ap999 Privacy Policy — How We Collect, Use and Protect Your Personal Information

1. Data Controller

ap999, operating through the domain ap999.bio, acts as the data controller in respect of all personal data collected from players who register and use the ap999 platform. As data controller, ap999 determines the purposes and means by which personal data is processed.

For all data protection enquiries, the ap999 data contact is reachable at [email protected] (plain text — not a clickable link). ap999 endeavours to respond to all data-related correspondence within 15 business days of receipt.

2. Categories of Personal Data Collected

ap999 collects the following categories of personal data from players:

ap999 does not collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, health data or biometric data beyond what is strictly necessary for identity verification purposes mandated by applicable gaming compliance requirements.

3. How ap999 Collects Personal Data

ap999 collects personal data through the following means:

• Direct collection: Information you provide when registering an ap999 account, completing identity verification, making deposits or withdrawals, contacting ap999 support, or updating account settings;
• Automated technical collection: Data collected automatically during your use of the ap999 platform, including device data, IP addresses, browser type, session duration and navigation patterns, via server logs and cookies;
• Payment provider data: Transaction reference data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank and other payment processors in connection with deposit and withdrawal instructions;
• Third-party verification services: Identity and age verification data obtained from document verification service providers in connection with KYC compliance requirements.

4. Purposes for Which ap999 Processes Personal Data

ap999 processes personal data for the following specific purposes:

• Creating, managing and administering player accounts on the ap999 platform;
• Processing deposits and withdrawals in PKR via JazzCash, EasyPaisa and Pakistani bank channels;
• Verifying the identity and age of players in accordance with applicable gaming compliance requirements (players must be 21 years of age or older);
• Detecting, preventing and investigating fraud, money laundering, account compromise and other prohibited activities;
• Providing customer support through the ap999 live chat and email channels;
• Administering responsible gaming tools including deposit limits, session alerts and self-exclusion programmes;
• Personalising the ap999 platform experience based on gaming preferences and usage patterns, where this improves service delivery;
• Sending transactional communications including deposit confirmations, withdrawal notifications and security alerts;
• Sending marketing communications about ap999 promotions and new game launches, where the player has provided explicit consent;
• Maintaining accurate records for audit, regulatory compliance and dispute resolution purposes;
• Improving the technical performance, security and user experience of the ap999 platform.

5. Legal Basis for Processing

ap999 processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil the ap999 player account agreement, including account administration, game access and payment processing;
• Legal obligation: Processing required to comply with applicable gaming licensing requirements, anti-money laundering regulations and age verification obligations;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring and technical platform improvement, where ap999's legitimate interests are not overridden by players' fundamental rights;
• Consent: Processing for marketing communications and non-essential cookies, where the player has provided explicit, freely given and withdrawable consent.

6. Sharing of Personal Data

ap999 does not sell personal data. ap999 shares player personal data only in the following limited circumstances and only to the extent necessary for the specified purpose:

• Payment processors: JazzCash, EasyPaisa and banking partners receive transaction data necessary to process deposits and withdrawals. These providers process data under their own privacy policies and are contractually required to maintain data security;
• Identity verification providers: Third-party KYC service providers receive identity documents for age and identity verification. These providers are subject to strict data processing agreements with ap999;
• Game software providers: Game studios whose content is hosted on ap999 may receive gaming session data for technical performance and integrity monitoring purposes. Personal identity data is not shared with game providers;
• Legal and regulatory authorities: ap999 will disclose personal data to law enforcement, regulatory bodies or courts where required to do so by applicable law, court order or legal process. ap999 will notify affected players of such disclosures where legally permitted to do so;
• Professional advisors: Legal, accounting and audit professionals who require access to player data to provide services to ap999, subject to professional confidentiality obligations.

7. Data Retention

ap999 retains personal data for as long as is necessary for the purposes for which it was collected, subject to the following retention guidelines:

• Active account data: Retained for the duration of the player's active ap999 account;
• Post-closure account data: Following account closure, ap999 retains core account and transaction records for a minimum of five (5) years to comply with anti-money laundering record-keeping requirements and to defend against potential legal claims;
• KYC documents: Identity verification documents are retained for the period required by applicable gaming compliance regulations following account closure;
• Marketing data: Retained until the player withdraws consent. Marketing opt-out records are retained indefinitely to prevent inadvertent re-marketing;
• Technical logs: Server and session logs are retained for a maximum of 12 months from collection unless a specific investigation requires extended retention;
• Support correspondence: Live chat transcripts and email records are retained for 36 months to support dispute resolution.

When personal data is no longer required and no legal obligation to retain it exists, ap999 securely deletes or anonymises the data in accordance with ap999's internal data deletion protocols.

8. Data Security Measures

ap999 implements the following technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure:

• SSL/TLS encryption on all data transmissions between the player's device and the ap999 platform;
• Encryption of sensitive stored data including identity documents and financial account references;
• Strict access controls ensuring that ap999 staff can only access personal data that is necessary for their specific role;
• Regular security assessments and penetration testing of the ap999 platform infrastructure;
• Two-factor authentication options available to players to protect their ap999 account login;
• Incident response procedures for detecting, assessing and notifying affected players of any personal data breach in a timely manner.

Whilst ap999 takes all reasonable security precautions, no system is entirely immune to security incidents. Players are encouraged to use strong, unique passwords for their ap999 login credentials and to enable two-factor authentication where available.

9. Cookies and Tracking Technologies

The ap999 platform uses cookies and similar tracking technologies to support platform functionality, security and performance. ap999 uses the following cookie categories:

• Strictly necessary cookies: Required for core platform functions including ap999 login session management, security and payment flow integrity. These cookies cannot be disabled without impairing platform functionality;
• Functional cookies: Store player preferences such as language settings and game display options to improve the ap999 experience across sessions;
• Analytics cookies: Collect aggregated, anonymised data about how players navigate and use the ap999 platform to inform technical improvement decisions. Analytics data does not identify individual players;
• Marketing cookies: Used only where the player has provided explicit consent to receive personalised promotional communications. Players may withdraw consent to marketing cookies at any time through account settings.

Players may manage cookie preferences through their browser settings. Note that disabling strictly necessary cookies will affect the core functionality of the ap999 platform including the ap999 login process.

10. Minors and Age Restriction

ap999 does not knowingly collect personal data from individuals under 21 years of age. The ap999 platform is strictly for adults aged 21 and above. Age verification is conducted as part of the ap999 account registration and KYC process.

11. Exercising Your Data Rights

Players may exercise the following rights in relation to personal data held by ap999 by submitting a written request to ap999 support:

• Right of access: Request a copy of the personal data ap999 holds about you and information about how it is being processed;
• Right to rectification: Request correction of inaccurate or incomplete personal data held by ap999;
• Right to erasure: Request deletion of your personal data where ap999 no longer has a legitimate basis for retaining it, subject to legal retention obligations;
• Right to restriction: Request that ap999 temporarily restrict processing of your personal data while an accuracy dispute or legitimate interests objection is being assessed;
• Right to object: Object to processing based on legitimate interests, including profiling for marketing purposes;
• Right to data portability: Request a copy of personal data you have provided to ap999 in a structured, machine-readable format;
• Right to withdraw consent: Withdraw consent to processing based on consent (including marketing) at any time without affecting the lawfulness of processing before withdrawal.

ap999 will respond to all valid data rights requests within 15 business days of receipt. ap999 may require identity verification before processing a data rights request to protect against unauthorised access to another player's data.

12. International Data Transfers

ap999 primarily stores and processes personal data within secure data centre facilities. Where personal data is transferred to third-party service providers operating outside Pakistan — including game studios, KYC verification services or cloud infrastructure providers — ap999 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection law.

Such safeguards may include standard contractual clauses, data processing agreements or transfers to jurisdictions with recognised adequate data protection frameworks. Players may request information about the specific safeguards applicable to any international transfer by contacting ap999 support.

13. Changes to This Privacy Policy

ap999 reserves the right to update this Privacy Policy at any time to reflect changes in ap999's data practices, legal obligations or platform features. The effective date at the top of this page will be updated whenever material changes are made.

Where changes to this Privacy Policy are material — meaning they affect how ap999 processes personal data in a way that could meaningfully affect players' privacy interests — ap999 will notify registered players through the ap999 platform notification system or via the mobile number registered to the player's account before the changes take effect.

Continued use of the ap999 platform after the effective date of any updated Privacy Policy constitutes acceptance of the revised terms.

14. Contact for Privacy Enquiries

For any questions, concerns or requests relating to this Privacy Policy or ap999's data processing practices, please contact ap999 through the following channels:

• Email: [email protected] — plain text only, not a clickable link. Quote "Privacy Enquiry" in your subject line for prioritised routing.
• Live Chat: Available 24/7 through the ap999 platform. Our support team can escalate data-related queries to the appropriate team.

ap999 is committed to resolving privacy concerns promptly and fairly. If you are not satisfied with the outcome of your enquiry, you may escalate the matter to the relevant data protection authority or gaming regulator applicable to your jurisdiction.