ae999 Privacy Policy —
Your Data, Your Rights, Our Obligations

For the purposes of this Privacy Policy, ae999 acts as the data controller in respect of personal data collected from users of the ae999 platform. ae999 operates ae999.biz and all associated gaming and account services under an internationally recognised gaming licence.

As data controller, ae999 determines the purposes for which and the means by which personal data is processed. This responsibility is taken seriously — ae999 has appointed designated personnel responsible for data protection compliance, and all data processing activities are subject to regular internal review.

Where ae999 engages third-party service providers to process personal data on its behalf (for example, payment processors and identity verification providers), those third parties act as data processors under contractual obligations that require them to protect the data and process it only in accordance with ae999's documented instructions.

2.1 Information You Provide Directly

ae999 collects information that you provide directly at registration and during your use of the platform. This includes:

• Full legal name and date of birth as they appear on your National Identity Card (CNIC);
• CNIC number and clear photographic copies (front and back), submitted as part of the KYC verification process;
• Pakistan mobile telephone number in the 03XX format;
• Email address used to create and communicate with your ae999 account;
• Banking and payment method details required to process deposits and withdrawals, including JazzCash and EasyPaisa wallet identifiers, bank account numbers (where provided for withdrawals), and partial card numbers where a card payment method is used;
• Communications sent to ae999 Customer Support, including live chat transcripts and email correspondence.

2.2 Information Collected Automatically

When you access and use ae999, certain technical and behavioural data is collected automatically through the platform's systems. This includes:

• IP address and derived geographic location at a country or region level — ae999 does not collect precise GPS coordinates;
• Device type, operating system version, browser type and version;
• Session timestamps including login time, session duration, and logout time;
• Pages and features accessed within the ae999 platform and the sequence in which they were accessed;
• Cookie identifiers and related tracking data as described in Section 8 of this Policy;
• Referring URLs where you accessed ae999 from another website.

2.3 Gaming Activity Data

ae999 records all gaming activity conducted through registered accounts. This includes bet placements, stakes, outcomes, game session logs, bonus claims and wagering progress records, and all responsible gaming tool activations including deposit limits, loss limits, and self-exclusion requests. This data is essential for account management, dispute resolution, regulatory reporting, and responsible gaming monitoring.

ae999 processes personal data under the following legal bases, which vary depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform the contract between ae999 and the registered user — including account management, bet processing, payment handling, and customer support;
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements imposed by ae999's operating licence, including Know Your Customer obligations, anti-money laundering procedures, age verification requirements, and regulatory reporting;
• Legitimate Interests: Processing for ae999's legitimate business interests where these are not overridden by the data subject's rights and freedoms — including fraud prevention, security monitoring, platform analytics, and responsible gaming monitoring;
• Consent: Processing based on your freely given, informed consent — specifically in relation to optional marketing communications. You may withdraw your consent to marketing at any time without affecting the lawfulness of processing prior to withdrawal.

ae999 uses the personal data it collects for the following specific purposes:

• Account Registration and Management: Creating your ae999 account, verifying your identity, maintaining account records, and enabling you to access the full suite of ae999 gaming services;
• Identity and Age Verification (KYC): Verifying that you are who you say you are and that you are at least 21 years of age — a mandatory requirement of ae999's operating licence;
• Payment Processing: Processing PKR deposits via JazzCash, EasyPaisa, and other accepted payment methods; processing withdrawal requests to verified payment accounts; maintaining transaction records;
• Fraud Detection and Prevention: Monitoring account activity, transaction patterns, and device data for indicators of fraudulent activity, bonus abuse, collusion, and other prohibited conduct as defined in the ae999 Terms and Conditions;
• Regulatory Compliance and Reporting: Meeting obligations imposed by ae999's operating licence including transaction reporting, suspicious activity reporting, and player data records maintenance;
• Responsible Gaming Monitoring: Identifying potential problem gambling behaviour through analysis of gaming patterns, deposit escalation, and other behavioural indicators; administering self-exclusion, deposit limit, and other responsible gaming tools;
• Customer Support: Responding to queries, complaints, and account disputes via live chat and email support channels;
• Platform Improvement: Analysing aggregated, anonymised usage data to identify areas for platform improvement, inform product development decisions, and optimise the user experience for Pakistani players;
• Marketing Communications: Where you have given consent, sending personalised promotional communications about ae999 offers, new games, and events. You may opt out of marketing communications at any time through your account settings.

ae999 shares personal data with third parties only in the following circumstances and to the limited extent necessary for each purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa/Mastercard networks, and cryptocurrency processors receive the minimum personal and transaction data required to process your deposit or withdrawal. These providers are contractually obligated to protect your data;
• Identity Verification Providers: Third-party KYC verification services receive identity documentation for the sole purpose of verifying your identity and age as required by ae999's licence obligations;
• Fraud Detection Services: Specialist fraud detection and anti-money laundering service providers analyse transaction and behavioural data on ae999's behalf to identify and prevent prohibited activity;
• Regulatory and Licensing Authorities: ae999's gaming licence authority, and in certain circumstances relevant law enforcement agencies, may receive player data where ae999 is legally required to disclose it — for example, under anti-money laundering reporting obligations or in response to a valid court order;
• Group Companies: ae999 may share data within its corporate group for the purposes of platform administration, risk management, and consolidated regulatory compliance.

All third parties with whom ae999 shares personal data are required by contract to implement appropriate technical and organisational security measures and to process the data strictly in accordance with ae999's documented instructions and applicable data protection obligations.

ae999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention periods applicable to ae999's key data categories are as follows:

• Identity and KYC Documentation: Retained for the duration of the account relationship plus a minimum of 5 years following account closure, as required by anti-money laundering regulations under ae999's operating licence;
• Transaction and Financial Records: Retained for a minimum of 5 years following the date of each transaction, as required for financial regulatory compliance and dispute resolution;
• Gaming Activity Records: Retained for a minimum of 3 years following the date of each gaming session, for regulatory reporting, responsible gaming monitoring, and dispute resolution purposes;
• Customer Support Communications: Retained for 2 years following the resolution of the relevant query or complaint;
• Technical and Device Data: Retained for 13 months from the date of collection for security monitoring and fraud prevention purposes, then deleted or anonymised;
• Marketing Consent Records: Retained until consent is withdrawn, plus 2 years as documentary evidence of the consent history.

Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted, or where deletion is not technically feasible, permanently anonymised so that it can no longer be attributed to any identifiable individual.

ae999 implements a multi-layered technical and organisational security framework to protect your personal data against unauthorised access, loss, destruction, or alteration. Security measures in place include:

• Transport Layer Security: All data transmitted between your device and ae999's servers is encrypted using TLS 1.2 or higher with 256-bit encryption. The padlock icon in your browser confirms this protection on every ae999 page;
• Data at Rest Encryption: Sensitive personal data stored on ae999's servers — including identity documents and financial records — is encrypted using AES-256 encryption at the database and storage layer;
• Access Controls: Access to personal data within ae999's systems is restricted to personnel with a documented need to access it for their role. Administrative access requires multi-factor authentication;
• Intrusion Detection: ae999's infrastructure is monitored 24/7 by automated intrusion detection systems, with alerts escalated to the security team for immediate response;
• Regular Audits: ae999 undergoes regular independent security penetration testing and vulnerability assessments conducted by qualified third-party security firms;
• Staff Training: All ae999 personnel with access to personal data undergo mandatory data protection and security awareness training.

ae999 uses cookies and similar tracking technologies on its platform. A cookie is a small text file placed on your device by a website that allows the website to recognise your device on future visits and deliver a more personalised experience. ae999 uses the following categories of cookies:

You may manage your cookie preferences through the ae999 cookie settings panel accessible from any page of the platform. Declining analytics or marketing cookies will not affect your ability to use ae999's core gaming services. Declining essential or functional cookies may affect platform functionality.

Most browsers also allow you to control cookies through browser settings, including blocking or deleting cookies. If you block essential cookies through your browser, you may be unable to log in to or use ae999.

ae999 recognises and respects the following individual data rights in relation to your personal data. All requests should be directed to support@ae999.biz with the subject line "Privacy Rights Request" and sufficient information to identify your ae999 account:

• Right of Access: You have the right to request a copy of the personal data ae999 holds about you. ae999 will provide this information within 30 days of a verified request, free of charge for the first request in any 12-month period;
• Right to Rectification: If any personal data ae999 holds about you is inaccurate or incomplete, you have the right to request correction. For certain data types (for example, your registered email address or mobile number), you can make corrections directly through your ae999 account settings;
• Right to Erasure: You have the right to request deletion of your personal data. ae999 will comply with such requests where the data is no longer necessary for the purpose for which it was collected, except where retention is required by legal or regulatory obligation — for example, KYC and transaction records required under anti-money laundering rules;
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to Restrict Processing: In certain circumstances — for example, while the accuracy of data is being contested — you have the right to request that ae999 restrict processing of your data;
• Right to Object: You have the right to object to processing based on ae999's legitimate interests where you believe your rights and interests override those interests. You also have an absolute right to object to processing for direct marketing purposes at any time;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

ae999 will respond to all valid privacy rights requests within 30 days. In complex or high-volume circumstances, ae999 may extend this period by a further 60 days with notice to you. ae999 will not charge for handling privacy rights requests except in cases where requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

ae999's registration process includes mandatory age verification, and KYC procedures require submission of CNIC documentation confirming that the account holder is at least 21 years of age. Any account found to belong to a minor — at any stage — will be immediately suspended, and all data associated with that account will be handled in accordance with applicable child data protection obligations.

If you are a parent or guardian and believe that a minor has registered on ae999 using false information, please contact ae999 immediately at support@ae999.biz. ae999 will conduct a prompt investigation and take appropriate action, including deletion of all personal data belonging to the minor.

ae999's principal operations and data storage infrastructure are located within the jurisdiction of its operating licence. Some personal data may be processed by third-party service providers located outside Pakistan — for example, certain payment processing and fraud detection services operate from servers in other countries.

Where such international transfers occur, ae999 ensures that appropriate safeguards are in place to protect the transferred data, including contractual data transfer agreements that impose obligations on the recipient to protect the data to standards equivalent to those applied by ae999. ae999 does not transfer personal data to jurisdictions without adequate data protection frameworks without implementing such safeguards.

ae999 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, ae999's data processing activities, or other relevant circumstances. Material changes to this Policy will be communicated to registered users via email to the address registered on the account and/or via a prominent notification on the ae999 platform, at least 14 days before the changes take effect.

The current version of this Privacy Policy, including the effective date, is always available at ae999.biz/privacy-policy. Your continued use of ae999 following the effective date of any amendment constitutes acknowledgement of the updated Policy. If you do not agree with the updated Policy, you should close your ae999 account before the effective date.

For all privacy-related queries, data rights requests, and privacy complaints, please contact ae999's Privacy Team using the details below. All privacy correspondence is handled by designated personnel with specific responsibility for data protection compliance.

ae999 is committed to resolving all privacy concerns promptly and fairly. If you submit a privacy complaint and are not satisfied with ae999's response within 30 days, you may escalate the matter to the relevant data protection supervisory authority in ae999's operating jurisdiction. ae999 will cooperate fully with any such regulatory process.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previous versions.