a999 Privacy Policy —
How We Protect Your Data

1 Data Controller

a999, operating through its licensed entity under an international online gaming license, is the data controller responsible for your personal information collected through the a999 Platform at a999.lol. As data controller, a999 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all privacy-related inquiries, data subject requests, or complaints regarding the handling of your personal information, please contact a999's Data Privacy team at the contact details provided in Section 16 of this Policy.

2 Information We Collect

a999 collects several categories of personal information in the course of providing its services. The specific information collected depends on how you interact with the Platform:

2.1 Identity & Registration Data

• Full legal name as it appears on your national identity document
• Date of birth (for age verification purposes)
• National Identity Card (CNIC) number or passport number
• Username and password (password stored in hashed, encrypted form)
• Residential address
• Nationality and country of residence

2.2 Contact Data

• Pakistani mobile phone number (used as primary account identifier and for OTP delivery)
• Email address (where provided)

2.3 Financial & Transaction Data

• Payment method details (JazzCash account number, EasyPaisa wallet number, bank account details, card details where applicable)
• Deposit and withdrawal history including amounts, timestamps, and payment methods
• Account balance information
• Source-of-funds documentation (where requested for KYC compliance)

2.4 Gaming & Betting Data

• Betting and gaming history — game type, stake amount, outcome, timestamp
• Session duration and gameplay patterns
• Bonus claims and wagering progress
• Responsible gaming limit settings and self-exclusion records

2.5 Technical & Usage Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser information
• Session cookies and authentication tokens
• Pages visited, features accessed, and time spent on Platform
• Error logs and crash reports

2.6 Communications Data

• Content of your communications with a999 customer support (live chat transcripts, email correspondence)
• Complaint and dispute records
• Survey responses and feedback submissions (where voluntarily provided)

3 How We Collect Your Data

a999 collects personal data through the following means:

• Directly from you: When you register an a999 account, complete your profile, make a deposit or withdrawal, contact support, submit a KYC document, or complete a survey.
• Automatically: When you browse or use the Platform, a999 automatically collects technical data such as your IP address, device identifiers, browser type, and usage patterns through cookies, session tokens, and server logs.
• From third-party payment providers: When you make a deposit via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or other accepted payment channels, a999 receives transaction confirmation data from those providers sufficient to credit your account and maintain accurate financial records.
• From identity verification services: Where a999 engages a third-party KYC or identity verification provider to validate your identity documents, that provider may share verification results with a999.
• From fraud prevention services: a999 may receive signals from third-party fraud detection services that help identify suspicious account activity or payment anomalies.

4 How We Use Your Personal Data

a999 uses the personal information collected for the following specific purposes:

5 Legal Basis for Processing

a999 processes your personal data only where a valid legal basis exists. The legal bases applicable to a999's processing activities are:

• Performance of a contract: Processing necessary to provide the gaming and betting services you have requested, manage your account, and process your financial transactions.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, tax reporting obligations, and gaming license conditions.
• Legitimate interests: Processing carried out for a999's legitimate business interests — including fraud prevention, platform security, abuse detection, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing for optional purposes — such as direct marketing communications — where you have provided clear, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

a999 does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. a999 shares personal data only in the following limited circumstances:

6.1 Service Providers

a999 engages carefully selected third-party service providers to support Platform operations. These providers access personal data only to the extent necessary to perform their contracted services and are bound by data processing agreements that prohibit them from using your data for any other purpose. Service providers engaged by a999 may include:

• Payment processors (JazzCash, EasyPaisa, bank transfer facilitators)
• Identity verification and KYC service providers
• Fraud detection and cybersecurity service providers
• Game software providers (for the purpose of delivering certified game content)
• Customer support platform providers
• Cloud hosting and infrastructure providers

6.2 Legal & Regulatory Disclosure

a999 may disclose personal data to regulatory authorities, law enforcement agencies, or other governmental bodies where required to do so by applicable law, court order, or in connection with a999's obligations under its international gaming license, anti-money laundering regulations, or counter-terrorism financing obligations.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of a999's business assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

7 Cookies & Tracking Technologies

a999 uses cookies and similar technologies to operate the Platform, authenticate users, remember preferences, and collect usage analytics. The types of cookies used by a999 include:

• Essential cookies: Strictly necessary for the Platform to function. These include session authentication cookies that keep you logged into your a999 account. These cookies cannot be disabled without disrupting Platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred game categories, and responsible gaming limit displays. These improve your experience but are not strictly required for Platform operation.
• Analytics cookies: Collect anonymised data about how users interact with the Platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used in aggregate to improve the Platform and is not linked to individual user identities.
• Security cookies: Used to detect fraudulent login attempts, identify unusual account activity, and support a999's account security systems.

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will affect your ability to log in and use the a999 Platform. a999 does not use third-party advertising or tracking cookies.

8 Data Security

a999 implements a multi-layered technical and organisational security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and a999's servers.
• Encrypted data storage — sensitive data including passwords (stored as one-way hashes), payment details, and identity documents are encrypted at rest.
• Access controls — internal access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based permissions and access logging.
• Two-factor authentication — available to all a999 users and mandatory for administrative staff accounts.
• Regular security audits — a999 conducts periodic penetration testing and security reviews of Platform systems.
• Intrusion detection systems — a999's infrastructure is monitored 24/7 for anomalous activity indicative of unauthorised access attempts.

9 Data Retention

a999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data: Retained for the duration of your account's existence on the a999 Platform, plus such additional period as required by applicable law following account closure.
• Financial and transaction records: Retained for a minimum of five (5) years following the relevant transaction, as required by applicable anti-money laundering and financial record-keeping regulations.
• KYC and identity verification documents: Retained for a minimum of five (5) years following account closure, or longer where required by applicable law or regulatory guidance.
• Customer support communications: Retained for three (3) years from the date of the interaction, or longer where the communication relates to an unresolved dispute.
• Gaming and betting history: Retained for five (5) years from the date of the relevant session or wager.
• Marketing consent records: Retained for the duration of your consent plus three (3) years to demonstrate compliance.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with a999's data retention and destruction procedures.

10 International Data Transfers

a999 operates as an internationally licensed online gaming platform, and certain aspects of Platform operations may involve the transfer of personal data to countries outside your country of residence. Where such transfers occur, a999 ensures that appropriate safeguards are in place to protect your personal data, including:

• Transferring data only to countries that have been assessed as providing adequate data protection standards.
• Implementing standard contractual clauses or equivalent contractual mechanisms with third-party service providers located outside Pakistan.
• Ensuring that all third-party service providers receiving personal data are bound by data processing agreements containing appropriate privacy protections.

You may request further information about the specific safeguards applicable to any international transfer of your personal data by contacting a999's Data Privacy team.

11 Your Privacy Rights

Subject to applicable law, you have the following rights in relation to your personal data held by a999. You may exercise any of these rights by contacting the a999 Data Privacy team at the details set out in Section 16:

• Right of access: You have the right to request confirmation of whether a999 processes personal data about you and, if so, to receive a copy of that data.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data held about you. You may update most account information directly from your a999 account settings.
• Right to erasure: In certain circumstances, you have the right to request deletion of personal data held about you. This right is subject to a999's legal obligations to retain certain data (see Section 9).
• Right to restrict processing: You have the right to request that a999 limit the processing of your personal data in certain defined circumstances.
• Right to data portability: Where processing is based on your consent or the performance of a contract, you have the right to receive a structured copy of your personal data in a machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing, a999 will cease processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

12 Children & Minors

The a999 Platform is strictly intended for adults aged 21 years and over. a999 does not knowingly collect, use, or retain personal data relating to persons under the age of 21. Age verification is a mandatory component of the a999 account registration and KYC processes.

If a999 discovers or is informed that a person under 21 has registered an account or provided personal data to the Platform, a999 will immediately close the account, delete all associated personal data to the extent legally permissible, cancel any pending transactions, and take such other steps as are appropriate to protect the minor's welfare and comply with applicable law.

If you believe that a minor may have accessed or registered with the a999 Platform, please notify us immediately at the contact details provided in Section 16 of this Policy.

13 Third-Party Links

The a999 Platform may contain references to third-party services (such as payment processors). Where you access third-party platforms or services in connection with your use of a999, those platforms and services operate under their own privacy policies, which a999 does not control. a999 accepts no responsibility or liability for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party services you use in connection with your a999 account.

14 Marketing Communications

a999 may, with your consent, send you marketing communications regarding a999 promotions, new games, deposit bonuses, and Platform news. You may provide or withdraw your consent for marketing communications at any time through your a999 account settings or by contacting the a999 support team.

a999 does not share your contact data with third parties for the purpose of third-party marketing. All marketing communications sent by a999 will clearly identify a999 as the sender and will include a simple mechanism to opt out of future communications.

15 Amendments to This Policy

a999 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform operations, or data processing practices. The "Last Updated" date at the top of this Policy will be revised accordingly whenever changes are made.

Where changes are material — meaning they significantly affect your privacy rights or how a999 processes your personal data — a999 will notify registered users via email or in-Platform notification at least 14 days before the changes take effect, except where immediate changes are required to comply with legal obligations.

Your continued use of the a999 Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the amended Policy, you must close your a999 account and cease using the Platform.

16 Contact Us

For all privacy-related inquiries, data subject access requests, or complaints regarding a999's handling of your personal information, please contact the a999 Data Privacy team through the following channel:

If you are not satisfied with a999's response to your privacy concern, you have the right to escalate your complaint to the relevant supervisory authority or data protection authority in your jurisdiction.