top of this page. It is your responsibility to review this Privacy Policy periodically. Your continued use of the sz999 platform following the effective date of any amended Privacy Policy constitutes your acceptance of the updated version.

For all data protection enquiries, subject access requests, and privacy-related complaints, please contact sz999 using the details below:

If you are not satisfied with sz999's response to a data protection complaint, you have the right to escalate your complaint to the data protection supervisory authority associated with sz999's licensing jurisdiction. This escalation right is independent of — and does not replace — your right to seek judicial remedy through the courts.

sz999 is committed to resolving all data protection complaints promptly and transparently. We encourage you to raise any concerns directly with sz999 in the first instance, as this typically results in the fastest resolution.