bj99 Privacy
Policy & Data
Protection

This Privacy Policy is issued by bj99 ("bj99", "we", "us", "our"), the operator of the online gaming platform accessible at bj99.blog. bj99 is an internationally licensed gaming operator providing casino games, sports betting, and related entertainment services primarily to players in Pakistan.

For the purposes of data protection law, bj99 is the data controller in respect of all personal data collected through the bj99 platform. This means we determine the purposes and means by which your personal data is processed. Where we engage third-party service providers to process data on our behalf, they act as data processors and are contractually bound to handle your data only in accordance with our instructions and this Privacy Policy.

This Privacy Policy applies to all users of the bj99 website, mobile platform, and any other bj99 digital services, regardless of how you access them. It applies to registered players, visitors who browse without registering, and individuals who interact with bj99 customer support.

bj99 collects personal data across several categories, depending on how you interact with the platform. The table below summarises the main categories:

bj99 does not collect or process sensitive personal data (such as biometric data, religious beliefs, or political opinions) except where directly required by regulatory identity verification procedures, in which case such data is processed solely for that stated purpose and subject to elevated security controls.

bj99 collects personal data through the following mechanisms:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a promotion.
• Automated collection: When you use the bj99 platform, our systems automatically collect technical data including IP address, device identifiers, browser fingerprint, and session activity logs.
• Cookies and similar technologies: The bj99 website uses cookies and local storage to maintain session state, remember your preferences, and collect analytics data. See Section 7 for full details.
• Payment processors: When you transact via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, we receive transaction confirmation data including reference numbers and timestamps from those processors.
• Third-party verification services: For KYC and AML compliance, bj99 may receive data from licensed identity verification service providers who cross-reference the documents you submit against authoritative data sources.

bj99 uses personal data for the following clearly defined purposes:

• Account management: Creating and maintaining your player account, verifying your identity, processing your login and session activity.
• Transaction processing: Processing deposits, withdrawals, and bonus credits. Reconciling transaction records and investigating payment disputes.
• Regulatory compliance: Meeting our Know Your Customer (KYC), Anti-Money Laundering (AML), and age verification obligations. Reporting to relevant regulatory and financial intelligence authorities where legally required.
• Fraud prevention: Detecting and preventing fraudulent activity, multiple account violations, bonus abuse, and platform manipulation.
• Customer support: Responding to your queries, investigating complaints, and maintaining records of support interactions for quality assurance purposes.
• Responsible gaming: Monitoring gaming patterns for indicators of problem gambling. Applying responsible gaming tools where appropriate and communicating with players displaying risk indicators.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience.
• Marketing communications: Sending promotional offers, bonus notifications, and relevant platform updates — but only to players who have opted in to receive marketing communications.

bj99 does not use personal data for automated decision-making that produces significant legal effects on players, except where such processing is required for fraud detection or AML compliance, in which case affected players retain the right to request human review of any automated decision.

Every data processing activity at bj99 is conducted on one of the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between you and bj99, including account operation, payment processing, and game access.
• Legal obligation: Processing required to comply with KYC, AML, age verification, and regulatory reporting obligations imposed by our gaming licence and applicable law.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregated analytics — where our legitimate interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications and optional data collection features, where you have provided clear, affirmative consent that can be withdrawn at any time.

bj99 does not sell your personal data. We share data with third parties only in the following strictly controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum data necessary to process your transactions. They operate under their own regulatory frameworks and privacy policies.
• KYC/AML service providers: Licensed identity verification partners receive CNIC data and verification documents for the sole purpose of completing mandatory checks. Data is not retained by these partners beyond the verification period.
• Game content providers: Live dealer studios and slot game providers may receive session identifiers and bet data necessary to operate their games within the bj99 platform. They do not receive full identity data.
• Regulatory authorities: bj99 is legally obligated to report certain data to financial intelligence units and gaming regulators where required by law. Such disclosures are made only to the extent legally required.
• IT infrastructure providers: Cloud hosting, CDN, and security service providers operate under Data Processing Agreements (DPAs) that strictly limit their use of bj99 player data to the provision of contracted technical services.
• Law enforcement: bj99 will disclose data to law enforcement agencies where compelled by a valid legal order or where necessary to protect the safety of individuals from serious harm.

All third parties with whom bj99 shares personal data are contractually required to maintain data security standards equivalent to or exceeding those applied by bj99. We conduct due diligence on all data processors before engagement.

The bj99 platform uses cookies and similar technologies to provide core platform functionality, improve user experience, and collect analytics data. The following types of cookies are used:

• Essential cookies: Required for the platform to function. These maintain your login session, remember your language preference, and ensure secure page navigation. They cannot be disabled without breaking platform functionality.
• Analytics cookies: Collect anonymised data about how players navigate the platform, which games are most played, and how long sessions last. This data is used in aggregate form only and is not linked to individual player identities for marketing purposes.
• Preference cookies: Remember your display settings, notification preferences, and responsible gaming tool configurations between sessions.
• Security cookies: Support fraud detection and session integrity verification. These help identify suspicious activity patterns and protect your account from unauthorised access.

You can manage non-essential cookie preferences through your browser settings or the bj99 cookie preference panel accessible from the platform footer. Disabling analytics or preference cookies will not prevent you from using bj99's core gaming features.

bj99 applies a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• TLS 1.3 encryption for all data in transit between your device and bj99 servers.
• AES-256 encryption for sensitive data stored in our databases, including financial records and identity documents.
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access personal data.
• Regular penetration testing and vulnerability assessments by independent security specialists.
• Real-time intrusion detection and anomaly monitoring across all production systems.
• Multi-factor authentication enforced for all bj99 staff with access to production systems or player data.
• Regular staff training on data protection obligations and information security practices.

bj99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory, and audit retention requirements. The following retention periods apply as general guidelines:

• Active account data: Retained for the duration of your account's active status plus a minimum of 5 years following account closure, in line with standard AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years following the end of the customer relationship, as required by AML compliance frameworks.
• Transaction records: Retained for a minimum of 5 years from the transaction date for financial audit and regulatory purposes.
• Support communications: Retained for 3 years following the resolution of the support interaction, or longer where the interaction forms part of an ongoing dispute.
• Marketing data: Retained until you withdraw marketing consent, at which point your data is removed from all marketing systems within 30 days.
• Technical and log data: Retained for 12 months in active storage for security and fraud investigation purposes, then archived for a further 12 months before deletion.

Following the expiry of the applicable retention period, personal data is securely and permanently deleted from bj99 systems in accordance with our data destruction procedures. Aggregated, anonymised analytics data that cannot identify any individual may be retained indefinitely for statistical purposes.

As a bj99 player, you have the following rights in respect of your personal data. bj99 is committed to facilitating the exercise of these rights promptly and without unnecessary friction:

• Right of Access: You may request a copy of all personal data bj99 holds about you. We will respond within 30 days of a verified request.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request correction. Basic account details can be updated directly through your account dashboard.
• Right to Erasure: You may request deletion of your personal data, subject to our legal retention obligations. Where we cannot delete data due to legal requirements, we will restrict its processing instead.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest its accuracy pending verification.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Marketing objections take effect immediately.
• Right not to be subject to automated decisions: Where bj99 applies automated processing that produces significant effects on your account, you retain the right to request human review.

To exercise any of these rights, contact bj99 support via live chat or email at [email protected]. We will verify your identity before processing any data subject request. There is no charge for exercising your privacy rights.

bj99 strictly prohibits access to its platform by individuals under the age of 21. The platform is not directed at, and does not knowingly collect personal data from, anyone under 21 years of age. All registration flows include an age declaration and are supported by mandatory CNIC-based age verification prior to any real-money activity.

If bj99 discovers that personal data has been collected from a person under the age of 21 — whether through age misrepresentation or any other means — we will immediately suspend the account, delete all associated personal data to the extent permitted by AML record-keeping requirements, and refund any unplayed deposits. Any winnings associated with the underage account will be forfeited.

bj99 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. Material changes — those that significantly affect your privacy rights or the way we use your data — will be communicated to registered players via the mobile number or email address on file at least 14 days before they take effect.

Minor or administrative changes (such as corrections of typographical errors, clarifications that do not alter the substance of existing provisions, or updates required by regulatory guidance) may take effect immediately. The "Last Updated" date at the top of this document reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how bj99 protects your information.

Your continued use of the bj99 platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with a material change to this policy, you may close your account and request deletion of your data by contacting bj99 support.

If you have any questions, concerns, or requests relating to this Privacy Policy or bj99's data processing practices, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly on the bj99 platform. Average first response time under 90 seconds. Recommended for urgent privacy matters.
• Email: [email protected] — for written privacy requests, data subject access requests, and formal complaints. Responses within 2 business hours.

If you are not satisfied with bj99's response to a privacy concern, you have the right to escalate the matter to the relevant data protection supervisory authority or gaming regulatory body. Details of the applicable authority will be provided upon request based on the nature of your complaint.