Privacy Policy — bro999

Introduction

This Privacy Policy ("Policy") is issued by bro999 ("Platform", "we", "us", "our"), accessible at https://bro999.cam. It describes our practices regarding the collection, processing, use, storage and disclosure of personal data relating to individuals ("Users", "you", "your") who access or use the bro999 platform.

bro999 is an online casino and sports betting information platform serving English-speaking users in Pakistan. We are committed to protecting the privacy and security of our users' personal information and to operating in compliance with applicable data protection principles.

By accessing or using bro999, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue your use of the Platform immediately.

Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a natural person — directly or indirectly. This includes name, email address, IP address, device identifiers, location data and account credentials.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, consultation, use, disclosure, erasure or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, bro999.
• "Data Processor" means any third party that processes personal data on behalf of bro999 under a data processing agreement.
• "Cookies" means small text files stored on a User's device by a web browser at the request of a website, used to remember preferences, session state and usage analytics.
• "KYC" (Know Your Customer) refers to the identity and address verification procedures used to confirm User identity, typically required before withdrawals can be processed.
• "Consent" means a freely given, specific, informed and unambiguous indication of the User's agreement to the processing of their personal data for one or more specific purposes.
• "Sensitive Data" means personal data that, by its nature, carries a higher risk of harm if disclosed — including identity document numbers (such as CNIC details), financial account information and health-related data.

Data Controller

For the purposes of this Policy, bro999 acts as the Data Controller in respect of personal data collected directly through the Platform. Where bro999 engages third-party service providers to process data on our behalf, those providers act as Data Processors and are contractually bound to process data only as directed by bro999 and in accordance with applicable data protection requirements.

If you have any questions about how your personal data is handled, or wish to exercise your data rights, you may contact us at the details provided in Section 16 of this Policy.

Data We Collect

bro999 collects personal data through several channels. The categories of data we collect, and the primary collection methods, are described in the table below.

4.1 Data You Provide Directly

When you register an account, complete KYC verification, contact support, submit a withdrawal request or interact with any feature of the Platform, you provide us with personal data directly. The accuracy of this data is your responsibility — providing false or incomplete information is a breach of our Terms & Conditions.

4.2 Data Collected Automatically

When you access bro999, our servers automatically record technical data including your IP address, browser version, device type, operating system and access times. This data is used for security monitoring, fraud prevention and service improvement purposes.

4.3 Data from Third Parties

In some cases we may receive personal data about you from third-party sources, including identity verification service providers used for KYC processing, fraud detection services and payment processing partners. Such third parties are contractually required to provide data lawfully.

Legal Basis for Processing

bro999 processes personal data only where a valid legal basis exists. The legal bases on which we rely are as follows:

• Performance of a contract: Processing necessary to fulfil the agreement between bro999 and the User — including account operation, transaction processing and support provision.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering obligations, KYC requirements and fraud prevention mandates.
• Legitimate interests: Processing necessary for the legitimate interests of bro999, where those interests are not overridden by the User's fundamental rights and freedoms. This includes platform security, fraud detection, analytics, and service improvement.
• Consent: Where processing is based on your consent — for example, in relation to certain marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

How We Use Your Data

bro999 uses personal data collected from Users for the following purposes:

• Account management: Creating, maintaining and securing your bro999 account, including password resets, session management and access controls.
• Transaction processing: Facilitating deposits, withdrawals and bonus activations, including verifying payment method ownership and applying applicable transaction limits.
• Identity verification (KYC): Verifying your identity and address as required before processing withdrawals or at the Platform's discretion for account security purposes.
• Customer support: Responding to your enquiries, resolving disputes, managing complaint procedures and providing technical assistance.
• Security and fraud prevention: Monitoring account activity for unusual patterns, detecting and preventing fraudulent transactions, multi-accounting and other prohibited activities.
• Legal compliance: Meeting obligations under applicable laws including anti-money laundering regulations, data retention requirements and obligations arising from court orders or regulatory demands.
• Platform improvement: Analysing usage data in aggregated, anonymised form to identify areas for improvement and to develop new platform features.
• Responsible gambling compliance: Processing data necessary to apply responsible gambling tools including deposit limits, self-exclusion lists and cooling-off periods at your request or where required to protect your wellbeing.
• Communications: Sending service-related notifications, security alerts and, where you have provided consent, promotional communications about offers and new features.

Data Sharing & Disclosure

bro999 does not sell, rent or trade personal data to third parties for their own marketing purposes. We share personal data with third parties only in the following circumstances and only to the extent necessary:

7.1 Service Providers

We engage carefully selected third-party service providers who assist in operating the Platform — including hosting providers, KYC verification services, payment processing infrastructure, fraud detection services and customer support platforms. These providers act as Data Processors under contractual data processing agreements and may only use your data as instructed by bro999.

7.2 Legal & Regulatory Disclosure

We may disclose personal data where required to do so by applicable law, regulation, court order or lawful request from a competent authority. This includes disclosures required under anti-money laundering legislation or at the direction of law enforcement agencies conducting authorised investigations.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale or other corporate restructuring involving bro999, personal data may be transferred to the successor entity. Users will be notified of any such transfer and of any change to the applicable Privacy Policy with reasonable advance notice.

7.4 Protection of Rights

We may disclose personal data where we believe in good faith that such disclosure is necessary to protect the rights, property or safety of bro999, its users or the public, including for the purposes of fraud investigation and prevention.

Cookies & Tracking Technologies

bro999 uses cookies and similar tracking technologies to operate and improve the Platform. By continuing to use bro999 after being presented with our cookie notice, you consent to the use of cookies in accordance with this section.

8.1 Types of Cookies Used

• Strictly necessary cookies: Essential to core Platform functionality, including session management, authentication tokens and security features. These cannot be disabled without impairing Platform operation.
• Functional cookies: Used to remember your preferences such as language settings, display preferences and previously entered data. These improve your experience but are not essential.
• Analytics cookies: Used to collect anonymised information about how users interact with the Platform — pages visited, time spent, click paths. This data is aggregated and does not identify individual users.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic and account intrusion attempts.

8.2 Cookie Management

You may manage your cookie preferences through your browser settings. Most browsers allow you to view, delete and block cookies. Note that blocking strictly necessary cookies will impair your ability to use core Platform features including account login. For detailed instructions on managing cookies in your specific browser, consult your browser's help documentation.

International Data Transfers

The bro999 Platform and its service infrastructure may operate across multiple jurisdictions. Personal data collected from Users in Pakistan may be transferred to, stored on, and processed in servers located outside Pakistan. By using bro999, you consent to such transfers.

Where personal data is transferred internationally, bro999 takes reasonable steps to ensure that appropriate safeguards are in place — including contractual data protection clauses with service providers — to provide a level of data protection broadly consistent with applicable data protection principles.

Data Retention

bro999 retains personal data only for as long as is necessary for the purpose for which it was collected, or for as long as required by applicable law. The following general retention periods apply:

• Active account data: Retained throughout the active life of your account.
• Account and transaction data post-closure: Retained for a minimum of five (5) years following account closure to comply with anti-money laundering, fraud prevention and financial record-keeping obligations.
• KYC verification documents: Retained for the period required by applicable AML and KYC regulations — typically five years from the date of verification or account closure, whichever is later.
• Support communications: Retained for a minimum of two (2) years following resolution of the relevant issue, for dispute resolution purposes.
• Server and technical logs: Typically retained for 90 days for security and fraud investigation purposes, unless a specific incident requires extended retention.
• Anonymised analytics data: May be retained indefinitely as it does not constitute personal data once fully anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

Security Measures

bro999 implements a range of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures include but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encrypted storage of sensitive account data including passwords (using industry-standard hashing algorithms).
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need.
• Regular security assessments and vulnerability monitoring of Platform infrastructure.
• Automated fraud detection systems monitoring for unusual account activity patterns.
• Two-factor authentication options available to Users for enhanced account security.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. In the event of a data breach that presents a risk to your rights or freedoms, we will notify affected Users and relevant authorities in accordance with applicable requirements.

Children's Privacy

The bro999 Platform is strictly intended for adults aged 18 years and over — or the higher minimum age required by the relevant operator or license jurisdiction. We do not knowingly collect, process or retain personal data from individuals under the minimum eligible age.

If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has created a bro999 account, please contact us immediately at [email protected] so we can investigate and take appropriate action.

User Rights

Subject to applicable law, you have the following rights in relation to your personal data held by bro999. These rights may be exercised by contacting us using the details in Section 16.