cr999 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") explains how cr999 ("cr999", "we", "us", "the Platform") collects, uses, stores, shares, and protects personal data obtained from users ("you", "User") of the cr999 website at cr999.asia and all associated services.

cr999 is committed to handling personal data responsibly and in accordance with applicable data protection principles. This Policy is intended to be clear and readable — not a document designed to obscure what happens with your information. If at any point something is unclear, please contact us at [email protected].

By registering an account on cr999, logging into the platform, or using any cr999 service, you acknowledge that you have read this Policy and consent to the collection and use of your personal data as described herein. This Policy should be read alongside the cr999 Terms & Conditions.

2. Data We Collect

cr999 collects personal data in the following categories, depending on how you interact with the platform:

2.1 Data You Provide Voluntarily

Most identity and contact data is provided directly by you during the registration process, account updates, or KYC document submission. You are responsible for the accuracy of data you provide to cr999. Inaccurate data may delay KYC verification or withdrawal processing.

2.2 Data Collected Automatically

Technical and usage data is collected automatically when you interact with the cr999 platform, through server logs, cookies, and similar technologies. This data does not typically identify you as a named individual but may be linked to your account for fraud prevention and platform security purposes.

3. How We Use Your Data

cr999 uses your personal data for the following purposes:

• Account management: Creating and maintaining your cr999 account, authenticating logins, and communicating important account notices.
• Service delivery: Processing bets, game sessions, deposits, and withdrawals. Calculating and crediting winnings to your PKR balance.
• Identity verification (KYC): Verifying your identity and age (18+) as required for responsible gaming compliance and anti-money-laundering obligations.
• Fraud prevention and security: Detecting and preventing fraudulent activity, multi-accounting, money laundering, and other prohibited conduct. Analysing unusual patterns in account behaviour.
• Responsible gaming: Monitoring account activity for indicators of problem gambling behaviour and administering self-exclusion, deposit limit, and cooling-off requests.
• Customer support: Responding to support enquiries, processing complaints, and maintaining records of communications.
• Platform analytics: Understanding how users interact with cr999 in order to improve product quality, game selection, and payment performance. Analytics are conducted on aggregated or anonymised data where possible.
• Legal and regulatory compliance: Meeting obligations under applicable laws, responding to lawful requests from regulatory or law enforcement authorities.

4. Legal Basis for Processing

Where data protection law requires cr999 to identify a legal basis for processing your personal data, we rely on the following:

• Contract performance: Processing necessary to provide the cr999 platform services as described in the Terms & Conditions — account management, bet processing, payments.
• Legal obligation: Processing required to comply with applicable anti-money-laundering laws, age verification requirements, tax reporting, and regulatory obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where our legitimate interests do not override your rights and freedoms.
• Consent: Where you have given specific consent — for example, for optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Third Parties

cr999 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. cr999 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and USDT network providers — to process your deposits and withdrawals. These providers have their own privacy policies governing their handling of your data.
• KYC and identity verification providers: Third-party services used to verify the identity, age, and document authenticity of registered users as part of responsible gaming and anti-money-laundering compliance.
• Fraud prevention services: Service providers that analyse transaction data and usage patterns to detect and prevent fraudulent activity.
• Game software providers: Casino game and sports data providers may receive limited technical data (e.g. session tokens) necessary to deliver their games or betting markets within the cr999 platform.
• Regulatory and law enforcement authorities: cr999 may disclose personal data to regulatory bodies or law enforcement agencies where required to do so by applicable law, court order, or regulatory obligation.

All third-party data processors used by cr999 are contractually required to handle your personal data securely and only for the specific purposes for which they have been engaged.

6. Cookies & Tracking Technologies

cr999 uses cookies and similar tracking technologies on the cr999.asia website. Cookies are small text files stored on your device when you visit a website. cr999 uses the following categories of cookies:

You may control cookie settings through your browser. Note that disabling strictly necessary cookies will impair your ability to use the cr999 platform. cr999 does not use cookies to serve advertising from third-party ad networks.

7. Data Retention

cr999 retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, including the duration of your active cr999 account and any legally mandated retention period that applies after account closure.

• Account and identity data is retained for a minimum of five (5) years following account closure, as typically required for anti-money-laundering and gaming regulatory compliance.
• Transaction and financial records are retained for a minimum of five (5) years following the date of the transaction.
• Support correspondence is retained for three (3) years following the date of the communication.
• Technical log data is retained for up to twelve (12) months unless a specific investigation requires longer retention.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

8. Data Security

cr999 implements technical and organisational security measures designed to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• HTTPS encryption for all data transmitted between your device and cr999 servers.
• Encryption of sensitive personal data at rest within cr999 databases.
• Role-based access controls ensuring cr999 staff only access personal data to the extent necessary for their function.
• Regular security assessments of the cr999 platform infrastructure.
• Payment data tokenisation — cr999 does not store full payment account numbers or credentials for JazzCash, Easypaisa, or bank accounts.

Notwithstanding these measures, no system is completely immune to security incidents. In the event of a data breach that poses a material risk to your rights, cr999 will notify affected users in accordance with applicable legal requirements. You also play a role in securing your account — use a strong, unique password and never share your cr999 login credentials.

9. Your Rights

Subject to applicable law, you have the following rights with respect to your personal data held by cr999:

• Right of access: Request a copy of the personal data cr999 holds about you.
• Right of rectification: Request correction of inaccurate or incomplete personal data.
• Right of erasure: Request deletion of your personal data, subject to cr999's legal retention obligations (e.g. anti-money-laundering record-keeping requirements may prevent immediate deletion).
• Right to restrict processing: Request that cr999 limit how it processes your data in certain circumstances.
• Right to data portability: Request that cr999 provide your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (e.g. marketing communications), withdraw that consent at any time without affecting prior lawful processing.
• Right to object: Object to processing of your personal data carried out on the basis of legitimate interests.

To exercise any of these rights, contact cr999 at [email protected] with your registered username and a description of your request. cr999 will respond within a reasonable timeframe and in accordance with applicable legal obligations.

10. Children & Minors

cr999 is strictly intended for adults aged 18 years and above. cr999 does not knowingly collect personal data from individuals under the age of 18. If cr999 becomes aware that personal data has been collected from a minor, that data will be deleted promptly and the associated account will be suspended.

11. Changes to This Policy

cr999 may update this Privacy Policy from time to time to reflect changes in platform operations, applicable laws, or data protection best practices. Material changes will be communicated to registered users via the email address on file or by a prominent notice on the cr999 platform prior to the change taking effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. Continued use of cr999 following a revision constitutes your acceptance of the updated Policy. We encourage you to review this page periodically.

12. Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by cr999, please contact:

Please include your registered cr999 username and a clear description of your query or request. For data subject access requests or deletion requests, identity verification may be required before cr999 can process your request.