Introduction
arr99 ("arr99", "we", "us", "our") is committed to protecting and respecting the privacy of all individuals who access or use the arr99 platform located at https://arr99.cam (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.
This Policy applies to all users of the Platform, including individuals who register an account ("Registered Users"), visitors who browse the Platform without registering ("Visitors"), and individuals who contact arr99 for support or other purposes. By accessing the Platform, you acknowledge that you have read, understood and agree to the practices described in this Policy.
This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. Where any conflict arises between these documents, the Terms & Conditions shall prevail unless expressly stated otherwise.
Definitions
The following defined terms are used throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — an individual who can be identified, directly or indirectly, by reference to an identifier such as a name, email address, device identifier or location data. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, organisation, structuring, adaptation, retrieval, use, disclosure, erasure or destruction. |
| "Data Controller" | arr99, which determines the purposes and means of processing Personal Data collected through the Platform. |
| "Data Processor" | Any third party that processes Personal Data on behalf of arr99 under a contractual arrangement and in accordance with arr99's instructions. |
| "User" / "you" | Any individual who accesses, registers on or uses the Platform in any capacity. |
| "KYC" | Know Your Customer — the identity verification process requiring submission of government-issued identification and proof of address prior to withdrawal processing. |
| "Cookie" | A small text file placed on a User's device by the Platform for the purpose of session management, analytics or preference retention. |
| "Sensitive Data" | A special category of Personal Data including health, biometric, financial and political information, which attracts heightened protection obligations. |
Data We Collect
arr99 collects Personal Data in the following categories, depending on the nature of your interaction with the Platform:
When you create an account on the arr99 Platform, we collect: full legal name; date of birth (for age verification); residential address (including city — for example Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan or Peshawar); email address; username; and account password (stored in hashed, non-reversible form).
To comply with applicable anti-money laundering (AML) and know-your-customer (KYC) requirements, and prior to processing withdrawal requests, arr99 may collect: copies of government-issued photo identification (such as a Pakistani CNIC or passport); proof of residential address (such as a recent utility bill or bank statement); and, in some cases, source-of-funds documentation. This data is processed solely for verification purposes and is handled with heightened security.
When you make deposits or withdrawals, we collect: transaction amounts; timestamps; payment method identifiers (e.g., last four digits of a bank account, mobile wallet reference — for example an Easypaisa or JazzCash transaction reference); and transaction status records. Full financial account credentials are handled exclusively by our designated payment processors — arr99 does not store complete payment credentials on its own servers.
We automatically collect technical data when you access the Platform, including: IP address; browser type and version; operating system; device identifiers; referring URLs; pages visited; session duration; and clickstream data. This data is used for security monitoring, Platform optimisation and fraud prevention.
We retain records of communications you send us through live chat, email or support tickets, including the content of those communications, timestamps and resolution outcomes. This enables us to provide consistent support and to maintain records of any disputes or agreements.
Where you use responsible gambling tools — including deposit limits, self-exclusion requests, session time limits or cooling-off periods — we collect and process records of those elections. This data is handled with particular care and is used solely to honour your responsible gambling preferences and to comply with applicable operator obligations.
Legal Basis for Processing
arr99 processes Personal Data only where a valid legal basis exists. The applicable legal bases for each category of processing are as follows:
| Processing Activity | Legal Basis |
|---|---|
| Account registration and management | Performance of a contract to which you are party |
| KYC / identity verification | Legal obligation; legitimate interest (fraud prevention) |
| Deposit and withdrawal processing | Performance of a contract |
| Technical data and security monitoring | Legitimate interest in maintaining Platform security and preventing fraud |
| Customer support communications | Performance of a contract; legitimate interest |
| Responsible gambling controls | Legal obligation; vital interests of the data subject |
| Marketing communications (where opted in) | Consent — you may withdraw consent at any time |
| Analytics and Platform improvement | Legitimate interest in improving the Platform experience |
How We Use Your Data
arr99 uses Personal Data collected from Users for the following purposes only:
- Account administration: creating and managing your account, authenticating your identity at login, and maintaining accurate account records;
- Service delivery: processing deposits and withdrawal requests, crediting bonuses and managing your account balance;
- Identity verification: fulfilling KYC obligations required prior to withdrawal and in compliance with AML standards;
- Fraud and security: detecting, investigating and preventing fraudulent activity, unauthorised account access, money laundering and other unlawful conduct;
- Responsible gambling: administering self-exclusion, deposit and loss limits, cooling-off periods and other responsible gambling controls you elect;
- Customer support: responding to your enquiries, resolving complaints and managing disputes;
- Legal compliance: meeting obligations imposed by applicable law, regulatory instructions, court orders or other lawful requests from authorities;
- Analytics and improvement: analysing aggregated, anonymised usage patterns to improve Platform performance and content relevance;
- Marketing (consent-only): sending promotional communications about arr99 offers and features where you have provided explicit consent. You may opt out at any time.
Data Sharing & Disclosure
arr99 does not sell, rent or trade your Personal Data to third parties for their own marketing purposes. We may disclose your Personal Data to the following categories of recipients, solely to the extent necessary for the purposes described in Section 5:
We engage third-party service providers to assist in the operation of the Platform, including payment processors (which may facilitate transactions via channels familiar to Pakistani users, such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank or Bank Alfalah — subject to their own privacy policies), identity verification providers, cloud hosting providers, customer support platforms and analytics services. All such processors are bound by contractual obligations requiring them to process your data only on arr99's instructions and to maintain appropriate security standards.
arr99 may disclose Personal Data where required by applicable law, a binding court order, a regulatory authority or a law enforcement agency. In such cases, arr99 will disclose only the minimum data necessary to satisfy the lawful requirement and will notify you of any such disclosure to the extent permitted by law.
In the event of a merger, acquisition, asset sale or corporate restructuring involving arr99, Personal Data may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer via a notice on the Platform or by direct communication, and the acquiring entity will be required to honour the commitments in this Policy.
arr99 may share aggregated, anonymised statistical data that does not identify individual Users with third parties for research, analytics or business reporting purposes. Such data is not Personal Data and is not subject to the restrictions in this Section.
International Data Transfers
The arr99 Platform may be operated from, and your Personal Data may be transferred to and processed in, jurisdictions outside Pakistan. Pakistan's personal data protection framework is continuing to evolve, and different jurisdictions maintain varying levels of data protection.
Where Personal Data is transferred to a jurisdiction that does not offer an equivalent level of data protection, arr99 will implement appropriate safeguards, which may include: standard contractual clauses approved by applicable data protection authorities; binding corporate rules; adequacy decisions where available; or other lawful transfer mechanisms.
By using the Platform, you acknowledge that your Personal Data may be transferred, stored and processed outside Pakistan. If you have concerns about international data transfers, you may contact our Data Protection contact using the details in Section 14.
Data Retention
arr99 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:
| Data Category | Indicative Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal obligation / AML compliance |
| KYC / identity documents | 5 years from last transaction or account closure | Anti-money laundering regulations |
| Transaction records | 5 years from transaction date | Legal obligation / financial record-keeping |
| Support correspondence | 3 years from resolution | Legitimate interest / dispute management |
| Technical / usage data | 13 months from collection | Legitimate interest / security |
| Responsible gambling records | Duration of exclusion + 5 years | Legal obligation / vital interests |
| Marketing consent records | Until withdrawal of consent + 2 years | Compliance with consent obligations |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in accordance with arr99's data deletion protocols.
Cookies & Tracking Technologies
arr99 uses cookies and similar tracking technologies (including web beacons, pixel tags and local storage) to operate the Platform effectively, analyse usage patterns and remember your preferences. The categories of cookies we deploy are as follows:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Session management, authentication, security tokens, fraud prevention. Required for the Platform to function. | No — Platform functionality depends on these. | |
| Anonymised usage statistics — pages visited, session duration, device type — to improve Platform performance. | Yes — opt out via cookie preferences. | |
| Language preferences, display settings and responsible gambling limit reminders stored between sessions. | Yes — deleting browser cookies removes stored preferences. |
You may manage or delete cookies through your browser settings at any time. Please be aware that disabling essential cookies may prevent the Platform from functioning correctly. For more information on managing cookies, consult your browser's help documentation.
Your Rights
Subject to applicable data protection law in the governing jurisdiction, you may hold the following rights with respect to your Personal Data held by arr99. To exercise any of these rights, please contact us using the details in Section 14. We will respond within a reasonable period and in accordance with applicable law.
Security Measures
arr99 implements technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:
- Encryption: Personal Data transmitted between your device and the arr99 Platform is protected using Transport Layer Security (TLS) encryption. Sensitive data at rest is encrypted using industry-standard algorithms.
- Access controls: Access to Personal Data within arr99's systems is restricted to authorised personnel on a need-to-know basis. Role-based access controls and multi-factor authentication are enforced for internal systems.
- Password security: User passwords are stored using one-way cryptographic hashing. arr99 staff cannot view or retrieve plaintext passwords.
- Security monitoring: arr99 operates continuous security monitoring to detect anomalous activity, potential intrusions and unauthorised data access attempts.
- Third-party security assessments: Key third-party processors are required to demonstrate compliance with appropriate data security standards as a condition of their engagement with arr99.
Despite these measures, no method of data transmission or storage is entirely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, arr99 will notify affected Users and relevant authorities in accordance with applicable data breach notification obligations.
Minors & Age Restriction
The arr99 Platform is strictly intended for adults. arr99 does not knowingly collect Personal Data from individuals under the age of eighteen (18), or such higher minimum age as may be required by the applicable operator or license jurisdiction.
If arr99 becomes aware that Personal Data has been collected from a minor without verifiable parental consent, that data will be deleted from our records without delay and the associated account will be suspended pending investigation. Any funds deposited by a minor will be returned in full. No winnings associated with a minor's account will be paid.
If you are a parent or guardian and believe that arr99 may have inadvertently collected Personal Data from a minor in your care, please contact us immediately using the details in Section 14. We will investigate and take corrective action promptly.
Policy Amendments
arr99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law or regulatory guidance. Material changes will be communicated to Registered Users via the email address associated with their account or via a prominent notice on the Platform. The "Last updated" date at the top of this page will be revised accordingly.
Your continued use of the Platform following the posting of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must discontinue use of the Platform and may close your account in accordance with the Terms & Conditions.
We encourage all Users to review this Privacy Policy periodically to remain informed of how arr99 processes and protects their data. Previous versions of the Policy may be made available upon written request to arr99 support.
Contact & Data Protection
If you have any questions, concerns or complaints regarding this Privacy Policy or the manner in which arr99 processes your Personal Data, or if you wish to exercise any of your data rights set out in Section 10, please contact us using the following details:
If you are dissatisfied with arr99's response to a privacy complaint, you may have the right to lodge a complaint with the data protection authority in the applicable governing jurisdiction.
Six Core Data Commitments
A quick summary of what matters most. These cards do not replace the full policy text above.