Privacy Policy — arp999

This Privacy Policy (the "Policy") describes how the operator of arp999 (the "Operator", "we", "us" or "our"), accessible at arp999.cam (the "Platform"), collects, uses, stores, discloses and protects the personal data of individuals who visit, register on or otherwise interact with the Platform (referred to as "Users", "you" or "your").

arp999 is an English-language online sports betting and live casino platform designed for Pakistani users. All account-related communication, support and platform content are delivered in English, with balances displayed in Pakistani Rupees (PKR). This Policy applies to all personal data collected from users regardless of their location, including users based in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar and other cities across Pakistan.

By registering an account or using any part of the Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not consent, you must refrain from registering or using the Platform.

arp999 does not hold or claim a gambling licence issued by any Pakistani authority, including the Government of Pakistan, the PTA or the State Bank of Pakistan. This Policy does not constitute legal advice regarding Pakistani data-protection law or the legality of online gambling in Pakistan.

The following definitions apply throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including names, email addresses, identification documents, financial details and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, transfer and deletion.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Operator is the Data Controller.
• "Data Processor" — A third party that processes personal data on behalf of the Data Controller under a contractual arrangement.
• "KYC" — Know Your Customer: the identity, age and source-of-funds verification process required under applicable compliance obligations.
• "AML" — Anti-Money Laundering: regulatory obligations designed to detect and prevent financial crime, including the processing of transaction data for monitoring purposes.
• "Cookies" — Small data files placed on your device by the Platform to support session management, security and analytics functions.
• "Special Category Data" — Sensitive personal data categories that receive enhanced protection, such as health information or biometric data. arp999 does not intentionally collect special category data unless strictly required for responsible-gambling assessments.

The Data Controller for personal data collected through the arp999 Platform is the Operator of arp999.cam. The Operator is responsible for determining why and how your personal data is processed in connection with the delivery of the Platform's services.

For all privacy-related enquiries, data-subject rights requests and data-protection concerns, please contact the Operator via:

arp999 collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your use of the website, and from third-party verification providers during the KYC process. The categories of data collected are set out below.

4.1 Data You Choose Not to Provide

Where the provision of certain personal data is optional, you will be informed at the point of collection. Declining to provide mandatory data — such as identity documents required for KYC — may result in account restrictions, including the inability to make withdrawals.

4.2 Payment Provider Data

When you use payment references familiar to Pakistani users — such as Easypaisa, JazzCash, Raast or bank transfers via HBL, UBL, Meezan Bank or Bank Alfalah — any data transmitted to those payment providers is subject to each provider's own privacy policy. arp999 does not control the data practices of third-party payment processors. No payment provider referenced on this Platform endorses or supports gambling activities.

arp999 processes personal data for the following purposes, each supported by a legitimate legal basis:

• Account Registration & Service Delivery: To create and manage your account, provide access to betting markets, live casino games and other platform features. Legal basis: performance of a contract.
• Identity Verification (KYC): To verify your age, identity and eligibility to use the Platform in accordance with our Terms & Conditions and applicable compliance requirements. Legal basis: legal obligation and contract performance.
• Financial Transactions: To process deposits and withdrawals in PKR, maintain accurate account balances and generate transaction records. Legal basis: contract performance and legal obligation.
• Anti-Money Laundering (AML) Monitoring: To detect and report suspicious financial activity as required under applicable AML frameworks. Legal basis: legal obligation.
• Responsible Gambling: To apply self-imposed limits, process self-exclusion requests, monitor for signs of problem gambling and provide intervention where appropriate. Legal basis: legitimate interests and legal obligation.
• Security & Fraud Prevention: To detect and prevent fraudulent account activity, unauthorised access, bonus abuse and other prohibited conduct. Legal basis: legitimate interests.
• Customer Support: To respond to your enquiries, resolve account issues and maintain support records. Legal basis: contract performance and legitimate interests.
• Platform Improvement: To analyse aggregated usage data for the purpose of improving platform performance, user experience and product development. Legal basis: legitimate interests.
• Legal & Regulatory Compliance: To comply with applicable legal obligations, including document retention requirements under AML law. Legal basis: legal obligation.

arp999 does not sell personal data to third parties. Personal data may be shared with the following categories of recipients only to the extent necessary for the stated purposes:

6.1 Service Providers & Data Processors

arp999 engages third-party processors who act under contractual data-processing agreements, including:

• KYC and identity-verification technology providers;
• Payment processing and fraud-detection services;
• Customer support platform providers;
• Cloud hosting and data storage providers;
• Analytics and platform-performance monitoring services.

All processors are required to handle personal data solely on arp999's instructions and in accordance with applicable data-protection obligations.

6.2 Regulatory & Law Enforcement Authorities

Personal data may be disclosed to competent authorities — including financial intelligence units, law enforcement agencies or regulatory bodies — where arp999 is legally obliged to do so, or where disclosure is necessary to prevent or detect fraud or other serious criminal activity.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring or sale of the Operator's business assets, personal data held by arp999 may be transferred to the relevant successor entity as part of that transaction. Users will be notified of any such transfer in advance where reasonably practicable.

6.4 With Your Consent

arp999 will not share your personal data with any other third party except where you have provided explicit, informed consent for such sharing.

arp999 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account's active status and for a defined period thereafter to satisfy legal obligations;
• KYC & Identity Documents: Retained for the minimum period required by applicable AML and compliance regulations following account closure;
• Transaction Records: Financial transaction data is retained for a minimum of five years in accordance with standard AML record-keeping requirements, unless a longer period is required by applicable law;
• Support Communications: Retained for a period sufficient to resolve ongoing disputes and meet applicable statutory limitation periods;
• Technical & Usage Data: Anonymised or aggregated analytics data may be retained indefinitely; identifiable technical data is subject to shorter retention cycles.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

arp999 applies appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest in databases and storage systems;
• Access controls that restrict employee access to personal data on a need-to-know basis;
• Two-factor authentication options for user accounts;
• Regular security assessments and vulnerability reviews of the Platform infrastructure;
• Secure protocols for KYC document handling and storage.

In the event of a personal data breach that poses a risk to your rights and freedoms, arp999 will take appropriate remedial action and notify affected users as required under applicable law.

arp999 uses cookies and similar tracking technologies to support the operation and improvement of the Platform. The following types of cookies may be placed on your device:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They enable core features such as session authentication, security token management and user preference storage. These cookies cannot be disabled without significantly impairing Platform functionality.

9.2 Analytics Cookies

arp999 uses basic analytics cookies to understand how users interact with the Platform — such as which pages are visited most frequently and where users encounter errors. This data is aggregated and not used to identify individual users.

9.3 Functional Cookies

Functional cookies remember your preferences — such as language settings and display preferences — to provide a more consistent experience across sessions.

9.4 Managing Cookies

You can manage or disable cookies through your browser settings. Instructions for common browsers are available through your browser's help documentation. Please note that disabling cookies may affect the functionality of the Platform, including the ability to log in and maintain an authenticated session.

As an online platform, arp999 may process personal data on servers or through service providers located outside Pakistan. Where personal data is transferred to countries that may not offer the same level of data protection as your country of residence, arp999 will implement appropriate safeguards to ensure that such transfers are carried out in compliance with applicable data-protection principles.

Safeguards may include contractual arrangements with receiving parties that impose data-protection obligations equivalent to those applied within the Operator's primary jurisdiction, or reliance on recognised adequacy frameworks where applicable.

By using the Platform, you acknowledge and consent to the potential transfer of your personal data to jurisdictions outside Pakistan for processing purposes as described in this Policy.

Subject to applicable law and any overriding legal obligations, you have the following rights in relation to your personal data held by arp999. To exercise any of these rights, please contact support via live chat or email at [email protected].

arp999 will acknowledge data-subject rights requests promptly and respond within a reasonable period. We reserve the right to verify your identity before acting on any request. Requests that are manifestly unfounded or excessive may be declined or subject to a reasonable administrative fee.

The arp999 Platform is strictly intended for adults aged 18 years or above — or the higher minimum age required by the operator's license jurisdiction. We do not knowingly collect personal data from individuals under the minimum eligible age.

If arp999 becomes aware that personal data has been collected from an underage individual, the relevant account will be closed immediately, any balance will be handled in accordance with applicable law, and the personal data will be deleted as promptly as legally permitted.

The arp999 Platform may reference third-party services — such as familiar Pakistani payment providers including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — in an informational context. These references do not constitute endorsement by any such provider of gambling activities, nor do they imply any formal partnership or integration agreement.

Any data you transmit directly to a third-party payment provider or service when completing a financial transaction is subject to that provider's own privacy policy. arp999 is not responsible for the data practices of third-party entities, and we encourage you to review the relevant privacy documentation before submitting data to any external service.

The Platform does not contain links to external third-party websites for the purpose of directing users off-platform for commercial or advertising purposes.

arp999 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, introducing a new category of data use or a new sharing arrangement — reasonable advance notice will be provided via the Platform or by email to the address registered on your account.

The current version number and effective date of this Policy are displayed at the top of this page. Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy. You are encouraged to review this Policy periodically.

If you object to any amended provisions, you should cease using the Platform and contact support to arrange account closure and data-deletion requests as appropriate.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by arp999, please contact us through the following channels. We aim to acknowledge all privacy-related enquiries within five business days.

When submitting a data-subject rights request, please include your registered email address and a clear description of the right you wish to exercise. Identity verification may be required before we act on your request. We are committed to handling all privacy matters with care and in accordance with the principles set out in this Policy.