at999 Privacy Policy

1.1 Scope. This Privacy Policy applies to all personal information collected, processed, stored, and transmitted by at999 in connection with your use of the at999 online gaming platform at at999.co, including all associated subdomains, mobile interfaces, and web applications operated by at999. It applies to all registered Players and to visitors who browse the Platform without registering.

1.2 Legal Framework. at999 processes personal data in compliance with Republic Act No. 10173 (the Data Privacy Act of 2012, or "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). at999's data processing activities are also subject to applicable PAGCOR licensing conditions, which may require the collection and disclosure of certain Player data to regulatory authorities.

1.3 Relationship with Terms and Conditions. This Privacy Policy forms an integral part of the at999 Terms and Conditions. Terms not defined in this Policy carry the meanings assigned to them in the at999 Terms and Conditions, available at at999.co/terms-conditions.

2.1 Identity. The data controller responsible for personal information processed under this Privacy Policy is at999, the entity operating the at999 Platform under a valid PAGCOR license. at999 has registered a Data Protection Officer (DPO) with the National Privacy Commission in accordance with NPC Circular No. 17-01.

2.2 Data Protection Officer. Questions, requests, and complaints relating to personal data may be directed to at999's Data Protection Officer at the contact details set out in Section 16 of this Policy. The DPO is responsible for overseeing at999's compliance with the Data Privacy Act and for handling data subject requests.

at999 collects the following categories of personal data from Players and Platform visitors. The specific data collected in each category depends on your level of interaction with the Platform:

3.1 Sensitive Personal Information. at999 classifies government ID numbers and biometric data (facial images used for identity matching) as sensitive personal information under Section 3(l) of the Data Privacy Act. This data is processed solely for the purpose of identity verification and is subject to enhanced security controls.

at999 collects personal data through the following methods:

• Direct submission: Data you provide during registration, KYC verification, payment transactions, support interactions, or when completing forms on the Platform;
• Automated technical collection: Data collected automatically when you visit the Platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs gathered via server logs and cookies;
• Third-party verification services: Identity and address verification data obtained from PAGCOR-approved KYC service providers, credit reference agencies, and sanctions screening databases;
• Payment processors: Transaction confirmation data from GCash, Maya, BPI, BDO, UnionBank, Metrobank, 7-Eleven Cliqq, and other accepted payment providers;
• Regulatory sources: Data obtained from PAGCOR or AMLC in connection with player screening obligations.

at999 processes your personal data on the following legal bases, as recognised under the Data Privacy Act and applicable NPC issuances:

• Contractual necessity: Processing required to fulfil the at999 Terms and Conditions — including account management, payment processing, game access, and customer support;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Republic Act No. 9160 (Anti-Money Laundering Act), Republic Act No. 10927 (AMLA amendment covering casinos), and any lawful order from PAGCOR, AMLC, or other competent Philippine authority;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your privacy rights;
• Consent: Processing for optional marketing communications, profiling for bonus personalisation, and use of non-essential cookies — all subject to your withdrawable consent.

6.1 No Unauthorised Sale. at999 does not sell, rent, trade, or otherwise transfer your personal information to third-party marketers or data brokers. Your data is not a commercial product. Sharing occurs only in the limited circumstances described below.

6.2 Regulatory Authorities. at999 is required by law to share Player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other competent Philippine government agencies upon lawful request or as required by its licensing conditions. These disclosures are mandatory and do not require your additional consent.

6.3 Service Providers. at999 engages third-party service providers to assist with platform operations, including KYC verification providers, payment processors, IT infrastructure providers, and customer support platforms. All service providers are subject to written data processing agreements that prohibit use of your data beyond the specific purpose for which it was shared, and require security standards equivalent to those maintained by at999.

6.4 Game Providers. Where technically necessary for game delivery, limited technical data (such as session tokens and wallet balance references) may be shared with at999's licensed game software providers. No personally identifiable information beyond what is technically required is shared with game providers.

6.5 Business Transfers. In the event of a corporate restructuring, merger, acquisition, or sale of at999's business or assets, your personal data may be transferred to the acquiring entity, subject to their assumption of the data privacy obligations set out in this Policy and any applicable NPC notification requirements.

7.1 Primary Processing Location. at999's primary data processing infrastructure is located in the Philippines or in jurisdictions that the NPC has recognised as providing an adequate level of data protection equivalent to that under the Data Privacy Act.

7.2 Transfer Safeguards. Where at999 transfers personal data to processors or sub-processors located outside the Philippines — for example, cloud infrastructure providers or internationally-based game software partners — such transfers are governed by data transfer agreements incorporating the standard contractual clauses approved by the NPC, or are made pursuant to your explicit consent where required.

7.3 Player Notification. at999 will notify you of any material change in the countries or regions where your personal data is processed, where such change involves jurisdictions not previously covered by this Policy, giving you the opportunity to object where you have that right under applicable law.

8.1 Retention Principle. at999 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and PAGCOR licensing conditions. When data is no longer required, it is securely deleted or anonymised in accordance with at999's internal data lifecycle management procedures.

8.2 Specific Retention Periods.

• Account and KYC data: Retained for the duration of your active account plus five (5) years following account closure, as required by Republic Act No. 9160 as amended;
• Transaction records: Retained for five (5) years from the date of each transaction, in compliance with PAGCOR and AMLC record-keeping requirements;
• Gaming and wagering history: Retained for three (3) years following the end of the relevant gaming session;
• Customer support records: Retained for two (2) years from the date of the last interaction;
• Marketing consent records: Retained until consent is withdrawn, and for one (1) year thereafter as evidence of consent;
• Technical/log data: Retained for ninety (90) days for security and fraud investigation purposes.

8.3 Regulatory Override. Where applicable Philippine law or a lawful PAGCOR direction requires retention beyond the periods stated above, at999 will comply with that requirement. Players will be notified of extended retention periods where required by law.

9.1 Technical Safeguards. at999 implements the following technical security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• AES-256 encryption for personal data at rest;
• TLS 1.3 (256-bit SSL) encryption for data in transit between your device and at999 servers;
• Multi-factor authentication requirements for all at999 administrative system access;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Automated intrusion detection and prevention systems;
• Regular penetration testing and vulnerability assessments by independent security professionals;
• KYC document storage in isolated, air-gapped environments with dedicated access logging.

9.2 Organisational Safeguards. at999 maintains internal data privacy and security policies, conducts regular staff training on data protection obligations, and operates a formal incident response programme. All employees and contractors with access to personal data are subject to confidentiality obligations.

9.3 Player Responsibilities. The security of your at999 account also depends on your own precautions. You are responsible for keeping your login credentials confidential, using a strong and unique password, enabling two-factor authentication (2FA), and promptly notifying at999 of any suspected unauthorised access to your account.

Under Republic Act No. 10173 (Data Privacy Act of 2012), Filipino players have the following rights with respect to their personal data held by at999. You may exercise any of these rights by contacting at999's Data Protection Officer using the details in Section 16:

11.1 Types of Cookies Used. The at999 Platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Required for the Platform to function, including session authentication cookies, load balancing cookies, and security tokens. These cannot be disabled without breaking Platform functionality;
• Functional Cookies: Cookies that remember your preferences, language settings, and login status to enhance your experience on the at999 Platform;
• Performance / Analytics Cookies: Cookies that collect anonymised data about how Players use the Platform — pages visited, session duration, error rates — to help at999 improve its service;
• Session Identification Cookies: Cookies used to maintain your authenticated game session and wallet state during active gameplay.

11.2 No Third-Party Advertising Cookies. at999 does not deploy third-party advertising network cookies or behavioural tracking pixels for purposes of cross-site advertising profiling. Analytics conducted by at999 are for internal platform improvement only.

11.3 Cookie Management. You may configure your browser to block or delete cookies at any time. Note that blocking strictly necessary cookies will impair Platform functionality, including your ability to log in and maintain an active gaming session. For all other cookie categories, at999 will respect your browser-level and on-Platform preferences.

12.1 Strict Age Restriction. at999 does not knowingly collect personal data from persons under 21 years of age. The at999 Platform is strictly restricted to adults aged 21 and above in compliance with PAGCOR regulations. Age verification is a mandatory component of the at999 KYC process.

12.2 Discovery of Underage Registration. If at999 discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age, it will immediately: (a) suspend the account; (b) delete or anonymise the personal data to the extent permitted by law; (c) return any deposited funds to the originating payment source; and (d) notify the relevant regulatory authority if required.

12.3 Parental Guidance. at999 strongly advises parents and guardians who share devices or internet access with persons under 21 to use parental control software and to ensure that at999 login credentials are not accessible to minors. at999 bears no liability for underage access arising from an adult's failure to secure their account credentials.

13.1 Consent-Based Marketing. at999 will only send direct marketing communications — including promotional SMS, email newsletters, and bonus notifications — to Players who have given explicit consent during registration or through their Account settings. Marketing communications are never sent to Players who have not opted in.

13.2 Withdrawal of Consent. You may withdraw your consent to receive marketing communications at any time by: (a) updating your communication preferences in your at999 Account settings; or (b) clicking the unsubscribe link in any at999 marketing email; or (c) contacting the DPO at the details in Section 16. Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before withdrawal.

13.3 Responsible Gaming Communications. Notwithstanding your marketing preferences, at999 reserves the right to send you non-commercial communications relating to responsible gaming, account security, mandatory KYC requests, and material changes to Terms or this Privacy Policy. These communications are sent on the basis of legal obligation or legitimate interest and are not subject to marketing opt-out controls.

13.4 No Marketing to Self-Excluded Players. Players who have activated self-exclusion will be removed from all marketing distribution lists for the duration of their self-exclusion period. at999 makes all reasonable efforts to suppress marketing to self-excluded Players across all channels.

14.1 Governing Law. This Privacy Policy and all data processing activities of at999 are governed by Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances and advisories of the National Privacy Commission of the Philippines.

14.2 Principles of Processing. at999 adheres to the following data processing principles mandated by the Data Privacy Act:

• Transparency: Players are informed of the nature, purpose, and extent of data collection prior to or at the time of collection;
• Legitimate Purpose: Personal data is processed for a declared, specified, and legitimate purpose only;
• Proportionality: Only data adequate, relevant, and not excessive for the declared purpose is collected and retained.

14.3 NPC Complaints. Filipino players have the right to lodge a complaint with the National Privacy Commission if they believe their data privacy rights have been violated. at999 will cooperate fully with any NPC investigation.

15.1 Right to Update. at999 reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, legal obligations, PAGCOR requirements, or NPC guidance. The "Last Updated" date at the top of this Policy will be revised accordingly.

15.2 Notification of Material Changes. Where changes to this Privacy Policy are material — meaning they significantly affect how your data is used or your rights under this Policy — at999 will notify registered Players by email to their registered address and/or by a prominent notice on the Platform, with at least seven (7) days' advance notice before the changes take effect.

15.3 Continued Use as Acceptance. Your continued use of the at999 Platform after the effective date of any Policy update constitutes your acknowledgement of and agreement to the updated Privacy Policy. If you do not agree with material changes, you may close your account in accordance with the at999 Terms and Conditions.

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact at999's designated Data Protection Officer. The DPO will acknowledge all privacy-related inquiries within five (5) business days.

For formal complaints under the Data Privacy Act that remain unresolved after engaging the at999 DPO, you may escalate your complaint to the National Privacy Commission through its official channels. at999 will cooperate fully with any NPC inquiry or investigation arising from a player complaint.