ar99 Privacy Policy

ar99 (operating at ar99.asia) is the data controller responsible for the personal information collected through and in connection with the ar99 platform. ar99 determines the purposes and means of processing your personal data as described in this Privacy Policy.

This policy applies to all individuals who visit ar99.asia, register an Account, or otherwise interact with any ar99 service. By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not consent to these practices, you should not use the ar99 platform.

For any data-related queries, including requests to exercise your rights as a data subject, the ar99 data protection contact is reachable via the support email or live chat as detailed in Section 14 of this policy.

ar99 collects personal data through your registration, your use of Platform features, and your interactions with ar99 support. The categories of data we collect include:

2.1 Registration Data

• Full name as it appears on your CNIC
• Date of birth
• Pakistani mobile number (used as primary account identifier)
• Username chosen at registration
• City of residence (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad)

2.2 Identity Verification (KYC) Data

• Copies of CNIC (front and back)
• Proof of payment method ownership (e.g., screenshot of JazzCash or Easypaisa account in your name)
• Additional documentation as may be requested by the ar99 compliance team in accordance with AML obligations

2.3 Financial Transaction Data

• Deposit and withdrawal amounts and timestamps
• Payment method identifiers (e.g., masked JazzCash mobile number, masked bank account number)
• Transaction reference numbers

2.4 Gaming Activity Data

• Game session logs including game title, stake amounts, outcome, and session duration
• Sports betting history including markets, selections, odds, and settlement outcomes
• Bonus claims and wagering progress records

2.5 Technical & Device Data

• IP address at time of login and transaction
• Device type, operating system, and browser information
• Session cookies and authentication tokens
• Geolocation data at account level (country/city, not precise GPS coordinates)

2.6 Communication Data

• Content of live chat support conversations
• Email correspondence with ar99 support
• Responses to any player surveys or feedback requests

ar99 processes your personal data for the following purposes:

• Account creation and management: To register your Account, verify your identity and age, manage your PKR Wallet, and administer your VIP tier status.
• Service delivery: To process deposits and withdrawals, settle bets and game results, award bonuses, and provide 24/7 customer support.
• Legal and regulatory compliance: To perform KYC checks, meet anti-money laundering (AML) obligations, respond to lawful regulatory enquiries, and maintain records as required by applicable law.
• Fraud prevention and security: To detect and prevent fraudulent activity, duplicate accounts, bonus abuse, and unauthorised account access. IP logging and device fingerprinting are used for this purpose.
• Responsible gaming: To monitor player activity patterns for indicators of problem gambling and to facilitate the activation of player-requested deposit limits, loss limits, and self-exclusion periods.
• Platform improvement: To analyse aggregate, anonymised usage data in order to improve Platform performance, game selection, and the user experience for Pakistani players.
• Direct communications: To send transactional SMS notifications (deposit confirmations, withdrawal notifications, OTP codes) and, where you have consented, promotional messages regarding new games, bonuses, and PSL cricket betting features.

ar99 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the services you have contracted for when registering an ar99 Account, including account management, payment processing, and bet settlement.
• Legal obligation: Processing required to comply with applicable AML regulations, age verification obligations, and lawful regulatory requests.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregate analytics where such interests are not overridden by your privacy rights.
• Consent: Processing for optional promotional communications, where you have provided explicit consent at registration or through your Account communication preferences. You may withdraw this consent at any time by contacting ar99 support.

ar99 does not sell, rent, or trade your personal data. ar99 may share your data with third parties only in the following circumstances:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa, Mastercard, USDT TRC20 processors, Skrill, and Neteller receive only the data necessary to process your specific transaction. These processors are bound by their own data protection obligations.
• Game software providers: Licensed game studios including JILI, PG Soft, Pragmatic Play, and WM Live receive anonymised session identifiers necessary for game state management. No personally identifiable registration data is shared with game providers.
• KYC and identity verification services: Third-party identity verification providers may receive CNIC data for the purpose of automated document verification, subject to their own confidentiality obligations.
• Regulatory and law enforcement authorities: ar99 will disclose personal data to law enforcement, regulatory bodies, or financial intelligence units where required by applicable law or a valid legal order. ar99 will not notify a user of such a disclosure where to do so would be unlawful.
• Professional advisers: Legal counsel, auditors, and compliance consultants may access personal data under confidentiality obligations as necessary for the provision of professional services to ar99.

In all cases, data shared with third parties is limited to the minimum necessary for the stated purpose.

ar99 maintains KYC and AML compliance procedures that require the collection and retention of identity and transaction documentation. CNIC copies and supporting identity documents are stored in an access-controlled secure environment and are accessible only to authorised ar99 compliance personnel.

AML transaction monitoring is conducted on all deposit and withdrawal activity. Where a transaction triggers an internal AML alert, the relevant transaction and account data will be reviewed by the ar99 compliance team. Where required by applicable law, suspicious activity will be reported to the relevant financial intelligence authority. Players subject to AML investigation may have their withdrawal processing suspended pending completion of the review.

KYC and AML records are retained for the minimum period required by applicable law from the date of Account closure or the date of the last relevant transaction, whichever is later.

ar99 uses the following categories of cookies on the Platform:

• Strictly necessary cookies: Required for the Platform to function, including session authentication tokens and security cookies. These cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your Platform preferences such as language settings and display options across sessions.
• Analytics cookies: Collect anonymised, aggregate information about how players navigate the Platform — page visit counts, session durations, and feature usage — to help ar99 improve the platform experience. No personally identifiable information is included in analytics data.

ar99 does not use third-party advertising or retargeting cookies. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair Platform functionality including the ar99 login process.

ar99 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and ar99 servers.
• Encryption of sensitive stored data including passwords (hashed using industry-standard algorithms) and payment identifiers.
• Two-factor authentication (2FA) available for all Accounts, delivering OTP verification via registered Pakistani mobile number.
• Role-based access controls limiting employee access to personal data to that which is necessary for their specific function.
• Regular internal security reviews and vulnerability assessments.
• Audit logging of all access to sensitive personal data.

While ar99 takes all reasonable precautions, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights or freedoms, ar99 will notify affected players without undue delay and in accordance with applicable regulatory obligations.

ar99 retains personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law:

• Active Account data: Retained for the duration of your Account plus a post-closure period as required by AML regulations.
• KYC documents: Retained for the minimum period specified by applicable anti-money laundering law from the date of the last relevant transaction or Account closure.
• Transaction records: Financial transaction records are retained for a minimum of five years from the date of the transaction in accordance with standard financial record-keeping obligations.
• Support communications: Live chat and email correspondence is retained for a period of three years for quality assurance and dispute resolution purposes.
• Marketing consent records: Records of your consent to or withdrawal from promotional communications are retained indefinitely to demonstrate compliance.

When data is no longer required and no legal retention obligation applies, ar99 will securely delete or anonymise it.

Subject to applicable law, you have the following rights in respect of your personal data held by ar99:

• Right of access: You may request a copy of the personal data ar99 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where ar99 no longer has a legitimate basis for retaining it, subject to our legal retention obligations.
• Right to restriction: You may request that ar99 restricts processing of your data in certain circumstances, for example while a rectification request is being resolved.
• Right to object: You may object to processing based on legitimate interests where your individual circumstances justify doing so.
• Right to withdraw consent: Where processing is based on your consent (such as promotional communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact ar99 support via live chat or email as detailed in Section 14. ar99 will respond to verifiable data subject requests within 30 days. For complex or multiple requests, this period may be extended by a further 60 days with prior notification.

ar99 services are strictly intended for adults aged 18 and over. ar99 does not knowingly collect personal data from any person under the age of 18. If ar99 becomes aware that personal data has been collected from a person under 18, that Account will be immediately suspended and the data will be securely deleted in accordance with our data retention procedures. Parents or guardians who believe that a minor has registered an ar99 Account should contact ar99 support immediately.

The ar99 Platform may contain references to third-party game studios or payment providers. ar99 is not responsible for the privacy practices of any third-party service. This Privacy Policy applies solely to data collected and processed by ar99 in connection with the ar99.asia platform. Players are encouraged to review the privacy policies of any third-party services they interact with independently of the ar99 platform.

ar99 reserves the right to update this Privacy Policy at any time. When material changes are made, ar99 will publish the updated policy on the Platform with a revised effective date and, where practical, will notify active Account holders via SMS. Your continued use of the ar99 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated policy, you should cease using the Platform and may request Account closure via ar99 support.

For any privacy-related queries, data subject requests, or concerns about how ar99 handles your personal data, please contact the ar99 data protection team:

• Live Chat: Available 24/7 on ar99.asia — the fastest way to reach ar99 support for urgent account or data matters.
• Email: [email protected]

ar99 will acknowledge data subject requests within 5 business days and will aim to resolve them within the 30-day statutory period. Where a request is particularly complex, ar99 will inform you of any required extension within the initial 30-day period.