ct111 Privacy Policy —
How We Handle Your Data
with Transparency & Respect

This Privacy Policy applies to all personal data collected, processed, and stored by ct111 (referred to throughout this document as "ct111", "we", "us", or "our") in connection with the operation of the ct111 gaming platform accessible at ct111.biz ("the Platform"). It applies to all registered players, visitors to the Platform, and persons who interact with ct111 through any channel, including live chat, email, and support communications.

This Policy should be read in conjunction with ct111's Terms & Conditions and Responsible Gaming Policy. Together, these three documents govern your relationship with ct111. Where this Privacy Policy conflicts with any other document, this Policy shall prevail with respect to matters concerning personal data.

ct111 is committed to handling your personal information lawfully, fairly, and transparently. We do not sell your personal data to third-party advertisers. We do not use your data for purposes beyond those described in this Policy without your explicit consent. We will always tell you clearly what data we hold and why.

For the purposes of applicable data protection legislation, ct111 is the data controller responsible for the personal information collected through the Platform. As data controller, ct111 determines the purposes for which and the means by which your personal data is processed.

ct111 operates under an international gaming license. Our licensing authority imposes specific data protection obligations as conditions of our license, including mandatory data security standards, player identity verification requirements, and data retention obligations. These regulatory requirements shape how and why we collect and retain certain categories of personal data.

For all privacy-related queries, requests to exercise data subject rights, or concerns regarding data processing, please contact our Data Protection contact via the support channels listed in Section 15 of this Policy.

ct111 collects the following categories of personal data from players and platform users. We collect only the data that is necessary for the purposes described in this Policy.

ct111 does not collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless this is strictly required for responsible gaming or regulatory purposes, in which case we will obtain your explicit consent before doing so.

ct111 collects personal data through the following methods:

• Direct submission: Information you provide when registering an account, completing KYC, submitting support queries, or communicating with ct111 through any channel.
• Automated collection: Technical and usage data collected automatically as you interact with the Platform, including through cookies, session tracking, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud screening data from third-party compliance partners; payment verification data from payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK).
• Publicly available sources: Sanctions lists, politically exposed person (PEP) databases, and publicly available fraud prevention databases consulted as part of our anti-money laundering obligations.

ct111 processes personal data only where we have a valid legal basis to do so. The legal bases we rely upon are:

1. Contractual necessity: Processing required to perform the contract between ct111 and the player — including account management, game operation, payment processing, and support delivery.
2. Legal obligation: Processing required to comply with our gaming license conditions, anti-money laundering legislation, counter-terrorist financing obligations, and other applicable legal requirements.
3. Legitimate interests: Processing for fraud prevention, platform security, network monitoring, product improvement, and responsible gaming monitoring — where such interests do not override the player's fundamental privacy rights.
4. Consent: Where required by law, or where we wish to send marketing communications or process data for purposes beyond the above, we will seek your explicit, freely given, informed consent — which you may withdraw at any time.

ct111 uses the personal data it collects for the following purposes:

1. Account registration and management: Creating your ct111 account, verifying your identity, managing your profile and preferences.
2. Age and identity verification: Ensuring all players are aged 21 or above, as required by ct111's license conditions and responsible gaming commitments.
3. Payment processing: Processing deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK; maintaining accurate financial records.
4. Game operation and integrity: Operating all games fairly, maintaining server logs for dispute resolution, and monitoring for cheating or collusion.
5. Fraud and money laundering prevention: Screening transactions and account behaviour against fraud indicators and sanctions lists, as required by our licensing obligations.
6. Responsible gaming: Monitoring player behaviour for signs of problem gaming; administering self-exclusion, deposit limits, session controls, and cool-off requests.
7. Customer support: Responding to queries, resolving disputes, and managing complaints — including maintaining support records for quality assurance.
8. Platform improvement: Analysing aggregated, anonymised usage patterns to improve the ct111 platform experience for Pakistani players.
9. Legal and regulatory compliance: Maintaining records required by our gaming license authority and applicable law; responding to lawful information requests from regulatory or law enforcement bodies.
10. Marketing communications (consent-based only): Sending promotional offers, bonus notifications, and platform updates, where you have opted in and subject to your right to opt out at any time.

ct111 does not sell your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• KYC and Identity Verification Providers: Third-party services that assist with CNIC verification, document authentication, and age verification as required by our license.
• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK — to process deposits and withdrawals.
• Fraud Prevention and Compliance Partners: Services that screen transactions against sanctions lists, PEP databases, and industry-shared fraud intelligence networks.
• Game Content Providers: Licensed game studios and live casino providers whose games are hosted on the ct111 platform — limited to technical data necessary for game delivery.
• IT Infrastructure and Security Providers: Cloud hosting, CDN, DDoS protection, and cybersecurity service providers operating under strict confidentiality agreements.
• Regulatory and Law Enforcement Authorities: Where we are legally required to disclose information to our licensing authority, tax authorities, financial intelligence units, or law enforcement agencies.
• Dispute Resolution Bodies: Where a formal dispute is escalated to an independent adjudicator under our license conditions.

All third parties engaged by ct111 to process personal data on our behalf are required to enter into data processing agreements that obligate them to handle player data only as instructed by ct111, in accordance with applicable data protection standards.

ct111 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that help us recognise returning visitors, maintain your login session, remember your preferences, and analyse how players interact with the Platform.

The categories of cookies used on ct111 are:

• Strictly Necessary Cookies: Required for the Platform to function. These enable login sessions, balance displays, and security features. They cannot be disabled without breaking core functionality.
• Performance Cookies: Collect anonymised data on how the Platform is used — which pages are visited most, how long sessions last, and where players encounter errors. Used solely to improve the Platform.
• Functional Cookies: Remember your preferences — such as language settings and responsible gaming configurations — so you do not need to re-enter them on each visit.
• Security Cookies: Support fraud detection, login anomaly detection, and protection against automated attacks.

ct111 does not use third-party advertising cookies or allow ad networks to track player behaviour across external websites via the ct111 Platform. Most browsers allow you to manage cookie settings. Disabling certain cookies may affect Platform functionality.

ct111 retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

ct111 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and ct111's servers is encrypted using 256-bit SSL/TLS — the same standard employed by international banking institutions.
• Encryption at Rest: Sensitive data stored on ct111's systems — including identity documents, financial records, and passwords — is encrypted at rest using AES-256 or equivalent standards.
• Password Hashing: Your account password is never stored in plain text. It is processed through a secure one-way cryptographic hash function, meaning even ct111 staff cannot read your password.
• Two-Factor Authentication (2FA): Available to all ct111 players. Enabling 2FA adds a critical second layer of account security.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with access to player data undergo background checks and data protection training.
• Penetration Testing: ct111's systems are subject to regular independent security assessments to identify and remediate vulnerabilities.
• Incident Response: ct111 maintains a data breach response procedure. In the event of a data breach affecting player rights, we will notify affected individuals and, where required, our licensing authority within the timeframes mandated by applicable law.

As a player on the ct111 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 15.

Right of Access: You may request a copy of the personal data ct111 holds about you, together with information about how it is processed.

Right to Rectification: You may request correction of any inaccurate personal data we hold about you. For account details, many corrections can be made directly through your account settings; others may require KYC re-verification.

Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Please note that ct111 may be required to retain certain data beyond an erasure request to fulfil legal and regulatory obligations (see Section 9).

Right to Object: You may object to processing based on ct111's legitimate interests at any time. You may also withdraw marketing consent and opt out of communications at any time — this will not affect the lawfulness of processing prior to your withdrawal.

ct111 will respond to all verified data rights requests within 30 days. In complex cases, this may be extended by a further 60 days with notification.

The ct111 platform is strictly intended for adults aged 21 years and above. ct111 does not knowingly collect personal data from persons under the age of 21, and does not permit minors to register, deposit, or participate in any game on the Platform.

Age is verified as part of the mandatory KYC process using government-issued CNIC documentation. Any account found to belong to a person under 21 will be immediately closed, associated funds forfeited, and the matter reported to our licensing authority as required.

If you believe that a person under the age of 21 has registered or is using a ct111 account, please contact our support team immediately via live chat.

ct111 operates globally and may store or process personal data on servers located outside Pakistan. Where data is transferred internationally, ct111 ensures appropriate safeguards are in place — including contractual protections with data processors, standard contractual clauses, or reliance on adequacy decisions where applicable.

Specifically, some of ct111's technical service providers (such as cloud hosting and CDN providers) operate data centres in multiple jurisdictions. In all cases, ct111 ensures that these providers apply data protection standards equivalent to those described in this Policy and required by our licensing authority.

Your payment data processed through Pakistani payment providers (JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank) is processed within Pakistan in accordance with those providers' own privacy practices and applicable Pakistani financial regulation.

ct111 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. Material changes — those that significantly affect your rights or how your data is used — will be communicated to registered players via email or in-platform notification at least 14 days before they take effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We recommend reviewing this Policy periodically. Your continued use of the ct111 Platform after the effective date of any update constitutes acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by ct111, please contact us through the following channels. We aim to acknowledge all privacy enquiries within 48 hours and respond fully within 30 days.

• Live Chat: Available 24/7 in Urdu and English via the ct111 website. This is the fastest channel for urgent privacy concerns.
• Email (plain text — not a clickable link): [email protected]

When contacting us about a data rights request, please include your registered username, the mobile number associated with your account, and a description of your request. We may need to verify your identity before processing any request that involves disclosure or deletion of personal data.