Privacy Policy — 999ar

1. Introduction

This Privacy Policy ("Policy") describes how 999ar ("999ar", "we", "us", or "the Platform") collects, uses, stores, and protects the personal data of individuals ("you", "the Player", "the User") who access or use the 999ar website at https://999ar.bet and all associated gaming services, including casino games, live dealer tables, slot titles, and sports betting markets.

999ar operates as an internationally licensed online gaming platform serving Pakistani players. The collection and processing of personal data is a necessary part of operating a regulated gaming service — it enables 999ar to verify player identities, process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other approved methods, comply with anti-money laundering obligations, and provide a safe, responsible gaming environment.

This Policy should be read alongside the 999ar Terms & Conditions, which govern your use of the platform as a whole. By registering a 999ar account or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

For the purposes of applicable data protection law, 999ar is the data controller in respect of all personal data collected through the 999ar platform. As data controller, 999ar determines the purposes for which personal data is processed and the means by which that processing is carried out.

All data protection enquiries, access requests, correction requests, and complaints should be directed to the 999ar Data Protection contact point:

• Email: [email protected]
• Subject Line: Data Protection Enquiry
• Response Time: Within five (5) working days of receipt

3. Personal Data We Collect

999ar collects several categories of personal data, depending on your level of engagement with the platform. The categories below summarise what we may hold about you as a registered Pakistani player:

3.1 Identity Data

• Full legal name as it appears on official identification documents;
• Date of birth (for 21+ age verification purposes);
• National Identity Card (NIC) number or passport number provided during KYC verification;
• Photographs or scans of government-issued identification documents submitted for KYC.

3.2 Contact Data

• Residential address in Pakistan (city, district, and full postal address);
• Email address registered to your 999ar account;
• Mobile number associated with your account or JazzCash / EasyPaisa wallet.

3.3 Financial Data

• JazzCash account number or registered mobile number;
• EasyPaisa account number or registered mobile number;
• Bank account details (account holder name, IBAN, and bank name for HBL, UBL, Meezan Bank, MCB, or other approved banks) where used for withdrawal;
• Visa or Mastercard details (card number masked to last four digits, expiry date, and cardholder name) where a card is used for deposit;
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method references.

3.4 Gaming Activity Data

• Game history, including titles played, wager amounts, results, and timestamps;
• Sports betting history, including markets selected, odds accepted, stake amounts, and settlement results;
• Bonus and promotional history, including bonuses claimed, wagering progress, and expiry outcomes;
• Session duration, login timestamps, and device type used during each session.

3.5 Technical Data

• IP address at the time of registration and at each subsequent login;
• Device identifiers, browser type, and operating system information;
• Geolocation data (country and city level) derived from IP address;
• Cookie identifiers and similar tracking data as described in Section 10.

3.6 Communications Data

• Records of communications between you and the 999ar support team, including emails, live chat transcripts, and support ticket content;
• Responses to surveys or feedback forms where you have chosen to participate.

4. How We Collect Personal Data

999ar collects personal data through the following channels:

• Direct submission: Information you provide when registering a 999ar account, completing KYC verification, making a deposit or withdrawal, contacting support, or completing a survey;
• Automated collection: Technical data collected automatically when you access the 999ar website, including IP address, device identifiers, session timestamps, and cookie data;
• Payment providers: Confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, MCB, Visa, and Mastercard when a transaction is initiated or completed;
• Identity verification services: Results and flags returned by third-party KYC and anti-money laundering screening services used to verify the identity and risk profile of new and existing players;
• Publicly available sources: In limited circumstances related to fraud prevention or regulatory compliance, 999ar may reference publicly available information to verify data you have provided.

5. Purposes & Legal Basis for Processing

999ar processes personal data only where a valid legal basis exists. The table below sets out the primary purposes for which we process your data and the corresponding legal basis in each case:

6. Data Sharing with Third Parties

999ar does not sell, rent, or trade your personal data to third parties. We share personal data only in the following limited circumstances, and only to the extent necessary for the specified purpose:

6.1 Payment Service Providers

To process PKR deposits and withdrawals, 999ar shares relevant financial and identity data with payment service providers including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, MCB, and card processors for Visa and Mastercard transactions. These providers process your data solely to complete payment transactions and are bound by their own regulatory obligations and data protection frameworks.

6.2 Identity Verification and AML Screening Providers

999ar uses third-party KYC and anti-money laundering screening services to verify player identities and screen against sanctions lists and politically exposed person (PEP) databases as required by our gaming licence. Personal data shared with these providers is limited to what is necessary to perform the verification check.

6.3 Gaming Content Providers

Certain slot titles and live casino games available on 999ar are provided by third-party game studios. These studios may receive technical session data (such as player session tokens and wager data) that is necessary to deliver the game to your device. Game studios do not receive your name, contact details, or financial information.

6.4 IT Infrastructure and Security Providers

999ar engages third-party providers for cloud hosting, content delivery, cybersecurity monitoring, and platform analytics. These providers access personal data only to the extent required to maintain and secure the 999ar platform infrastructure and are contractually bound to process data only on 999ar's documented instructions.

6.5 Regulatory and Law Enforcement Authorities

999ar may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or our gaming licence obligations. Where legally permissible, 999ar will notify affected players of such disclosures.

7. International Data Transfers

As an internationally licensed gaming platform serving Pakistani players, 999ar may transfer personal data to countries outside Pakistan in connection with the provision of its services — for example, to cloud infrastructure providers or game content studios whose servers are located in other jurisdictions.

Where personal data is transferred internationally, 999ar takes appropriate steps to ensure that the receiving party provides an adequate level of data protection, including through the use of contractual data protection clauses, data processing agreements, or reliance on the receiving country's recognised adequacy status under applicable frameworks.

Players who wish to obtain more information about the specific safeguards in place for international data transfers may submit a written request to [email protected] with the subject line "International Transfer Enquiry".

8. Data Retention

999ar retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by our gaming licence, anti-money laundering regulations, or other applicable legal obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your active 999ar account and for a minimum of five (5) years following account closure, in line with standard AML record-keeping requirements;
• KYC documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Support communications: Retained for three (3) years from the date of the last communication, or longer where a complaint or dispute remains unresolved;
• Marketing consent records: Retained for the duration of your account or until consent is withdrawn, whichever occurs first;
• Technical and session data: Retained for twelve (12) months for platform security and fraud detection purposes, after which data is aggregated or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted from 999ar systems or anonymised such that it can no longer be attributed to an identifiable individual.

9. Security Measures

999ar implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• TLS encryption for all data in transit between your device and 999ar servers;
• Encryption at rest for stored personal and financial data using AES-256 or equivalent standards;
• Role-based access controls limiting internal access to personal data to staff who require it to perform their specific duties;
• Multi-factor authentication requirements for all internal system access;
• Regular penetration testing and vulnerability assessments of the 999ar platform;
• Audit logging of all access to personal data held in 999ar systems;
• Incident response procedures for managing and notifying affected parties of data security incidents within required timeframes.

Notwithstanding these measures, no internet-connected system is entirely immune to security risks. Players are encouraged to use a strong, unique password for their 999ar account and to enable any available two-factor authentication options. If you suspect that your account credentials have been compromised, notify 999ar immediately at [email protected].

10. Cookies & Tracking Technologies

The 999ar website uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and support fraud detection. The categories of cookies used by 999ar are as follows:

10.1 Strictly Necessary Cookies

These cookies are essential for the 999ar platform to function and cannot be switched off. They enable core functions such as maintaining your logged-in session, remembering your language preference, and supporting secure payment flows. No personal data collected by strictly necessary cookies is used for marketing purposes.

10.2 Functional Cookies

Functional cookies allow 999ar to remember your preferences — such as your preferred deposit method or game lobby view — and provide a more personalised experience. These cookies do not track your activity across other websites.

10.3 Analytics Cookies

999ar uses analytics cookies to collect aggregated, anonymised information about how players use the platform — for example, which game categories are most popular among Pakistani players, or which pages have the highest exit rates. This information is used to improve the 999ar platform and is not used to identify individual players.

10.4 Security and Fraud Detection Cookies

Certain cookies support 999ar's fraud detection and account security systems by identifying unusual patterns of behaviour or flagging login attempts from unrecognised devices. These cookies are essential to protecting the integrity of the 999ar platform and the security of player accounts.

11. Your Data Rights

As a 999ar player, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact 999ar in writing at [email protected] with the subject line "Data Rights Request":

• Right of Access: You may request a copy of the personal data 999ar holds about you, together with information about how it is being processed. 999ar will respond to access requests within thirty (30) calendar days.
• Right to Rectification: If any personal data held by 999ar is inaccurate or incomplete, you may request that it be corrected. Players may update basic account details (email address, contact number, address) directly from their account settings.
• Right to Erasure: In certain circumstances — for example, where data is no longer necessary for the purpose for which it was collected — you may request that 999ar delete your personal data. Note that this right is subject to 999ar's legal obligations to retain data for AML and regulatory compliance purposes, which may override erasure requests in respect of certain data categories.
• Right to Restriction: You may request that 999ar restrict processing of your personal data while a correction request or objection is being assessed.
• Right to Object: You may object to processing of your personal data where 999ar relies on legitimate interests as the legal basis. 999ar will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Data Portability: Where technically feasible and legally applicable, you may request that personal data you have provided to 999ar be delivered to you in a structured, commonly used, machine-readable format.

12. Minors

The 999ar platform is strictly restricted to individuals aged 21 years and over. 999ar does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the account registration and KYC process for all players.

If 999ar becomes aware that personal data has been collected from an individual who is under the age of 21 — whether through a false declaration of age at registration or by any other means — the relevant account will be immediately closed, all associated data will be handled in accordance with our legal obligations, and any deposits will be returned net of any withdrawals already made.

13. Changes to This Privacy Policy

999ar reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, regulatory requirements, or the services offered on the platform. Where material changes are made to this Policy, 999ar will notify registered players via the email address on record at least seven (7) days before the revised Policy takes effect.

The effective date at the top of this Policy will be updated each time a revision is made. Your continued use of the 999ar platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes to this Policy, you should cease using the 999ar platform and request account closure.

Prior versions of this Privacy Policy are available upon written request to [email protected].

14. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the manner in which 999ar handles your personal data, please contact us using the details below:

• Email: [email protected]
• Subject Line: Privacy Policy Enquiry
• Response Time: Within five (5) working days of receipt
• Support Hours: Monday – Sunday, 9:00 AM – 11:00 PM Pakistan Standard Time (PST)

If you are not satisfied with 999ar's response to a data protection complaint, you may escalate the matter through the dispute resolution process set out in the 999ar Complaints Policy. Details of the applicable supervisory authority under our international gaming licence are available from the support team upon request.