Privacy Policy — at999 Pakistan

at999 ("the Platform", "we", "us", "our") operates the online betting and casino website available at https://at999.click and any associated mobile applications. at999 is built for Pakistani players and is operated by the at999 operating entity.

For the purposes of this Privacy Policy, at999 is the data controller — meaning we are the organisation responsible for deciding how and why your personal data is collected and processed. If you have any questions or concerns about how we handle your data, you can contact our dedicated privacy team at support@at999.click.

This Privacy Policy applies to all personal data collected through the at999 website, mobile application, customer support channels and any other means of interaction you have with at999. It should be read alongside our Terms and Conditions and Responsible Gaming Policy.

at999 collects only the data necessary to provide you with a safe, functional and personalised service. The categories of personal data we may collect include:

at999 does not collect sensitive personal data such as biometric information, religious beliefs or political opinions. We do not collect full payment card numbers — card processing is handled entirely by our PCI-DSS certified payment partners who do not share full card details with us.

at999 collects your personal data through three main channels:

at999 processes your personal data for the following specific purposes. We only use your data for a purpose you would reasonably expect given how you provided it.

• Account creation and management: To register your account, verify your identity, maintain your profile and provide you with access to at999 services.
• Processing transactions: To accept deposits, process withdrawal requests, apply bonus credits and maintain accurate financial records of all transactions on your account.
• Providing the platform: To deliver sports betting, live casino, crash games, virtual sports and all other at999 products and services to you in a personalised manner.
• Security and fraud prevention: To detect and prevent fraudulent accounts, duplicate registrations, bonus abuse, money laundering, payment fraud and other prohibited activities described in our Terms and Conditions.
• Customer support: To respond to your queries, resolve disputes, handle complaints and communicate with you about your account.
• Responsible gaming: To administer the tools you set — deposit limits, session timers, self-exclusion — and to identify patterns of play that may indicate problem gambling, in line with our Responsible Gaming obligations.
• Legal and regulatory compliance: To comply with applicable anti-money laundering (AML) requirements, know-your-customer (KYC) obligations and to respond to lawful requests from Pakistani authorities.
• Platform improvement: To analyse usage patterns, test new features, fix bugs and improve the overall experience on at999 for all Pakistani players.
• Communications: To send you account-related notifications (deposit confirmations, withdrawal approvals, security alerts) and, where you have opted in, promotional messages about at999 offers.

at999 processes your personal data on the following legal grounds:

• Contractual necessity: Most processing — account operation, transaction processing, customer support — is necessary to perform our contract with you under the at999 Terms and Conditions.
• Legal obligation: Identity verification, AML screening and record-keeping are required by applicable law and regulatory standards applicable to the operation of at999.
• Legitimate interests: Fraud detection, security monitoring and platform analytics are carried out on the basis of at999's legitimate interest in operating a safe and fair platform. We have assessed that these interests do not override your rights in the circumstances.
• Consent: Sending you optional promotional communications is done only with your explicit consent. You can withdraw consent at any time by contacting support@at999.click or using the unsubscribe link in any marketing message.

at999 does not sell, rent or trade your personal data. We share data with third parties only where necessary and only under strict data processing agreements. The categories of third parties who may receive your data are:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT partners and Visa/Mastercard acquiring banks receive the payment details necessary to process your deposits and withdrawals. They operate under their own privacy policies and PCI-DSS obligations.
• Identity verification providers: Where we perform KYC checks, we use regulated identity verification services that process your CNIC or other identity documents solely for the purpose of confirming your identity and age.
• Technology and hosting partners: at999's platform is hosted on cloud infrastructure. Our hosting partners have access to server logs and technical data as part of providing infrastructure services. They operate under confidentiality agreements and are not permitted to use your data for their own purposes.
• Fraud prevention services: We use third-party fraud detection tools that may process technical and behavioural data to identify suspicious account activity. These providers act as data processors under our instruction.
• Legal and regulatory authorities: at999 will disclose personal data to Pakistani authorities, courts or regulators when required to do so by law, court order or regulatory directive. We will notify you of such disclosures where legally permitted to do so.

at999 uses cookies and similar tracking technologies to make the platform function correctly and to understand how players use the site. A cookie is a small text file stored on your device by your browser when you visit a website.

The types of cookies at999 uses:

• Essential cookies: Required for the platform to function. These handle your login session, remember your preferences and ensure secure form submissions. You cannot opt out of essential cookies and remain logged in.
• Analytics cookies: at999 uses privacy-friendly analytics to understand aggregate usage patterns — which pages are visited most, where players spend time, and where the experience could be improved. These do not identify you personally and are not shared with advertising networks.
• Security cookies: Used to detect and prevent fraud, including recognising trusted devices and flagging logins from unusual locations.

at999 does not use advertising cookies or share your browsing behaviour with external ad networks. You can manage cookie preferences through your browser settings. Blocking essential cookies will affect your ability to log in and use the platform.

at999 takes data security seriously and has implemented a layered set of technical and organisational measures to protect your personal data from unauthorised access, loss, alteration or disclosure.

• Encryption in transit: All communication between your device and at999 servers is encrypted using 256-bit SSL/TLS. The padlock icon in your browser confirms this is active.
• Encrypted data at rest: Sensitive data — including passwords (stored as hashed values, never in plain text), financial account identifiers and identity documents — is encrypted in our databases.
• Access controls: at999 staff access to player data is restricted on a strict need-to-know basis. Access is logged, audited and reviewed regularly. No single team member has unrestricted access to all personal data.
• Payment security: Full payment card numbers are never stored by at999. Card transactions are tokenised by our PCI-DSS certified payment partner and only a masked reference is retained.
• Penetration testing: at999's platform undergoes regular third-party security assessments to identify and address vulnerabilities before they can be exploited.
• Incident response: We have a documented data breach response plan. If a breach occurs that affects your data and creates a risk to you, we will notify you promptly with details of what happened and what we are doing about it.

at999 retains personal data only for as long as necessary for the purpose it was collected and to comply with our legal obligations. Key retention periods are:

• Active account data: Retained for the full duration of your account relationship with at999.
• Transaction and financial records: Retained for a minimum of five (5) years after the last transaction, in line with standard financial record-keeping and AML requirements.
• Identity verification documents: Retained for five (5) years from account closure or the date of verification, whichever is later.
• Customer support records: Retained for three (3) years from the date of the interaction.
• Responsible gaming records: Self-exclusion requests and related records are retained for the duration of the exclusion period plus five (5) years, to prevent reactivation within a restricted period.
• Technical logs: Server and access logs are retained for up to 12 months for security and fraud analysis purposes.

When data is no longer required, at999 securely deletes or anonymises it so it can no longer be associated with you. Anonymised aggregated data may be retained indefinitely for analytical purposes.

You have the following rights in relation to your personal data held by at999. To exercise any of these rights, contact us at support@at999.click. We will respond within 30 days and will not charge a fee for reasonable requests.

Please note that some rights are subject to exceptions. For example, at999 cannot delete financial transaction records that we are legally required to retain. We will explain any limitations when you make a request.

at999 is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered on at999 or provided personal data to us, please contact us immediately at support@at999.click with details and we will investigate and take appropriate action, including closing the account and deleting any associated data.

at999 uses age verification measures at registration — including mobile number verification and, where triggered, CNIC-based identity verification — to prevent underage access. We take underage gambling seriously and cooperate fully with any parental or guardian request to investigate a minor's use of the platform.

at999 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or platform features. When we make material changes, we will notify registered players by email or in-platform notification at least seven (7) days before the changes take effect.

The "Last updated" date at the top of this page will always reflect when the current version came into force. We encourage you to review this page periodically. Continued use of at999 after the effective date of any change constitutes your acceptance of the updated Privacy Policy.

Previous versions of the Privacy Policy are available on request by contacting support@at999.click.

If you have any questions about this Privacy Policy, how at999 handles your personal data, or if you wish to exercise any of your data rights, please contact us:

• Email: support@at999.click
• Live chat: Available 24/7 within the at999 website and mobile app in English and Urdu
• Response time: Data rights requests acknowledged within 72 hours and resolved within 30 days

If you are not satisfied with at999's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or pursue legal remedies through the courts. at999 will cooperate fully with any regulatory investigation into our data practices.