Encrypted Storage
All personal data is stored using industry-standard AES-256 encryption at rest and TLS in transit.
No Data Sales
sz99 does not sell, rent, or trade your personal information to third parties for marketing purposes.
Your Rights
You retain rights to access, correct, restrict, and request deletion of your personal data at any time.
Defined Retention
Data is kept only as long as necessary for operational, legal, and regulatory purposes, then securely deleted.
1 Introduction
This Privacy Policy ("Policy") describes how sz99 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("User", "you", "your") who visit, register on, or use the services available at sz99.cam and any associated subdomains or applications.
sz99 is committed to protecting the privacy and security of our users' personal information. We process personal data in a manner that is lawful, fair, transparent, and limited to what is necessary for the purposes described in this Policy. This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform.
By registering an account on sz99 or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood its contents. If you do not agree with how we process personal data as described herein, please discontinue use of the Platform and contact us to request account closure.
2 Definitions
For the purposes of this Policy, the following terms carry the meanings set out below:
- Personal Data
- Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
- Data Controller
- The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, sz99 acts as the Data Controller in respect of user personal data collected through the Platform.
- Data Processor
- A natural or legal person who processes personal data on behalf of the Data Controller under a contractual arrangement. Third-party service providers engaged by sz99 to support Platform operations may act as Data Processors.
- Processing
- Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
- Cookies
- Small text files placed on a user's device by a website. Cookies may store preferences, session information, and usage data that the Platform can access on subsequent visits.
- KYC Data
- Documentation and information provided by Users during Know Your Customer identity verification procedures, including government-issued identification, proof of address, and financial source documentation.
3 Data We Collect
sz99 collects various categories of personal data depending on how you interact with the Platform. The table below summarises the primary data categories, specific data types, and the context in which each is collected:
| Category | Data Types | Collection Context |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, CNIC or passport number | Account registration and KYC verification |
| Contact Data | Email address, phone number, residential and mailing address | Registration form and profile updates |
| Financial Data | Payment method details, bank account references, digital wallet identifiers, transaction amounts, deposit and withdrawal history | Deposit and withdrawal processing; KYC source-of-funds verification |
| Activity Data | Gameplay history, wager records, game session duration, bonus usage, betting market selections | Platform use; generated automatically during gaming sessions |
| Technical Data | IP address, device type, operating system, browser type, device identifiers, screen resolution, network provider | Automatically collected on Platform access via server logs and cookies |
| Communications Data | Support chat transcripts, email correspondence, feedback submissions | Customer support interactions |
| Verification Data | Copies of identity documents, proof-of-address documents, selfies or biometric data where required for identity verification | KYC verification process; fraud prevention |
| Preference Data | Language settings, notification preferences, responsible gambling limit settings | Account preferences and responsible gambling tool configuration |
4 How Data Is Collected
sz99 collects personal data through the following primary channels:
- Direct Submission: Information you provide when completing the registration form, updating your account profile, submitting KYC documentation, contacting customer support, or participating in surveys or feedback requests.
- Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, session data, clickstream data, and browser or operating system information, gathered via server logs, cookies, and similar technologies.
- Transaction Processing: Financial data generated during deposit and withdrawal operations, including records of payment method usage, transaction amounts, and processing timestamps.
- Gameplay Activity: Records generated automatically by Platform systems during gaming sessions, including wager placements, game outcomes, session durations, and bonus activity.
- Third-Party Sources: In limited circumstances, sz99 may receive data from third-party identity verification providers, payment processors, fraud-detection services, or credit reference agencies as part of KYC and anti-fraud procedures. Such third parties are contractually required to have a lawful basis for sharing this data with us.
5 Data Processing Purposes
sz99 processes your personal data for the following specific and documented purposes:
Account Management
Processing identity, contact, and security data to create, operate, and maintain your sz99 account, authenticate your identity on login, and manage account settings and preferences.
Payment Processing
Processing financial data to execute deposit and withdrawal requests, verify payment method ownership, prevent fraudulent transactions, and maintain accurate financial records for each account.
KYC & Compliance
Processing identity and verification data to fulfil Know Your Customer obligations, anti-money laundering (AML) requirements, counter-terrorism financing (CTF) controls, and age verification responsibilities.
Fraud Prevention
Analysing technical, financial, and activity data to detect and prevent fraudulent account activity, bonus abuse, identity theft, unauthorised account access, and financial crime.
Customer Support
Using contact and communications data to respond to your support requests, resolve account queries, investigate complaints, and maintain service quality records for 24/7 English-language support.
Responsible Gambling
Monitoring activity data to support responsible gambling obligations, including enforcing player-set limits, detecting patterns potentially indicative of problem gambling, and applying self-exclusion restrictions.
We do not use your personal data for automated decision-making that produces significant legal or similarly significant effects on you without first providing you with an opportunity to request human review of that decision.
6 Legal Basis for Processing
Each processing activity described in this Policy is conducted under one or more of the following legal bases:
- Contractual Necessity: Processing required to perform the contract between you and sz99 — including operating your account, processing deposits and withdrawals, and delivering gaming services.
- Legal Obligation: Processing required to comply with applicable legal requirements, including KYC verification, anti-money laundering obligations, and responses to lawful requests from law enforcement or regulatory authorities.
- Legitimate Interests: Processing conducted in pursuit of sz99's legitimate business interests where those interests are not overridden by your data protection rights, including fraud prevention, security monitoring, and service improvement analytics.
- Consent: Where required by applicable law, we will obtain your explicit consent before processing certain categories of data, such as the use of non-essential cookies or the delivery of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
7 Data Sharing & Third Parties
sz99 does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We may share personal data with carefully selected categories of third parties where necessary to deliver Platform services or meet legal obligations:
- Payment Processors: Financial data is shared with payment service providers engaged to process your deposits and withdrawals. This includes technical data necessary to complete transactions. Payment providers include services contextually familiar to Pakistani users such as digital wallet processors and bank transfer services. None of these providers are claimed to endorse sz99 or the gambling industry.
- Identity Verification Providers: KYC documentation and identity data may be shared with accredited third-party identity verification and age verification service providers who process this data on our behalf under strict contractual data processing agreements.
- Game Software Providers: Activity data related to specific games may be processed by the relevant game software providers under data processing agreements, to the extent necessary for game functionality, fairness certification, and dispute resolution.
- Fraud Detection Services: Technical and financial data may be shared with fraud-detection analytics providers to identify and prevent fraudulent account activity, money laundering, and bonus abuse.
- Legal and Regulatory Authorities: sz99 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by applicable law, valid court order, or lawful regulatory request. We will notify you of such disclosures where legally permitted to do so.
- Corporate Transactions: In the event of a merger, acquisition, reorganisation, or sale of assets, personal data held by sz99 may be transferred to a successor entity as part of that transaction. You will be notified of any such change and your rights regarding your data.
All third-party Data Processors engaged by sz99 are required to comply with data protection obligations equivalent to those described in this Policy, and are prohibited from using your personal data for any purpose beyond the specific processing activity for which they are engaged.
8 International Data Transfers
sz99 operates internationally and your personal data may be transferred to, stored in, or processed in countries other than Pakistan. These countries may have data protection laws that differ from, and in some cases offer fewer protections than, Pakistani law.
Where such transfers occur, sz99 implements appropriate safeguards to protect your personal data, which may include:
- Standard contractual clauses approved by relevant data protection authorities
- Contractual data processing agreements with third-party processors requiring equivalent data protection standards
- Technical and organisational security measures appropriate to the risk profile of the data being transferred
10 Data Retention
sz99 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law and regulatory obligations. The following general retention principles apply:
- Active Account Data: Personal data associated with your active sz99 account is retained for the duration of the account relationship and for a period of up to 5 years following account closure, to satisfy legal, regulatory, and dispute-resolution requirements.
- KYC & Verification Documents: Identity and verification documentation is retained for a minimum of 5 years from the date of verification or from account closure, whichever is later, in accordance with anti-money laundering regulatory requirements applicable to the operator's jurisdiction.
- Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of 5 years following the transaction date for accounting, audit, and regulatory compliance purposes.
- Support Communications: Customer support correspondence is retained for up to 3 years from the date of the interaction to support complaint investigation, quality monitoring, and dispute resolution.
- Technical Logs: Server logs and technical access records are typically retained for up to 12 months and then deleted or anonymised, unless a specific security investigation requires extended retention.
- Marketing Consent Records: Records of consent to receive marketing communications are retained for the duration of the consent period and for 2 years following withdrawal of consent.
On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identified individual.
11 Security Measures
sz99 implements a range of technical and organisational security measures designed to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
Encryption
All data transmissions between your browser or device and sz99 servers are encrypted using TLS (Transport Layer Security). Data stored at rest is encrypted using AES-256 industry-standard encryption.
Access Controls
Internal access to personal data is restricted to authorised personnel who require it for specific, documented business purposes. Role-based access controls limit the scope of employee data access.
Security Audits
Regular internal and periodic external security assessments are conducted to identify vulnerabilities in Platform systems, data storage practices, and access control configurations.
Incident Response
sz99 maintains a documented data breach response procedure. In the event of a personal data breach affecting your rights, we will notify you and relevant authorities in accordance with applicable legal requirements.
While sz99 implements robust security measures, no system connected to the internet can be guaranteed to be completely immune from security threats. You also bear responsibility for securing your own account — use a strong, unique password, enable any available two-factor authentication, and do not share your login credentials with any other person.
12 User Rights
Depending on your location and applicable data protection law, you may have some or all of the following rights with respect to your personal data held by sz99. We will respond to valid rights requests within a reasonable period, typically within 30 days:
Right of Access
You have the right to request a copy of the personal data sz99 holds about you and information about how it is being processed. We will provide this in a structured, commonly used format.
Right to Rectification
You have the right to request correction of inaccurate personal data held about you. You may update most account details directly through your account settings, or request correction via our support team.
Right to Erasure
In certain circumstances, you may request deletion of your personal data. This right is subject to legal retention obligations — we may be required to retain certain data (such as KYC and transaction records) regardless of erasure requests.
Right to Restrict Processing
You may request that sz99 restricts the processing of your personal data in circumstances where you contest its accuracy, object to its use, or require it to be preserved for legal claims rather than deleted.
Right to Data Portability
Where processing is based on your consent or contractual necessity, you have the right to receive personal data you provided to us in a structured, machine-readable format for transfer to another service provider.
Right to Object
You have the right to object to processing of your personal data where that processing is based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease that use immediately.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.
To exercise any of these rights, please contact our support team as described in Section 16 with a clear description of your request. We may require proof of identity before processing rights requests to prevent unauthorised access to your personal data.
13 Minors & Age Restrictions
sz99 strictly prohibits registration and use of the Platform by persons under 18 years of age, or the higher minimum age required by the operator's licensing jurisdiction. We do not knowingly collect personal data from minors.
Age verification is conducted as part of the KYC process. Where sz99 discovers that a minor has registered an account, the account will be immediately closed, all balances will be returned to the originating payment source (less any amounts won from wagers, which will be forfeited), and all personal data will be deleted to the extent permitted by applicable law.
Parents and guardians of minors are advised to use device-level parental control software to prevent access to online gambling services. If you believe a minor in your care has accessed sz99, please contact us immediately at the details provided in Section 16.
14 Pakistan-Specific Context
sz99 is an internationally operating platform targeting Pakistani users. The following points are relevant to Pakistani users regarding data protection and local law:
Data Protection in Pakistan
Pakistan's data protection framework is still developing. The Personal Data Protection Bill, when enacted, will establish formal statutory requirements for data controllers processing Pakistani citizens' data. sz99 operates under the data protection frameworks of its operating jurisdiction and applies the standards described in this Policy regardless of whether equivalent standards are currently mandated under Pakistani law.
The State Bank of Pakistan (SBP) and other Pakistani regulatory bodies have no oversight of sz99's data processing activities. References to Pakistani payment providers such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, and Bank Alfalah in our Platform context are for user-information purposes only — these institutions do not regulate or endorse sz99's data practices.
This section is provided as contextual information and does not constitute legal advice regarding Pakistani data protection law. If you have specific concerns about data protection rights available to you under Pakistani law, we recommend consulting a qualified legal professional.
15 Changes to This Policy
sz99 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform operations. Where changes are material, we will provide reasonable advance notice through in-platform notifications or email to your registered address prior to the changes taking effect.
Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you should cease using the Platform and contact us to close your account and request data deletion in accordance with Section 12.
The date of most recent review is indicated at the top of this page. We recommend that you revisit this Policy periodically to remain informed of how we handle your personal data.
16 Contact Us
If you have questions, concerns, or complaints regarding this Privacy Policy, the personal data sz99 holds about you, or how you can exercise your data rights, please contact our support team through the following channel:
Data & Privacy Support
Email: [email protected]
Availability: 24 hours a day, 7 days a week
Response Time: We aim to acknowledge all data-related requests within 72 hours and provide a substantive response within 30 days of receipt
Subject Line Guidance: When contacting us about data rights, please include "Privacy Request" and your account username in the subject line to help us route your request promptly
For urgent account security matters — such as suspected unauthorised access to your account — please use the live chat function available within your account dashboard for faster response rather than email correspondence.
Questions About Your Privacy?
Our support team is available 24/7 to answer questions about your data and privacy rights. You can also review our Terms & Conditions for the full contractual framework, or visit our FAQ for quick answers to common queries.