At AR 999 we handle the personal information of Pakistani players with care. This Privacy Policy explains exactly what data we collect, why we collect it, how it is stored, who can see it and what rights you have over it. There is no technical jargon designed to confuse — just a straight explanation of how AR 999 works with your data.
This Privacy Policy applies to all services provided by AR 999 through the website ar999.world and any associated mobile applications. It sets out how AR 999 collects, uses, stores and protects the personal information of users who register accounts, make deposits, play games or otherwise interact with the AR 999 platform.
AR 999 is designed specifically for Pakistani players. The data practices described in this policy reflect the realities of operating a PKR-based gaming platform — including the use of Easypaisa, JazzCash and other local payment infrastructure — and are written to be understandable to users based in Pakistan.
By registering an AR 999 account, you acknowledge that you have read and understood this Privacy Policy. If you have questions about anything here before registering, please contact us at support@ar999.world. We are happy to explain anything in more detail in either English or Urdu.
AR 999 collects personal data in three main ways: information you provide directly, information generated automatically when you use the platform and information received from payment processors when you make transactions. Below is a full breakdown of what AR 999 collects and why.
When you make a deposit or withdrawal at AR 999, our payment processors — including Easypaisa, JazzCash, NayaPay, SadaPay and card networks — share transaction confirmation data with AR 999. This includes transaction reference numbers, timestamps and the masked account or number associated with the payment. AR 999 does not receive your full payment credentials from processors.
AR 999 uses personal data for specific, defined purposes only. Your data is never processed for purposes incompatible with those listed below without your prior consent.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Name, mobile number, password, date of birth | Contract performance |
| Identity and age verification | CNIC copy, date of birth, name | Legal obligation |
| Processing deposits and withdrawals | Payment method details, transaction data | Contract performance |
| Delivering games and platform services | Usage data, device data, game history | Contract performance |
| Fraud prevention and AML compliance | Transaction data, IP address, device data | Legal obligation / Legitimate interest |
| Responsible gaming monitoring | Betting patterns, session data, deposit history | Legal obligation / Legitimate interest |
| Customer support | Account data, support communications | Contract performance |
| Promotional and bonus communications | Mobile number, opt-in preferences | Consent |
| Platform analytics and improvement | Anonymised usage data | Legitimate interest |
AR 999 processes personal data on the following legal bases depending on the specific processing activity involved:
Given that AR 999 is a PKR-based gaming platform serving Pakistani players through local payment methods, the handling of payment data deserves specific attention.
When you make a deposit or withdraw funds via Easypaisa or JazzCash, AR 999 receives your mobile number and a transaction reference number from the payment processor. AR 999 stores this information to maintain a record of your transactions, which is required for customer support, dispute resolution and AML compliance. Your Easypaisa or JazzCash PIN is never collected or stored by AR 999 at any point.
Card payments at AR 999 are processed by a PCI DSS-compliant payment gateway. AR 999 does not store your full card number, CVV or card expiry date on its own servers. The payment gateway stores tokenised card data which allows AR 999 to process withdrawals back to the same card without needing to store sensitive card details itself.
For IBFT deposits and withdrawals, AR 999 collects and stores the bank account number and bank name you provide. This is required to process withdrawal instructions and is stored securely with access restricted to the AR 999 payments team.
AR 999 maintains a full transaction history for every account covering deposits, withdrawals, bonus credits and wagering activity. This data is retained for a minimum of five years for compliance purposes and is accessible to you at any time from your account dashboard.
AR 999 uses cookies and similar technologies to operate the platform effectively, remember your preferences, keep your session secure and gather anonymous analytics data to improve the site. Below is a plain-language explanation of each cookie category used.
These cookies are required for the AR 999 platform to function. They handle session management, login authentication and security tokens. Without these cookies, you cannot log in, place bets or process payments. You cannot opt out of strictly necessary cookies while using the platform.
Functional cookies remember your preferences — such as your preferred game category, language setting and any display options you have customised. Disabling these cookies means your preferences will not be saved between sessions but the platform will still work.
AR 999 uses analytics cookies to understand how players navigate the platform, which games are most popular, where technical problems occur and how long typical sessions last. This data is collected in aggregate and anonymised form. No individual player activity is associated with analytics reports.
You can manage or disable non-essential cookies through your browser settings at any time. Most browsers allow you to view, block or delete cookies under their privacy or settings menu. Blocking analytics or functional cookies will not affect your ability to play games, deposit or withdraw at AR 999.
AR 999 does not sell personal data to third parties. Data is shared only in the specific circumstances described below and only to the extent necessary for the stated purpose.
AR 999 shares the minimum necessary data with payment processors — Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banking networks and card processors — to complete your transactions. Each processor operates under their own privacy policy and applicable financial regulations.
When identity verification is required, AR 999 may use a third-party verification service to check the authenticity of documents provided. Verification providers are contractually bound to use your data only for the purpose of identity checking and not for any other purpose.
AR 999 uses third-party cloud infrastructure, content delivery and security services to operate the platform. These providers process data on AR 999's behalf under data processing agreements and are not permitted to use the data for their own purposes.
AR 999 may be required to disclose personal data to law enforcement, regulatory authorities or courts in response to lawful requests. AR 999 will only comply with such requests where legally obligated to do so and will notify affected account holders where permitted by law.
AR 999 keeps your personal data for as long as necessary to deliver the service, meet legal obligations and resolve disputes. The following retention periods apply as a general guide:
When data is no longer required beyond its retention period, AR 999 securely deletes or anonymises it in a way that makes it impossible to re-identify the original individual.
AR 999 takes the security of your personal data seriously. The following technical and organisational measures are in place to protect your information from unauthorised access, loss or disclosure.
All data exchanged between your device and the AR 999 platform is encrypted using TLS 1.2 or higher. This applies to login, game sessions, payment processing and all API communications. The AR 999 SSL certificate is renewed regularly and enforced across all platform endpoints.
Sensitive data stored in AR 999 databases — including identity documents, payment method details and passwords — is encrypted at rest using AES-256 encryption. Passwords are stored using a one-way hashing algorithm and cannot be read by any AR 999 employee.
Access to personal data within AR 999 is controlled on a strict need-to-know basis. Different employee roles have access only to the data required for their specific function. All access is logged and monitored. The compliance and payments teams operate under enhanced access protocols with multi-factor authentication requirements.
AR 999 runs continuous security monitoring across its infrastructure, including intrusion detection, anomaly alerting and regular penetration testing. In the event of a data breach affecting AR 999 players, AR 999 will notify affected users as quickly as possible and take immediate steps to contain the breach.
As an AR 999 account holder, you have the following rights over the personal data AR 999 holds about you. To exercise any of these rights, contact us at support@ar999.world with the subject line "Data Rights Request" and we will respond within 14 days.
AR 999 is strictly an adult platform for users aged 18 and over. AR 999 does not knowingly collect personal data from individuals under 18 years of age. If AR 999 discovers that an account has been registered by a person under 18, that account will be closed immediately and any personal data associated with it will be deleted, with the exception of records necessary to document the age violation for compliance purposes.
If you believe a person under the age of 18 has registered an AR 999 account using your details or device, please contact support at support@ar999.world immediately so the account can be investigated and closed.
AR 999 sends two types of communications to registered members: transactional messages and promotional messages. Understanding the difference matters for how you manage your communication preferences.
Transactional messages include deposit confirmations, withdrawal notifications, security alerts (such as new login from an unfamiliar device), verification requests and account-related updates. These messages are sent to your registered mobile number via SMS and are required for the operation of your account. You cannot opt out of transactional messages while your account is active.
Promotional messages include information about new AR 999 promotions, bonus offers, tournament announcements and seasonal campaigns. These are sent only to members who have opted in to marketing communications during registration or via their account settings. You can opt out of promotional messages at any time by updating your communication preferences in your account settings or by replying STOP to any promotional SMS. Opting out does not affect transactional messages.
AR 999 may update this Privacy Policy from time to time to reflect changes in the platform, changes in data processing practices or changes in applicable law. When material changes are made, AR 999 will notify registered members via SMS to their registered mobile number and by displaying a notice on the platform at next login.
The "Last Updated" date at the top of this policy reflects the most recent revision. If you continue to use the AR 999 platform after a Privacy Policy update takes effect, you are considered to have accepted the updated policy. If you do not accept the changes, you should close your account before the update comes into effect.
Previous versions of this Privacy Policy are available on request by contacting support@ar999.world.
If you have any questions about this Privacy Policy, want to exercise your data rights or have a complaint about how AR 999 has handled your personal information, please get in touch with the AR 999 privacy team. We respond to all privacy queries within 14 days and communicate in both English and Urdu.
If you are not satisfied with AR 999's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority applicable in your jurisdiction.
Security is not an afterthought at AR 999. Here is a plain summary of the protections in place for every Pakistani player on the platform.
Every connection between your device and AR 999 — login, game play, deposits, withdrawals — is encrypted with TLS 1.2 or higher. This means data in transit between your phone and our servers is unreadable to anyone intercepting the connection, including on shared Wi-Fi networks.
Sensitive data stored by AR 999 — including CNIC copies, payment method details and account credentials — is encrypted at rest using AES-256, the same standard used by banks. Even in the unlikely event of a storage breach, encrypted data cannot be read without the decryption keys, which are stored separately.
Your AR 999 account password is never stored in readable form anywhere on our systems. It is converted into a one-way hash on the way in. No AR 999 employee can see your password — they can only reset it. If you forget your password, a reset is the only option because the original is genuinely not recoverable.
Access to player data within AR 999 follows a strict need-to-know model. Support staff can see only what is necessary to handle your query. The compliance team sees transaction records. The payments team handles withdrawal verification. No single employee has unrestricted access to all player data.
Card payments at AR 999 run through a PCI DSS-compliant payment gateway. AR 999's own servers never touch your full card number, CVV or expiry date. Tokenisation means your card can be used for future withdrawals without AR 999 storing any sensitive card data on its side.
AR 999 infrastructure runs 24/7 security monitoring with automated intrusion detection and anomaly alerting. Regular independent penetration testing is carried out to identify and fix vulnerabilities before they can be exploited. Suspicious activity triggers immediate automated responses.
These are not theoretical rights buried in a policy — they are practical things AR 999 will action when you request them. Contact support@ar999.world to exercise any of the following.
Request a full copy of all personal data AR 999 holds on your account. Your transaction history, bet records and account details are already accessible directly from your dashboard. For a complete data export, contact support.
If any information AR 999 holds about you is wrong, you can request a correction. Most account details can be updated directly from account settings. For CNIC-linked details, contact support with updated documents.
Ask AR 999 to delete your personal data. AR 999 will delete everything not subject to a legal retention requirement. Transaction records must be kept for five years under AML obligations but all other data can be deleted on request.
If you previously opted in to promotional SMS from AR 999, you can withdraw that consent at any time from your account settings or by replying STOP to any promotional message. Withdrawal takes effect immediately.
Request your personal data in a structured, machine-readable format such as JSON or CSV where technically feasible. This lets you transfer your data to another provider if you choose to close your AR 999 account.
Privacy policies tend to get written in a way that protects the company more than it informs the user. This summary is an attempt to cut through that and say plainly what the AR 999 Privacy Policy means for someone in Karachi, Lahore, Islamabad or anywhere else in Pakistan who plays on the platform.
Your mobile number is used to verify your account and send you transactional SMS messages — deposit confirmations, withdrawal notifications, security alerts. It is not shared with anyone else. It will not end up on a list sold to a marketing company. If you also opted in to promotional messages, you will receive bonus and promotion updates via that number and can stop those at any time by updating your account settings.
Your Easypaisa or JazzCash credentials — your PIN, your wallet password — are never seen or stored by AR 999. The transaction goes through the Easypaisa or JazzCash system directly and AR 999 receives a confirmation that it went through, along with your number and a reference code. That is all. The same applies to IBFT transfers and card payments — AR 999 gets a confirmation, not your full account details.
Your CNIC copy — if you are asked to provide one for verification — is stored encrypted and only accessible to AR 999's compliance team. It is not used for any purpose beyond confirming your identity and age. It is retained for five years after account closure as required by AML regulations, then securely deleted.
If you want to know exactly what AR 999 holds on you, just ask. Send an email to support@ar999.world with "Data Rights Request" in the subject line and you will receive a full response within 14 days. If something is wrong — wrong name, wrong address — AR 999 will fix it. If you want your account closed and your data deleted, that can be arranged too, subject to the legal retention requirements for transaction records that apply to all licensed gaming platforms.
Create your AR 999 account today. Deposit as little as Rs 200 via Easypaisa or JazzCash, claim your welcome bonus and enjoy Andar Bahar, Baccarat, Poker and Slots — all in PKR, all secured by the data protections described in this policy.
18+ only · Play responsibly · Responsible Gaming tools available