at999 Privacy Policy — How We Handle Your Personal Data

1 Who We Are

at999 ("at999", "we", "us", "our") operates the online casino and sports betting platform accessible at https://at999.io and any associated mobile applications or services (collectively, the "Platform"). at999 acts as the data controller in respect of personal data collected through the Platform, meaning we determine the purposes for which and the manner in which your personal data is processed.

Our designated point of contact for all privacy and data-related enquiries is our support team, reachable at [email protected]. We are committed to handling all data rights requests promptly and in accordance with applicable data protection principles.

2 Personal Data We Collect

at999 collects the following categories of personal data in connection with your use of the Platform:

at999 does not knowingly collect sensitive special-category personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where you voluntarily disclose such information in the context of a responsible gaming self-assessment or support interaction, in which case it is used solely for the purpose of providing appropriate responsible gaming support.

3 How We Collect Your Data

at999 collects personal data through the following means:

• Direct submission — data you actively provide during account registration, KYC document uploads, deposit and withdrawal requests, support contacts, and promotional opt-ins.
• Automated technologies — technical and usage data collected automatically when you visit or interact with the Platform, including through cookies, server logs, and analytics tools. See Section 7 (Cookies & Tracking) for full details.
• Third-party sources — identity verification data returned by our KYC partners when you submit identity documents; fraud and risk signals from payment processors; and, where applicable, publicly available information used to fulfil anti-money laundering obligations.

4 Purposes of Processing

at999 processes your personal data for the following specific purposes:

• Account management — creating and maintaining your player account, authenticating your identity on login, and providing access to Platform features.
• Identity verification (KYC) — confirming your age, identity and payment method ownership in compliance with responsible gaming and anti-money laundering requirements.
• Payment processing — facilitating deposits and withdrawals through bKash, Nagad, Rocket, Upay and other supported payment methods.
• Responsible gaming — monitoring gaming patterns for signs of problem gambling, applying deposit limits and self-exclusion settings, and providing intervention support where appropriate.
• Fraud prevention and platform security — detecting, investigating and preventing fraudulent transactions, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Customer support — responding to queries, complaints, and technical support requests submitted via live chat or email.
• Legal and regulatory compliance — retaining records as required by applicable law and responding to legitimate requests from authorities.
• Marketing communications — sending promotional offers, bonus notifications and platform updates to players who have opted in to receive such communications. Marketing is always opt-in; you may withdraw consent at any time.
• Platform improvement — using aggregated and anonymised analytics data to improve the performance, design and game selection of the at999 Platform.

5 Legal Basis for Processing

at999 relies on the following legal bases to process your personal data:

• Contractual necessity — processing required to fulfil our obligations to you under the at999 Terms & Conditions (e.g., account management, payment processing, KYC verification).
• Legitimate interests — processing conducted for at999's legitimate business interests, including fraud prevention, platform security, and analytics, provided those interests are not overridden by your privacy rights.
• Legal obligation — processing required by applicable law, including anti-money laundering record-keeping requirements.
• Consent — processing for purposes where at999 has sought and obtained your express consent, principally direct marketing communications. You may withdraw this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6 Data Sharing and Third Parties

at999 does not sell, rent or trade your personal data to any third party. We may share your data with the following categories of trusted third parties, strictly to the extent necessary to deliver the at999 service:

• Payment service providers — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Visa, Mastercard and other payment partners receive the financial data necessary to process your transactions.
• KYC and identity verification providers — third-party identity verification services that assist at999 in verifying your identity and age during the KYC process.
• Game studios and platform providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi and other game content providers may receive the minimum necessary technical and usage data required to deliver their games and ensure fair play.
• IT and hosting infrastructure providers — cloud hosting, content delivery and cybersecurity providers who process data on at999's behalf under strict data processing agreements.
• Legal and regulatory authorities — law enforcement, financial intelligence units, or other governmental bodies where at999 is legally required to disclose information.

All third-party processors engaged by at999 are contractually required to implement appropriate technical and organisational security measures and to process data only in accordance with at999's documented instructions.

7 Cookies and Tracking Technologies

at999 uses cookies and similar tracking technologies on the Platform to deliver a functional, secure and personalised experience. The following types of cookies are used:

• Essential cookies — strictly necessary for the Platform to function. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without disrupting Platform functionality.
• Analytics cookies — used to collect aggregated, anonymised information about how players navigate and interact with the Platform. This data informs improvements to design and performance. These cookies are set with your consent.
• Functional cookies — remember your preferences (such as language and display settings) to provide a more personalised experience across sessions. Set with your consent.
• Marketing cookies — used to track the effectiveness of at999's promotional campaigns and to deliver relevant offers to opted-in players. Set only with your explicit consent.

You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies will impair your ability to use the at999 Platform. at999 does not use cookies to build individual advertising profiles for sale to third-party advertisers.

8 Data Retention

at999 retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised:

Where at999 is required by law to retain data for a longer period than specified above, the legally mandated retention period shall take precedence. Self-excluded players' data is retained for the duration of the self-exclusion period plus five years to prevent re-registration during an active exclusion.

9 Data Security

at999 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration or destruction. Our technical and organisational security measures include:

• TLS 1.3 encryption for all data transmitted between your device and the at999 servers;
• AES-256 encryption for sensitive data at rest, including financial records and KYC documents;
• Bcrypt one-way hashing for account passwords — at999 staff cannot view your password in plain text;
• Multi-factor authentication options for player accounts;
• Regular third-party penetration testing and vulnerability assessments;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• 24/7 intrusion detection and security monitoring on all production infrastructure.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a material risk to your rights, at999 will notify affected players without undue delay and take immediate steps to contain and remediate the incident.

10 International Data Transfers

at999 primarily operates from and stores data within servers located in secure jurisdictions. In certain circumstances — for example, when a third-party game studio or payment processor operates infrastructure in a different country — your data may be transferred to and processed in jurisdictions outside Bangladesh. at999 ensures that any such international transfer is subject to appropriate safeguards, including contractual data transfer agreements that impose data protection standards equivalent to those applied to data processed domestically.

By using the at999 Platform, you acknowledge that your personal data may be transferred internationally as described in this section. If you have concerns about a specific international transfer, please contact us at [email protected].

11 Children and Minors

The at999 Platform is strictly intended for adults aged 21 years and above. at999 does not knowingly collect personal data from any person under the age of 21. If at999 becomes aware that a minor has registered an account or provided personal data, that account will be immediately suspended, the relevant data will be deleted without undue delay, and any deposits made will be returned to the payment method of origin subject to verification.

Parents and guardians who have reason to believe that a minor in their household has accessed the at999 Platform are encouraged to contact us immediately at [email protected]. at999 will investigate and act promptly on all such reports.

12 Marketing Communications

at999 may send you promotional emails, SMS notifications, or in-platform messages regarding bonuses, new games, tournaments, and special offers, provided you have opted in to receive such communications. Marketing communications are always optional and consent-based. You may withdraw your marketing consent at any time by:

• Updating your communication preferences in your account settings dashboard;
• Clicking the unsubscribe link at the bottom of any marketing email; or
• Contacting our support team at [email protected] with the subject line "Marketing Opt-Out".

Withdrawal of marketing consent does not affect your ability to use the Platform or receive essential service communications (such as transaction confirmations, security alerts, and account notifications), which are sent regardless of marketing preference as they form part of the contractual service.

13 Exercising Your Data Rights

To exercise any of the data rights described in the "Your Rights" section of this page — including access, rectification, erasure, portability, objection, or restriction — please submit a written request to [email protected] with the subject line "Data Rights Request". Your request should include:

• Your full name as registered on your at999 account;
• Your registered email address;
• A clear description of the right you wish to exercise and the specific data or processing activity to which your request relates.

at999 will acknowledge receipt of your request within 5 business days and will endeavour to provide a substantive response within 30 calendar days. Where a request is complex or high in volume, this period may be extended by a further 30 days, in which case at999 will notify you of the extension and the reason for it. at999 processes standard data rights requests free of charge. For manifestly unfounded or excessive requests, at999 reserves the right to charge a reasonable administrative fee.

For the protection of your data, at999 may need to verify your identity before processing a data rights request. You may be asked to provide documentation consistent with the KYC verification process.

14 Changes to This Privacy Policy

at999 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made, at999 will post the revised policy on the Platform and, where practically possible, notify registered players by email at least 14 days before the updated policy takes effect.

The "Effective Date" at the top of this document will be updated each time a new version is published. We encourage you to review this Privacy Policy periodically to stay informed about how at999 protects your data. Your continued use of the at999 Platform after the effective date of any updated policy constitutes your acknowledgment of the changes.

15 Contact Us

If you have any questions, concerns or complaints regarding this Privacy Policy or at999's data handling practices, please reach our team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for privacy enquiries: "Privacy Policy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the at999 Platform
• Response time: Within 2–4 hours for live chat; within one business day for email privacy enquiries
• Operating timezone: Bangladesh Standard Time (BST, UTC+6)

at999 takes all privacy complaints seriously and will investigate each one thoroughly. If you are not satisfied with at999's response to your privacy complaint, you may have the right to lodge a complaint with a relevant data protection authority in your jurisdiction.