arr999 Privacy Policy — Pakistan Data Protection & Your Rights

arr999 collects personal data in three main ways: information you provide directly when registering or using the platform, information generated automatically by your use of the platform, and in limited cases, information obtained from third parties such as payment processors.

Information you provide to arr999:

• Full legal name as it appears on your CNIC
• CNIC number and a photograph or scan of your CNIC (front and back)
• Date of birth
• Pakistan mobile phone number
• Email address (if provided during registration)
• Payment account details — your Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, or card information used for deposits and withdrawals
• Selfie photograph provided during KYC verification
• Any communications you send to arr999 support, including live chat transcripts and emails

Information generated automatically by platform use:

• Device identifiers (device model, operating system version, unique device ID)
• IP address and approximate geolocation at login and transaction times
• Browser type and version
• Session duration, pages visited, and features used within the arr999 platform
• Full betting and gaming history including all bets placed, stakes, results, and transaction records
• Login timestamps and access logs

Information from third parties:

• Transaction confirmation data from Easypaisa, JazzCash, and banking partners (to verify deposits and process withdrawals)
• Fraud screening results from payment fraud prevention services

arr999 uses your personal data only for purposes that are directly connected to providing, securing, and improving the platform. The table below summarises the main uses:

arr999 does not use your personal data for automated individual decision-making that produces significant legal effects — for example, arr999 does not use your data to automatically determine creditworthiness. Human review is involved in all significant account decisions including closures and withdrawal holds.

arr999 processes your personal data under the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfill the arr999 Terms and Conditions that you entered into at registration. This includes account creation, payment processing, and access to the arr999 platform. Without this processing, the arr999 service cannot be provided.
• Legitimate interests: Processing carried out in arr999's legitimate business interests and not overridden by your privacy interests. This includes fraud prevention, platform security, abuse detection, and improving the platform experience through anonymised analytics.
• Consent: Processing carried out only where you have given clear, freely given, specific, and informed consent. Marketing communications are the primary example — arr999 sends these only with your opt-in consent and you may withdraw consent at any time.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering obligations, tax reporting requirements, and responses to lawful requests from regulatory authorities in Pakistan.

arr999 does not sell personal data. Sharing of your data outside arr999 occurs only in the specific circumstances described below:

• Payment processors: Transaction data is shared with Easypaisa, JazzCash, NayaPay, SadaPay, IBFT processors, and Visa/Mastercard networks as necessary to execute your deposit and withdrawal requests. These parties are bound by their own privacy and security obligations under their respective regulatory frameworks.
• Fraud prevention services: Device identifiers, IP addresses, and transaction patterns may be shared with third-party fraud screening services that arr999 uses to protect the platform from fraudulent activity. Data shared with these services is subject to contractual data protection obligations.
• Regulatory and law enforcement authorities: arr999 will disclose personal data to relevant authorities in Pakistan where legally required — for example, in response to a court order, regulatory investigation, or anti-money laundering inquiry. arr999 will not disclose data beyond what is specifically required by the applicable legal obligation.
• Platform infrastructure providers: Cloud hosting and infrastructure providers who process data solely on arr999's behalf, under contractual data processing agreements that restrict their use of the data.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of arr999's business, player data may transfer to the acquiring entity. Players will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

In every case of data sharing, arr999 applies the minimum necessary principle — only the data required for the specific purpose is shared, and it is shared under contractual or legal obligations that limit its use to that purpose.

arr999 takes the security of your personal data seriously and has implemented technical and organisational measures appropriate to the risk level of the data we process. The core security measures include:

• Encryption in transit: All data transmitted between your device and arr999's servers is protected by TLS 1.3 (256-bit SSL). The arr999 platform does not function over unencrypted HTTP connections.
• Encryption at rest: Personal data stored on arr999's servers — including KYC documents, CNIC images, and transaction records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within arr999 is restricted on a strict need-to-know basis. Staff access to player data is logged, monitored, and subject to regular access reviews. KYC documents are accessible only to the dedicated verification team.
• Two-factor authentication: Available and recommended for all arr999 player accounts, and mandatory for internal staff accessing sensitive systems.
• Penetration testing: arr999 conducts regular security assessments and vulnerability testing of the platform infrastructure.
• Incident response: arr999 has a documented data breach response procedure. In the event of a breach affecting player data, affected players will be notified promptly with relevant information about what data was affected and what steps arr999 is taking.

arr999 uses cookies and similar tracking technologies on the platform. These are small data files stored on your device that help the platform function correctly, remember your preferences, and understand how the platform is used. The cookies arr999 uses fall into the following categories:

You can manage cookie preferences through your browser settings. Disabling essential cookies will affect platform functionality. On mobile devices, the arr999 app uses equivalent local storage mechanisms rather than browser cookies.

CNIC-based identity verification is required by arr999 before processing withdrawal requests. The handling of CNIC documents and related KYC data is subject to particularly careful controls given the sensitivity of this information.

• CNIC images and selfie photographs submitted for KYC are stored on dedicated, isolated storage systems that are not connected to the broader arr999 platform infrastructure.
• Access to KYC documents within arr999 is restricted to the verification team members whose role specifically requires it. Access is logged and audited monthly.
• CNIC documents submitted to arr999 are used solely for identity verification and age confirmation. They are not used for any other purpose, including marketing profiling or fraud scoring beyond your arr999 account.
• Once KYC verification is complete and approved, arr999 retains the documents for the period required by applicable anti-money laundering regulations. After this period, documents are securely deleted.
• arr999 does not share CNIC documents with third parties except where legally compelled by a court order or regulatory authority request.

arr999 is strictly an adults-only platform. The minimum age for registration and use is 18 years. arr999 does not knowingly collect personal data from any person under 18 years of age.

Where arr999 discovers that personal data has been collected from a person under 18 — whether through the registration process or through post-registration age verification — the account will be closed immediately, any deposits returned to the payment method used, and all personal data associated with the account securely deleted from arr999's systems.

Age verification via CNIC is the primary mechanism arr999 uses to confirm that all players are 18 or older. If you are a parent or guardian and believe a minor has created an arr999 account, please contact support@arr999.bet immediately with the subject line "Underage Account". arr999 will investigate and respond within 24 hours.

arr999 may send you marketing communications about platform promotions, new features, and bonus offers. Marketing communications are sent only where you have provided explicit opt-in consent during registration or through your account settings.

The types of marketing communication arr999 may send (with your consent) include:

• SMS to your registered Pakistan mobile number about active promotions and deposit bonuses
• Email to your registered address about new features, tournaments, and upcoming PSL cricket betting markets
• In-platform push notifications about offers relevant to the products you use most frequently

Withdrawing consent: You can opt out of all marketing communications from arr999 at any time through the following methods:

• Log in to arr999, go to Account Settings, and toggle off marketing preferences
• Reply STOP to any arr999 SMS message
• Click Unsubscribe in any arr999 marketing email
• Email support@arr999.bet with the subject line "Unsubscribe" from your registered email address

Withdrawal of marketing consent will take effect within 48 hours. Essential account communications — transaction confirmations, security alerts, and account notifications — are not affected by marketing opt-out and will continue to be sent as necessary for your account.

arr999 retains personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data (name, contact details, account settings): Retained for the duration of your active arr999 account relationship plus a 5-year post-closure period as required for anti-money laundering compliance.
• Transaction records (deposits, withdrawals, bets): Retained for 7 years from the transaction date, in accordance with financial record-keeping requirements.
• KYC documents (CNIC images, selfies): Retained for 5 years following account closure or the completion of the KYC process, whichever is later.
• Customer support communications (chat logs, emails): Retained for 2 years from the date of the communication.
• Session and device logs (IP addresses, login times): Retained for 12 months from creation for security and fraud prevention purposes.
• Marketing consent records: Retained for as long as your account is active and for 2 years following withdrawal of consent, as evidence of the consent history.

After the applicable retention period, personal data is either securely deleted or anonymised so that it can no longer be linked to your identity. Anonymised data may be retained indefinitely for aggregate analytics purposes.

As a player on the arr999 platform, you have the following rights in relation to your personal data. arr999 will respond to all valid requests within 30 days:

To exercise any of these rights, contact arr999 at support@arr999.bet with the subject line "Privacy Request" and include your registered mobile number for identity verification. arr999 may need to verify your identity before processing the request to protect against unauthorised access to another player's data.

arr999 may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable legal requirements. When changes are made, the "Last Updated" date at the top of this page and in the hero section will be revised.

For material changes — changes that significantly affect how arr999 processes your personal data or that reduce your privacy protections — arr999 will notify registered players via SMS or in-platform notification at least 14 days before the changes take effect. This gives you the opportunity to review the changes and, if you do not accept them, to close your account before they apply to you.

Minor updates — corrections to language, reorganisation of existing content, or additions that expand your rights — will be made without prior notice but with the "Last Updated" date revised. It is your responsibility as an arr999 player to review this policy periodically.

For any privacy-related enquiries, data requests, or concerns about how arr999 handles your personal information, you can reach us through the following channels:

• Email: support@arr999.bet — use the subject line "Privacy Request" for all privacy-related enquiries to ensure they are routed to the correct team.
• Live Chat: Available 24/7 through the arr999 platform after login. For privacy requests that require documentation, email is preferred.

arr999 aims to acknowledge all privacy-related requests within 5 working days and to respond in full within 30 days. For complex requests involving large volumes of data or requiring legal review, an extension of up to an additional 30 days may be required, and you will be informed of this.

To understand the full terms under which arr999 operates, please also read the Terms and Conditions and the Responsible Gaming page.