p399 Privacy Policy

This Privacy Policy ("Policy") describes how p399 ("p399", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("you", "your", "User", "Player") who access or use the p399 online gaming platform, including the website at p399.net and any associated mobile or desktop interfaces.

p399 is committed to protecting the privacy of all users, including players based in Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan. We take data protection seriously and operate in accordance with internationally recognised privacy standards, including principles aligned with the General Data Protection Regulation (GDPR) where applicable.

This Policy should be read alongside the p399 Terms & Conditions and Responsible Gaming Policy, both of which are available on this website. This Policy may be updated from time to time — the date of the most recent revision is displayed at the top of this page and in the Document Info panel on this page.

For the purposes of this Privacy Policy, p399 acts as the data controller in respect of all personal data collected through the p399 platform. As data controller, p399 determines the purposes and means of processing your personal information.

p399 operates under an internationally recognised online gaming licence. All data processing activities carried out by p399 are conducted in accordance with the requirements of that licensing regime and applicable international data protection standards.

If you have any questions or concerns about how your personal data is handled by p399, or wish to exercise any of your data rights, please contact our dedicated privacy team at:

p399 collects personal data from you in the following ways: information you provide directly to us, information collected automatically when you use the platform, and information received from third parties such as payment providers and identity verification services.

Information you provide directly:

• Registration data: full legal name, date of birth, email address, phone number, residential address, and chosen username and password
• Identity verification documents: copies of your CNIC (Computerised National Identity Card), passport, or other government-issued identification, along with proof of address documents where required
• Payment information: your JazzCash or EasyPaisa mobile wallet number, bank account details (HBL, UBL, Meezan Bank), and transaction reference numbers — note that p399 does not store full card numbers on its own servers
• Communications: any messages, emails, or support tickets you send to the p399 customer support team
• Responsible gaming preferences: deposit limits, loss limits, self-exclusion elections, and cool-off period settings

Information collected automatically:

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution
• Usage data: pages visited, time spent on pages, games played, bet amounts and outcomes, session duration, login timestamps
• Cookie and tracking data: session identifiers, analytics data — see Section 7 for full cookie details
• Geolocation data: general location derived from IP address for compliance and fraud prevention purposes

Information from third parties:

• Identity verification outcomes and flags from our KYC (Know Your Customer) verification service providers
• Transaction confirmation and status data from JazzCash, EasyPaisa, and banking partners
• Fraud risk signals from our fraud prevention and risk management partners

p399 uses the personal data it collects for the following purposes:

p399 does not use your personal data for any purpose beyond those listed above without first obtaining your explicit consent, unless we are required to do so by applicable law or regulatory authority.

p399 processes your personal data on the following legal bases, in accordance with internationally recognised data protection principles:

• Contractual necessity: Processing required to fulfil the contract between you and p399, including account registration, transaction processing, and customer support. Without this processing, p399 cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and age verification duties under p399's gaming licence.
• Legitimate interests: Processing carried out for p399's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and platform analytics — provided these interests are not overridden by your privacy rights.
• Consent: Where p399 relies on your consent as the legal basis for processing — primarily for direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

p399 does not sell, rent, or trade your personal information. We share your data only in the limited circumstances described below, and only with parties who are contractually bound to protect it to standards at least equivalent to our own:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum personal and payment data necessary to process your deposit or withdrawal transactions.
• Identity verification providers: Third-party KYC and AML service providers receive identity document data and personal details solely for the purpose of verifying your identity and assessing fraud risk.
• Gaming software providers: Certain game providers integrated into the p399 platform may receive session identifiers and anonymised gameplay data required to operate their games within our environment.
• Fraud prevention partners: Our fraud and risk management partners may receive device fingerprint data, IP addresses, and behavioural signals for the purpose of detecting and preventing fraudulent activity.
• Regulatory and legal authorities: p399 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts when legally required to do so, or when disclosure is necessary to protect the rights, property, or safety of p399, its users, or the public.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of p399's business, personal data held by p399 may be transferred to the successor entity, subject to equivalent privacy protections.

p399 uses cookies and similar technologies on the p399.net platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies allow the platform to recognise your device, maintain your session, and remember certain preferences.

p399 uses the following categories of cookies:

• Strictly necessary cookies: These are essential for the p399 platform to function. They maintain your login session, remember your language preference, and ensure the security of your account. These cookies cannot be disabled without severely impairing your ability to use the platform.
• Functional cookies: These cookies remember choices you have made — such as your responsible gaming settings or preferred display options — to provide a more personalised experience within the p399 platform.
• Analytics cookies: p399 uses first-party analytics to understand how users interact with the platform — which pages are visited most frequently, where users encounter difficulties, and how gameplay flows. This data is aggregated and used solely to improve the p399 experience. p399 does not use Google Analytics or other third-party analytics services that share your data externally.

p399 does not use advertising cookies, retargeting pixels, or any tracking technology designed to follow your activity across other websites or display p399 adverts on third-party platforms.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the p399 platform. Instructions for managing cookies can be found in your browser's help documentation.

p399 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, and for as long as required by applicable law and our gaming licence obligations.

The following retention principles apply:

• Active accounts: Personal data associated with an active p399 account is retained for the full duration of the account's activity.
• Closed accounts: Following account closure — whether voluntary or by p399 — we retain personal data for a minimum of five (5) years in order to meet our AML, KYC, and regulatory record-keeping obligations. This period may be longer where required by law or where an investigation is ongoing.
• Transaction records: Financial transaction data is retained for a minimum of seven (7) years in accordance with standard financial record-keeping requirements.
• Support communications: Customer support correspondence is retained for three (3) years following the resolution of the relevant matter.
• Marketing consent records: Records of your marketing consent or withdrawal of consent are retained for the duration of any associated legal obligation or dispute limitation period.

Once the applicable retention period has elapsed, personal data is securely deleted or anonymised so that it can no longer be linked to you as an individual.

p399 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

• TLS/SSL encryption for all data transmitted between your device and the p399 platform
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment details
• Access controls that restrict access to personal data to only those p399 staff members who require it for their specific job function
• Multi-factor authentication for administrative access to systems handling personal data
• Regular security audits and penetration testing of the p399 platform infrastructure
• Incident response procedures to detect, investigate, and notify affected users of any personal data breaches in accordance with applicable requirements

As a p399 user, you have the following rights in relation to your personal data held by p399. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Request":

• Right of access: You have the right to request a copy of the personal data p399 holds about you, along with information about how it is being used.
• Right to rectification: If any personal data p399 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: In certain circumstances, you have the right to request that p399 deletes your personal data. Note that this right may be limited where p399 has a legal or regulatory obligation to retain the data.
• Right to restrict processing: You have the right to request that p399 restricts its processing of your personal data in certain circumstances, for example while the accuracy of the data is disputed.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to p399's processing of your personal data where that processing is based on legitimate interests. You also have an unconditional right to object to processing of your data for direct marketing purposes.
• Right to withdraw consent: Where p399 relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

p399 will respond to all valid data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it.

The p399 platform is strictly for individuals aged 21 years and above. p399 does not knowingly collect personal data from any person under the age of 21. Registration on the p399 platform by persons under 21 is prohibited.

p399 implements the following age protection measures:

• Date of birth collection at registration and automated age calculation checks
• Mandatory identity verification (KYC) that includes age confirmation via government-issued documentation
• Monitoring of account activity for indicators of underage access
• Immediate account closure and voiding of all activity if an account is found to belong to a person under 21

If p399 becomes aware that it has inadvertently collected personal data from a person under the age of 21, that data will be deleted immediately and the account permanently closed.

p399 operates as an internationally licensed gaming platform. This means that personal data collected from Pakistani players and users worldwide may be stored and processed in jurisdictions outside of Pakistan, including the jurisdiction in which p399's hosting infrastructure and licensing authority are based.

Where your personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to international standards, p399 ensures that appropriate safeguards are in place. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities
• Contractual requirements on recipient parties to implement data protection measures equivalent to those applied by p399
• Transfer only to jurisdictions with adequate data protection frameworks as recognised by applicable standards

By using the p399 platform, you acknowledge and consent to the transfer of your personal data to the jurisdictions in which p399 operates, subject to the safeguards described above.

p399 reserves the right to update or modify this Privacy Policy at any time. Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — p399 will make reasonable efforts to notify registered players via email or an on-platform notification prior to the changes taking effect.

The date of the most recent revision to this Policy is displayed at the top of this page. We encourage you to review this page periodically to stay informed about how p399 is protecting your personal data. Continued use of the p399 platform after updated terms are published constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by p399, please reach out to our team through the following channel:

For concerns about underage access, responsible gaming, or account self-exclusion, please use the subject line "Responsible Gaming" so our dedicated safety team can prioritise your request.

If you are not satisfied with p399's response to a privacy concern, you have the right to escalate the matter to the data protection authority or regulatory body with jurisdiction over p399's operations under its gaming licence. Details of the relevant authority will be provided upon request.