arr999 Privacy Policy

Welcome to arr999 — Pakistan's premier licensed online casino and sports betting platform. arr999 is committed to protecting the privacy and personal data of every player who registers on and uses the arr999 platform. This Privacy Policy sets out a transparent, detailed account of how arr999 collects, processes, stores, shares, and protects your personal information in connection with your use of arr999.org and all associated services.

This policy applies to all registered arr999 players and website visitors, regardless of location — including players accessing arr999 from Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, Multan, Peshawar, and all other cities across Pakistan. By accessing arr999.org or completing the arr999 registration process, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

This Privacy Policy should be read alongside the arr999 Terms & Conditions and the arr999 Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the arr999 platform.

For the purposes of this Privacy Policy, arr999 acts as the data controller in respect of all personal data collected from players and visitors through arr999.org. As data controller, arr999 is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out lawfully, fairly, and transparently.

arr999 is operated under an international gaming license. The platform is governed by the regulatory framework associated with that license, which includes data protection obligations that align with internationally recognised privacy standards, including principles comparable to those established under the General Data Protection Regulation (GDPR).

If you have any questions about how arr999 handles your personal data, or if you wish to exercise any of your data rights described in this policy, please contact the arr999 Data Privacy team via the details provided in Section 14 of this document.

arr999 collects and processes the following categories of personal data from registered players and platform visitors:

arr999 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data except where expressly required for responsible gaming self-exclusion compliance or as required by our licensing obligations.

arr999 collects personal data through the following means:

• Direct Submission: Data you provide voluntarily when completing the arr999 registration form, submitting identity documents for KYC verification, making deposit or withdrawal requests, or contacting arr999 support via live chat or email.
• Automated Technical Collection: Data collected automatically when you access arr999.org, including IP address, device identifiers, browser type, and session activity logs. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 09.
• Payment Processor Data: When you transact via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, or USDT TRC20, arr999 receives transaction confirmation data (reference numbers, amounts, timestamps) from the respective payment processor. arr999 does not store full payment credentials — these remain with the respective payment service provider.
• Third-Party Verification Providers: Where arr999 uses licensed identity verification or anti-money laundering service providers to conduct KYC checks, those providers may supply additional verification data (e.g., document authenticity results) to arr999 in connection with your account.
• Public Sources: In limited circumstances, arr999 may supplement identity verification with information from publicly available records or credit reference databases as permitted under its licensing obligations.

arr999 processes your personal data only where a lawful basis exists under applicable data protection principles. The following table summarises the key processing activities, their purposes, and the corresponding legal basis:

arr999 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Personal data is disclosed only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT TRC20 processors receive only the transaction data necessary to process your deposit or withdrawal. These processors are contractually bound by their own data protection obligations.
• Identity Verification Providers: Licensed KYC and AML service providers who assist arr999 in verifying player identities and conducting source-of-funds checks as required under our gaming license. These providers operate under strict data processing agreements with arr999.
• Game Software Providers: Where necessary for the delivery of specific casino games (live baccarat, slots, live dealer tables), limited session data may be shared with licensed game providers. No financial or identity data is shared with game providers.
• Regulatory Authorities: arr999 may be required to disclose player data to the regulatory body overseeing its international gaming license, law enforcement agencies, or financial intelligence units where required by law or as part of its AML reporting obligations.
• Fraud Prevention Services: arr999 may share data with licensed fraud prevention and responsible gaming databases where required to prevent multi-accounting, detect prohibited conduct, or fulfil self-exclusion obligations.
• Professional Advisors: Lawyers, auditors, and compliance consultants who are subject to professional confidentiality obligations and who assist arr999 in meeting its legal and regulatory responsibilities.

In all cases where data is shared with third parties, arr999 implements contractual data protection safeguards consistent with internationally recognised standards. arr999 remains responsible for ensuring that third-party processors handle your data in a manner consistent with this Privacy Policy.

arr999 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of the player's registered account with arr999, plus a minimum of five (5) years following voluntary account closure, in compliance with anti-money laundering record-keeping requirements under arr999's international gaming license.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later, as required by AML compliance obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, consistent with financial record-keeping requirements.
• Terminated Accounts (for cause): Where an arr999 account is terminated due to fraud, prohibited conduct, or AML concerns, relevant data may be retained for up to ten (10) years to support potential legal proceedings or regulatory investigations.
• Marketing Consent Records: Retained for the duration of the active account plus one (1) year following opt-out, as evidence of consent and withdrawal.
• Technical & Log Data: Server logs and session data are retained for a maximum of thirteen (13) months from the date of collection, after which they are anonymised or deleted.

At the expiry of the applicable retention period, arr999 securely deletes or irreversibly anonymises your personal data in accordance with its internal data disposal procedures.

arr999 takes the security of your personal data seriously. The following technical and organisational security measures are in place across the arr999 platform to protect player data against unauthorised access, loss, destruction, or disclosure:

• TLS Encryption: All data in transit between your browser or device and arr999.org is encrypted using Transport Layer Security (TLS 1.2 or higher). This includes your login credentials, payment instructions, and any personal data submitted via the arr999 interface.
• Data Encryption at Rest: Sensitive data stored on arr999 servers — including CNIC details, identity document images, and financial data — is encrypted at rest using industry-standard symmetric encryption.
• Two-Factor Authentication (2FA): arr999 offers SMS-based two-factor authentication for all registered accounts and strongly recommends all Pakistani players enable this feature to add a second layer of protection to their arr999 login.
• Access Controls: Access to arr999 player data is restricted on a strict need-to-know basis. Only authorised arr999 personnel with a defined business need may access personal data, and all such access is logged and audited.
• Penetration Testing & Security Audits: arr999's platform infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All arr999 employees and contractors who handle personal data receive mandatory data protection and security awareness training as part of onboarding and on an ongoing basis.

arr999 uses cookies and similar tracking technologies on arr999.org to ensure the platform functions correctly, to maintain your authenticated session, and to collect anonymised analytics data that helps arr999 improve the player experience for Pakistani users.

The following categories of cookies are used on arr999.org:

• Strictly Necessary Cookies: These cookies are essential for arr999.org to function. They manage your authenticated login session, maintain your PKR account currency settings, and remember your responsible gaming preferences. These cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how visitors use arr999.org — including which pages are visited most frequently and how players navigate between the casino lobby, sportsbook, and arr999 Login portal. This data is used solely to improve platform performance and is not linked to individual identities.
• Functional Cookies: These cookies remember your preferences, such as your preferred language, display settings, and notification choices, to provide a more personalised experience on the arr999 platform.

arr999 does not use third-party advertising cookies or behavioural targeting cookies. No cookie data collected on arr999.org is shared with advertising networks or social media platforms for the purpose of serving targeted advertisements to arr999 players.

You can manage and delete cookies via your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in to and use the arr999 platform. For guidance on managing cookies in your specific browser, consult your browser's help documentation.

arr999 recognises the following personal data rights for all registered players. These rights can be exercised by contacting the arr999 support team via live chat or email as described in Section 14:

• Right of Access: You have the right to request a copy of the personal data arr999 holds about you. arr999 will provide a summary of your data within 30 days of a verified access request.
• Right to Rectification: If you believe any personal data arr999 holds about you is inaccurate or incomplete, you have the right to request correction. Most contact data corrections can be made directly within your arr999 account settings following re-verification.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where arr999 no longer has a lawful basis for retaining it. Note that arr999 cannot delete data that is subject to mandatory legal retention obligations (e.g., AML record-keeping requirements) — these override erasure requests for the applicable retention period.
• Right to Restrict Processing: You may request that arr999 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on arr999's legitimate interests, including profiling for fraud detection purposes. arr999 will cease such processing unless compelling legitimate grounds exist that override your interests.
• Right to Withdraw Consent: Where arr999 processes your data based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

arr999 operates a strict 21+ age policy across all products and services. The arr999 platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. Age verification is a mandatory part of the arr999 registration and KYC process, and all players are required to confirm they are 21 years of age or older before their account is fully activated.

If arr999 discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, arr999 will:

• Immediately suspend the relevant account pending investigation.
• Delete all personal data associated with the underage account to the extent permitted by law and our licensing obligations.
• Void all balances, bonuses, and winnings associated with the account in line with arr999's underage gambling policy.
• Report the incident to the relevant regulatory authority as required under arr999's international gaming license.

Parents and guardians in Pakistan who are concerned that a minor may have accessed arr999.org are encouraged to use parental control software and to contact arr999 support immediately via live chat so that the account can be investigated and closed without delay.

As an internationally licensed online gaming operator, arr999 may process and store personal data on servers located outside of Pakistan. Where personal data is transferred internationally — for example, to data centres or licensed service providers in other jurisdictions — arr999 ensures that appropriate safeguards are in place to protect your data to a standard consistent with this Privacy Policy and with internationally recognised data protection principles.

Such safeguards may include:

• Contractual data processing agreements with all international processors and sub-processors that impose data protection obligations equivalent to those applicable to arr999 under its licensing framework.
• Transfers only to jurisdictions or service providers that maintain adequate data protection standards as assessed by arr999's compliance team.
• Encryption of personal data both in transit (TLS) and at rest during any international transfer or storage.

By registering an arr999 account and accepting this Privacy Policy, you acknowledge and consent to the international transfer of your personal data as described in this section, subject always to the safeguards described above.

arr999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or platform operations. When material changes are made to this policy, arr999 will update the "Last Updated" date at the top of this page and, where the changes are significant, will notify registered players via email or an in-platform notification.

Your continued use of the arr999 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Privacy Policy, you should cease using arr999.org and may request account closure via the arr999 support team.

arr999 encourages all players to review this Privacy Policy periodically to stay informed about how arr999 protects and handles personal data. The current version of the Privacy Policy is always available at arr999.org/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data arr999 holds about you, please contact the arr999 Data Privacy team through the following channels:

• Live Chat: Available 24/7 via the chat widget on arr999.org. This is the fastest way to reach the arr999 team for privacy-related queries. Support agents are available around the clock, including during PSL match nights and Pakistani public holidays.
• Email: [email protected] — for formal data rights requests, privacy complaints, or written correspondence. Please include your registered arr999 username and a clear description of your request so the team can assist you efficiently.

arr999 is committed to resolving all privacy-related queries promptly and transparently. Formal data rights requests will receive an acknowledgment within 48 hours and a substantive response within 30 days.