san99 Privacy Policy —
How We Collect, Use, and
Protect Your Personal Data
This Privacy Policy explains exactly what personal information san99 collects from players in Pakistan, why we collect it, how we use it, who we may share it with, and the rights you hold over your own data. We believe privacy is a right, not a checkbox.
Six Promises san99 Makes to Every Player
Before reading the full legal policy, here is a plain-English summary of the six core privacy commitments that guide how san99 handles your data.
We Only Collect What We Need
san99 does not collect personal data for its own sake. Every piece of information we gather — your name, mobile number, CNIC details, payment records — has a specific, documented purpose: account security, KYC verification, payment processing, or fraud prevention. We do not collect data speculatively.
We Never Sell Your Data
san99 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. When we share data with third parties — such as payment processors like Easypaisa and JazzCash, or game providers — it is strictly to deliver the service you have requested, and those parties are bound by confidentiality obligations.
We Protect Your Data Technically
All data transmitted between your device and san99 is encrypted using 256-bit SSL/TLS. Stored personal data — including identity documents submitted for KYC and payment account details — is held in access-controlled, encrypted storage systems. san99 conducts regular security audits of its data infrastructure.
You Control Your Data
As a registered san99 player, you have the right to request access to the personal data we hold about you, to correct inaccurate data, and in certain circumstances to request deletion of your data. Contact our support team at [email protected] to exercise any of these rights — we respond within 30 days.
We Keep Data Only as Long as Necessary
san99 does not store your personal data indefinitely. Active account data is retained for the duration of your registration. Following account closure, data required for legal, regulatory, or dispute resolution purposes is retained for the minimum period required by applicable law, after which it is securely deleted.
We Notify You of Material Changes
If san99 makes material changes to this Privacy Policy — changes that affect how we collect or use your data in a significantly different way — we will notify you via the contact details registered to your Account before those changes take effect. Continued use of san99 after notification constitutes acceptance of the revised Policy.
Rights You Hold Over Your san99 Data
As a san99 player, you hold specific rights over the personal data we process. These rights apply to all registered accounts regardless of whether the account is currently active.
Right of Access
You can request a copy of all personal data san99 holds about your Account — including registration information, transaction history, KYC documents submitted, and any notes from support interactions. We provide this within 30 days of a verified request.
Right to Rectification
If personal data we hold about you is inaccurate or incomplete — for example, a misspelled name or an outdated mobile number — you have the right to request correction. Contact san99 support with the correct information and any supporting documentation required for verification.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (if consent is the basis for processing), or where you object to processing and there is no overriding legitimate interest. Note that regulatory retention obligations may limit full deletion in some cases.
Right to Restrict Processing
You can ask san99 to restrict how we use your data — for example, while you contest the accuracy of data we hold, or while a complaint is being investigated. During a restriction period, we will continue to store your data but will not actively process it beyond what is strictly necessary.
Right to Data Portability
Where san99 processes your data based on your consent or to perform a contract, and that processing is carried out by automated means, you have the right to receive your data in a structured, machine-readable format. You can then transfer that data to another service provider if you choose.
Right to Object
You can object to san99 processing your data for direct marketing purposes at any time. If you receive promotional communications from san99 and wish to stop them, contact our support team and we will update your communication preferences within 5 business days.
This Privacy Policy ("Policy") describes how san99 ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal information of users ("you", "Player") who access and use the san99 platform at san99.win. This Policy applies to all registered Accounts, all transactions processed in PKR, and all interactions with san99 support, regardless of the device or browser used to access the platform. By registering an Account or using any san99 service, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein.
Who We Are
san99 is an online casino and sports betting platform operating at san99.win. For the purposes of this Privacy Policy, san99 is the data controller in respect of the personal information processed as described herein. Our support team is reachable at [email protected] for any privacy-related enquiry or data subject request.
san99 serves players in Pakistan, and this Policy is written to reflect the privacy expectations and data practices applicable to Pakistani users. All data processing activities described in this Policy are conducted with reasonable and proportionate data protection measures in place.
Personal Data We Collect
san99 collects personal data in three ways: data you provide directly when registering or using the platform, data generated automatically by your use of the platform, and data received from third parties such as payment processors.
2.1 Data You Provide Directly
| Data Category | Specific Items | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, Pakistani CNIC number, CNIC scan or photograph | KYC verification before first withdrawal |
| Contact Data | Registered mobile number, email address (if provided) | Account registration |
| Account Credentials | Username, hashed password (never stored in plain text) | Account registration |
| Payment Data | Easypaisa / JazzCash / SadaPay / HBL / UBL / MCB account identifiers (not full account numbers); USDT TRC20 wallet address if applicable | First deposit or withdrawal |
| Support Data | Content of live chat conversations and email correspondence with san99 support | Customer support interactions |
| Responsible Gaming Data | Self-exclusion status, deposit limits, session time limit settings, cooling-off periods | When responsible gaming tools are activated |
2.2 Data Generated Automatically
When you use san99, certain technical data is generated automatically by your device and browser. This includes:
- IP address and approximate geographic location (city-level, not precise GPS)
- Device type, operating system, and browser version
- Session timestamps — when you log in and out of san99
- Pages viewed and navigation paths within the san99 platform
- Games played, bet amounts, and game session durations
- Transaction amounts in PKR and payment method used per transaction
2.3 Data Received from Third Parties
san99 may receive limited personal data about you from the following third parties:
- Payment processors (Easypaisa, JazzCash, SadaPay, Raast, HBL, UBL, MCB Bank): Transaction confirmation data including amount, timestamp, and a payment reference identifier — not full account numbers or PINs.
- Identity verification services: Confirmation of whether a submitted CNIC document matches the national identity records database, used to complete KYC verification.
- Fraud detection partners: Risk scores and flagged identifiers associated with known fraudulent activity patterns, used to protect the integrity of the san99 platform and its players.
How We Use Your Personal Data
san99 uses your personal data for the following specific purposes:
- Account creation and management: To register your Account, authenticate your identity at login, and manage your Account settings and preferences.
- Payment processing: To process deposits in PKR, verify withdrawal requests, match payment confirmations from Easypaisa, JazzCash, and other providers to your Account, and maintain accurate transaction records.
- KYC and identity verification: To comply with our obligations to verify that you are who you say you are, that you are 18 years of age or older, and that your payment methods belong to you.
- Customer support: To review and respond to your support requests via live chat and email, and to maintain a record of past interactions to improve future support quality.
- Fraud detection and security: To detect, investigate, and prevent fraudulent account activity, multi-accounting, money laundering, and other prohibited conduct described in the san99 Terms and Conditions.
- Responsible gaming: To monitor your play patterns for indicators of problem gambling behaviour, to enforce self-exclusion and deposit limit settings you have activated, and to provide tailored responsible gaming notifications where appropriate.
- Promotions and personalisation: Where you have not opted out of marketing communications, to send you promotional offers and personalised game recommendations relevant to your activity on san99. You can opt out at any time by contacting [email protected].
- Legal and regulatory compliance: To fulfil our obligations under applicable law, including anti-money-laundering requirements, and to respond to lawful requests from competent authorities.
- Platform improvement: To analyse aggregate usage patterns to improve the san99 platform — including navigation, game loading performance, and cashier transaction flows — in a way that does not involve identifying or profiling individual players.
Legal Basis for Processing
san99 processes your personal data under the following legal bases:
- Contractual necessity: Processing required to create and manage your Account, process deposits and withdrawals in PKR, and provide the gaming services you have requested.
- Legal obligation: Processing required to comply with anti-money-laundering regulations, age verification requirements, and lawful requests from competent authorities.
- Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring — where our legitimate interest in protecting the platform and its players does not override your privacy interests.
- Consent: Processing for direct marketing and personalised promotions, where you have not opted out. You can withdraw marketing consent at any time by contacting [email protected] without affecting the lawfulness of processing prior to withdrawal.
Data Sharing with Third Parties
san99 does not sell, rent, or trade your personal data. We share your data only with the following categories of third party, and only to the extent necessary for the specified purpose:
5.1 Payment Processors
To process your deposit and withdrawal requests, san99 shares necessary transaction data (amount, your registered account identifier, and a transaction reference) with the relevant payment provider — Easypaisa, JazzCash, SadaPay, Raast, HBL, UBL, MCB Bank, or USDT TRC20 network operators. These providers process your payment data under their own privacy policies and are not authorised by san99 to use your data for any purpose other than completing the requested transaction.
5.2 Game Providers
To deliver casino games and live dealer experiences, san99 shares a session token and your in-session bet activity with the relevant game studio (such as Evolution Gaming or Pragmatic Play). Game providers receive a pseudonymous session identifier — not your full name or CNIC — and are contractually prohibited from using session data to identify or profile you beyond the scope of the specific game session.
5.3 Identity Verification Services
To complete KYC verification, san99 may transmit your submitted identity document data to a third-party verification service for cross-referencing against official Pakistani identity databases. These services operate under strict confidentiality and data security obligations.
5.4 Law Enforcement and Regulatory Authorities
san99 will disclose personal data to law enforcement agencies, financial intelligence units, or regulatory authorities where required to do so by applicable law, court order, or in response to a lawful formal request. san99 does not disclose data voluntarily beyond what is legally required.
Cookies & Tracking Technologies
san99 uses cookies and similar tracking technologies on the san99.win platform. Cookies are small text files stored on your browser or device that help us deliver a functional and personalised experience.
6.1 Types of Cookies Used
- Strictly necessary cookies: Required for the platform to function — including session authentication (keeping you logged in during your visit), CSRF protection tokens, and load balancing. These cannot be disabled without breaking platform functionality.
- Functional cookies: Remember your preferences — such as your preferred language, game lobby filter settings, and notification preferences — to improve your experience across sessions.
- Analytics cookies: Collect aggregated, anonymised data about how players navigate and use san99, used to improve platform performance and user experience. san99 uses privacy-focused analytics that do not transmit individual user data to third-party advertising networks.
6.2 Managing Cookies
You can control and delete cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and receive notifications when cookies are set. Note that disabling strictly necessary cookies will prevent the san99 Login and other core platform functions from operating correctly.
Data Storage & Security
All personal data processed by san99 is stored on secure servers with the following technical and organisational protections in place:
- All data in transit between your browser and san99 is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon in your browser address bar confirms this encryption is active during every san99 Login session.
- Stored personal data — including KYC documents, transaction records, and account registration information — is held in encrypted storage with access restricted to authorised san99 personnel on a need-to-know basis.
- Passwords are hashed using a strong one-way cryptographic function before storage. san99 never stores plaintext passwords.
- Access to data systems containing personal information is protected by multi-factor authentication and audit-logged access controls.
- san99 conducts periodic security assessments of its data infrastructure and acts promptly to address identified vulnerabilities.
Data Retention
san99 retains personal data for the minimum period necessary for the purpose it was collected. The following general retention periods apply:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of active account + 5 years post-closure | Regulatory / legal obligation |
| KYC identity documents | Duration of active account + 5 years post-closure | AML compliance obligation |
| Transaction records (PKR deposits & withdrawals) | 7 years post-transaction | Financial record-keeping requirement |
| Customer support chat logs | 2 years post-interaction | Dispute resolution and quality improvement |
| Game session logs | 12 months post-session | Dispute resolution and responsible gaming monitoring |
| Marketing preference records | Until consent withdrawn + 1 year | Proof of lawful marketing basis |
Following the applicable retention period, personal data is permanently and securely deleted or anonymised so that it can no longer be associated with an individual.
Children's Privacy
san99 is strictly for adults aged 18 and above. san99 does not knowingly collect, store, or process the personal data of individuals under the age of 18. Age verification is conducted as part of the san99 Account registration and KYC process to enforce this restriction.
If san99 becomes aware that personal data belonging to a person under 18 has been submitted — for example, through an age falsification at registration — that data will be immediately deleted, the associated Account will be permanently closed, and any real-money balance derived from wagers placed during the underage period will be withheld.
Marketing Communications
Where you have not opted out of marketing communications, san99 may contact you with promotional offers, bonus notifications, and game recommendations via your registered mobile number (SMS) or email address. All marketing messages from san99 will clearly identify san99 as the sender.
You can opt out of marketing communications at any time by:
- Contacting san99 support via live chat and requesting removal from marketing lists
- Emailing [email protected] with the subject line "Unsubscribe from Marketing"
- Updating your communication preferences in the Account Settings section of your san99 Account
Opting out of marketing communications does not affect transactional messages — such as deposit confirmations, withdrawal notifications, and security alerts — which are sent regardless of marketing preferences as they are necessary for Account management.
Exercising Your Privacy Rights
To exercise any of the privacy rights described in the "Your Privacy Rights" section above — access, rectification, erasure, restriction, portability, or objection — please contact the san99 support team:
- Email: [email protected] — include "Data Subject Request" in your subject line and specify which right(s) you are exercising.
- Live Chat: Available 24/7 on the san99 platform — our support team will log your request and escalate it to the data team.
san99 will acknowledge your request within 5 business days and respond substantively within 30 days. In cases of complex requests, we may extend this period by up to a further 60 days, but will notify you of the extension and reason within the initial 30-day period.
Changes to This Privacy Policy
san99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. All changes will be published at san99.win/privacy-policy with an updated "Last Updated" date.
For material changes — those that significantly affect how we collect, use, or share your personal data — san99 will notify registered Players via their registered mobile number or email before the changes take effect. The notification will describe what is changing and why. Continued use of san99 after the effective date of a material change constitutes acceptance of the revised Policy.
For minor, non-material changes (such as clarifications of existing practices or formatting updates), we will update the Policy at san99.win/privacy-policy without individual notification.
Contact the san99 Privacy Team
For any privacy-related enquiry, data subject request, or concern about how san99 handles your personal information, please contact us through the following channels:
- Email: [email protected] — available for formal data requests, complaints, and detailed privacy enquiries. Response within 4 hours for general enquiries; up to 5 business days for formal data subject requests.
- Live Chat: 24/7 on the san99 platform for urgent privacy concerns and to initiate a data subject request.
All privacy correspondence must be submitted in English. The current version of this Privacy Policy is always available at san99.win/privacy-policy.
18+ Only — san99 Is Strictly for Adults in Pakistan
All san99 services are for individuals aged 18 and above. Gambling involves financial risk and is intended as entertainment only. If you need help managing your gaming activity, san99 offers self-exclusion and deposit limit tools. Visit our Responsible Gaming page for full details and support guidance. Please gamble responsibly.