arr999 Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, including name, email address, mobile number, CNIC number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, combination, restriction, erasure, or destruction.
• "Data Controller" means arr999, the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Data Processor" means a third party that processes Personal Data on behalf of arr999 under a data processing agreement, such as payment gateway operators and fraud detection service providers.
• "KYC Data" means identity verification documents and associated personal information provided by Players for Know Your Customer compliance purposes, including CNIC copies, passport scans, and proof of payment method ownership.
• "Player" / "You" means any individual who registers an account on arr999.one or accesses the arr999 gaming platform as a visitor or registered member.
• "Sensitive Personal Data" means personal data requiring a higher level of protection, including financial account details, identity document numbers, and responsible gaming self-declaration information.

arr999 operates as the Data Controller with respect to Personal Data collected through the arr999.one platform. As Data Controller, arr999 determines the purposes for which your Personal Data is processed and the means by which such processing takes place.

arr999 operates under an international gaming licence and complies with the data protection requirements imposed by its regulatory framework. Where arr999 engages third-party Data Processors — including payment technology providers, fraud prevention services, and KYC verification platforms — appropriate data processing agreements are in place to ensure your data is handled lawfully.

arr999 collects the following categories of Personal Data in connection with your use of the platform:

arr999 does not collect data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (other than identity verification selfies required for KYC), or health data, except where voluntarily disclosed in responsible gaming self-assessment contexts.

arr999 collects Personal Data through the following channels and mechanisms:

• Direct Provision: Information you actively submit during account registration, KYC verification, deposit and withdrawal transactions, customer support interactions, and responsible gaming tool configuration.
• Automated Technical Collection: IP addresses, device identifiers, session tokens, and browser data are collected automatically when you access the arr999 platform, whether logged in or as a visitor. This data is collected via server logs and, where applicable, cookies and local storage technologies.
• Payment Processor Data: When you transact via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, relevant transaction reference data is passed to arr999 by the payment processor to enable deposit crediting and withdrawal processing. arr999 receives only the data necessary for payment reconciliation — full payment credentials are handled by the payment processor, not stored by arr999.
• Gaming Platform Data: Game server systems automatically record gaming activity data, including bets placed, game outcomes, session timestamps, and stake amounts, for every gaming session conducted on arr999.
• Third-Party Verification Services: Where arr999 uses third-party KYC and identity verification service providers, those providers may return identity match scores, document authenticity assessments, and age verification results to arr999 as part of the verification process.

arr999 processes your Personal Data only where a lawful basis for doing so exists. The following table summarises our primary processing purposes and the corresponding legal basis for each:

arr999 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. Your data may be shared with the following categories of recipients only where strictly necessary for the stated purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction-specific data necessary to process your deposits and withdrawals. These entities act as independent data controllers with respect to their own payment processing operations and are governed by their own privacy policies.
• KYC & Identity Verification Providers: Third-party identity verification services may receive your KYC documentation and biometric data for the purpose of age and identity verification. These providers are contractually restricted from using your data for any purpose other than the verification service provided to arr999.
• Fraud Prevention & AML Services: Anti-fraud and anti-money laundering screening providers may receive transactional and behavioural data to enable automated risk scoring and suspicious activity detection. Data shared for this purpose is processed under legitimate interests and legal obligation bases.
• Game Technology Providers: Third-party game studios and platform software providers may receive game session data — including stake amounts and game outcomes — for the purpose of game result verification and RNG audit purposes. These providers do not receive personally identifiable information beyond what is strictly required for this function.
• Regulatory & Law Enforcement Authorities: arr999 will disclose Personal Data to regulatory bodies, law enforcement agencies, and judicial authorities where required to do so by applicable law, court order, or regulatory directive. Such disclosures are made in strict compliance with applicable legal procedures.
• Professional Advisers: Legal advisers, auditors, and compliance consultants acting under professional confidentiality obligations may access Personal Data where necessary for arr999 to obtain professional advice or conduct internal investigations.

Given that arr999 serves Pakistani players via PKR-denominated wallet infrastructure, particular care is applied to the handling of financial Personal Data. The following principles govern arr999's treatment of payment-related information:

• arr999 does not store complete JazzCash PIN codes, EasyPaisa PINs, or full banking credentials on its own servers. Payment credentials are handled directly by the respective payment processor's secure infrastructure.
• arr999 stores transaction reference numbers, amounts in PKR, timestamps, payment method type (e.g., JazzCash, EasyPaisa, HBL), and transaction status for account reconciliation, regulatory reporting, and dispute resolution purposes.
• Financial transaction records are stored in encrypted form and access is restricted to authorised arr999 financial operations and compliance personnel on a need-to-know basis.
• Where KYC verification requires confirmation of payment method ownership — for example, a JazzCash account registered in the player's name — the relevant documentation is stored in an encrypted KYC document repository with access strictly limited to KYC compliance staff.
• All payment data transmissions between the player's device and arr999 servers, and between arr999 servers and payment processor infrastructure, are encrypted using TLS 1.2 or higher.

arr999 implements a layered data security architecture designed to protect your Personal Data against unauthorised access, accidental loss, unlawful destruction, and disclosure. Our technical and organisational security measures include:

• Encryption at Rest: Personal Data and financial records stored in arr999 databases are encrypted using AES-256 encryption. Password data is stored exclusively as salted bcrypt hashes and is never stored in recoverable plain-text form.
• Encryption in Transit: All data transmissions between user devices and arr999 servers are protected by TLS 1.2+ (Transport Layer Security). HTTPS is enforced across all arr999 platform interfaces.
• Access Controls: Access to Personal Data held in arr999 systems is restricted to authorised personnel on a role-based, need-to-know basis. Administrative access to production systems requires multi-factor authentication.
• Intrusion Detection: arr999 operates continuous network monitoring and intrusion detection systems designed to identify and respond to unauthorised access attempts in real time.
• Penetration Testing: arr999 commissions periodic independent penetration testing of its platform infrastructure to identify and remediate security vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed personal data breach, arr999 will take immediate containment action, conduct a root cause analysis, notify affected players in a timely manner, and report to applicable regulatory authorities in accordance with applicable legal obligations.

arr999 retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by applicable regulatory obligations. The following retention periods apply to the principal categories of Personal Data held by arr999:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with arr999's data disposal procedures. Anonymised data — from which it is not reasonably possible to re-identify any individual — may be retained indefinitely for statistical and analytical purposes.

As a registered arr999 player, you hold the following rights with respect to your Personal Data. These rights are exercisable by contacting arr999 support via live chat or by email, with identity verification required before processing requests affecting sensitive Personal Data:

arr999 will respond to valid data rights requests within 30 calendar days of receipt and identity verification. Where a request is complex or numerous, this period may be extended by a further 60 days with notification to the requesting player. arr999 does not charge fees for standard data rights requests.

arr999 uses cookies and similar client-side storage technologies to enable platform functionality, maintain login sessions, support responsible gaming monitoring, and analyse platform performance. The following categories of cookies are used on arr999.one:

• Strictly Necessary Cookies: Required for core platform functionality including maintaining your authenticated session, remembering your currency and language preferences, and enabling the gaming platform to operate. These cookies cannot be disabled without disrupting platform use.
• Functional Cookies: Enable enhanced platform features such as remembering your responsible gaming limit settings between sessions, storing your game lobby filter preferences, and pre-populating returning player login fields.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the arr999 platform, enabling arr999 to identify usability improvements, performance bottlenecks, and popular game categories. Analytics data does not identify individual players.
• Fraud Prevention Cookies: Used to generate and maintain a session fingerprint for fraud and bot detection purposes. These cookies support arr999's security and responsible gaming obligations.

arr999 does not use third-party advertising cookies or behavioural tracking cookies for the purpose of serving advertisements on behalf of third-party commercial entities. You may manage cookie preferences through your browser settings, noting that disabling strictly necessary cookies will impair your ability to use the arr999 platform. Your continued use of the platform following acceptance of this Policy constitutes your acknowledgement of arr999's cookie use as described herein.

arr999 maintains an absolute prohibition on account registration by individuals under the age of 21. arr999 does not knowingly collect Personal Data from persons under 21 years of age. This Policy and the arr999 Terms and Conditions collectively enforce this age restriction through mandatory age verification during the KYC process.

• If arr999 discovers or has reasonable grounds to believe that Personal Data from a person under the age of 21 has been collected — whether through falsified registration information or any other means — arr999 will immediately suspend the account, delete all associated Personal Data to the extent permissible by regulatory requirements, and handle any account balance in accordance with applicable regulatory procedures.
• Parents or legal guardians who believe that a minor may have registered an arr999 account should contact arr999 support immediately via live chat. arr999 will treat such reports with the highest priority and respond within 24 hours.

As an internationally operated gaming platform serving Pakistani players, arr999 may transfer your Personal Data to servers, data processors, or service providers located in jurisdictions outside of Pakistan. Such transfers may occur in connection with KYC verification services, fraud prevention infrastructure, game platform technology, and cloud-based storage systems.

• Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to internationally recognised standards, arr999 implements appropriate safeguards — including contractual data protection clauses — to ensure your data remains protected during and after the transfer.
• Payment data relating to JazzCash and EasyPaisa transactions is processed primarily within Pakistan's domestic payment infrastructure, consistent with the regulatory requirements of those payment service providers.
• Banking transaction data relating to HBL, UBL, and Meezan Bank withdrawals is processed in accordance with the data handling practices of those regulated Pakistani financial institutions.

arr999 may send promotional and marketing communications — including information about new game launches, bonus offers, PSL cricket betting markets, and seasonal promotions — to Players who have opted in to receive such communications during registration or subsequently through account settings.

• Marketing communications from arr999 are sent by email and, where you have provided a Pakistani mobile number and opted in, by SMS. arr999 does not send unsolicited marketing communications to Players who have not provided consent.
• You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, by updating your communication preferences in your arr999 account settings, or by contacting customer support.
• Opt-out requests from marketing communications will be processed within 5 business days. Opting out of marketing does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are sent on a contract performance basis and cannot be disabled.
• arr999 does not share your contact details with third-party marketing entities for the purpose of sending you unsolicited commercial communications.

arr999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or platform functionality. The effective date of the current version is displayed at the top of this Policy and in the hero section of this page.

• Where amendments to this Policy are material — meaning they affect how your Personal Data is collected, used, shared, or retained in ways that are less protective of your privacy rights — arr999 will notify registered Players by email to the address associated with their account at least 14 days before the amended Policy takes effect.
• Your continued use of the arr999 platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.
• If you do not agree with any amendment, you may close your arr999 account before the effective date by contacting support. Account closure under these circumstances will be processed without penalty, subject to completion of any pending withdrawal and KYC requirements.

For all privacy-related enquiries, data rights requests, complaints regarding data processing, or questions about this Privacy Policy, please contact arr999 through the following channels:

• Live Chat: The arr999 live chat facility is available 24 hours a day, 7 days a week. Live chat agents can handle general privacy enquiries and initiate formal data rights request workflows on your behalf. Bilingual support in English and Urdu is available.
• Email: support arr999.one (plain text — not a clickable link). Please use the subject line "Privacy Enquiry" or "Data Rights Request" to ensure your message is directed to arr999's data protection team. Response target: within 24 hours for standard enquiries; within 30 days for formal data rights requests.
• FAQ: Common questions about arr999 account management, including data handling questions, are addressed in the arr999 FAQ section.

arr999 is committed to responding substantively to all legitimate privacy enquiries. Where a complaint regarding data processing is not resolved to your satisfaction through arr999's internal process, you have the right to escalate your complaint to the data protection supervisory authority or regulatory body governing arr999's operating jurisdiction.