ctt999 Privacy Policy

1 Data Controller

ctt999 ("the Platform", "we", "us", "our") is the data controller responsible for the personal data collected through the ctt999 website at ctt999.org and all associated services. As data controller, ctt999 determines the purposes and means by which your personal data is processed.

Where ctt999 engages third-party service providers to process personal data on its behalf — for example, payment processors and KYC verification providers — those parties act as data processors under binding contractual arrangements that restrict how they may use your data and require them to implement appropriate security measures.

2 Personal Data We Collect

ctt999 collects personal data in the following categories, depending on the nature of your interaction with the Platform:

ctt999 does not collect special category data (such as health information, biometric data, or political opinions) unless this is explicitly required for responsible gaming assessments and you have provided your express consent.

3 How We Collect Your Data

ctt999 collects personal data through the following channels:

• Direct submission: Information you provide when completing the ctt999 registration process, submitting KYC documents, initiating transactions, contacting support, or updating your Account profile.
• Automated collection: Technical and usage data collected automatically as you browse and interact with the Platform, via server logs, session tracking technology, and first-party cookies.
• Third-party sources: Identity and fraud-screening data received from KYC verification service providers and payment processors when processing your deposits or withdrawal requests. ctt999 may also receive data from fraud prevention databases to protect the integrity of the Platform.
• Responsible gaming tools: Data generated when you voluntarily set deposit limits, session reminders, cool-off periods, or self-exclusion preferences within your Account settings.

4 Purpose & Legal Basis for Processing

ctt999 processes your personal data only where there is a valid legal basis for doing so. The following table sets out the primary purposes for which your data is processed and the corresponding legal basis:

• Contract performance: Processing your registration, managing your Account, executing deposits and withdrawals in PKR, settling bets, and delivering Platform features you have requested. Without this processing, ctt999 cannot provide you with its services.
• Legal obligation: Conducting KYC identity verification, age verification (confirming you are 21 or older), anti-money laundering checks, record-keeping for regulatory audits, and responding to lawful requests from regulatory bodies or law enforcement authorities.
• Legitimate interests: Detecting and preventing fraud, bonus abuse, and account security threats; improving Platform performance; conducting internal analytics to enhance the user experience for Pakistani players; and managing responsible gaming risk signals.
• Consent: Sending you optional promotional communications, personalised bonus offers, and marketing materials about new games, cricket betting markets, and PSL promotions. You may withdraw consent for marketing communications at any time by updating your notification preferences in your Account settings or by contacting support.

5 Data Sharing & Disclosure

ctt999 does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the financial and identity data necessary to process your PKR transactions securely. These providers operate under their own privacy policies and are independently regulated financial service providers.
• KYC and identity verification providers: Third-party services used to verify your identity documents and confirm you meet the 21+ age requirement may process copies of your identification documents. These providers are contractually bound to use your data solely for verification purposes.
• Fraud prevention and AML screening services: ctt999 may cross-reference your data against fraud detection databases and AML screening lists to protect the Platform and comply with regulatory obligations.
• Game content providers: Where games are provided by third-party software providers, limited technical session data may be passed to those providers for the purpose of game delivery and RNG integrity verification. No financial or identity data is shared with game providers.
• Regulatory and law enforcement authorities: ctt999 will disclose personal data where required to do so by a court order, regulatory directive, or other lawful legal process. We will notify affected users of such disclosures to the extent permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ctt999's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected users will be notified in advance of any such transfer.

6 Cookies & Tracking Technologies

ctt999 uses first-party cookies and similar technologies to operate the Platform, maintain your login session, remember your preferences, and gather aggregate usage analytics. We do not use third-party advertising cookies or cross-site tracking technologies.

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without severely impairing your ability to use the Platform.
• Functional cookies: Remember your language preferences, display settings, and responsible gaming tool configurations between sessions.
• Analytics cookies: Aggregate, anonymised data about how pages are accessed and which features are used, used solely to improve Platform performance. No personally identifiable information is included in analytics data.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies may prevent you from accessing certain features of the ctt999 Platform, including the ctt999 Login page.

7 Data Retention

ctt999 retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the full duration of your account relationship with ctt999, including periods during which the account may be temporarily suspended.
• Post-closure retention: Following account closure — whether voluntary or due to a breach of the ctt999 Terms and Conditions — account records, transaction history, and KYC documentation are retained for a minimum period required by our licensing authority's anti-money laundering and record-keeping obligations. This period is typically five (5) years from the date of account closure.
• Support communications: Live Chat transcripts and email correspondence are retained for a period sufficient to resolve any related dispute or regulatory inquiry, after which they are securely deleted.
• Technical and log data: Server logs and IP address records are retained for a shorter period consistent with security monitoring needs, unless they are required for an ongoing fraud investigation or legal matter.

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised such that it can no longer be associated with any individual player.

8 Data Security

ctt999 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data in transit between your device and the ctt999 Platform.
• Encryption of sensitive data fields at rest within our secure database infrastructure.
• Role-based access controls ensuring that only authorised ctt999 personnel with a specific operational need can access personal data.
• Regular security assessments, vulnerability scanning, and penetration testing of the Platform infrastructure.
• PCI-DSS compliant payment processing — ctt999 does not store full card numbers or CVV codes on its own servers under any circumstances.
• Multi-factor authentication requirements for administrative access to systems that process personal data.
• Staff training on data protection obligations and secure data handling procedures.

9 Your Data Rights

As a ctt999 player, you have the following rights in respect of your personal data, subject to applicable legal limitations and regulatory obligations:

• Right of access: You may request a copy of the personal data ctt999 holds about you, along with information about how it is being processed.
• Right to rectification: You may request that inaccurate or incomplete personal data held by ctt999 be corrected. You can update most Account information directly within your Account profile settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. This right is subject to ctt999's legal obligations to retain certain records.
• Right to restrict processing: You may request that ctt999 suspend processing of your data in certain circumstances, for example while a dispute about its accuracy is being resolved.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data where ctt999 relies on legitimate interests as its legal basis, unless ctt999 can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our support team via Live Chat (available 24/7 inside your ctt999 dashboard) or by emailing [email protected]. ctt999 will respond to all data rights requests within thirty (30) calendar days of receipt.

10 Minors & Age Restriction

The ctt999 Platform is strictly intended for individuals who are 21 years of age or older. ctt999 does not knowingly collect personal data from individuals under 21. Age verification is a mandatory step in the ctt999 registration process, and we reserve the right to request documentary proof of age at any point during the account lifecycle.

If ctt999 becomes aware that personal data has been collected from an individual under 21 years of age, that Account will be immediately closed, all associated data will be deleted to the extent permitted by law, and any balance will be handled in accordance with our regulatory obligations and the ctt999 Terms and Conditions.

11 International Data Transfers

As an internationally licensed gaming platform, ctt999 may process or store personal data on servers located outside of Pakistan. Where personal data is transferred internationally, ctt999 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy.

Such safeguards may include contractual arrangements with data processors that impose obligations equivalent to those imposed on ctt999 by its licensing authority, or reliance on the data protection frameworks of jurisdictions that provide an adequate level of protection as determined by applicable regulatory standards.

By using the ctt999 Platform, you acknowledge and consent to the transfer of your personal data to servers and processors outside Pakistan where necessary for the provision of ctt999's services.

12 Changes to This Privacy Policy

ctt999 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect how we process your personal data or your rights in respect of it — ctt999 will provide advance notice via the email address registered to your Account or through a prominent notice displayed on the Platform. Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

13 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or ctt999's data processing practices, please contact our support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, inside your ctt999 account dashboard. This is the fastest route for urgent data protection queries.
• Email: [email protected] — for formal data rights requests, privacy complaints, and non-urgent privacy-related enquiries. Please mark your email subject line with "Privacy Request" to ensure it is routed to the correct team. We aim to respond within 30 calendar days.

If you wish to raise a complaint about ctt999's data processing practices and are not satisfied with our response, you may escalate your complaint to the relevant data protection authority or regulatory body applicable under ctt999's licensing jurisdiction.