tz999 Privacy Policy

This Privacy Policy is issued by tz999, the operator of the online gaming and sports betting platform available at tz999.app ("tz999", "we", "us", "the Platform"). For the purposes of applicable data protection law, tz999 acts as the data controller in respect of all personal data collected from players and visitors through the Platform.

tz999 is an online gaming platform designed and operated primarily for adult Pakistani players aged 21 and above. Our Platform offers slot games, live casino tables, and cricket and sports betting, all transacted in Pakistani Rupees (PKR) via JazzCash, EasyPaisa, and major Pakistani banks including HBL, UBL, and Meezan Bank.

This Privacy Policy applies to all personal data collected through the tz999.app website, any associated mobile web application, and all communications between tz999 and its registered players, including live chat support interactions and email correspondence. It does not apply to any third-party websites or services that may be referenced within the Platform.

tz999 collects the following categories of personal data from players and visitors. We do not collect data beyond what is necessary for the purposes described in this Policy.

2.1 Registration Data

When you register a tz999 account, we collect your Pakistani mobile number (which serves as your account identifier and username), your self-created password (stored in hashed, non-reversible form using bcrypt), your confirmed date of birth for age verification purposes, and your agreement to our Terms and Conditions and this Privacy Policy at the date and time of registration.

2.2 Identity Verification (KYC) Data

Prior to the processing of your first withdrawal, tz999 is required to verify your identity in accordance with applicable anti-money laundering obligations. We collect a copy of your National Identity Card (CNIC), a live selfie or recent photograph, and where applicable, additional supporting documentation requested by our verification team. KYC documentation is processed through certified third-party identity verification providers and is not retained for longer than legally required.

2.3 Financial Transaction Data

tz999 records all deposits, withdrawal requests, bonus transactions, and account balance movements associated with your account. Payment method identifiers (such as your JazzCash account number or HBL account details) are recorded for the purposes of processing transactions and complying with anti-money laundering requirements. We do not store complete payment card numbers or full banking credentials on our own systems.

2.4 Gaming Activity Data

We collect records of your gaming sessions, including games played, bet amounts, win and loss outcomes, session durations, and responsible gaming tool usage. This data is used to provide the Platform service, calculate bonuses, support responsible gaming monitoring, and generate your account history statements.

2.5 Technical & Device Data

We automatically collect certain technical data when you access the Platform, including your IP address, device type and operating system, browser type and version, mobile network identifier, and session timestamps. This data is used for fraud prevention, security monitoring, and Platform performance optimisation.

2.6 Communications Data

We retain records of all communications between you and the tz999 support team, including live chat transcripts, email correspondence, and any documentation submitted in connection with a complaint or account query. These records are maintained for the purposes of resolving disputes, training, and regulatory compliance.

tz999 uses the personal data it collects exclusively for the following documented purposes:

• Account Management: Creating, maintaining, and securing your tz999 player account, including authentication, session management, and account recovery;
• Service Delivery: Providing access to all gaming features of the Platform — including slot games, live casino, and cricket betting — and processing all associated financial transactions in PKR;
• Identity Verification: Conducting age verification to confirm you are 21 years of age or above, and KYC verification to satisfy anti-money laundering compliance obligations prior to withdrawal processing;
• Payment Processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and reconciling all financial records associated with your account;
• Fraud & Security: Monitoring account activity, login patterns, and transaction behaviour for indicators of fraud, money laundering, account compromise, or other prohibited conduct;
• Responsible Gaming: Monitoring your gaming activity in connection with the responsible gaming tools you have configured, identifying patterns that may indicate problematic gambling behaviour, and administering self-exclusion requests;
• Customer Support: Responding to your queries, complaints, and requests through live chat and email support channels;
• Promotions & Bonuses: Calculating your eligibility for, and the terms of, bonuses and promotional offers based on your account activity and tier status;
• Legal & Regulatory Compliance: Satisfying all applicable legal, regulatory, and licensing obligations to which tz999 is subject, including responding to lawful requests from regulatory authorities and law enforcement agencies;
• Platform Improvement: Using anonymised and aggregated usage data to improve Platform performance, develop new features, and optimise the gaming experience for Pakistani players.

tz999 processes your personal data on one or more of the following lawful bases, each of which is documented and applied to the specific categories of data and processing activities described in this Policy:

• Contractual Necessity (Article 6(1)(b)): The majority of data processing by tz999 is necessary to perform our contract with you — i.e., to provide you with the gaming services you have registered to access. This includes account management, payment processing, game delivery, and customer support;
• Legal Obligation (Article 6(1)(c)): Certain processing activities are required by applicable law — particularly KYC identity verification, anti-money laundering transaction monitoring, and data retention for regulatory reporting purposes. tz999 is required to perform these activities regardless of your preferences;
• Legitimate Interests (Article 6(1)(f)): tz999 processes technical and device data for fraud prevention and platform security on the basis of its legitimate interest in protecting its players, its financial integrity, and the fairness of its gaming environment. We have assessed that this processing does not override your fundamental privacy interests;
• Consent (Article 6(1)(a)): Where tz999 processes your data for optional marketing communications (SMS or email promotional messages), we do so only on the basis of your explicit consent, which you may withdraw at any time without affecting the operation of your account.

tz999 does not sell, rent, or trade your personal data. We share personal data only with the following categories of third parties and only to the extent strictly necessary for the purposes described:

5.1 Payment Processing Partners

We share transaction data — including your registered mobile number and payment method identifier — with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank solely for the purpose of processing your deposits and withdrawals. These providers are contractually prohibited from using your data for any purpose other than processing the specific transaction requested.

5.2 Identity Verification Providers

KYC documentation — including your CNIC copy and selfie — is processed through third-party identity verification service providers who are certified for this purpose and operate under strict data processing agreements with tz999. These providers process your data exclusively to perform identity verification on our behalf.

5.3 Game Software Providers

Game software provided by our partner studios (including Pragmatic Play, PG Soft, and Play'n GO) may require limited technical session data to function. These providers receive only the data necessary to deliver and record gameplay. They do not receive your full identity information or payment details.

5.4 Legal & Regulatory Authorities

tz999 will disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by a lawful order, warrant, or regulatory obligation. Where permitted by law, tz999 will inform you of such a disclosure. We are not liable for any harm arising from disclosures made in good faith compliance with legal obligations.

5.5 No Cross-Border Marketing Transfers

tz999 does not transfer your personal data to overseas marketing companies, advertising networks, or data analytics platforms for commercial purposes. Any international transfers of data that do occur — for example, in connection with cloud infrastructure — are governed by appropriate data transfer safeguards.

The tz999 Platform uses cookies and similar browser storage technologies to provide its services effectively. Below is a clear breakdown of the cookies we use and their purpose.

6.1 Strictly Necessary Cookies

These cookies are essential to the operation of the tz999 Platform and cannot be disabled without rendering the Platform non-functional. They include session authentication cookies (which keep you logged in between pages), CSRF protection tokens (which protect against cross-site request forgery attacks), and device recognition cookies (which allow your device to be recognised on return visits without requiring OTP re-verification on each login).

6.2 Functional Cookies

Functional cookies remember your Platform preferences — such as your preferred game category, table bet limits, and responsible gaming tool configurations. These cookies improve your experience by restoring your settings on return visits. They are session-scoped or expire within 90 days.

6.3 Analytics Cookies

tz999 uses privacy-compliant analytics tools to understand how players navigate the Platform — which game categories are most visited, where navigation difficulties occur, and how support content is used. Analytics data is processed in aggregated, anonymised form and is not associated with your individual account identity.

6.4 Managing Cookies

You may configure your browser to block or delete cookies. Note that blocking strictly necessary cookies will prevent you from logging into and using the tz999 Platform. For information on managing cookies in your specific browser, refer to your browser's help documentation. tz999 does not support a cookie preference centre for strictly necessary cookies, as these are essential for service operation.

tz999 implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, and destruction. The following technical and organisational measures are in place:

• Transport Encryption: All data transmitted between your device and tz999 servers is protected by 256-bit SSL/TLS encryption. HSTS (HTTP Strict Transport Security) headers are enforced to prevent protocol downgrade attacks;
• Password Security: Account passwords are hashed using bcrypt with a suitable work factor before storage. tz999 does not store passwords in recoverable form. Password reset is performed via mobile OTP, not by revealing the original password;
• Two-Factor Authentication: New device logins require OTP verification via your registered Pakistani mobile number, providing a second layer of protection against credential compromise;
• Access Controls: Internal access to player personal data is restricted on a strict need-to-know basis. Access is logged and subject to periodic review. Support agents access only the data necessary to resolve your specific query;
• Fraud Monitoring: Automated systems monitor login patterns, transaction volumes, and device identifiers for indicators of account compromise or fraudulent activity, triggering alerts for human review where anomalies are detected;
• Data Minimisation in Storage: tz999 does not store complete payment credentials. Payment method identifiers are stored in tokenised or masked form where technically possible.

tz999 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected and to comply with applicable legal retention obligations. The following retention periods apply to the principal categories of personal data we hold:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any individual. Data subject to ongoing legal proceedings may be retained beyond the standard retention period until the matter is fully resolved.

Subject to applicable law and certain limitations, you have the following rights in respect of the personal data tz999 holds about you. To exercise any of these rights, please contact tz999 support via live chat or by email at [email protected]:

• Right of Access: You have the right to request a copy of the personal data tz999 holds about you, along with information about how it is being processed. tz999 will provide this information within 30 days of a verified request;
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For account-level data, many corrections can be made directly by contacting support;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations. Note that AML and financial regulatory requirements mean some data cannot be deleted even upon account closure;
• Right to Restrict Processing: You have the right to request that tz999 restrict the processing of your data in certain circumstances — for example, where you contest the accuracy of the data, pending verification by tz999;
• Right to Data Portability: Where processing is based on your consent or a contract with you, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format;
• Right to Object: Where processing is based on legitimate interests, you have the right to object. tz999 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw your consent at any time without affecting the lawfulness of prior processing;
• Right to Lodge a Complaint: If you believe tz999 has processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

tz999 will respond to all verified data rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further sixty (60) days, with advance notice provided to you.

The tz999 Platform is strictly restricted to adults aged 21 years and above. tz999 does not knowingly collect personal data from any person under the age of 21. If we become aware that a player under the age of 21 has registered an account or provided personal data through the Platform, we will immediately close the account, void any transactions, and delete or anonymise the associated personal data to the extent permitted by applicable legal obligations.

If you believe that a person under the age of 21 has created a tz999 account, please contact us immediately via live chat or at [email protected]. tz999 takes underage gambling extremely seriously and will act on all credible reports without delay.

tz999's primary player base is in Pakistan. Some of the technical infrastructure supporting the Platform — including cloud hosting, KYC verification processing, and game software delivery — may involve the transfer of personal data to servers or service providers located outside Pakistan.

Where such transfers occur, tz999 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to its protection in Pakistan. These safeguards include data processing agreements with all third-party processors, contractual clauses requiring equivalent data protection standards, and, where relevant, reliance on established transfer mechanisms under applicable international data protection frameworks.

In all cases, tz999 transfers only the minimum data necessary for the specific processing purpose, and all transfer arrangements are reviewed periodically to ensure ongoing compliance with evolving data protection standards.

The tz999 Platform may contain links to third-party websites or services — for example, links to game software provider demonstration pages or payment method help pages. tz999 is not responsible for the privacy practices of any third-party website or service, and this Privacy Policy does not apply to data collected by third parties through their own platforms or services.

We encourage you to review the privacy policy of any third-party service before providing personal data to it. The presence of a link on the tz999 Platform does not constitute an endorsement of the privacy practices of the linked website or service.

tz999 may, with your explicit prior consent, send you promotional communications regarding new games, bonuses, seasonal promotions (including PSL season offers, Eid bonus promotions, and cricket tournament specials), and Platform updates via SMS to your registered Pakistani mobile number or via in-platform notification.

You are under no obligation to consent to marketing communications as a condition of registering or using your tz999 account. You may opt in to receive marketing communications during the registration process or at any subsequent point via your account settings. You may opt out of marketing communications at any time by updating your notification preferences in your account settings or by contacting tz999 support directly.

Withdrawal of consent to marketing communications will not affect the operation of your tz999 account, your access to any game or feature, or any existing bonus conditions. Transactional communications — such as deposit confirmations, withdrawal notifications, OTP messages, and security alerts — are sent regardless of your marketing preference settings, as they are necessary for account operation and security.

tz999 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable data protection law, our data processing practices, or our Platform services. Where amendments are material — meaning they affect your rights or how we process your personal data in a significant way — tz999 will provide advance notice of not less than fourteen (14) days via SMS to your registered mobile number and via an in-platform notification.

Minor amendments — including corrections of typographical errors, clarifications that do not change the substance of the Policy, and updates that reflect new legal or regulatory guidance — may take effect immediately upon publication without advance notice.

The most current version of this Privacy Policy is always available at tz999.app/privacy-policy. The effective date shown at the top of this document indicates the date from which the current version applies. We encourage you to review this Policy periodically to remain informed about how tz999 protects your data.

If you have any questions regarding this Privacy Policy, wish to exercise any of your data rights, or wish to raise a concern or complaint about tz999's data processing practices, please contact our support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week from within your logged-in tz999 account. This is the fastest channel for all privacy queries and data rights requests;
• Email: [email protected] — please mark your email "Privacy Request" or "Data Rights Request" in the subject line to ensure prompt routing to the appropriate team. tz999 will respond to all privacy-related email enquiries within 5 business days;
• Data Rights Requests: To verify your identity before processing a data access, rectification, or deletion request, tz999 may ask you to confirm certain account details. This is done to ensure your data rights are not exercised by an unauthorised third party.

If you are dissatisfied with tz999's handling of a privacy complaint after raising it directly with us, you have the right to escalate your complaint to the relevant data protection supervisory authority or gaming regulatory body in your jurisdiction.