bp999 Privacy Policy — How We Protect Your Personal Data

In this Privacy Policy, the following terms shall carry the meanings assigned below unless the context requires otherwise:

• "bp999" / "we" / "us" / "our" — refers to bp999.im and the legal entity operating the platform under an international gaming licence.
• "Platform" — refers to the bp999 website accessible at bp999.im, including all subpages, account portals, gaming interfaces, and associated mobile-optimised experiences.
• "User" / "you" / "your" — any natural person who visits, registers on, or uses the bp999 Platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, either alone or in combination with other information.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "KYC" — Know Your Customer procedures, including identity verification, age verification, and source of funds checks, carried out in accordance with bp999's international gaming licence obligations.
• "Cookies" — small data files placed on a User's browser or device by the bp999 Platform for the purposes described in Clause 9.
• "Third-Party Processor" — any external service provider engaged by bp999 to process Personal Data on bp999's behalf, including payment processors, game providers, and KYC service providers.

bp999 acts as the data controller in respect of all Personal Data collected from Users of bp999.im. As data controller, bp999 determines the purposes and means of processing your Personal Data and is responsible for ensuring that such processing is carried out in compliance with applicable data protection law and the data protection obligations arising under bp999's international gaming licence.

If you have any questions about how bp999 processes your Personal Data, or wish to exercise any of the rights described in Clause 10, please contact bp999's data protection point of contact using the details provided in Clause 15 of this Policy.

bp999 collects the categories of Personal Data described in the table below. The data collected depends on the nature of your interaction with the Platform — some categories are collected from all visitors, while others are only collected from registered account holders.

bp999 does not intentionally collect sensitive personal data (such as biometric data, health data, or political opinions) beyond what is strictly necessary for age verification purposes in connection with its KYC obligations under the international gaming licence.

bp999 collects Personal Data through the following channels and methods:

• Directly from you: When you register an Account on bp999.im, complete KYC verification, make a deposit or withdrawal, contact customer support via live chat or email, respond to surveys, or submit a complaint.
• Automatically: Technical and Usage Data is collected automatically through cookies, web beacons, log files, and analytics tools when you visit bp999.im or interact with the Platform, regardless of whether you are a registered user.
• From third-party service providers: bp999 may receive data about you from identity verification providers (for KYC), payment processors (for transaction verification), and fraud prevention services, where such data is necessary for the purposes described in Clause 5.
• From publicly available sources: In limited circumstances and where permitted by law, bp999 may verify Personal Data against publicly available records, including government identity registries, for fraud prevention and AML compliance purposes.

bp999 processes your Personal Data for the following purposes. Each purpose is supported by a specific legal basis as described below:

bp999 does not sell your Personal Data to third parties for their own marketing or commercial purposes. bp999 may share your Personal Data with the following categories of third parties, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 processing partners — for the purpose of executing and verifying financial transactions on your Account.
• KYC and identity verification providers: Third-party services engaged to verify the identity and age of registered users in compliance with bp999's international gaming licence KYC obligations.
• Game and platform technology providers: Licensed game providers and software suppliers whose products are integrated into the bp999 Platform, where necessary for game outcome verification and RNG certification.
• Fraud prevention and AML screening services: Third-party services used to screen transactions and account behaviour against fraud and money laundering risk indicators.
• Analytics and platform optimisation providers: Services used to analyse Platform usage, improve user experience, and diagnose technical issues — operating on anonymised or pseudonymised data where possible.
• Legal and regulatory authorities: bp999 may be required to disclose Personal Data to law enforcement agencies, gaming regulatory bodies, financial intelligence units, or other public authorities where required by law or where bp999 is compelled to do so under the obligations of its international gaming licence.

All third-party processors engaged by bp999 are required to process Personal Data only in accordance with bp999's instructions and to implement appropriate technical and organisational security measures. bp999 does not permit third-party processors to use your Personal Data for their own independent purposes beyond the scope of the services they provide to bp999.

bp999 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or for such longer period as is required by applicable law or bp999's regulatory obligations. The following general retention principles apply:

• Account data and transaction records: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, in accordance with standard AML and gaming licence record-keeping requirements.
• KYC verification documents: Retained for a minimum of five (5) years from the completion of the KYC process or the closure of the associated Account, whichever is later.
• Customer support communications: Retained for a minimum of three (3) years from the date of the communication, to enable dispute resolution and quality monitoring.
• Responsible gaming records: Retained for a minimum of five (5) years from the date of the relevant entry, to support compliance verification and player protection monitoring.
• Technical and usage data (cookies/analytics): Retained for periods aligned with the specific cookie type as described in Clause 9, typically ranging from session-only to twenty-four (24) months.

Upon expiry of the applicable retention period, bp999 will securely delete or anonymise your Personal Data in a manner that prevents recovery or reconstruction.

bp999 implements appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption applied to all data transmissions between your device and bp999.im;
• Encrypted storage of sensitive data fields including CNIC numbers, financial account references, and KYC documentation;
• Access controls limiting Personal Data access to authorised bp999 personnel and third-party processors on a strict need-to-know basis;
• Multi-factor authentication for all internal bp999 systems that hold or process Personal Data;
• Regular security audits and penetration testing of the bp999 Platform and underlying infrastructure;
• OTP and device verification requirements to protect individual user accounts from unauthorised access.

While bp999 takes all reasonable steps to protect your data, no online platform can guarantee absolute security against all forms of cyber attack. You are responsible for maintaining the security of your own Account credentials. bp999 strongly recommends using a unique, strong password and enabling OTP or biometric login on your bp999 Account.

bp999.im uses cookies and similar tracking technologies (including web beacons and local storage) to operate the Platform effectively, improve user experience, and generate analytics data. Cookies are small text files stored on your browser or device when you visit the Platform.

bp999 uses the following categories of cookies:

Strictly necessary cookies cannot be disabled as they are essential to Platform operation. You may manage your preferences for all other cookie categories through your browser settings. Disabling analytics or functional cookies may affect certain Platform features but will not prevent access to your Account or Gaming Products.

bp999 does not use cookies for third-party advertising or behavioural targeting purposes.

Subject to applicable law and any overriding obligations arising from bp999's international gaming licence (including AML and KYC record-keeping requirements), you have the following rights in respect of your Personal Data held by bp999:

• Right of Access: You may request a copy of the Personal Data bp999 holds about you, together with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data held by bp999 be corrected or completed without undue delay.
• Right to Erasure: In certain circumstances, you may request that bp999 delete your Personal Data. This right is subject to overriding retention obligations under gaming and AML regulations.
• Right to Restriction: You may request that bp999 restrict the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or have objected to its processing.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract and is carried out by automated means, you may request that bp999 provide your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing based on bp999's legitimate interests at any time. bp999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact bp999 using the details provided in Clause 15. bp999 will respond to all verified rights requests within 30 days of receipt. In complex cases, this period may be extended by a further two months, in which case bp999 will notify you of the extension and the reasons for it within the initial 30-day period.

bp999 does not knowingly collect, process, or retain the Personal Data of any individual under the age of 21. The bp999 Platform is strictly intended for adults aged 21 and above, and access by minors is prohibited at all times.

Age verification through CNIC-based KYC is applied to every registered Account before real-money play is permitted. Any Account found to be held by a person under the age of 21 will be immediately suspended, all associated funds will be frozen, and the Personal Data of the minor will be processed only as necessary to fulfil bp999's legal reporting obligations before being securely deleted.

If you believe that a person under the age of 21 has registered an Account on bp999 or that a minor has gained access to your Account, please notify bp999 immediately at [email protected]. bp999 takes all such reports seriously and will investigate and respond promptly.

bp999 also recommends that parents and guardians of minors install appropriate parental control software on shared devices to prevent inadvertent access to online gaming platforms. bp999 cannot be held responsible for a minor's access to the Platform where that access was facilitated by a registered adult using their own verified Account.

The bp999 Platform does not contain links to external third-party websites for general browsing purposes. To the limited extent that any reference to an external organisation or service appears within the Platform (for example, in responsible gaming guidance), bp999 does not control the privacy practices of any such external website and accepts no responsibility for how those websites collect, process, or protect your Personal Data.

If you navigate to any external website from a reference within the bp999 Platform, you should review that website's own privacy policy before providing any Personal Data. bp999's Privacy Policy applies solely to Personal Data processed in connection with bp999.im and the bp999 Account.

As an internationally licensed gaming platform serving Pakistani players, bp999 may transfer your Personal Data to and process it in countries outside Pakistan. This may occur, for example, where bp999's game providers, KYC verification services, or infrastructure hosting is located in a different jurisdiction.

Where Personal Data is transferred outside Pakistan, bp999 ensures that appropriate safeguards are in place to protect your data, including:

• Transfers to countries that provide an equivalent level of data protection under applicable law;
• Use of contractual data transfer agreements (equivalent to standard contractual clauses) with third-party processors in jurisdictions that do not provide an equivalent level of data protection;
• Ensuring all international third-party processors are bound by data protection obligations consistent with this Privacy Policy.

By using the bp999 Platform and accepting this Privacy Policy, you consent to the international transfer of your Personal Data in accordance with the safeguards described above.

bp999 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, the scope of bp999's data processing activities, or the features and services offered on the Platform.

Where material changes are made to this Privacy Policy, bp999 will notify registered users by posting a prominent notice on bp999.im and, where practicable, by direct communication to the email address or mobile number registered on the User's Account. In cases where immediate amendment is required by law or regulatory direction, changes may take effect without advance notice.

The effective date displayed at the top of this Privacy Policy indicates when it was last updated. Continued use of the bp999 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

Previous versions of this Privacy Policy may be requested by contacting bp999 support using the details in Clause 15.

All data protection queries, rights requests, and privacy-related complaints should be directed to bp999 through the following channels:

• Email: [email protected] — subject line "Data Protection Request" (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the bp999.im account dashboard
• Response Time: bp999 acknowledges all data protection requests within 5 business days and provides a full response within 30 days.
• Platform: bp999.im

If you are not satisfied with bp999's response to a data protection complaint, you have the right to lodge a complaint with the relevant supervisory authority in the jurisdiction applicable to your situation. bp999 encourages Users to contact bp999 directly in the first instance so that we have the opportunity to resolve any concern before it is escalated to a regulatory body.