Privacy Policy — gh999

1. Introduction

This Privacy Policy (the "Policy") describes how gh999 (the "Platform", "we", "us", "our"), the operator of the online sports-betting and casino services accessible at https://gh999.cam, collects, uses, stores, shares and protects the personal data of registered users, visitors and prospective players (collectively "you", "User", "Data Subject").

By accessing or using the gh999 Website and services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of, and should be read together with, our Terms & Conditions.

If you do not agree with any part of this Policy, you should not use the gh999 Platform and should contact our support team to close your account if one has already been registered.

2. Definitions

• "Personal Data" means any information that identifies or can be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure or deletion.
• "Data Controller" means gh999, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of gh999 under a contractual obligation.
• "KYC" means Know Your Customer — identity and age-verification procedures required before processing withdrawals and for ongoing compliance purposes.
• "Cookies" means small text files stored on your device by the Platform for session management, analytics and preference retention.
• "Sensitive Data" means Personal Data that requires heightened protection, such as government-issued identification numbers, financial account details and biometric data collected during KYC.

3. Data We Collect

gh999 collects Personal Data through the following categories and channels:

3.1 Registration & Account Data

When you create an account, we collect:

• Full legal name, date of birth and gender;
• Email address and, where provided, mobile phone number;
• Residential address (city, province, postal code, country — including cities such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar);
• Username and encrypted password;
• Preferred currency (PKR) and language preference.

3.2 Identity Verification (KYC) Data

To comply with anti-money-laundering and age-verification obligations, we collect:

• Government-issued photo identification — Pakistani CNIC, passport or driving licence;
• Proof of residential address — utility bill, bank statement or equivalent document;
• Source-of-funds documentation for high-value transactions, where required;
• Facial verification images collected during liveness checks, where the KYC provider requires them.

3.3 Financial & Transaction Data

We record all deposits and withdrawals, including: transaction amounts in PKR, payment method type (e.g., bank transfer via HBL, UBL, Meezan Bank or Bank Alfalah, mobile services such as Easypaisa and JazzCash, Raast interbank transfers, or cryptocurrency), transaction timestamps and reference numbers. We do not store full card numbers, CVV codes or full banking credentials. Payment provider names are referenced for transactional record-keeping only and do not imply any endorsement or affiliation with gh999.

3.4 Betting & Gaming Activity Data

We maintain a full record of your wagering activity, including bets placed, markets selected, stakes, winnings, game sessions and live-betting interactions. This data is used for account management, responsible-gambling monitoring and dispute resolution.

3.5 Technical & Device Data

Automatically collected data includes: IP address, device type and operating system, browser type and version, session duration, page interactions and referring URLs. This data is used for platform security, fraud detection and analytics.

3.6 Communications Data

Records of your communications with gh999 support — including live chat transcripts, email correspondence and, where calls are recorded, voice recordings — are retained for quality assurance, dispute resolution and regulatory purposes.

4. Legal Basis for Processing

gh999 processes Personal Data on the following legal bases:

Processing Activity	Legal Basis
Account registration and operation	Performance of contract
KYC / identity verification	Legal obligation; performance of contract
Processing deposits and withdrawals	Performance of contract
Fraud detection and AML monitoring	Legal obligation; legitimate interests
Responsible-gambling monitoring	Legitimate interests; legal obligation
Marketing communications	Consent (opt-in)
Platform analytics and improvement	Legitimate interests
Customer support and complaints	Performance of contract; legitimate interests

5. How We Use Your Personal Data

gh999 uses collected Personal Data for the following purposes:

• Account management — creating, maintaining and securing your registered account;
• Transaction processing — facilitating PKR deposits, withdrawals and in-platform transfers;
• Identity verification — completing KYC checks and verifying minimum age requirements (18+ or higher as required);
• Regulatory compliance — meeting anti-money-laundering (AML), counter-terrorism financing (CTF) and applicable licensing obligations;
• Responsible gambling — monitoring wagering patterns to identify potential problem gambling and applying self-imposed or operator-imposed limits;
• Fraud prevention and security — detecting suspicious activity, preventing multi-accounting and protecting the integrity of the Platform;
• Customer support — responding to enquiries, resolving disputes and processing complaints in English and Urdu;
• Platform improvement — analysing usage data to improve features, performance and user experience;
• Marketing — sending promotional offers, bonus communications and platform updates to users who have opted in. You may withdraw consent at any time.

6. Disclosure to Third Parties

6.1 gh999 does not sell, rent or trade your Personal Data to any third party for commercial purposes. Data is shared only in the following circumstances:

• Payment processors — to facilitate deposit and withdrawal transactions. These processors operate under contractual obligations consistent with this Policy;
• KYC and identity-verification providers — to complete age and identity checks in compliance with our regulatory obligations;
• Fraud-detection and AML service providers — to screen transactions and account activity against watchlists and risk models;
• IT infrastructure and cloud-hosting providers — to operate Platform servers, databases and security systems under data-processing agreements;
• Legal and regulatory authorities — where disclosure is required by a court order, lawful regulatory request or mandatory legal obligation. gh999 will notify you of such a disclosure where legally permissible;
• Business transfers — in the event of a merger, acquisition or asset sale, your Personal Data may be transferred to the acquiring entity subject to equivalent privacy protections.

6.2 All third-party Data Processors engaged by gh999 are bound by contractual obligations to process Personal Data only as instructed and to maintain appropriate technical and organisational security measures.

7. International Data Transfers

7.1 gh999 operates internationally and your Personal Data may be transferred to, and processed in, countries outside Pakistan and outside the jurisdiction in which you reside. In such cases, gh999 implements appropriate safeguards — including contractual data-protection clauses and vendor security assessments — to ensure that transferred data receives a standard of protection consistent with this Policy.

7.2 By registering on gh999, you acknowledge and consent to the international transfer of your Personal Data as described in this section.

8. Cookies & Tracking Technologies

8.1 gh999 uses the following categories of cookies and tracking technologies:

• Essential cookies — required for the Platform to function, including session management and login persistence. These cannot be disabled without impairing Platform functionality;
• Analytics cookies — collect anonymised usage data (e.g., pages visited, session duration) to help us understand how the Platform is used and where improvements can be made;
• Preference cookies — remember your language, currency and display settings to personalise your experience;
• Security cookies — used to detect fraudulent activity, bot traffic and unauthorised access attempts.

8.2 You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling cookies may affect the functionality of certain Platform features. gh999 does not use third-party advertising cookies or cross-site tracking cookies.

9. Data Security

gh999 implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, alteration, disclosure or destruction. These measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your device and our servers;
• Encrypted storage of passwords using industry-standard hashing algorithms;
• Two-factor authentication (2FA) options for account login;
• Role-based access controls limiting staff access to Personal Data on a need-to-know basis;
• Regular security vulnerability assessments and penetration testing;
• Incident response procedures for detecting, reporting and mitigating data breaches.

In the event of a data breach that poses a material risk to your rights, gh999 will notify affected users without undue delay and take all reasonable steps to contain and remediate the breach.

10. Data Retention

10.1 gh999 retains Personal Data for as long as your account remains active and for a minimum period thereafter as required by our regulatory and licensing obligations. Typical retention periods are as follows:

Data Category	Retention Period
Account registration data	Duration of account + 5 years minimum post-closure
KYC identity documents	Duration of account + 5 years minimum post-closure
Transaction records	7 years from transaction date (AML obligation)
Betting and gaming activity logs	5 years from account closure
Support communications	3 years from last interaction
Marketing preferences (opted-in)	Until opt-out or account closure
Security and access logs	12 months from creation

10.2 Following expiry of the relevant retention period, Personal Data will be securely deleted or anonymised so that it can no longer be associated with any individual.

11. Exercising Your Data Rights

11.1 To exercise any of the data rights described in this Policy, please submit a written request to our support team at the contact details provided in Section 14. To protect your privacy, we will require identity verification before processing any data-access, rectification or deletion request.

11.2 gh999 will respond to verified requests within 30 calendar days. Where a request is complex or gh999 receives a high volume of requests, this period may be extended by a further 30 days, and you will be notified accordingly.

11.3 Certain data-erasure requests may be declined or partially fulfilled where retention is required by a legal obligation, including AML and licensing requirements. We will explain the reason for any refusal in writing.

12. Minors & Age Verification

gh999 does not knowingly collect Personal Data from individuals under the age of 18 (or the higher minimum age required by the operator's licence jurisdiction). Age verification is a mandatory step during KYC. If gh999 discovers that Personal Data has been collected from a minor, the account will be immediately closed, all funds will be dealt with in accordance with applicable regulatory requirements, and associated Personal Data will be deleted except where retention is required for legal compliance purposes.

If you are a parent or guardian and believe your child has registered on gh999, please contact our support team immediately using the details in Section 14.

13. Changes to This Privacy Policy

gh999 reserves the right to update or amend this Privacy Policy at any time. Material changes — such as new data categories, new third-party sharing arrangements or changes to retention periods — will be communicated to registered users via email or a prominent notice on the Platform at least seven (7) days before the effective date of the change.

Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

14. Contact Us

For all data-privacy enquiries, including requests to exercise your rights, questions about this Policy or to report a suspected data-security incident, please contact our Data Protection team:

We aim to respond to all data-privacy requests within 30 calendar days. For urgent security incidents, please mark your email "URGENT – Security Incident" to ensure priority handling.