1Who We Are
at 999 (operated at at999.im) is an online casino and sports betting platform serving players in Pakistan. When this Privacy Policy refers to "at 999", "we", "us" or "our", it means the company operating at999.im in its capacity as the data controller responsible for your personal information.
As the data controller, at 999 determines how and why your personal data is processed. This policy sets out our obligations and your rights in relation to that processing. If you have questions about any part of this policy, our dedicated support team is reachable 24/7 through your logged-in account via live chat, or by email at support@at999.im.
This Privacy Policy forms part of the at 999 Terms and Conditions. By registering an account on at999.im you confirm that you have read and accepted both documents.
2What Data at 999 Collects
at 999 only collects the personal data that is genuinely necessary to operate the platform, verify your identity, process payments and comply with legal obligations. We do not collect information for the sake of it. Below is a breakdown of the categories of data we collect and the circumstances in which they are gathered.
2.1 Registration Data
When you create an account at at 999, we collect your full name, date of birth, registered mobile number, email address (if provided) and the username and password you choose. This information is necessary to create and secure your account.
2.2 Identity Verification (KYC) Data
Before processing withdrawals, at 999 may request copies of identity documents such as your CNIC (Computerised National Identity Card), passport or other government-issued ID. We may also request proof of your payment account (such as a screenshot of your Easypaisa or JazzCash account). This data is processed strictly for identity verification and fraud prevention purposes.
2.3 Financial and Transaction Data
We record all deposits, withdrawals, bet placements, winnings and bonus transactions linked to your account. This includes the payment method used (mobile wallet, bank account or card), transaction reference numbers and transaction timestamps. We never store full card numbers — card payment processing is handled by our PCI-DSS compliant payment processor.
2.4 Gameplay and Activity Data
We collect data on games played, bets placed, outcomes, session duration and feature usage. This data is used to operate the platform correctly, detect fraud, personalise your experience and fulfil responsible gaming obligations.
2.5 Device and Technical Data
When you access at999.im, we automatically collect your IP address, device type, operating system, browser type and version, screen resolution and referral URL. This information helps us optimise the platform for the devices Pakistani players actually use and assists with fraud detection.
2.6 Communications Data
If you contact our support team via live chat or email, we retain records of those communications. This allows us to provide consistent support and resolve disputes fairly with reference to the full conversation history.
| Data Category | Collected When | Mandatory? |
|---|---|---|
| Registration details | Account creation | Yes |
| KYC documents | Before first withdrawal | Yes (withdrawal) |
| Transaction records | Every deposit/withdrawal/bet | Yes |
| Gameplay history | During active sessions | Yes |
| Device / IP data | Every site visit | Automatic |
| Support communications | When you contact us | As needed |
| Marketing preferences | During registration or settings | Optional |
3How at 999 Uses Your Personal Data
Every piece of data we collect has a defined purpose. We process your personal data only for the purposes described below:
- Account management: Creating, maintaining and securing your at 999 account, including password resets and security alerts.
- Identity verification: Confirming that you are who you say you are, that you meet the minimum age requirement of 18 years, and that your payment methods belong to you.
- Payment processing: Facilitating your deposits and withdrawals through the supported PKR payment methods (Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, Visa/Mastercard).
- Game delivery: Operating the games, live casino tables, sports betting markets and cricket score features that make up the at 999 platform.
- Fraud prevention and security: Detecting and preventing multi-accounting, money laundering, payment fraud, bot activity and other prohibited conduct as defined in the Terms and Conditions.
- Bonus and promotion administration: Verifying bonus eligibility, tracking wagering requirements and ensuring that promotional offers operate fairly.
- Responsible gaming: Monitoring for signs of problem gambling behaviour, administering deposit limits, self-exclusion requests and other responsible gaming tools you have activated on your account.
- Customer support: Responding to your queries, resolving disputes and improving the quality of our support through conversation records.
- Platform improvement: Analysing aggregated, anonymised usage data to understand how players use the platform and where improvements can be made.
- Legal compliance: Meeting our obligations under applicable law, including responding to lawful requests from regulatory and law enforcement authorities.
- Marketing communications: Sending you promotional offers, bonus announcements and platform news by SMS or push notification — only if you have opted in to receive these communications.
4Legal Basis for Processing
at 999 processes your personal data on the following legal grounds depending on the nature of the processing activity:
- Contract performance: Most data processing at at 999 is necessary to deliver the services you signed up for — operating your account, processing payments, running games and providing support. Without this processing, we cannot provide the platform.
- Legal obligation: Certain processing activities — particularly KYC verification, transaction record-keeping and fraud reporting — are required by applicable laws and regulatory requirements. We must carry out these activities regardless of preference.
- Legitimate interests: Fraud detection, platform security, abuse prevention and quality assurance are processed on the basis of at 999's legitimate interest in operating a safe and fair platform for all players.
- Consent: Marketing communications via SMS or push notification are sent only where you have provided explicit consent. You may withdraw this consent at any time through your account settings or by contacting support.
5Who at 999 Shares Your Data With
at 999 does not sell your personal data to any third party, full stop. We share data only in the limited circumstances described below, and only with parties that have contractual obligations to handle your data securely:
- Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank networks and card payment processors receive the transaction data necessary to execute your deposits and withdrawals. Each processor operates under its own privacy framework and is contractually bound to process your data only for payment purposes.
- Identity verification providers: Where automated KYC checks are performed, your identity documents may be shared with a certified identity verification service provider. These providers are bound by strict data security obligations and use your documents solely to complete the verification check.
- Fraud prevention networks: In cases of suspected fraud, money laundering or serious terms violations, at 999 may share relevant account data with industry fraud prevention services and payment networks to prevent the same fraud being perpetrated on other platforms.
- Legal and regulatory authorities: at 999 will disclose personal data to law enforcement agencies, regulators or courts when required to do so by a valid legal process. We will notify you of such requests where permitted by law.
- Technology service providers: Certain platform operations (hosting, analytics, support software) are delivered by third-party technology providers. These providers act as data processors on our behalf, under contractual terms that prohibit them from using your data for any purpose other than delivering the service to at 999.
Our commitment: at 999 has never sold player data to advertisers, data brokers or any third party for commercial gain. Every data-sharing arrangement is governed by a written contract with security and use-limitation obligations.
6Cookies and Tracking Technologies
at 999 uses cookies and similar technologies on at999.im. Here is what you need to know:
6.1 Essential Cookies
These cookies are required for the platform to function. They maintain your login session, remember your language preferences and protect the platform against cross-site request forgery attacks. You cannot opt out of essential cookies without disabling platform access entirely.
6.2 Performance Cookies
These cookies collect anonymised data on how players navigate the platform — which pages load slowest, where errors occur and how long sessions last. This data is used exclusively to improve platform performance and is not linked to your personal identity.
6.3 Functional Cookies
These cookies remember your preferences — such as your last game category, preferred table limits or notification settings — so the platform behaves consistently between visits.
6.4 Managing Cookies
You can control non-essential cookies through your browser settings. Disabling performance or functional cookies will not prevent you from using the platform but may affect certain personalisation features. Essential cookies cannot be disabled through browser settings without breaking platform functionality.
7How at 999 Protects Your Data
Protecting your personal and financial data is a core operational priority at at 999. We apply multiple layers of technical and procedural security:
- SSL/TLS encryption: All data transmitted between your device and at999.im is encrypted using TLS 1.2 or higher. The padlock in your browser address bar confirms this encryption is active throughout your session.
- Encrypted data storage: Sensitive data including passwords (stored as hashed values, never plain text), identity documents and financial records are stored in encrypted form at rest.
- Access controls: Internal access to your personal data is restricted on a strict need-to-know basis. Staff can only access the specific data categories required for their job function, and all access is logged and audited.
- Fraud monitoring: at 999 operates continuous real-time monitoring of account activity for patterns consistent with account takeover, fraudulent transactions or identity theft. Suspicious activity triggers immediate investigation and, where necessary, account protection measures.
- PCI-DSS compliance: Card payment processing is handled entirely by our PCI-DSS certified payment processor. at 999 never receives or stores raw card numbers.
- Two-factor authentication: We strongly encourage all players to enable two-factor authentication (2FA) on their account. 2FA adds a critical second layer of protection against unauthorised access even if your password is compromised.
Security tip: at 999 will never ask for your password via SMS, email, live chat or any other channel. If you receive a message claiming to be from at 999 and asking for your password, treat it as a phishing attempt and report it to our support team immediately.
8How Long We Keep Your Data
at 999 retains personal data only for as long as necessary for the purpose it was collected, or as required by law. The general retention periods are as follows:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years | Legal / regulatory obligation |
| KYC documents | Duration of account + 5 years | Anti-money laundering law |
| Transaction records | 7 years from transaction date | Financial record-keeping law |
| Gameplay history | Duration of account + 3 years | Dispute resolution / compliance |
| Support communications | 3 years from last contact | Quality assurance / disputes |
| Marketing preferences | Until you opt out or close account | Consent management |
| Technical / device logs | 12 months rolling | Security monitoring |
After these periods, data is securely deleted or anonymised so that it can no longer be linked to you personally. Legally mandated retention periods may extend these timelines where applicable law requires it.
9Your Rights Over Your Personal Data
You have meaningful rights over the personal data that at 999 holds about you. These rights are listed below along with how to exercise each one:
Right of Access
You can request a copy of all personal data at 999 holds about you. We will provide this in a commonly used electronic format within 30 days of your verified request. Contact support via live chat or email to submit a Subject Access Request.
Right to Rectification
If any of the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. Update your details directly from your account settings or contact support for changes that require manual update.
Right to Erasure ("Right to Be Forgotten")
You can request deletion of your personal data where it is no longer necessary for the original purpose, where you withdraw consent, or where we have no overriding legal basis to retain it. Note that legally mandated retention obligations (e.g., financial records) may mean some data cannot be deleted immediately.
Right to Restriction
You can ask at 999 to restrict processing of your data in certain circumstances — for example, while you dispute the accuracy of your data or object to a particular use of it.
Right to Data Portability
You can request a copy of data you have provided to at 999 in a structured, machine-readable format (such as CSV) for transfer to another service. This applies to data processed on the basis of consent or contract performance.
Right to Object
You can object to processing carried out on the basis of legitimate interests, including profiling. You can also object to direct marketing at any time — this will always be honoured immediately without requiring justification.
To exercise any of these rights, contact our support team via live chat from your logged-in account or email support@at999.im. We will respond within 30 days of receiving a verified request. We may ask you to verify your identity before actioning the request to protect your data from unauthorised access.
10Children's Privacy
at 999 is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not register or use at999.im in any way.
If at 999 becomes aware that an account has been operated by or on behalf of a minor, we will immediately close the account, delete associated personal data to the extent legally permissible, and forfeit any balance in accordance with our Terms and Conditions. We may report such cases to relevant child protection authorities.
If you believe a minor in your household has registered on at 999, contact our support team immediately. We will prioritise the investigation and closure of the account.
11Marketing Communications and Opt-Out
at 999 may send you promotional messages about bonuses, new games, cricket betting markets and platform features. We only do this where you have given explicit consent to receive marketing communications during registration or through your account settings.
The types of marketing communications we may send include:
- SMS messages to your registered mobile number about active bonuses and limited-time promotions.
- Push notifications (if enabled on your device) about live match alerts, new game launches and personalised offers.
Opting out is simple and immediate. You can withdraw your consent to marketing communications at any time through your account notification settings, by replying STOP to any SMS from at 999, or by contacting our support team and requesting removal from marketing lists. Opting out of marketing does not affect your ability to use the platform or receive service-related communications such as payment confirmations or security alerts.
Service-related messages — such as deposit confirmations, withdrawal notifications, security alerts and KYC requests — are not marketing and will be sent regardless of your marketing preference settings. These messages are necessary to operate your account and cannot be disabled.
12Third-Party Services and Links
The at 999 platform integrates with a small number of third-party services to deliver functionality. These include our payment processing partners, the live casino game studios that supply our live dealer tables, and the sports data providers that power the live cricket score section.
Each of these third-party providers has their own privacy frameworks. at 999 selects partners who meet our data security standards and contractually restricts them from using player data for any purpose beyond delivering the service to at 999. However, once data leaves the at 999 environment and enters a third-party system, the third party's own privacy practices apply in addition to ours.
at999.im does not contain links to external websites in the navigation or content areas of the platform. The only URLs present on the platform are internal pages within at999.im. If you navigate away from at999.im to an external site through any other means, at 999 is not responsible for the privacy practices of that site.
13Changes to This Privacy Policy
at 999 will update this Privacy Policy from time to time to reflect changes in how we operate, changes in applicable law or improvements in how we describe our practices. When changes are made:
- The revised policy will be published at at999.im/privacy-policy with an updated "Last Updated" date.
- For material changes that significantly affect how your personal data is processed, we will notify registered players via their registered mobile number or through an in-platform notification at next login, at least 14 days before the changes take effect.
- Continued use of at 999 after the effective date of any changes constitutes your acceptance of the updated policy.
- If you disagree with a material change, you may close your account before the effective date and request deletion of your data subject to legal retention obligations.
14Contact Us and Complaints
If you have any questions about this Privacy Policy, how at 999 processes your personal data, or how to exercise your rights, please get in touch:
- Live Chat: Available 24/7 from your logged-in at 999 account — the fastest way to reach us.
- Email: support@at999.im — for detailed or formal privacy queries.
If you believe at 999 has not handled your personal data correctly and our support team has not resolved your concern to your satisfaction, you have the right to escalate the matter formally. Please email support@at999.im with the subject line "Privacy Complaint" and we will treat it as a formal complaint, acknowledging within 48 hours and providing a full response within 14 business days.