Privacy Policy — 99ah

Welcome to 99ah, accessible at https://99ah.cam (the "Site"). 99ah is an independent, English-language online gaming information and education website built for Pakistani users. This Privacy Policy (the "Policy") describes how 99ah ("we", "us" or "our") collects, uses, stores, discloses and otherwise processes personal data when you access or use the Site.

We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Policy should be read in conjunction with our Terms & Conditions, which govern your overall use of the Site.

This Policy applies to all visitors and users of the Site, including users accessing the Site from cities across Pakistan such as Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. It does not apply to third-party websites, platforms or services that may be referenced or described in our editorial content.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), including but not limited to name, email address, IP address, device identifiers and browsing behaviour.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure and erasure.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, 99ah acts as the Data Controller in respect of the data described herein.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller.
• "Cookie" means a small text file placed on your device by a website server for the purpose of identifying your browser or storing information about your session.
• "Site" means the 99ah website accessible at https://99ah.cam, including all pages and subpages.
• "User" or "you" means any individual who accesses or uses the Site.

3.1 For the purposes of this Policy, 99ah operates as the Data Controller in respect of Personal Data collected through the Site. As Data Controller, we are responsible for ensuring that Personal Data is processed in accordance with applicable data protection principles.

3.2 99ah is an independent information website and is not affiliated with, endorsed by or operating under any licence issued by the Government of Pakistan, the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan or any Pakistani financial institution.

3.3 If you have any questions about how we handle your Personal Data, or if you wish to exercise any of your rights as a Data Subject, please contact us using the details provided in Section 14 of this Policy.

4.1 Data Collected Automatically. When you visit the Site, certain technical data is collected automatically by our servers and analytics tools. This includes:

• IP address and approximate geographic location (country/city level);
• Browser type, version and language settings;
• Operating system and device type;
• Referring URL (the page you visited immediately before arriving at the Site);
• Pages viewed, time spent on each page and navigation paths;
• Date and time of each visit;
• Cookie identifiers and session tokens.

4.2 Data You Provide Voluntarily. If you contact us by email — for example, to submit a question, correction request or feedback — we will collect the information you choose to include in that communication, such as your name and email address.

4.3 Data We Do Not Collect. 99ah does not collect or process the following categories of data:

• Financial data such as bank account numbers, credit or debit card details, Easypaisa wallet IDs or JazzCash account credentials;
• Government-issued identity documents such as CNIC or passport numbers;
• Biometric data of any kind;
• Health or medical information;
• Data relating to criminal convictions or offences.

4.4 The table below summarises the categories of Personal Data we collect and their sources:

5.1 We process Personal Data only where we have a valid lawful basis to do so. The purposes for which we process your data, together with the corresponding legal basis, are set out below:

• Operating and maintaining the Site — Processing is necessary for the purposes of our legitimate interests in providing a functioning, accessible and secure website to users.
• Analysing Site performance and user behaviour — We use aggregated analytics data to understand how users interact with our content and to improve the quality and relevance of our guides. This is based on our legitimate interests, subject to your right to object.
• Responding to enquiries and feedback — Where you contact us directly, we process your communication data to the extent necessary to respond to your request. This is based on our legitimate interests or, where applicable, on performance of a contract.
• Compliance with legal obligations — We may process or retain certain data where we are required to do so by applicable law, including obligations relating to fraud prevention, security and regulatory compliance.
• Security and fraud prevention — We may process technical data (such as IP addresses) to detect and prevent abusive, fraudulent or unlawful activity on the Site.

5.2 We do not use your Personal Data for automated decision-making or profiling that produces legal or similarly significant effects on you.

6.1 What Are Cookies. Cookies are small text files stored on your device by your browser when you visit a website. They allow the website to recognise your device on subsequent visits and to remember certain information about your session or preferences.

6.2 Types of Cookies We Use. The Site may use the following categories of cookies:

• Strictly Necessary Cookies: These are essential for the Site to function correctly. They enable core features such as page navigation and security. You cannot opt out of these cookies as the Site cannot function without them.
• Analytics Cookies: These cookies allow us to measure and analyse how visitors interact with the Site in aggregate — for example, which pages are visited most frequently and how users navigate between sections. The data collected is anonymised or pseudonymised and is not used to identify individuals.
• Functional Cookies: These cookies remember choices you have made (such as your language preference) to provide a more personalised experience. They are not used for advertising purposes.

6.3 Managing Cookies. You can control and manage cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies or notify you when a new cookie is set. Please note that disabling certain cookies may affect the functionality of the Site.

6.4 Third-Party Analytics. We may use third-party analytics services to help us understand Site usage. These services may set their own cookies and collect data in accordance with their own privacy policies. We do not grant these services access to personally identifiable information beyond what is described in this Policy.

7.1 We Do Not Sell Your Data. 99ah does not sell, rent or trade your Personal Data to any third party for commercial or marketing purposes under any circumstances.

7.2 Service Providers. We may share limited Personal Data with carefully selected third-party service providers who assist us in operating the Site, such as hosting providers, analytics platforms and security services. These providers act as Data Processors on our behalf and are contractually obligated to process data only in accordance with our instructions and to maintain appropriate security standards.

7.3 Legal Requirements. We may disclose Personal Data where required to do so by law, regulation, court order or other lawful government or regulatory request. We will, where permitted by law, notify you of such disclosure.

7.4 Business Transfers. In the event that 99ah undergoes a business transition such as a merger, acquisition or sale of assets, Personal Data held at that time may be transferred to the successor entity. We will notify users of any such change via a prominent notice on the Site prior to data being transferred and becoming subject to a different privacy policy.

7.5 Aggregated or Anonymised Data. We may share aggregated or anonymised data that cannot reasonably be used to identify you with third parties for research, analysis or reporting purposes.

8.1 We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, as described in this Policy, or as required by applicable law.

8.2 Retention periods by data type:

• Technical and usage data collected via analytics tools is typically retained in aggregated form for up to 26 months, after which it is deleted or further anonymised.
• Communication data (emails sent to us) is retained for as long as necessary to resolve your enquiry and for a reasonable period thereafter in case of follow-up, not exceeding 2 years unless a longer period is required by law.
• Cookie data persists for the duration specified by each cookie type — session cookies are deleted when you close your browser; persistent cookies expire on the date specified in their settings.
• Security and fraud prevention logs may be retained for up to 12 months to allow investigation of incidents.

8.3 When Personal Data is no longer required, we will securely delete or anonymise it in a manner that prevents reconstruction or identification.

9.1 We implement reasonable and appropriate technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction or alteration. These measures include, where applicable: encrypted data transmission via HTTPS, access controls limiting data access to authorised personnel, and regular security reviews of our systems and processes.

9.2 Notwithstanding the above, no method of transmission over the internet or method of electronic storage is completely secure. While we take all practical precautions, we cannot guarantee absolute security and you use the Site at your own risk insofar as data transmission is concerned.

9.3 If you become aware of any security vulnerability or incident involving 99ah or this Site, please notify us promptly at [email protected] (plain text — not a clickable link).

10.1 Depending on the data protection laws applicable in your jurisdiction, you may have the following rights in respect of your Personal Data:

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how we process it.
• Right to Rectification: You may request that we correct inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure: You may request that we delete your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other lawful basis for processing.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, such as where you contest its accuracy or object to its use.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including for analytics purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

10.2 To exercise any of these rights, please submit a written request to [email protected] (plain text — not a clickable link). Please include sufficient detail to allow us to identify you and process your request. We will acknowledge your request within 2 business days and provide a substantive response within 30 calendar days.

10.3 We may ask you to verify your identity before acting on a rights request to prevent unauthorised access to or modification of your Personal Data.

11.1 The Site is strictly intended for adults aged 18 years and above, or the higher minimum age required by the operator or licence jurisdiction relevant to any gambling activity the user may pursue. We do not knowingly collect Personal Data from individuals under the applicable minimum age.

11.2 If you are the parent or guardian of a minor and believe that the minor has provided us with Personal Data, please contact us immediately at [email protected] (plain text — not a clickable link) and we will take prompt steps to delete that data from our systems.

12.1 The Site may be hosted on servers located outside Pakistan. If you access the Site from Pakistan, your data may be transferred to and stored in countries that have different data protection laws to those applicable in Pakistan.

12.2 Where such transfers occur, we take reasonable steps to ensure that your Personal Data receives an adequate level of protection, including by ensuring that any service providers we use maintain appropriate contractual or technical safeguards.

12.3 By using the Site, you acknowledge that your data may be processed outside Pakistan as described in this Section.

13.1 We reserve the right to update or amend this Privacy Policy at any time. When we make material changes, we will update the Effective Date shown at the top of this page. We encourage you to review this Policy periodically to stay informed about how we are protecting your data.

13.2 Your continued use of the Site following the posting of any changes to this Policy constitutes your acceptance of those changes. If you do not agree with the updated Policy, you should discontinue use of the Site.

13.3 Where a change significantly affects your rights or how we use your data, we will endeavour to provide a more prominent notice, such as a banner or announcement on the Site's homepage.

If you have any questions, concerns or complaints relating to this Privacy Policy or to the way in which we handle your Personal Data, please contact us using the details below. We take all privacy enquiries seriously and aim to resolve them promptly and fairly.

We aim to acknowledge all privacy-related communications within 2 business days and to provide a full response within 30 calendar days. For complex requests, we may require an extension of up to a further 30 days, in which case we will notify you of the extension and the reason for it.

All correspondence should be submitted in English. Where possible, we will also assist users who write to us in Urdu, though English remains the primary language of this Site and of our formal responses.