Privacy Policy

wh999 ("we", "us", "our") is committed to protecting the privacy and personal data of everyone who uses the wh999 platform at wh999.cam (the "Platform"). This Privacy Policy ("Policy") sets out how we collect, use, store, share and protect personal data, and explains your rights in relation to that data.

This Policy applies to all users of the Platform, including visitors who browse without registering, registered account holders and anyone who contacts us for support. It covers data collected through the website, any associated mobile interfaces and all communications with our support team.

By using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with how we process your data as described here, you should discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

wh999 serves users across Pakistan, including major cities such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. We are aware that Pakistan has its own data protection landscape. While wh999 operates under the data protection framework of its licensing jurisdiction, we are committed to handling user data in a manner that reflects internationally recognised privacy principles regardless of where our users are located.

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person — including name, email address, device identifiers, IP addresses, transaction records and any combination of data points that can identify an individual.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure and destruction, whether by automated or manual means.
• "Data Controller" means wh999, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of wh999 under a written data processing agreement (e.g., cloud hosting providers, KYC verification services, payment processors).
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data used for identification, or financial data beyond standard transaction records.
• "KYC Data" means identity documents, proof of address, selfies and source-of-funds information collected as part of the Know Your Customer verification process.

wh999 collects personal data in three primary ways: data you provide directly, data generated by your use of the Platform, and data received from third parties. The categories of data collected are set out below.

wh999 processes personal data for the purposes set out in the table below. Each purpose is tied to a specific legal basis, which is addressed in Clause 5.

wh999 does not use personal data for automated decision-making that produces significant legal effects on users without human review, except where required for fraud prevention or legal compliance purposes in which case you have the right to request human review.

wh999 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions — including operating your account, processing bets and withdrawals, and providing customer support.
• Legal obligation: Processing required to comply with applicable laws — including anti-money laundering legislation, identity verification requirements under our license, and cooperation with competent authorities.
• Legitimate interests: Processing necessary for wh999's legitimate business interests, including fraud prevention, platform security, analytics and improving our services — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where wh999 relies on consent — for example, for non-essential cookies or marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

wh999 does not sell personal data to third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for each stated purpose:

• Service providers and data processors: Third-party companies that provide services on our behalf — such as cloud hosting, identity verification (KYC) providers, payment processors, fraud detection services and analytics platforms — process data under written agreements that restrict their use of your data to the services they provide to us.
• Payment processing partners: When you make a deposit or request a withdrawal, your transaction data is shared with the relevant payment processing partner to complete the transaction. Payment references familiar to Pakistani users — such as mobile wallet services and local bank processors — handle payment data under their own published privacy policies and security standards.
• Regulatory and law enforcement bodies: wh999 may disclose personal data to competent authorities, regulators, courts or law enforcement agencies where required by law, court order or regulatory direction. We cannot notify you of such disclosures where legally prohibited from doing so.
• Group companies: Where wh999 operates as part of a corporate group, data may be shared with affiliated entities for the purposes of group-level compliance, risk management and consolidated reporting, under appropriate intra-group data sharing agreements.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of all or part of wh999's business assets, personal data held by wh999 may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

All third parties with whom wh999 shares personal data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose beyond what is specified in the relevant agreement.

wh999 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website. Cookies enable the Platform to recognise your device, remember your preferences and collect analytical data about your usage.

7.1 Categories of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function — including session authentication, security tokens, load balancing and fraud detection signals. These cookies cannot be disabled without impairing core Platform functionality and do not require your consent.
• Analytics cookies: Collect anonymised or pseudonymised data about how users navigate the Platform — pages visited, session duration, device type and traffic sources. This data helps us improve Platform performance and user experience. These cookies require your consent.
• Functional cookies: Remember your preferences — such as language settings, display preferences and previously selected options — to provide a more personalised experience. These cookies require your consent.
• Marketing cookies: Track your activity to deliver relevant promotional content. wh999 uses these cookies only with your explicit consent. You may withdraw consent at any time through your browser settings or our cookie preference centre.

7.2 Managing Cookies. You can manage or disable cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies and set notifications when a new cookie is placed. Disabling strictly necessary cookies will impair Platform functionality. Instructions for managing cookies in popular browsers are available through the browser's own help documentation.

wh999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligations or our licensing conditions. The following general retention periods apply:

• Account and registration data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements and to resolve any post-closure disputes.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of collection or the date of account closure, whichever is later, as required by applicable AML and licensing obligations.
• Transaction and betting records: Retained for a minimum of five (5) years from the date of the transaction or bet, for regulatory, tax and dispute resolution purposes.
• Support correspondence: Retained for a period of three (3) years from the last interaction, for quality assurance and dispute resolution.
• Analytics and technical data: Aggregated and pseudonymised analytics data may be retained indefinitely for trend analysis. Identifiable technical data (e.g., IP logs) is retained for up to twelve (12) months from collection for security purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures. Where anonymisation is not technically possible, the data is placed under restricted access pending secure deletion.

wh999 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include, without limitation:

• Encryption of data in transit using TLS/SSL protocols, and encryption of sensitive data at rest using industry-standard encryption algorithms.
• Role-based access controls ensuring that personal data is accessible internally only to staff whose role requires it, with access activity logged and regularly audited.
• Secure password policies including hashed password storage — wh999 does not store plaintext passwords under any circumstances.
• Regular security assessments of Platform infrastructure, including penetration testing and vulnerability scanning.
• Incident response procedures for detecting, containing and notifying affected parties in the event of a data breach, in accordance with applicable notification obligations.

While wh999 takes robust measures to protect your data, no system is completely immune to risk. You are responsible for maintaining the confidentiality of your account credentials. If you suspect your account has been compromised, contact our support team immediately.

Depending on the data protection law applicable to your situation, you may have some or all of the following rights in relation to your personal data held by wh999. We are committed to facilitating the exercise of these rights without creating unnecessary barriers.

To exercise any of these rights, submit a written request to our support team at [email protected]. We may need to verify your identity before processing your request. We will respond within a reasonable period and will explain our reasoning if we are unable to fulfil a request due to legal obligations.

wh999 operates internationally and may transfer personal data to countries outside of your jurisdiction of residence, including countries where data protection laws may differ from those in Pakistan or the jurisdiction you are located in.

Where personal data is transferred outside of the jurisdiction in which it was collected, wh999 ensures that appropriate safeguards are in place before the transfer takes place. These safeguards may include:

• Adequacy decisions by relevant data protection authorities confirming that the recipient country offers an adequate level of protection;
• Standard contractual clauses or equivalent contractual protections binding the recipient to appropriate data protection obligations;
• Binding corporate rules where transfers are made to affiliated companies within the wh999 corporate group;
• Certification schemes or codes of conduct approved by applicable supervisory authorities.

If you would like further information about the specific safeguards applied to any international transfer of your personal data, please contact us using the details in Clause 14.

The wh999 Platform is strictly for adults aged 18 years or older — or the higher minimum age required by the operator's license jurisdiction. wh999 does not knowingly collect personal data from persons under this age threshold.

Age verification is a core component of our KYC process. Accounts suspected of belonging to minors are suspended immediately pending investigation, and any associated data is processed in accordance with applicable legal requirements for the handling of data about minors.

If you believe that a minor has registered on the Platform or that wh999 holds personal data about a minor, please notify us immediately at [email protected]. We will take prompt action to investigate and, where confirmed, delete the relevant data and close the account.

wh999 may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or changes to the Platform's functionality. When material changes are made, we will notify registered users by email and/or by a prominent notice on the Platform. The "Last updated" date at the top of this Policy will be revised accordingly.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms. If you disagree with the changes, you should cease using the Platform and may request account closure.

Previous versions of this Privacy Policy are available on request from our support team. We recommend reviewing this Policy periodically, particularly if you update your account settings or claim a new promotion.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to make a complaint about how wh999 has handled your personal data, please contact us using the details below. All communications should be in English.

For formal data protection correspondence, please mark your email "Data Protection Officer — Formal Notice". We are committed to resolving data-related concerns at the first point of contact wherever possible. Where a complaint cannot be resolved satisfactorily, you may have the right to lodge a complaint with the applicable data protection supervisory authority.