cc99 Privacy Policy

This Privacy Policy applies to all personal data processed by cc99 in connection with the cc99 platform — the online casino, sports betting, live casino, and related services available at cc99.games. It applies to all registered players, prospective players who visit the cc99 website, and individuals who contact cc99 support.

cc99 takes its data protection obligations seriously. The platform serves over 2.4 million registered players across Pakistan — from Karachi and Lahore to Islamabad and Faisalabad — and the personal and financial data associated with those accounts is handled with the same level of care we apply to payment security and game integrity.

This Privacy Policy should be read alongside the cc99 Terms and Conditions, available at cc99.games/terms-conditions. By registering a cc99 account or using the platform, you acknowledge that you have read and understood this Privacy Policy.

cc99 is the data controller in respect of personal data collected and processed through the cc99 platform. As data controller, cc99 determines the purposes and means of processing personal data in connection with platform operation, account management, payment processing, KYC verification, and responsible gaming compliance.

For all data-related enquiries, including the exercise of data subject rights, players may contact the cc99 data support team via live chat on the platform (available 9 AM – 12 AM PKT daily) or by email at the address specified in Section 15 of this Policy.

cc99 collects personal data across several categories, depending on how you interact with the platform:

cc99 uses personal data collected from Pakistani players for the following purposes:

• Account creation and management: Setting up and maintaining your cc99 account, including authentication, account settings, and profile management.
• Payment processing: Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK. Financial data is used to match transactions to your account and to facilitate refunds where applicable.
• KYC and identity verification: Verifying your identity and age in compliance with cc99's operating licence requirements and international anti-money laundering obligations.
• Platform operation and personalisation: Delivering the cc99 casino and sports betting platform, recording game outcomes, maintaining betting history, and personalising the platform experience based on your activity.
• Fraud prevention and security: Detecting and preventing fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited conduct. Technical data is used extensively for this purpose.
• Responsible gaming compliance: Monitoring gaming patterns to identify potential problem gambling behaviour and enforcing self-exclusion and responsible gaming limits applied to your account.
• Legal and regulatory compliance: Meeting cc99's obligations under its international gaming licence, including record-keeping, AML transaction monitoring, and responding to lawful requests from competent authorities.
• Customer support: Handling account enquiries, payment disputes, responsible gaming requests, and complaint resolution.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. See Section 13 for marketing opt-out information.

cc99 processes personal data only where a lawful basis exists under applicable data protection law. The primary lawful bases applicable to cc99's processing activities are:

• Contractual necessity: Processing required to fulfil the contract between you and cc99 — including account operation, payment processing, game delivery, and support.
• Legal obligation: Processing required to comply with legal requirements, including KYC identity verification, AML transaction monitoring, and regulatory record-keeping under cc99's operating licence.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where cc99's legitimate interests do not override your fundamental data rights.
• Consent: Processing for direct marketing communications, where your consent has been obtained at registration or subsequently. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

cc99 does not sell, rent, or trade personal data to third parties for their own commercial purposes. Personal data is shared with third-party service providers only to the extent necessary to operate the cc99 platform and meet legal obligations.

The categories of third parties with whom cc99 may share personal data include:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Raast/1LINK operators — for the sole purpose of processing your PKR deposits and withdrawals.
• KYC and identity verification providers: Third-party verification services used to confirm identity documents and age in compliance with licensing requirements.
• Fraud detection and AML service providers: Automated transaction monitoring systems that analyse financial activity for suspicious patterns in compliance with anti-money laundering obligations.
• Game software providers: Live casino and RNG game providers who may process technical session data to deliver game content and resolve disputes.
• Cloud infrastructure and hosting providers: Secure server infrastructure providers on whom cc99 relies for platform operation and data storage.
• Regulatory and legal authorities: Financial intelligence units, licensing authorities, and law enforcement agencies where cc99 is legally required to disclose information.

cc99 uses cookies and similar tracking technologies on the platform to ensure proper functionality, improve user experience, and support fraud prevention and analytics. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function — including session authentication, security tokens, and cashier functionality. These cannot be disabled without impairing platform use.
• Performance cookies: Anonymous analytics data that helps cc99 understand how players navigate the platform, which games are most frequently accessed, and where technical issues occur. This data is aggregated and does not identify individual players.
• Functional cookies: Remember your preferences — such as preferred language settings, last-visited game category, and responsible gaming reminder settings.
• Security cookies: Support fraud detection by identifying anomalous session behaviour, login patterns, and device fingerprinting for account security purposes.

Players may manage cookie preferences through their browser settings. Disabling non-essential cookies will not prevent access to the cc99 platform, though some personalisation features may be affected.

cc99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the duration of the account relationship and for a minimum of five years following account closure, in compliance with AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven years following the relevant transaction, in compliance with financial record-keeping obligations under cc99's operating licence.
• KYC documents: Retained for the duration of the account and for five years following account closure.
• Support communications: Retained for three years from the date of the last interaction, or longer where the subject matter relates to an unresolved dispute or regulatory enquiry.
• Technical and session data: Retained for 24 months from the date of collection for fraud prevention and security analysis purposes.
• Self-exclusion records: Retained permanently to prevent re-registration during any active exclusion period and to support responsible gaming compliance records.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with cc99's data disposal procedures.

cc99 implements a layered approach to data security, applying technical and organisational measures appropriate to the sensitivity of the data held and the risks associated with its processing.

• Encryption in transit: All data transmitted between your device and the cc99 platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Encryption at rest: Sensitive personal data and financial records stored on cc99 infrastructure are encrypted at rest using AES-256 encryption.
• Access controls: Internal access to personal data is governed by role-based access controls. Only personnel with a specific operational need can access personal data, and all access is logged and auditable.
• Two-factor authentication: All internal cc99 administrative accounts require two-factor authentication. Players are also encouraged to enable 2FA on their own cc99 accounts.
• Security monitoring: cc99 maintains continuous security monitoring with automated alerts for anomalous access patterns, data exfiltration indicators, and account compromise signals.
• Penetration testing: The cc99 platform undergoes periodic third-party security assessments and penetration testing to identify and remediate vulnerabilities proactively.

cc99 operates under an international gaming licence and relies on cloud infrastructure and third-party service providers located in multiple jurisdictions. As a result, personal data collected from Pakistani players may be transferred to and processed in countries outside Pakistan.

Where personal data is transferred internationally, cc99 applies appropriate safeguards to ensure the data receives equivalent protection to that applied in its country of collection. These safeguards include:

• Binding contractual clauses in data processing agreements with international service providers
• Restrictions on onward transfer of personal data by service providers
• Requirements for equivalent technical and organisational security measures at the recipient location
• Selection of service providers in jurisdictions with recognised data protection frameworks where possible

cc99 recognises the following data rights for registered players. These rights are not absolute in all circumstances — some are subject to balancing against cc99's legal obligations — but cc99 will respond to all rights requests within 30 days of receipt.

To exercise any of the above rights, contact the cc99 support team via live chat (9 AM – 12 AM PKT) or email. cc99 may request identity verification before processing a rights request to ensure your data is not disclosed to an unauthorised party.

The cc99 platform is strictly for adults aged 21 and above. cc99 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process specifically to prevent underage access.

If cc99 becomes aware that personal data has been collected from an individual under the age of 21, the associated account will be immediately closed, all data collected will be deleted, and any deposits made will be returned to the payment method of origin to the extent technically possible.

cc99 may send promotional emails, SMS messages, and in-platform notifications to players who have opted in to marketing communications. Marketing communications include bonus offers, deposit match promotions, PSL cricket betting boosts, and platform feature announcements.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in the cc99 account settings under the Notifications section
• Using the unsubscribe link included in any cc99 marketing email
• Contacting cc99 support directly with an opt-out request

Opting out of marketing communications does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are sent as part of the contractual service and cannot be disabled while your account is active.

Players who have applied a self-exclusion to their cc99 account are automatically removed from all marketing communication lists for the duration of the exclusion period and will not receive any promotional content.

cc99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in platform operations, data processing activities, legal requirements, or regulatory guidance. The effective date at the top of this document will be updated whenever material changes are made.

Where changes are material — meaning they affect the nature of data collected, the purposes for which it is used, or the rights available to players — cc99 will notify registered players via their registered email address or via an in-platform notification prior to the changes taking effect. For non-material clarifications and editorial updates, the revised Policy will be published at cc99.games/privacy-policy without individual notification.

Continued use of the cc99 platform following the effective date of any updated Privacy Policy constitutes acknowledgement of the revised terms. If you do not accept the updated Policy, you should discontinue use of the platform and contact cc99 support to request account closure.

For all privacy-related enquiries — including data subject rights requests, questions about this Policy, or concerns regarding how cc99 handles your personal data — please contact the cc99 support team through the following channel:

• Live Chat: Available on the cc99 platform daily, 9:00 AM – 12:00 AM Pakistan Standard Time (PKT)
• Email: [email protected] (plain text — not a clickable link)
• Support Hours: 7 days a week, including public holidays

cc99 aims to respond to all privacy-related requests within 30 calendar days of receipt. Where a request is complex or where a high volume of requests has been received, cc99 may extend this period by a further 30 days, with notification provided to the requesting player within the initial 30-day window.

This Privacy Policy was last reviewed and updated on 1 January 2026. The current version is always available at cc99.games/privacy-policy.