mp999 Privacy
Policy & Data Rights

This Privacy Policy ("Policy") describes how mp999 ("Company", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to individuals ("Users", "Players", "you") who access or use the mp999 platform at mp999.app (the "Platform"), including all casino games, sportsbook services, mobile applications, and support channels.

This Policy forms part of the overall contractual relationship between mp999 and its Players, and should be read alongside our Terms & Conditions and Responsible Gaming Policy. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

mp999 is committed to the responsible and lawful handling of all personal data. We do not sell your personal information to unaffiliated third parties for their own marketing purposes — full stop. Our data practices are designed around the principle of collecting only what is strictly necessary to deliver a safe, fair, and compliant gaming experience to Pakistani players.

For the purposes of applicable data protection legislation, the data controller responsible for your personal data is the legal entity operating the mp999 Platform under its international online gaming licence. The Platform operates as mp999 and can be contacted for all data-related matters at:

• Privacy Enquiries: [email protected]
• Compliance & Data Protection: [email protected]
• Platform Domain: mp999.app

All written data requests — including Subject Access Requests, deletion requests, and consent withdrawal notices — should be submitted to the above contacts with your registered account username and a description of your request. We aim to acknowledge all privacy-related communications within 72 hours and provide a substantive response within 30 calendar days.

mp999 collects personal data across several categories. The table below summarises the main categories of data we may hold about you:

We do not intentionally collect sensitive categories of personal data (such as racial origin, religious beliefs, biometric data, or health information) unless strictly required by our KYC or responsible gaming obligations and with your explicit consent.

mp999 collects personal data through the following channels:

Data you provide directly when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting a complaint. This includes all form fields completed on the Platform.

When you access the mp999 Platform, our servers automatically collect technical data including your IP address, device identifiers, browser type, and interaction logs. Cookies and similar tracking technologies are also deployed as described in Section 8 of this Policy.

mp999 may receive data about you from third parties in specific circumstances, including:

• Identity verification and KYC service providers who confirm the authenticity of documents you submit
• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) who confirm transaction status
• Fraud detection and AML screening databases
• Responsible gaming self-exclusion registries, where applicable under our licensing framework

If you arrive at mp999 via an affiliate or referral link, we may record the referral source for commission and compliance purposes. No additional personal data is received from the referring party beyond the referral identifier.

mp999 processes personal data only where a valid legal basis exists. The principal legal bases we rely upon are as follows:

• Contractual Necessity: Processing required to fulfil our obligations under the Player Account Agreement, including operating your account, processing deposits and withdrawals, and settling bets.
• Legal Obligation: Processing required to comply with KYC, AML, and responsible gaming laws and regulations applicable under our international gaming licence framework.
• Legitimate Interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving our services — where these interests do not override your fundamental rights.
• Consent: Where we process data for marketing communications or non-essential cookies, we do so only with your freely given, specific, and informed consent, which you may withdraw at any time.

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to confirm that our interests do not outweigh your rights and freedoms. You may request details of any such assessment by contacting [email protected].

mp999 uses the personal data we hold about you for the following purposes:

• To create, maintain, and manage your mp999 account
• To verify your identity and age (minimum 21 years) in compliance with our licensing requirements
• To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and bank transfer in PKR
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities
• To monitor your gaming activity for responsible gaming purposes, including applying deposit limits, cooling-off periods, and self-exclusion where requested or required
• To settle bets, resolve disputes, and maintain accurate gaming records
• To communicate with you about your account, including security alerts, transaction confirmations, and policy updates
• To send you promotional offers and bonuses — only where you have provided marketing consent and remain eligible
• To improve the Platform's performance, user experience, and game offering
• To comply with our legal and regulatory obligations under applicable gaming, financial crime, and data protection frameworks

mp999 does not sell, rent, or trade your personal data to unaffiliated third parties for marketing purposes. We may share your data with trusted third parties only in the following circumstances:

We engage third-party processors who perform services on our behalf, including KYC and identity verification providers, payment processors, cloud infrastructure providers, IT security firms, and customer support platforms. All such providers are contractually bound to process data only on our instructions and to maintain appropriate security standards.

mp999 will disclose personal data to government bodies, regulators, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory directive — including obligations under our international gaming licence.

Our licensing authority may require mp999 to submit certain player data as part of routine compliance reporting or investigations. All such disclosures are made in accordance with our licence conditions and applicable data protection obligations.

In the event of a merger, acquisition, restructuring, or sale of all or part of the mp999 business, your personal data may be transferred to the acquiring entity. We will notify affected Players in advance of any such transfer where required by applicable law.

We may share your data with any third party where you have given your explicit prior consent to that specific disclosure.

mp999 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your login session, detect fraudulent activity, and — with your consent — to analyse usage patterns and deliver relevant content.

These cookies are strictly necessary for the Platform to function. They enable core features such as session management, security token validation, and account authentication. Essential cookies cannot be disabled without impairing your ability to use the Platform.

With your consent, we deploy analytics tools to understand how Players interact with mp999 — including which games are most popular, where users encounter difficulty, and how the Platform can be improved. Analytics data is aggregated and anonymised wherever possible.

These cookies remember your preferences — such as language settings and display choices — so you do not need to reconfigure them on each visit.

You can manage or withdraw cookie consent at any time through your browser settings or the cookie preference centre within your mp999 account. Withdrawing consent for non-essential cookies will not affect your ability to access your account or play games, but may limit certain personalisation features.

mp999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account and for a minimum of five (5) years following account closure, in compliance with our AML and gaming licence record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years in accordance with financial crime legislation applicable to our licensing jurisdiction.
• Gaming Activity Logs: Retained for a minimum of three (3) years for responsible gaming monitoring and dispute resolution purposes.
• Support and Complaints Records: Retained for three (3) years from the date of resolution.
• Marketing Consent Records: Retained for the duration of your account plus two (2) years, as evidence of lawful consent.

At the end of each applicable retention period, your data is securely deleted or anonymised in accordance with our internal data destruction procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be linked to you as an individual.

mp999 is an internationally operated gaming platform. As a result, your personal data may be transferred to and processed in countries outside of Pakistan, including the jurisdiction in which our gaming licence is held, and the locations of our cloud infrastructure and third-party service providers.

Where personal data is transferred internationally, mp999 ensures that adequate safeguards are in place to protect your data to a standard equivalent to that required by applicable data protection principles. These safeguards may include:

• Contractual clauses in our agreements with third-party processors that require equivalent data protection standards
• Transfer to jurisdictions recognised as providing an adequate level of data protection by our regulatory authority
• Technical and organisational security measures applied to all transferred data

You may request further information about the specific safeguards applied to any international transfer of your personal data by contacting [email protected].

Subject to applicable law and our regulatory obligations, you have the following rights in relation to your personal data held by mp999:

• Right of Access: You may request a copy of all personal data we hold about you (commonly known as a Subject Access Request).
• Right to Rectification: You may request that any inaccurate or incomplete personal data we hold about you be corrected.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, while the accuracy of the data is under dispute.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling, at any time. You also have an unconditional right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected] with your registered account username and a clear description of your request. We will respond within 30 calendar days. We may need to verify your identity before processing certain requests to protect against unauthorised access.

The mp999 Platform is strictly intended for users aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and accounts will be suspended immediately where underage access is suspected.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on the mp999 Platform, please contact us immediately at [email protected]. We will take prompt action to investigate, suspend the account, and delete any personal data collected from an underage individual, subject to any legal obligations to retain records of the attempted underage access.

mp999 encourages responsible digital practices within households. We recommend the use of parental control software to prevent access to gaming platforms by minors. For guidance on responsible gaming tools available on the mp999 Platform, including self-exclusion and deposit limits, please visit our Responsible Gaming page.

mp999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the mp999 Platform
• Encryption at rest for sensitive stored data, including financial records and identity documents
• Role-based access controls limiting internal access to personal data to authorised personnel only, on a strict need-to-know basis
• Regular security audits and penetration testing conducted by independent third-party security firms
• Intrusion detection systems and real-time security monitoring
• Multi-factor authentication options for Player accounts and mandatory multi-factor authentication for internal administrative access
• Documented incident response procedures with notification protocols in the event of a data breach

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, mp999 will notify affected Players without undue delay and in accordance with applicable regulatory obligations. You should report any suspected unauthorised access to your mp999 account immediately to [email protected].

The mp999 Platform may contain references to third-party services, including payment processors such as JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank. Interactions with third-party services — including any data you provide directly to those services — are governed by their own respective privacy policies, which are independent of this Policy.

mp999 is not responsible for the privacy practices of any third-party service provider. We recommend that you review the privacy policy of any third party before providing them with your personal data. Our contractual agreements with third-party processors do, however, require them to maintain appropriate data protection standards when handling data on our behalf.

mp999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. The effective date at the top of this document will be updated whenever a substantive change is made.

Where changes are material — meaning they meaningfully affect your rights or how your data is used — we will provide advance notice via your registered email address or through a prominent notice on the Platform prior to the changes taking effect. We encourage you to review this Policy periodically so that you remain informed of how mp999 handles your personal data.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes, you should cease using the Platform and may close your account in accordance with our Terms & Conditions.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way mp999 handles your personal data, please contact us using the following details:

• General Privacy Enquiries: [email protected]
• Data Protection & Compliance: [email protected]

All privacy-related correspondence should include your registered account username, a description of your query, and — where applicable — the specific data right you wish to exercise. We acknowledge all written communications within 72 hours and provide substantive responses within 30 calendar days.

If you are dissatisfied with our response to a privacy complaint, you may have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. Details of available supervisory authority mechanisms will be provided upon request to [email protected].