How h99 Handles Your Personal Information
At h99, your privacy is built into how we operate — not added as an afterthought. This policy explains exactly what personal data we collect from you, how...
What This Policy Covers and Where It Applies
This Privacy Policy applies to all personal data processed when you open and use an h99 account in supported regions, including Pakistan where local law permits. We collect information you provide directly — such as your name, contact details, and payment identifiers for JazzCash, Easypaisa, SadaPay, and Raast — as well as technical data like device identifiers and session activity. We hold
this data only as long as your account remains active or as required under applicable law. If you close your account, we follow a defined retention schedule before permanent deletion. We do not sell your data to advertisers or unaffiliated third parties.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
How We Keep This Policy Accurate and Current
Our Privacy Policy is reviewed on a rolling basis by our legal, security, and product teams. When regulations affecting Pakistan or our data practices change, we update this document and notify you...
Legal Review Cycle
Our internal legal team reviews the full policy text every six months, cross-checking it against applicable data protection laws and any regulatory guidance issued in supported regions.
Security Audit Integration
Our security team flags any infrastructure change that affects how personal data is stored or accessed, triggering an immediate policy review section update rather than waiting for the scheduled cycle.
User Notification Commitment
We send advance notice to your registered email or in-app notification at least 14 days before any material change to this policy takes effect, so you always have time to review and respond.
Version History Available
Every published version of this policy is archived and accessible from your account settings. You can compare the current version with any prior version to see exactly what changed and when.
Data Minimisation Practice
We apply data minimisation as a standing principle: our product team is required to justify every new data field before it enters collection, and redundant fields are retired on a quarterly basis.
Third-Party Processor Vetting
Any third party that handles your data on our behalf — such as payment processors or identity verification services — must meet our written data protection standards before integration is approved.
How This Policy Aligns With Our Other Legal Pages
Our Privacy Policy does not stand alone. It is drafted to work consistently alongside our Terms of Service, Cookie Policy, and Account Security Policy so the rules governing...
| Terms of Service | Defines the contractual basis for data processing and references the Privacy Policy as the governing document for personal data handling throughout your account lifecycle. |
|---|---|
| Cookie Policy | Details every cookie and tracking technology in use, specifying which are essential and which require your consent, consistent with the consent framework described here. |
| Account Security Policy | Covers authentication, two-factor verification, and session management — all of which interact directly with the personal data protections outlined in this Privacy Policy. |
| Payment Data Handling | Clarifies how payment identifiers — including those for JazzCash, Easypaisa, SadaPay, and Raast — are tokenised and which third-party processors we share them with for settlement purposes. |
| Data Retention Schedule | A separate schedule document lists retention periods for each data category. This Privacy Policy links to it directly so the rules for deletion are always traceable and specific. |
| KYC and Verification Policy | Identity documents collected during account verification are governed by both this Privacy Policy and our KYC Policy, with the stricter retention and deletion rule taking precedence. |
| Breach Notification Procedure | Sets out the timeline and process we follow to notify you if a data security incident affects your personal information, complementing the security commitments in this policy. |
Key Elements Shaping Our Privacy Approach
Six structural principles define how privacy works inside h99. Each one is a standing commitment to you — not a marketing claim — and each is...
Consent-First Collection
We collect personal data only where you have given clear consent or where processing is necessary to fulfil the service you requested. Consent records are logged with a timestamp tied to your account.
Encrypted Data Storage
Personal data — including your contact details and payment method identifiers — is stored using encryption at rest. Access to decrypted records is restricted to authorised personnel on a need-to-know basis.
Right of Access
You can request a full export of the personal data we hold on your account at any time through the Privacy Controls section in account settings. We deliver the export within seven business days.
Right to Erasure
You can request deletion of your personal data when your account is closed. We erase records subject to any minimum retention periods required by applicable law in Pakistan or our licensing jurisdiction.
No Profiling for Third Parties
We do not build or sell behavioural profiles of your account activity to advertisers or data brokers. Internal analytics are used solely to improve platform performance and your account experience.
Cross-Border Transfer Controls
Where your data is processed outside Pakistan — for example by payment processors or cloud infrastructure providers — we require contractual safeguards that meet the standard of local data protection law.