Privacy Policy

VP999 ("we", "us", "our" or "the Platform") is an online gaming and sports betting platform operating under applicable international licensing. We recognize that the personal data you entrust to us is genuinely important, and we take our obligations as a data controller seriously.

This Privacy Policy describes the categories of personal data we collect from players, visitors and prospective players who interact with the VP999 Platform; the purposes for which that data is processed; the circumstances in which data may be shared with third parties; the security measures we apply; and the rights you hold in relation to your personal information.

This Policy applies to all personal data collected through the VP999 website, mobile-optimized platform and any associated applications or services. It should be read alongside our Terms & Conditions and Responsible Gambling Policy.

The following terms carry the meanings defined below throughout this Privacy Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes, but is not limited to, name, email address, date of birth, device identifiers and payment information.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For data processed through the VP999 Platform, VP999 acts as the Data Controller.
• "Data Processor" — A third party that processes personal data on behalf of the Data Controller under a binding contractual arrangement.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure and destruction.
• "Consent" — A freely given, specific, informed and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "Account" — A registered player account on the VP999 Platform.
• "KYC" — Know Your Customer — identity and age verification procedures carried out in accordance with licensing and anti-money-laundering obligations.
• "Cookies" — Small text files placed on your device by the Platform for the purpose of storing session, preference or analytics information.

VP999 collects only the personal data that is necessary for the purposes described in this Policy. The table below summarises the main categories of data we collect and the typical context in which each is obtained.

VP999 does not intentionally collect special categories of sensitive personal data (such as health data, biometric data, or information about religious beliefs) unless it becomes strictly necessary in connection with a specific responsible gambling or regulatory matter, and only with an appropriate legal basis.

VP999 collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide voluntarily during registration, KYC verification, cashier transactions, support interactions or account settings updates.
• Automated technical collection: Technical data collected automatically when you access or browse the Platform, including IP address, device identifiers, session data and browser characteristics.
• Cookies and similar technologies: Data collected via session cookies, persistent cookies and similar tracking technologies as described in Section 8 of this Policy.
• Third-party payment processors: Transactional confirmation data received from payment processors when you make a deposit or withdrawal. VP999 does not store full payment card numbers.
• Identity verification providers: Verification results and identity confirmation data received from third-party KYC and anti-fraud service providers used by VP999 to fulfil its compliance obligations.
• Anti-fraud and security systems: Behavioural and transactional signals generated by the Platform's automated fraud detection systems during your use of the Platform.

VP999 processes personal data only where a valid legal basis exists for doing so. The principal legal bases on which VP999 relies are as follows:

• Contractual necessity: Processing required to perform the contract between VP999 and the Account holder — including account management, transaction processing, KYC verification, game delivery and customer support.
• Legitimate interests: Processing necessary for VP999's legitimate business interests where those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, platform security, anti-money-laundering monitoring and improvement of the Platform.
• Legal obligation: Processing required to comply with VP999's obligations under its applicable gaming licence, anti-money-laundering regulations and other applicable laws.
• Consent: Where you have given specific, informed consent to a particular processing activity, such as opting in to receive marketing communications. Consent may be withdrawn at any time via your account settings or by contacting support.

VP999 uses the personal data it collects for the following specific purposes. We do not use your data for purposes incompatible with those stated at the time of collection without first obtaining your consent or establishing a further valid legal basis.

• Account management: Creating, maintaining and securing your Account; verifying your identity and age in compliance with our KYC obligations; processing deposits and withdrawals denominated in PKR.
• Platform delivery: Providing access to casino games, live dealer tables, sportsbook markets (including Pakistan cricket, PSL, ICC tournaments and other events) and all other VP999 services.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent transactions, money laundering, bonus abuse, multi-accounting and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gambling: Monitoring gaming behaviour to identify indicators of problem gambling; applying deposit, loss and time limits; processing self-exclusion requests; fulfilling our responsible gambling obligations under our operating licence.
• Legal and regulatory compliance: Meeting obligations under our gaming licence, anti-money-laundering requirements and any applicable legal demands from competent authorities.
• Customer support: Responding to Account enquiries, resolving disputes and processing complaints.
• Platform improvement: Analysing aggregated usage data to improve the functionality, performance and content of the VP999 Platform, including mobile optimization for players across Pakistan.
• Marketing communications: Sending promotional offers, new game announcements and bonus notifications to players who have opted in. You may opt out at any time.

VP999 does not sell, rent or trade your personal data with third parties for their own marketing purposes. We share personal data only in the limited circumstances described below.

• Service providers acting as Data Processors: Third-party providers who process data on our behalf under binding data processing agreements. These include KYC and identity verification providers, payment processing partners (such as operators of local payment infrastructure familiar to Pakistani users — e.g., mobile wallet and bank transfer systems), hosting and infrastructure providers, fraud detection services, and customer support tools. These providers are contractually restricted from using your data for any purpose beyond the services they provide to VP999.
• Game and technology suppliers: Game studios and platform technology providers may receive limited technical data necessary for game delivery, RNG certification and platform integration. They do not receive unnecessary personal information.
• Regulatory and licensing authorities: VP999's gaming licence may require disclosure of player data to the licensing authority for audit, compliance monitoring or investigation purposes. Such disclosures are made only to the extent legally required.
• Law enforcement and legal proceedings: VP999 may disclose personal data where required by a valid court order, statutory obligation or legitimate law enforcement request, to the extent mandated by applicable law.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of VP999's business, personal data held by VP999 may be transferred to a successor entity. Players will be notified of any such transfer and of any material change to data processing practices.

The VP999 Platform uses cookies and similar tracking technologies to deliver, secure and improve our services. Cookies are small text files stored on your device when you visit the Platform.

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens and load-balancing cookies. They cannot be disabled without preventing core platform functionality.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how players interact with the Platform — such as pages visited, session duration and navigation paths. This data helps VP999 identify usability issues and improve the Platform experience, particularly for mobile users across Pakistan.
• Functional cookies: Store your preferences such as language settings, preferred currency display and responsible gambling tool settings to personalise your experience.
• Marketing and targeting cookies: Used only with your prior consent to track the effectiveness of promotional campaigns and to deliver relevant offers. You may withdraw consent and disable marketing cookies at any time via your browser settings or account preferences.

Most web browsers allow you to control cookies through their settings. Disabling certain cookies may affect the functionality of the Platform. For detailed instructions on managing cookies in your browser, refer to your browser's official help documentation.

VP999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations and applicable law. The following retention principles apply:

• Active Account data is retained for the duration of the Account relationship and for a minimum period following Account closure as required by our gaming licence and anti-money-laundering obligations. This period is typically five (5) years from Account closure, though specific regulatory requirements may mandate longer retention.
• KYC verification documents are retained in accordance with our licence's prescribed retention schedule, which is generally aligned with anti-money-laundering regulatory requirements.
• Gaming and transaction records are retained for the minimum period required by the licensing authority and applicable financial regulations.
• Support communications are retained for a period sufficient to resolve any related disputes and to meet our legitimate business and legal record-keeping needs.
• Marketing preference data is updated in real time and marketing communications cease promptly following an opt-out request.
• Technical and log data collected automatically may be retained in aggregated or anonymised form for longer periods for security analysis and platform improvement purposes, provided it can no longer be linked to an identifiable individual.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

VP999 implements a range of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS/SSL) encryption of all data transmitted between your device and the Platform.
• Encryption of sensitive data at rest within our storage systems.
• Role-based access controls limiting Platform staff access to personal data on a strict need-to-know basis.
• Regular security assessments and vulnerability testing of the Platform and underlying infrastructure.
• Incident response procedures to detect, investigate and respond to personal data breaches in a timely manner.
• Staff training on data protection obligations and information security practices.

Depending on your jurisdiction and the applicable data protection framework, you may hold some or all of the following rights in relation to your personal data held by VP999. To exercise any of these rights, please contact us using the details provided in Section 16.

VP999 will respond to valid data rights requests within a reasonable timeframe. In some cases, VP999 may need to verify your identity before processing a request. Requests may be refused or limited where they conflict with legal retention obligations, licensing requirements or the rights of third parties.

The VP999 Platform is strictly for adults aged 18 and over — or the higher minimum age required by our applicable license jurisdiction. VP999 does not knowingly collect personal data from any person under the minimum eligible age.

If VP999 discovers or reasonably suspects that personal data has been collected from an underage individual, the relevant Account will be immediately suspended, the data will be securely deleted, and any balance held will be handled in accordance with our Terms & Conditions and applicable law.

Parents and guardians who believe that a minor may have registered an Account or provided personal data to VP999 are encouraged to contact us immediately using the details provided in Section 16.

VP999 operates under international licensing and uses service providers located in various jurisdictions. As a result, your personal data may be transferred to, stored in, and processed in countries outside of Pakistan. Pakistan does not have a comprehensive data protection law equivalent to those in some other jurisdictions.

Where personal data is transferred internationally, VP999 takes steps to ensure that appropriate safeguards are in place to protect the data in the destination jurisdiction. These safeguards may include contractual data processing agreements with third-party processors requiring data protection standards comparable to those applied by VP999.

By using the VP999 Platform, you acknowledge that your personal data may be processed in jurisdictions outside Pakistan. If you have questions about specific international transfers, please contact us using the details in Section 16.

The VP999 Platform does not include outbound links to third-party websites as a matter of policy. However, the Platform integrates third-party services including game content from licensed studios, payment processing infrastructure and analytics tools. These integrations are governed by contractual data processing agreements that require third parties to process your data only for the purposes authorised by VP999.

VP999 is not responsible for the privacy practices of any third-party provider beyond the scope of its contractual arrangements. Players who independently visit third-party websites — including those of payment providers such as Easypaisa, JazzCash, HBL or UBL — do so subject to those providers' own privacy policies, which are entirely independent of this Policy.

VP999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or our operating environment. The "Last Updated" date at the top of this page will be revised accordingly.

Where changes are material — meaning they significantly affect how we process your personal data or the rights you hold — VP999 will use reasonable efforts to notify registered Account holders via in-platform notification or email prior to the change taking effect.

Continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy. We encourage you to review this page periodically.

If you have any questions, concerns or requests relating to this Privacy Policy or the manner in which VP999 processes your personal data, please contact our support team. All contact details below are displayed as plain text only and are not clickable links.

When submitting a data rights request, please provide sufficient information to allow VP999 to verify your identity before responding. This is necessary to protect your data from being disclosed to or acted upon at the request of an unauthorised third party.