Privacy Policy — 9ab Betting & Casino Platform

1. Overview

9ab ("the Platform", "we", "us", "our") operates the online betting and casino platform at 9ab.onl. When you register an account, make a deposit, place a bet, play a casino or slot game, or contact our support team, you share certain personal information with us. This Privacy Policy explains what we collect, why we collect it and how we handle it responsibly.

We take data privacy seriously. The 9ab platform is built specifically for Pakistani players, and we understand that trust is earned — not assumed. We do not sell your personal data to third parties, and we do not use your information for any purpose beyond what is described in this policy.

By registering an account or using the 9ab platform, you confirm that you have read this Privacy Policy and that you consent to the collection and use of your personal data as described here. If you do not agree, please do not use the platform.

2. Personal Data We Collect

We collect personal data in three main ways: information you give us directly, information generated by your use of the platform, and information received from third-party service providers who help us operate the platform.

Information you provide directly:

• Full name (as it appears on your government-issued identity document)
• Date of birth
• Email address and/or mobile phone number
• Registered payment method details (JazzCash account number, Easypaisa number, bank account details, card details)
• Identity document details submitted during KYC verification (CNIC, passport or driving licence)
• Communications you send to our support team via live chat or email

Information generated by your platform activity:

• Login timestamps, IP address and device information
• Browser type, operating system and mobile device model
• Pages visited, features used and time spent on the platform
• Betting and gaming history — markets placed, stakes, outcomes and balances
• Deposit and withdrawal transaction records
• Session duration and frequency of visits
• In-app preferences and settings you configure

Information from third-party providers:

• Payment verification data from JazzCash, Easypaisa, Raast and bank partners
• Identity verification responses from KYC processing services
• Fraud and risk signals from anti-fraud technology providers
• Technical performance and error data from platform infrastructure providers

3. How We Use Your Personal Data

We use the personal data we hold about you for the following purposes:

We will not use your personal data for any purpose not listed above without first obtaining your explicit consent or as required by applicable law.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms and Conditions — including account management, payment processing and delivering the betting and gaming services you use.
• Legitimate interests: Processing necessary to detect and prevent fraud, maintain platform security, conduct responsible gaming monitoring and improve platform performance — where these interests are not overridden by your data protection rights.
• Legal obligation: Processing required to comply with applicable laws and regulations, including identity verification and financial record-keeping obligations.
• Consent: Processing based on your explicit consent, such as receiving promotional communications. You may withdraw consent at any time by contacting support or adjusting your account preferences.

5. Sharing Your Personal Data

9ab does not sell or rent your personal data. We share your data only in the following limited circumstances and only to the extent necessary for each purpose:

• Payment providers: JazzCash, Easypaisa, Raast, banks and card processors receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and data handling standards.
• KYC and identity verification providers: Third-party identity verification services receive your ID document data to complete the KYC process. These services are bound by confidentiality obligations.
• Game studios and content providers: Providers such as Pragmatic Play, NetEnt and PG Soft receive the minimum data required to deliver game sessions — typically a session token, not your personal identity details.
• Fraud prevention and security providers: Anti-fraud technology providers may process device signals and behavioural data to identify suspicious activity. No directly identifying personal data (such as your full name or ID) is shared for this purpose.
• Legal and regulatory authorities: We will disclose personal data to law enforcement or regulatory bodies where required to do so by applicable law, court order or other legal obligation.
• Business transfers: In the event of a merger, acquisition or sale of platform assets, your data may be transferred to the successor entity, subject to equivalent data protection standards.

6. Payments and KYC Data

Financial and identity data receives a higher level of protection within the 9ab platform. All deposits and withdrawals on 9ab are processed in PKR through the payment channels you register with your account — JazzCash, Easypaisa, Raast, bank transfer or card.

Payment method details are handled by our payment processing partners using industry-standard encryption. 9ab does not store full card numbers or full mobile wallet credentials on its own servers. Payment data is tokenised so that your payment method can be used for future transactions without us holding the raw credentials.

KYC documents — including CNIC copies, passport scans or other identity documents — are stored in an encrypted document management system with access restricted to authorised team members who require them to complete the verification process. Once verification is complete, documents are retained only for as long as required by applicable record-keeping obligations.

Withdrawals are only processed to payment methods registered in the same name as your 9ab account. This requirement protects your funds and helps prevent unauthorised access to your balance.

7. Cookies and Platform Tracking

9ab uses cookies and similar tracking technologies to keep the platform working correctly, remember your preferences, and understand how players use the platform so we can improve it. The types of cookies we use are as follows:

• Essential cookies: Required for the platform to function — including maintaining your logged-in session, remembering your preferred language settings and enabling security features. These cannot be disabled.
• Functional cookies: Remember choices you make — such as deposit limit preferences or game display settings — so you don't have to reconfigure them each visit.
• Analytics cookies: Collect anonymised data about how players navigate the platform — pages visited, features used and session duration. This data is aggregated and does not identify individual players. It helps us understand which parts of the platform work well and which need improvement.
• Security cookies: Help detect and prevent fraudulent login attempts, bot activity and other security threats by analysing device and behavioural signals.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the platform, but some features may not work as smoothly. Note that essential cookies cannot be disabled as they are required for the platform to operate.

8. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active account data: Retained for the full duration of your account being open on the platform and for a defined period after closure.
• Transaction records: Financial transaction records — including deposit and withdrawal history — are retained for a minimum period in line with standard financial record-keeping requirements.
• KYC documents: Identity documents submitted for verification are retained for the period required by applicable regulations and then securely deleted.
• Support communications: Records of your interactions with the support team are retained to enable consistent service and are reviewed periodically for deletion once no longer needed.
• Dormant accounts: If your account has had no activity for an extended period, we may contact you before taking steps to close the account in line with our dormant account policy. Data associated with a dormant account is handled in accordance with legal retention obligations.

When personal data is no longer required, it is either deleted securely or anonymised so that it can no longer be linked to you as an individual.

9. Data Security

9ab applies technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. Key security measures in place include:

• All data transmitted between your device and the 9ab platform is encrypted using TLS (Transport Layer Security).
• Account passwords are stored using industry-standard one-way hashing — meaning your plain-text password is never stored and cannot be retrieved by anyone, including our team.
• Access to personal data within the 9ab organisation is restricted to team members who need it for a specific, defined purpose. Access is logged and reviewed.
• Payment data is tokenised and processed by PCI-DSS compliant payment partners. Full card or wallet credentials are not stored on 9ab servers.
• KYC documents are stored in an encrypted system with access controls and audit logging.
• The platform is monitored continuously for unusual activity, with automated alerts and human review processes in place for potential security incidents.

While we take security seriously and work hard to protect your data, no online platform can guarantee absolute security. If you ever suspect that your 9ab account has been accessed without your knowledge, contact support immediately via live chat so we can take action promptly.

10. Your Rights Over Your Personal Data

As a 9ab account holder, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or at the email address listed in Section 13.

• Right to access: You can request a copy of the personal data we hold about you at any time. We will provide this within a reasonable timeframe.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you can ask us to correct it. For KYC-related corrections, updated documentation will be required.
• Right to erasure: You may request deletion of your personal data in certain circumstances — for example, when data is no longer required for the purpose it was collected. Note that we may be legally required to retain certain records (such as financial transaction history) for a defined period even after an account is closed.
• Right to restrict processing: In certain situations, you can ask us to limit how we use your data while a query or complaint is being resolved.
• Right to data portability: You can request that we provide your personal data in a structured, machine-readable format so that you can transfer it to another service provider if you wish.
• Right to withdraw consent: Where processing is based on your consent — for example, receiving promotional emails or SMS messages — you can withdraw that consent at any time by contacting support or adjusting your account notification settings.
• Right to object: You can object to processing based on legitimate interests where you believe your rights and interests outweigh ours. We will review each objection on its merits.

We aim to respond to all data rights requests promptly. Complex requests may take longer, and we will keep you informed of progress if that is the case.

11. Children's Privacy

The 9ab platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age. During registration, all players are required to confirm that they meet the minimum age requirement.

As part of the KYC process, we verify the date of birth provided against government-issued identity documents. Any account found to belong to a person under 18 will be immediately closed and any balance held in the account will be returned to the payment method used for deposits, following verification that the payment method belongs to a guardian or parent.

If you believe that a person under 18 has registered an account on 9ab, please contact our support team immediately so we can investigate and take appropriate action.

12. Changes to This Privacy Policy

9ab may update this Privacy Policy from time to time to reflect changes in how we operate the platform, changes in applicable law, or improvements to our data handling practices. When we make material changes, we will notify registered players via email or through a notice on the platform. The updated policy will be published on this page with a revised "Last Updated" date at the top.

We encourage you to review this policy periodically so you remain aware of how your data is being handled. Your continued use of the 9ab platform after any update has been communicated constitutes your acceptance of the revised Privacy Policy.

If you have questions or concerns about any change to this policy, please contact our support team before continuing to use the platform.

13. Contact Us

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how your personal data has been handled, please get in touch with the 9ab support team. The quickest way to reach us is through the live chat feature on the platform, which is available throughout the day.

For written correspondence, you can contact us at: [email protected]

Please include your registered account username or email address in any communication so we can locate your account and respond accurately and efficiently.

We aim to respond to all privacy-related queries within a few business days. For complex data rights requests, we will acknowledge receipt promptly and provide a fuller response as quickly as possible.