Privacy Policy — eu999

1 Introduction

This Privacy Policy ("Policy") describes how eu999 ("eu999", "we", "us", "our") collects, uses, stores, discloses and otherwise processes personal data in connection with the operation of the eu999 platform, accessible at https://eu999.cam ("Platform"), and all related services, features and communications (collectively, the "Services").

This Policy applies to all individuals who access or use the Platform, whether as registered account holders or as unregistered visitors ("you", "User"). By accessing the Platform or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside the eu999 Terms & Conditions, which govern the overall contractual relationship between you and eu999. In the event of any inconsistency between this Policy and the Terms & Conditions regarding data processing matters, this Policy shall prevail.

2 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, contact details, identification numbers, location data, online identifiers and any other information that could, alone or in combination, identify an individual.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure or destruction.
• "Data Controller" means eu999, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party that processes personal data on behalf of eu999 under a contractual arrangement and in accordance with this Policy.
• "Cookies" means small text files stored on your device by the Platform's web server, used for session management, security, analytics and preference settings.
• "KYC" means Know Your Customer — the regulatory and compliance process by which eu999 verifies the identity and age of account holders.
• "Sensitive Personal Data" means a subset of personal data that warrants heightened protection, including government-issued identification numbers (such as CNIC), financial account details, and biometric data collected during liveness verification.

3 Data We Collect

eu999 collects personal data across several categories depending on how you interact with the Platform. The table below provides an overview of the primary data categories:

We do not intentionally collect data from individuals under the age of 18 (or such higher minimum age as required by the applicable licensing jurisdiction). If we discover that personal data has been collected from a minor, we will take steps to delete it promptly.

4 How We Collect Your Data

eu999 collects personal data through the following means:

• Direct provision: Information you submit when registering an account, completing KYC verification, contacting support, or participating in a promotional programme.
• Automated collection: Technical and usage data collected automatically as you interact with the Platform, including through cookies, server logs and session tracking technologies.
• Third-party sources: Identity verification and fraud prevention data received from third-party KYC and AML service providers who process your submitted documents on our behalf.
• Payment processors: Transaction confirmation data and payment status information received from payment processing partners when you make a deposit or withdrawal.

5 Purposes & Legal Basis for Processing

eu999 processes personal data for the following purposes, each supported by a legitimate legal basis:

• Account management and service delivery — necessary for the performance of the contract between eu999 and the account holder, as established upon registration.
• Identity and age verification (KYC) — necessary for compliance with legal obligations applicable to the operator under its licensing arrangements and anti-money-laundering regulations.
• Payment processing and transaction record-keeping — necessary for the performance of the contract and for compliance with financial record-keeping obligations.
• Fraud prevention and security monitoring — necessary for the legitimate interest of eu999 in protecting the integrity of the platform and the security of its users.
• Responsible gambling monitoring — necessary for compliance with applicable responsible gambling obligations and for the legitimate interest of protecting player wellbeing.
• Customer support and complaint resolution — necessary for the performance of the contract and for the legitimate interest of resolving user concerns efficiently.
• Platform analytics and performance optimisation — based on the legitimate interest of eu999 in understanding and improving user experience, subject to the use of privacy-preserving measures where feasible.
• Legal and regulatory compliance — necessary for compliance with applicable legal obligations, including record retention requirements imposed by the operator's licensing jurisdiction.

6 Data Sharing & Disclosure

eu999 does not sell, rent or trade personal data to third-party commercial entities for marketing purposes. Personal data may be shared in the following limited circumstances:

• Service providers and data processors: Third parties engaged by eu999 to provide specific services — including KYC/identity verification platforms, payment processing infrastructure, fraud detection systems, cloud hosting providers and customer support software — may receive personal data to the extent necessary to perform their contracted functions. All such third parties are required to process data under confidentiality obligations and in accordance with this Policy.
• Regulatory and law enforcement authorities: eu999 may disclose personal data to competent regulatory authorities, law enforcement agencies or courts where required by applicable law, a valid legal order, or where such disclosure is necessary to protect the rights, property or safety of eu999, its users or the public.
• AML and financial intelligence obligations: Transaction and identity data may be reported to relevant financial intelligence units or anti-money-laundering authorities where the operator's licensing obligations require such reporting.
• Corporate restructuring: In the event of a merger, acquisition, asset sale or restructuring of eu999's business, personal data held by eu999 may be transferred to the successor entity, subject to equivalent privacy protections.

7 International Data Transfers

eu999 operates internationally, and your personal data may be transferred to, stored in, or processed in countries other than your country of residence. In particular, data may be processed in the jurisdiction(s) where the operator's licensing authority is located, and in the locations where our third-party service providers maintain infrastructure.

Where personal data is transferred internationally, eu999 takes appropriate steps to ensure that such transfers are subject to adequate protections, including contractual safeguards with receiving parties. Users in Pakistan should be aware that data protection standards in receiving jurisdictions may differ from those applicable in Pakistan.

8 Data Retention

eu999 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable legal, regulatory or licensing obligations. Specific retention periods include:

• Account and registration data: Retained for the duration of the account relationship and for a minimum period following account closure as required by the operator's AML and licensing obligations (typically a minimum of 5 years post-account closure).
• KYC and identity verification documents: Retained for the minimum period required by applicable AML legislation in the operator's licensing jurisdiction. Document records are stored in encrypted form.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, or longer where required by regulatory obligations.
• Support communications: Retained for a minimum of 3 years from the date of the communication, unless a longer period is required by an ongoing dispute or regulatory inquiry.
• Technical and usage logs: Retained for up to 12 months unless fraud investigation or legal obligations require extended retention.

Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9 Cookies & Tracking Technologies

The eu999 Platform uses cookies and similar technologies to support its operation. The categories of cookies in use are:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security cookies and load-balancing cookies. They cannot be disabled without impairing core functionality.
• Functional cookies: Used to remember your preferences, such as language settings and interface configuration, to improve your experience on return visits.
• Analytics cookies: Used to collect aggregated data about how users interact with the Platform — pages viewed, session lengths, click paths — to help eu999 improve performance. These do not identify you individually.
• Security cookies: Used to detect and prevent fraudulent activity, protect against CSRF attacks, and support our responsible gambling monitoring systems.

Most modern browsers allow you to control cookie settings at the browser level. However, disabling strictly necessary cookies will prevent you from accessing core Platform functionality, including account login.

10 Data Security

eu999 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration or disclosure. These include:

• TLS encryption for all data transmitted between your device and the Platform servers.
• Encryption at rest for sensitive personal data stored on Platform infrastructure.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Automated anomaly detection and fraud monitoring systems.
• Regular internal security assessments and third-party penetration testing of critical infrastructure.
• Formal incident response procedures for data security events, including notification obligations where applicable law requires.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is completely immune to risk. eu999 cannot guarantee absolute security but commits to employing reasonable and appropriate safeguards at all times.

11 Your Rights

Subject to applicable law and the legitimate restrictions described below, you may have the following rights in relation to your personal data held by eu999:

To exercise any of the above rights, please contact the eu999 support team in writing at the address provided in Section 15. eu999 will respond to rights requests within 30 days. We may require verification of your identity before processing a request. Certain rights may be limited where legal obligations require retention of data — for example, AML record-keeping requirements will override a deletion request for transaction records within the mandatory retention period.

12 Children & Minors

The eu999 Platform is strictly intended for adults aged 18 or older — or the higher minimum age required by the operator's licensing jurisdiction. eu999 does not knowingly collect, process or store personal data relating to individuals below the applicable minimum age.

eu999 employs mandatory age verification (KYC) procedures to identify and exclude underage users. Where we become aware that personal data has been collected from a minor, we will delete that data promptly and close the associated account. Any real-money balance held in an account determined to belong to a minor will be handled in accordance with applicable law.

If you are a parent or guardian and believe that a minor in your care has accessed the eu999 Platform, please contact our support team immediately at the details provided in Section 15.

13 Pakistan-Specific Notice

Users accessing the eu999 Platform from Pakistan should be aware of the following considerations specific to their jurisdiction:

• Pakistan does not have a comprehensive data protection law equivalent to the EU General Data Protection Regulation (GDPR) in force across all sectors as of the effective date of this Policy. The processing of personal data by international operators is governed by the operator's licensing jurisdiction rather than Pakistani data protection law.
• By using the Platform, Pakistani users consent to their personal data being processed and potentially stored in jurisdictions outside Pakistan, including the operator's licensing territory. Data protection standards in those jurisdictions may differ from Pakistani standards.
• The Prevention of Electronic Crimes Act (PECA), 2016 governs certain aspects of electronic data and privacy in Pakistan. eu999 encourages users to understand their rights under applicable Pakistani law independently.
• eu999 does not share user data with the Government of Pakistan, the PTA, the State Bank of Pakistan, or any Pakistani authority except where compelled by a valid legal instrument from a jurisdiction with authority over eu999. eu999 will notify affected users of government data requests to the extent permitted by law.

14 Policy Amendments

eu999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements or platform features. Material changes will be communicated to registered users via notice on the Platform or to registered contact details, with reasonable advance notice where practicable.

The "Effective Date" shown at the top of this page indicates when the current version came into force. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. We encourage you to review this page periodically.

15 Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or the processing of your personal data by eu999, please contact our support team. All privacy-related correspondence should be submitted in writing to allow for an accurate and auditable response.

eu999 aims to acknowledge all written privacy enquiries within 24 hours during business days (Pakistan Standard Time, PKT), and to provide a substantive response within 30 days.

Email: [email protected]

Support is available in English and Urdu.