arp999 Privacy Policy

This Privacy Policy ("Policy") describes how arp999 ("we," "us," "our," or "the Platform"), operating at arp999.net, collects, processes, stores, and protects the personal data of individuals ("you," "your," or "Player") who access or use the arp999 online gaming platform.

arp999 operates under an international gaming authority license, which imposes specific data protection, Know Your Customer (KYC), and anti-money laundering (AML) obligations on us. Compliance with these obligations requires us to collect and process certain personal data. Where such processing is required by law or by the conditions of our gaming license, we will always be transparent about that requirement.

By registering an arp999 account, making a deposit, or otherwise using any arp999 service, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the arp999 platform.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

For the purposes of applicable data protection law, arp999 is the data controller responsible for your personal data. As data controller, arp999 determines the purposes for which and the means by which your personal data is processed.

arp999 has appointed a designated Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection legislation. You may contact our DPO directly via the support contact details provided in Section 17 of this Policy, marking your correspondence "Data Protection Officer — Privacy Enquiry."

arp999 collects personal data in several categories. The specific data collected depends on your level of interaction with our platform:

3.1 Registration Data

When you create an arp999 account, we collect:

• Full legal name (as it appears on your CNIC)
• Date of birth (to verify the 21+ age requirement)
• Pakistani mobile number (for account verification and 2FA)
• Email address
• Residential address (city and province)
• CNIC number (for KYC identity verification purposes)
• Username and encrypted password

3.2 KYC Verification Data

To comply with our gaming license KYC requirements, we collect:

• CNIC photograph (front and back)
• Selfie or facial photograph for identity matching where required
• Proof of payment method ownership (e.g., JazzCash or EasyPaisa account confirmation, bank statement header)
• Source of funds documentation for high-volume accounts

3.3 Financial & Transaction Data

• Deposit amounts, dates, and payment method details
• Withdrawal requests, amounts, and processing history
• JazzCash or EasyPaisa account numbers or bank account details (last four digits only where possible)
• USDT wallet addresses where applicable
• Bonus history and wagering activity

3.4 Gaming & Behavioural Data

• Game session history — games played, stakes, outcomes, session durations
• Sports and cricket betting market selections and results
• Responsible gaming tool usage (deposit limits set, cooling-off periods activated)
• Customer support interaction history

3.5 Technical Data

• IP address and approximate geolocation (city/region level)
• Device type, operating system, and browser version
• Session timestamps and login/logout events
• Cookie identifiers and similar tracking technologies (see Section 8)

arp999 collects personal data through the following means:

• Directly from you: When you register an arp999 account, complete KYC verification, make deposits or withdrawal requests, contact our support team, or update your account profile.
• Automatically: Through our platform's technical infrastructure — including server logs, session tracking, and cookies — as you browse and interact with arp999.
• From payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT processors may share transaction confirmation data with arp999 to reconcile your account balance. arp999 does not receive your full payment credentials from these providers.
• From identity verification providers: Where arp999 uses a third-party KYC verification service to process your CNIC documents, that provider will share the verification result (pass/fail) and extracted identity data with arp999.
• From fraud prevention partners: arp999 may receive risk signals from our fraud detection and AML compliance partners, which may contain limited data points about your device or account behaviour.

arp999 processes your personal data for the following specific purposes, each supported by a documented legal basis:

arp999 does not sell your personal data to any third party. We share your personal data only in the following circumstances:

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These include:

• KYC/identity verification providers — to process CNIC documents and confirm your identity and age.
• Payment processors — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT partners process transaction data necessary to execute your deposits and withdrawals.
• Game content providers — third-party game studios (such as Pragmatic Play and NetEnt) may receive limited session data necessary to deliver their games through the arp999 platform. These providers are contractually bound to use such data only for game delivery purposes.
• Fraud prevention and AML monitoring services — specialist providers who analyse transaction patterns and device fingerprints to detect suspicious activity on arp999 accounts.
• Cloud infrastructure and hosting providers — arp999's platform infrastructure is hosted on enterprise-grade cloud servers. Our hosting providers process server-level data but do not have access to your personal data in a meaningful sense.

6.2 Regulatory & Legal Disclosure

arp999 will disclose personal data to regulatory authorities, law enforcement agencies, and courts where required to do so by applicable law, court order, or our gaming license obligations. This includes disclosures to our international gaming regulatory authority as part of license compliance monitoring. arp999 will notify affected Players of such disclosures wherever legally permissible to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of arp999's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify registered Players of any such transfer at least 30 days in advance and will ensure that the acquiring entity is bound by data protection obligations no less protective than those in this Policy.

arp999 processes payment information with particular care given the sensitivity of financial data. Specific rules that apply to your payment data on arp999:

• arp999 does not store your full JazzCash PIN, EasyPaisa PIN, bank internet banking credentials, or USDT private keys on our servers at any point.
• Payment transactions are processed via our certified payment processor partners. arp999 receives transaction confirmation data (amount, reference, and account identifier) but does not receive your full payment credentials.
• Bank account numbers and mobile wallet numbers associated with your arp999 account are stored in encrypted format and are accessible only for the purpose of processing your withdrawal requests.
• All financial data transmitted between your device and arp999's servers is encrypted using TLS 1.3 (256-bit SSL). This applies to all pages of the arp999 platform, not just the payment and arp999 login pages.
• Financial transaction records are retained for a minimum of 5 years from the date of the transaction, as required by our gaming license AML obligations.

arp999 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit arp999. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are essential to the functioning of the arp999 platform and cannot be disabled. They include your session authentication token (which keeps you logged in during your arp999 session), CSRF protection tokens, and security cookies that detect fraudulent session activity. No consent is required for strictly necessary cookies.

8.2 Functional Cookies

These cookies remember your platform preferences — such as your language setting, preferred game categories, and responsible gaming reminder preferences — to provide you with a personalised arp999 experience. These cookies are set with your implicit consent on first use.

8.3 Analytics Cookies

arp999 uses privacy-respecting analytics tools to understand how Players navigate and use the platform. Analytics data is aggregated and anonymised. We do not use third-party advertising analytics networks (such as Google Ads) that would transmit your data to external marketing platforms.

8.4 Cookie Management

You may manage your cookie preferences through your browser settings. Please note that disabling functional cookies may affect the quality of your arp999 experience. Disabling strictly necessary cookies will prevent you from logging into your arp999 account. Most modern browsers (including Chrome, Firefox, and Safari on Android and iOS) provide granular cookie controls under their Privacy or Security settings menus.

arp999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by our gaming license obligations and applicable law. Our retention schedule is as follows:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with arp999's data destruction policy. Anonymised or aggregated data that can no longer be linked to an individual may be retained indefinitely for statistical and platform improvement purposes.

arp999 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security infrastructure includes:

• Transport Layer Security: All data transmitted between your device and arp999 is encrypted using TLS 1.3, providing 256-bit AES encryption. This is the same encryption standard used by major international banks.
• At-rest encryption: Sensitive personal data — including CNIC details, payment account identifiers, and KYC documents — is encrypted at rest using AES-256 on our database servers.
• Access controls: arp999 employee access to personal data is governed by strict role-based access controls. Staff can only access the personal data categories required for their specific job function. All internal data access is logged and audited.
• Two-Factor Authentication: arp999's internal administration systems require multi-factor authentication for all staff access. We encourage all arp999 Players to enable 2FA on their accounts as well.
• Penetration testing: arp999's platform undergoes regular third-party penetration testing and security audits as a condition of our international gaming license.
• Incident response: arp999 maintains a documented data breach response plan. In the event of a data breach that poses a risk to Players, we will notify affected individuals and the relevant regulatory authority within the timeframe required by applicable law.

As an internationally licensed platform serving Pakistani users, arp999 may transfer personal data to our service providers and infrastructure partners located outside Pakistan. Such transfers may include, for example, transfers to cloud infrastructure providers or game content providers operating from jurisdictions outside Pakistan.

Where personal data is transferred internationally, arp999 ensures that appropriate safeguards are in place to protect the data, including:

• Contractual data processing agreements with all service providers that impose data protection obligations equivalent to those set out in this Policy.
• Transfers only to service providers located in jurisdictions with adequate data protection frameworks, or subject to appropriate contractual protections where the destination jurisdiction's framework is assessed as inadequate.
• Encryption of personal data in transit and at rest for all international transfers.

arp999 will not transfer your personal data to any jurisdiction or third party where adequate safeguards cannot be established.

As an arp999 account holder, you have the following rights with respect to your personal data. You may exercise any of these rights by contacting arp999 support via live chat or the email address in Section 17:

arp999 may send you promotional communications — including bonus offers, new game announcements, PSL cricket betting specials, and platform news — via SMS to your registered Pakistani mobile number or via email to your registered address. Such communications are sent only where you have:

• Explicitly opted in to marketing communications during account registration or via your account settings; or
• Previously interacted with a similar arp999 promotion and have not opted out (where permitted by applicable law).

You may withdraw your consent to marketing communications at any time by:

• Clicking the "unsubscribe" link included in every arp999 marketing email;
• Replying STOP to any arp999 promotional SMS from your registered mobile number; or
• Updating your notification preferences under Account Settings after arp999 login.

Opting out of marketing communications will not affect your ability to receive transactional communications from arp999, such as deposit confirmation messages, withdrawal notifications, KYC status updates, and account security alerts. These communications are necessary for the operation of your account and cannot be opted out of while your account remains active.

arp999 is strictly restricted to adults aged 21 years and above. We do not knowingly collect, process, or retain the personal data of individuals under the age of 21. If arp999 discovers or has reasonable grounds to believe that an account holder is under 21 years of age, the following steps will be taken immediately:

• The account will be suspended pending investigation.
• All associated personal data will be flagged for review by our KYC and compliance team.
• Any funds in the account will be withheld and the matter referred to the relevant regulatory authority.
• Personal data of confirmed underage users will be deleted as soon as legally permissible, with appropriate records retained for regulatory reporting purposes.

If you are a parent or guardian and believe that a minor under your care has accessed arp999 and provided personal data, please contact us immediately at the details in Section 17. We will investigate and take appropriate action promptly.

The arp999 platform may contain references to or integrations with third-party services — such as payment processors including JazzCash and EasyPaisa, or game content providers. Please be aware that:

• Third-party services operate under their own privacy policies, which are entirely independent of this arp999 Privacy Policy.
• arp999 is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service you interact with in connection with your arp999 account.
• Where arp999 shares data with third-party service providers (as described in Section 6), such sharing is governed by contractual data processing agreements that bind those providers to use your data only for the specified purpose.

arp999 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law or gaming license requirements, or the introduction of new platform features. The date of the most recent update is displayed at the top of this page.

When material changes are made to this Policy — particularly changes that affect the legal basis for processing, the categories of data shared with third parties, or your privacy rights — arp999 will notify registered Players at least 14 days in advance of the changes taking effect. Notification will be provided via email to your registered address and/or via a prominent banner on the arp999 platform.

Your continued use of arp999 following the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you must cease using arp999 and may request account closure via our support team.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by arp999, please contact us using the following channels:

• Live Chat: Available 24/7 inside your arp999 account dashboard — the fastest way to reach our privacy team for urgent requests.
• Email: [email protected] — please mark the subject line as "Privacy Policy Enquiry" or "Data Protection Officer" for priority routing. We respond to all privacy-related emails within 24 hours.

If you are not satisfied with arp999's response to your privacy enquiry, you have the right to escalate your complaint to the relevant data protection or gaming regulatory authority in the jurisdiction under which arp999 is licensed. Contact our support team for details of the relevant regulatory body.