bq999 Privacy Policy

bq999 operates the online gaming platform accessible at bq999.bio ("Platform"). For the purposes of this Privacy Policy, bq999 acts as the data controller in respect of all personal data collected from registered account holders and visitors to the Platform.

As data controller, bq999 is responsible for determining the purposes and means of processing your personal data. We are committed to processing your data lawfully, fairly, and transparently in accordance with applicable data protection standards and the requirements of our international gaming operating licence.

bq999 serves players across Pakistan, including in Karachi, Lahore, Islamabad, Faisalabad, and all other cities and regions. Pakistani Rupee (PKR) is the platform's operating currency. All data processing practices described in this Policy apply uniformly to all bq999 account holders regardless of their city or region within Pakistan.

bq999 collects personal data through several channels: directly from you during registration and account management, automatically through your use of the Platform, and in limited cases from third-party payment providers and identity verification services. The following table describes the categories of personal data collected, the source, and the primary purpose for each category.

Registration at bq999 requires only your mobile phone number, a chosen password, and age confirmation. Full identity documentation (CNIC) is required only at the KYC verification stage, which is triggered at specific withdrawal thresholds or at bq999's discretion for compliance purposes. You may use the Platform for deposits and gaming prior to completing full KYC verification, subject to the applicable account limits.

bq999 processes your personal data only where we have a lawful basis for doing so. The following legal bases apply to bq999's data processing activities:

• Contractual Necessity: Processing required to perform the contract between bq999 and you — including account operation, payment processing, game delivery, and withdrawal execution. CONTRACT
• Legal Obligation: Processing required for compliance with applicable laws and regulations — including anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, age verification mandates, and tax reporting obligations under our operating licence. LEGAL OBLIGATION
• Legitimate Interests: Processing necessary for bq999's legitimate interests, where those interests are not overridden by your data protection rights — including fraud detection and prevention, platform security, responsible gaming monitoring, and service improvement analytics. LEGITIMATE INTEREST
• Consent: Processing based on your freely given, specific, informed consent — including sending promotional communications, personalised offer notifications, and any data use not covered by the above bases. You may withdraw consent at any time by updating your communication preferences within your account settings or by contacting support. CONSENT

Your personal data is used by bq999 for the following specific purposes, each grounded in the legal bases identified in Section 3:

Your contact data and identity data are used to create, verify, and maintain your bq999 account. Your financial data is used to process deposits from Pakistani payment channels (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Bank Alfalah) and to execute withdrawal requests to your registered payment accounts. Your gaming activity data is used to display your session history, balance, and bet records within your account dashboard.

Technical data (IP address, device fingerprint, login history) and financial data (transaction patterns, deposit/withdrawal frequency) are analysed by bq999's security systems to detect and prevent fraudulent account activity, money laundering, unauthorised access, and the creation of multiple accounts by the same individual. Where suspicious activity is identified, bq999 is legally required to file reports with relevant authorities and may suspend account access pending investigation.

bq999 uses gaming activity data — session duration, bet frequency, deposit patterns, and responsible gaming tool usage — to identify account holders who may be experiencing gambling-related harm. This monitoring allows bq999 to proactively offer responsible gaming tools, apply protective limits where appropriate, and intervene in line with our responsible gaming obligations. See the Responsible Gaming Policy for full detail.

Communication data (live chat transcripts, support ticket history) is retained to enable bq999 support staff to assist you effectively, track the resolution of past issues, and handle formal complaints or dispute resolution requests accurately and fairly.

Where you have provided consent, bq999 may use your contact data to send promotional notifications — such as information about new bonus offers, cricket betting promotions aligned with PSL and international match schedules, new slot game launches, and responsible gaming reminders. You may opt out of promotional communications at any time by contacting bq999 support or updating your notification preferences in your account settings. Opting out of promotional communications does not affect your ability to use the Platform.

bq999 does not sell your personal data to any third party under any circumstances. Data sharing with third parties occurs only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Providers: Your financial data (transaction amounts, account identifiers) is shared with payment processors — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and Bank Alfalah — solely to the extent required to execute your deposit and withdrawal instructions. Each payment provider processes your data under its own privacy policy and applicable Pakistani financial services regulations.
• Game Providers: Technical data (session token, game result data) is shared with third-party game studio providers (such as PG Soft and Pragmatic Play) to deliver game content and record game outcomes. Game providers are contractually prohibited from using this data for any purpose other than game delivery and RNG certification compliance.
• Identity Verification Services: Where KYC verification is triggered, your identity data (CNIC details) may be shared with regulated identity verification service providers who check document authenticity and cross-reference sanctions lists. These providers process data solely for verification purposes under their own regulatory obligations.
• Regulatory and Law Enforcement Authorities: bq999 is legally obligated to disclose account data to competent regulatory authorities, law enforcement agencies, or anti-money laundering reporting bodies where required by applicable law, court order, or regulatory instruction. Such disclosures are made only to the extent legally required and are logged internally.
• Professional Advisers: bq999's legal advisers, auditors, and compliance consultants may access limited personal data in the course of providing professional services to bq999, subject to strict confidentiality obligations.

bq999 operates as an internationally licensed gaming platform. As a consequence, some personal data may be processed by service providers or system infrastructure located outside of Pakistan. Where such international transfers occur, bq999 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding that which applies within Pakistan.

Safeguards applied to international data transfers include: contractual data protection clauses binding the recipient to confidentiality and security standards consistent with applicable international data protection law; technical security measures (encryption in transit and at rest); and access controls limiting data access to authorised personnel with a legitimate operational need.

bq999 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual. Where anonymisation is applied, the resulting anonymous data may be retained for statistical or analytical purposes indefinitely.

Subject to applicable legal limitations, you hold the following rights with respect to your personal data held by bq999. These rights may be exercised at any time by contacting bq999 support via live chat or plain-text email. bq999 will respond to all valid rights requests within thirty (30) calendar days of receipt.

bq999 uses cookies and similar tracking technologies on the Platform to provide essential functionality, improve user experience, and analyse platform performance. A cookie is a small data file placed on your device by a web server when you visit a site. You can manage cookie settings through your browser settings at any time.

The following categories of cookies are used on the bq999 platform:

• ESSENTIAL Session and Authentication Cookies: Required for the bq999 Login system to function. These cookies maintain your logged-in state, enable the 2FA flow, and preserve your session across pages. Cannot be disabled without rendering the Platform non-functional. Deleted on browser close (session cookies) or after 30 days (persistent session cookies where "Keep me signed in" is selected).
• ANALYTICS Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how players use the bq999 Platform — which games are most visited, where errors occur, page load times, and navigation patterns. This data is used internally to improve platform performance. No individual player is identified from analytics data.
• FUNCTIONAL Preference Cookies: Store your platform preferences — such as language selection, notification settings, and interface layout choices — so that these are preserved across sessions without requiring you to reset them on every visit.
• MARKETING Promotional Cookies: Used only where you have consented to promotional communications, to track which offers you have been shown and whether you have engaged with them, ensuring you do not receive duplicate promotional messages and allowing bq999 to assess the effectiveness of promotional campaigns.

bq999 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures are reviewed and updated regularly in line with evolving security standards.

• Transport Layer Security (TLS): All data transmitted between your browser or mobile device and bq999 servers is encrypted using 256-bit TLS, preventing interception by third parties on the network.
• Data at Rest Encryption: Personal data stored in bq999 databases is encrypted using AES-256 encryption. Encryption keys are managed through a secure key management system with restricted access.
• Two-Factor Authentication (2FA): bq999 provides 2FA to all account holders. When enabled, each login from a new device requires OTP confirmation via the registered phone number, providing a second layer of defence against credential compromise.
• Access Control: Internal access to personal data is restricted on a need-to-know basis using role-based access control (RBAC). bq999 employees and contractors can access only the data required for their specific operational role.
• Login Monitoring: bq999 systems monitor login attempts, device changes, and geographic access patterns for all accounts. Anomalous activity triggers automated security alerts and, where appropriate, temporary account locks.
• Regular Security Assessments: bq999 platform infrastructure undergoes periodic security reviews including vulnerability scanning and penetration testing by qualified security professionals.

Despite these measures, no internet transmission or digital storage system can be guaranteed to be 100% secure. In the event of a data breach that poses a risk to your rights and interests, bq999 will notify affected individuals and relevant regulatory authorities as required by applicable law, without undue delay.

The bq999 Platform is strictly an adult platform. bq999 does not knowingly collect, process, or retain personal data belonging to any person under twenty-one (21) years of age. The 21+ age requirement is a platform-wide, product-wide, and registration-level restriction that is enforced through age confirmation at registration and through identity verification at applicable account milestones.

The bq999 Platform integrates third-party services — including game content from licensed studios, payment processing infrastructure, and identity verification tools — that may collect and process personal data under their own privacy policies. bq999 selects third-party partners carefully and requires all data processors to maintain security and confidentiality standards consistent with bq999's obligations under this Policy.

bq999 is not responsible for the privacy practices of third-party services, including the payment platforms (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Bank Alfalah) used for deposits and withdrawals. Players are encouraged to review the privacy policies of any third-party service with which they interact in connection with their bq999 account usage.

bq999 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, regulatory requirements, or platform functionality. When material changes are made, bq999 will notify registered account holders via the phone number or contact details associated with their account, or through a prominent notice on the Platform, with reasonable advance notice before changes take effect.

The effective date at the top of this document indicates when the current version was published. Your continued use of the bq999 Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not accept any material change, your appropriate course of action is to close your account and cease using the Platform prior to the change taking effect.

For all privacy-related enquiries, data rights requests, consent withdrawal, or complaints regarding bq999's data processing practices, please contact the bq999 Data Support team using the following channels. All privacy requests are handled with confidentiality and without prejudice to your account status.

If you are not satisfied with bq999's response to a privacy complaint, you may have the right to escalate the matter to the relevant supervisory or regulatory authority in your jurisdiction. bq999 will cooperate fully with any such regulatory review process.