Privacy Policy — How kp999 Handles Your Personal Data

01 Introduction

This Privacy Policy ("Policy") applies to all personal data processed by kp999 ("the Platform", "we", "us", "our") in connection with the operation of the kp999 online gaming and sports betting platform accessible at kp999.bio and any associated subdomains, mobile-optimised versions, or progressive web applications.

By registering for a kp999 account, logging in to the kp999 platform, or otherwise using any feature of the kp999 service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the kp999 Terms & Conditions and should be read alongside them.

02 Data Controller

For the purposes of applicable data protection legislation, kp999 acts as the data controller with respect to all personal data collected from players using the kp999 platform. As data controller, kp999 determines the purposes for which and the means by which your personal data is processed.

kp999 is an internationally licensed gaming operator. Queries relating to this Policy or the processing of your personal data should be directed to our support team using the contact details set out in Section 14 of this Policy. We will acknowledge all data-related queries within 48 hours and provide a substantive response within 30 calendar days.

03 Categories of Personal Data We Collect

kp999 collects personal data across the following categories:

kp999 does not intentionally collect special category data (such as health data, biometric data, or religious beliefs) unless voluntarily provided by a player in the context of a responsible gaming or self-exclusion request, in which case it is processed solely for that purpose and subject to heightened safeguards.

04 How kp999 Collects Your Data

kp999 collects personal data through the following channels:

• Direct collection: Information you provide when completing the kp999 registration form, submitting KYC documents, making deposits or withdrawal requests, contacting our support team, or configuring responsible gaming settings;
• Automated technical collection: Data collected automatically when you access the kp999 platform, including your IP address, device identifiers, session data, and cookie-based tracking data (see Section 10);
• Third-party sources: Identity verification agencies used for KYC purposes, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) for transaction verification, and fraud prevention services for account security screening.

05 Purpose of Processing & Legal Basis

The following table sets out the specific purposes for which kp999 processes your personal data and the legal basis for each processing activity:

06 Data Sharing with Third Parties

kp999 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of third parties only where strictly necessary for the purposes described above:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and any other payment service provider used to process your deposit or withdrawal. Data shared is limited to the minimum required to complete the transaction and comply with anti-money-laundering requirements.
• Identity verification providers: Third-party KYC/AML services used to verify the identity, age, and address of kp999 account holders as required under our licensing conditions.
• Game software providers: Licensed third-party game studios whose titles are available on the kp999 platform may receive anonymised or pseudonymised gameplay data for the purpose of game performance monitoring and regulatory compliance. These providers are contractually prohibited from using such data for independent marketing purposes.
• Fraud and security services: Specialist providers engaged to monitor for account abuse, suspicious login activity, and financial crime. Data shared is subject to strict confidentiality obligations.
• Regulatory authorities: kp999's licensing authority and other relevant regulators may require disclosure of certain player data as a condition of our operating licence. kp999 will comply with all lawful regulatory disclosure requests.
• Professional advisers: Lawyers, auditors, and accountants bound by legal professional privilege and confidentiality obligations, where disclosure is necessary to obtain professional advice in connection with kp999's operations.

All third-party data processors engaged by kp999 are subject to written data processing agreements that require them to process your data only on kp999's documented instructions and to implement appropriate technical and organisational security measures.

07 International Data Transfers

kp999 may transfer personal data to servers or third-party processors located outside Pakistan. Where such transfers occur, kp999 ensures that appropriate safeguards are in place to protect your data to an equivalent standard as required under applicable data protection law. Safeguards employed include:

• Standard contractual clauses approved by competent supervisory authorities;
• Transfers to jurisdictions that have been determined to provide an adequate level of protection for personal data;
• Binding corporate rules where applicable to intra-group transfers within the kp999 corporate structure.

For further information about the safeguards applied to any specific international transfer of your personal data, please contact kp999 support using the details in Section 14.

08 Data Retention

kp999 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods imposed by our licensing and legal obligations:

• Account and identity data: Retained for a minimum of five (5) years following account closure, as required under anti-money-laundering regulations applicable to licensed gaming operators.
• Transaction data: Retained for a minimum of five (5) years from the date of each transaction for financial crime compliance and audit purposes.
• KYC documents: Retained for the duration of account activity plus five (5) years following account closure.
• Communications data: Live chat transcripts and support correspondence retained for two (2) years from the date of the interaction, unless related to an ongoing dispute or regulatory investigation.
• Responsible gaming records: Retained for the duration of any active self-exclusion order plus five (5) years, to prevent re-registration by self-excluded players.
• Technical and usage data: Aggregated anonymised analytics retained indefinitely; personally identifiable technical logs retained for a maximum of twelve (12) months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

09 Security Measures

kp999 implements the following technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration:

• 256-bit SSL/TLS encryption on all data transmitted between player devices and kp999 servers, including login pages, payment pages, and all authenticated sessions;
• Encryption at rest for all databases containing personal data and financial records;
• Role-based access controls limiting internal access to personal data to authorised kp999 personnel who require it for their specific job function;
• Two-factor authentication on all internal kp999 administrative systems that access personal data;
• Regular security audits and penetration testing conducted by qualified independent security professionals;
• Incident response procedures designed to identify, contain, and report personal data breaches within the timeframes required by applicable law.

10 Cookies & Similar Tracking Technologies

kp999 uses cookies and similar browser-based technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the kp999 platform to function. These include session authentication tokens that keep you logged in during your visit. These cookies cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your preferences such as language settings, preferred games, and responsible gaming configurations. These improve the usability of your kp999 experience.
• Analytical cookies: Used to understand how players navigate the kp999 platform in aggregate. Data collected through analytical cookies is anonymised or pseudonymised and used solely for internal product improvement purposes.
• Security cookies: Used for fraud detection and suspicious activity monitoring, including identifying unusual login patterns that may indicate account compromise.

kp999 does not use cookies for cross-site tracking or for serving interest-based advertising on third-party websites. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect platform functionality.

11 Your Data Protection Rights

Subject to applicable data protection law and the conditions and limitations set out therein, kp999 account holders hold the following rights in respect of their personal data:

To exercise any of the above rights, please contact kp999 support using the details in Section 14. kp999 will verify your identity before processing any data subject request and will respond within 30 calendar days. There is no charge for submitting a data subject request. Where a request is complex or numerous, kp999 may extend the response period by a further 60 days and will inform you accordingly.

To withdraw consent for promotional marketing communications at any time, update your communication preferences in your kp999 account settings or contact support directly. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal, nor does it affect processing carried out on other legal bases.

12 Minors & Age Restriction

kp999 implements mandatory age verification as part of the KYC process for all accounts. If kp999 discovers that an account has been registered by or on behalf of a person under the age of 21, the account will be immediately suspended, all personal data collected in connection with that account will be securely deleted (subject to any legal retention obligations), and the matter may be reported to the relevant regulatory authority.

If you are aware that a minor has created a kp999 account, please contact our support team immediately via live chat or email so that the account can be closed and the data removed promptly.

13 Changes to This Privacy Policy

kp999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or regulatory guidance. Where changes are material, kp999 will:

• Post the updated Policy on the kp999 website with a revised effective date;
• Where appropriate, notify registered players via email or in-platform notification prior to the changes taking effect;
• Maintain an archive of previous Policy versions accessible on request.

Your continued use of the kp999 platform following the publication of any amended Policy constitutes acceptance of the revised terms. If you do not accept the revised Policy, you must cease using the kp999 platform and may request account closure through our support team.

14 Contact Information & Complaints

For all data protection queries, data subject rights requests, or privacy-related complaints, please contact the kp999 Data Protection team:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through your kp999 account dashboard — please state "Data Protection Query" at the start of the conversation
• Response Time: Acknowledgement within 48 hours; substantive response within 30 calendar days

If you are not satisfied with kp999's handling of your data protection concern after contacting us, you have the right to lodge a complaint with the competent supervisory authority in the jurisdiction applicable to your circumstances.

For general account queries not related to data protection, our full support team is available 24 hours a day, 7 days a week.