Privacy Policy

This Privacy Policy ("Policy") is issued by the operator of cit999.cam ("cit999", "the Platform", "we", "us", "our"). It describes how we collect, use, store, share and protect personal data relating to individuals ("you", "the Player", "the User") who visit or use the cit999 platform, register an account, or otherwise interact with our services.

By accessing cit999.cam, creating an account, or using any feature of the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein. If you do not agree, you must not use the Platform.

This Policy forms part of the overall legal framework governing your use of cit999, together with the Terms & Conditions and the Responsible Gambling Policy.

• "Personal Data" means any information that identifies or could reasonably identify a living individual, directly or in combination with other data — including name, email address, IP address, device identifiers and transaction records.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, the operator of cit999.cam.
• "Data Processor" means any third-party entity that processes personal data on behalf of the Data Controller under a contractual arrangement, such as payment processors or identity verification providers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• "Cookies" means small text files placed on your device by websites to store state, session and preference information.
• "KYC" means Know Your Customer — the identity and address verification process mandated for account verification and anti-money laundering compliance.
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

cit999 collects personal data through multiple channels in the course of providing its services. The categories of data collected and their primary sources are set out in the table below:

cit999 processes personal data only where a valid legal basis exists. The primary legal bases applicable to our data processing activities are:

• Performance of a Contract: Processing necessary to provide you with the services you have requested — including account creation, bet placement, payment processing and withdrawal handling.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC identity verification, AML transaction monitoring and mandatory record-keeping.
• Legitimate Interests: Processing carried out to pursue the legitimate business interests of cit999, including fraud prevention, platform security, abuse detection and product improvement — provided these interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your specific, freely given consent — for example, processing for direct marketing purposes, where applicable. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5.1 Account and Service Delivery

We use identity, contact and financial data to create and maintain your account, process deposits and withdrawals, verify your identity for KYC purposes, and deliver the full range of betting and gaming services available on cit999.

5.2 Compliance and Fraud Prevention

We use identity, transaction and technical data to comply with anti-money laundering obligations, detect and prevent fraud, investigate suspicious account activity, and maintain the integrity of the Platform for all users.

5.3 Responsible Gambling

We use usage and account data to monitor player behaviour for indicators of problem gambling, enforce player-set limits and self-exclusion commitments, and contact players where our responsible gambling policies require intervention or support.

5.4 Customer Support

We use communications and account data to respond to support queries, resolve disputes, process complaints and maintain records of significant account interactions.

5.5 Platform Improvement and Analytics

We use technical and usage data to analyse platform performance, identify and fix errors, improve navigation and user experience, and develop new features based on aggregated usage patterns. Analytics processing uses pseudonymised or aggregated data where possible.

5.6 Marketing Communications (Consent-Based)

Where you have provided explicit consent to receive marketing communications, we may use your contact data to send promotional offers, bonus announcements and platform news. You may opt out of marketing communications at any time via your account notification settings or by contacting support. Withdrawal of marketing consent does not affect your ability to use the Platform.

cit999 does not sell your personal data to third parties. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Processors: To facilitate deposits and withdrawals. Payment service providers receive only the transaction data necessary to execute the relevant payment. Familiar Pakistani payment references such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced as familiar payment context only — none endorse, support or are affiliated with cit999.
• Identity Verification Providers: To conduct KYC and AML verification, your identity documents may be processed by specialist third-party verification services operating under contractual data protection obligations.
• Technology and Hosting Providers: Third-party infrastructure, cloud hosting and software providers who process data on our behalf under data processing agreements. These providers do not use your data for their own purposes.
• Fraud Prevention and Security Services: Specialist fraud detection and cybersecurity providers who help protect the Platform and all users from financial crime and security threats.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order or regulatory obligation, we may disclose personal data to competent authorities. We disclose only the minimum data legally required.
• Corporate Transactions: In the event of a merger, acquisition, restructuring or sale of assets, personal data held about registered players may be transferred to the relevant successor entity — subject to the same privacy commitments in this Policy.

cit999 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the website. They serve several functional and analytical purposes.

7.1 Cookie Categories Used

7.2 Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to refuse all or specific categories of cookies. Please note that disabling strictly necessary cookies will impair or prevent your ability to use the Platform, including logging in to your account. Analytics and marketing cookies can be disabled without affecting core Platform functionality.

cit999 implements a range of technical and organisational security measures to protect personal data against unauthorised access, loss, disclosure, alteration or destruction. These measures include:

• HTTPS/TLS Encryption: All data in transit between your browser and our servers is encrypted using HTTPS with TLS protocols.
• Access Controls: Personal data is accessible only to authorised personnel who require it to perform their role. Access is governed by role-based permissions and audit logging.
• Password Security: Account passwords are stored using industry-standard hashing algorithms — plain-text passwords are never retained.
• System Monitoring: Platform infrastructure is monitored continuously for security anomalies, unauthorized access attempts and suspicious patterns.
• Third-Party Security Obligations: Data processors and technology partners are contractually required to maintain security standards commensurate with those applied by cit999.

cit999 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligation. The following general retention principles apply:

• Active Account Data: Personal data associated with an active account is retained throughout the account's active lifetime and for a defined period following account closure, to allow for dispute resolution, regulatory review and legal proceedings.
• KYC and AML Records: Identity documents and AML transaction records are retained in accordance with the retention obligations under the applicable operating licence — typically for a minimum of five years following account closure or the relevant transaction date, whichever is later.
• Support Communications: Customer support chat transcripts and email correspondence are retained for a period sufficient to allow resolution of ongoing or potential future disputes.
• Marketing Consent Records: Records of marketing consent and its withdrawal are retained for as long as necessary to evidence compliance with consent obligations.
• Technical/Log Data: Server logs and technical usage data are retained for a limited period for security monitoring and performance analysis purposes, after which they are deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to an identifiable individual.

Depending on the data protection framework applicable to your situation, you may hold some or all of the following rights in respect of your personal data processed by cit999. We will respond to all valid requests within a reasonable timeframe.

As an internationally operating platform, cit999 may transfer personal data to, or process personal data in, jurisdictions outside your country of residence — including through third-party service providers such as cloud hosting, payment processing and fraud prevention partners.

Where personal data is transferred across borders, cit999 takes steps to ensure that appropriate safeguards are in place — such as contractual obligations on data processors — to provide a level of protection broadly comparable to that applied within the Platform's primary operating jurisdiction.

Pakistani players should be aware that their personal data will be processed outside Pakistan, in the jurisdiction(s) where cit999 and its third-party processors operate. By using the Platform, you acknowledge this cross-border processing.

cit999 is strictly an adults-only platform. The collection and processing of personal data from individuals under the minimum eligible age (18 years, or the higher minimum required by the applicable operator or license jurisdiction) is not permitted.

If we become aware that personal data has been collected from a person who is under the minimum eligible age, we will take immediate steps to delete such data and close the associated account. Any winnings generated by an underage player are void and will not be paid out.

If you are a parent or guardian and have reason to believe that a minor in your care has created an account on cit999, please contact our support team immediately so that we can take appropriate action.

The cit999 Platform may contain references to or integrations with third-party services, such as payment processing interfaces and game studios delivered via iFrame or API. cit999 does not control the data practices of these third-party services when you interact with them directly.

This Privacy Policy applies exclusively to personal data collected and processed by cit999 in connection with the operation of cit999.cam. It does not govern the data practices of game studios, payment processors, or any other third-party service that operates independently of the cit999 Platform.

We recommend that you review the privacy policies of any third-party service you interact with through or alongside the Platform, particularly payment services providers whose interfaces you access during deposit or withdrawal transactions.

cit999 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance or the services we provide. The most current version of this Policy will always be available at cit999.cam/privacy-policy.

The "Last Reviewed" date at the top of this page will be updated whenever material changes are made. Where a change significantly affects how we process your personal data — particularly where it affects your rights or the purposes for which we process your data — we will use reasonable efforts to notify active players via the Platform interface or by email.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree to an update, you should cease using the Platform and may request account closure.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact the cit999 support team using the following channels:

• Email: [email protected] — Plain text only, not a clickable link. Typical response time: within 24 hours (operator-stated). For data rights requests, please include "Data Rights Request" in your subject line.
• Live Chat: Available 24/7 via the Platform (operator-stated availability). Access via your logged-in account. Suitable for urgent enquiries including immediate self-exclusion requests and suspected data security incidents.
• Language Support: Primary support language is English. Urdu language assistance is available on request for Pakistani players in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and across Pakistan.

Data rights requests will be acknowledged promptly and responded to within a reasonable period. We may request proof of identity before processing a data access, correction or deletion request to ensure your data is not disclosed to or modified by an unauthorized party.