99ar Privacy Policy — How We Collect, Use & Protect Your Data

1 Introduction

This Privacy Policy ("Policy") describes how 99ar ("the Company", "99ar", "we", "us", "our") collects, receives, uses, stores, shares, transfers, and processes the personal information of individuals ("Members", "Players", "you", "your") who register accounts on, access, or interact with the 99ar online casino and sports betting platform, available at 99ar.bio and any associated mobile applications, subdomains, or related services (collectively, "the Platform").

99ar is committed to handling your personal data responsibly, transparently, and in compliance with applicable data protection laws and international best practices. This Policy is intended to give you a clear and complete picture of how your data is managed throughout your relationship with 99ar, from initial registration through to account closure.

This Privacy Policy should be read alongside 99ar's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2 Data Controller

99ar is the data controller in respect of all personal data collected through the Platform. As data controller, 99ar determines the purposes for which your personal data is collected and the means by which it is processed.

All data protection queries, access requests, correction requests, and deletion requests should be directed to 99ar's data team via the contact details provided in Section 17 of this Policy.

3 Personal Data We Collect

99ar collects the following categories of personal data from Members. We apply a data minimisation principle — we collect only what is strictly necessary for the stated purposes:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, CNIC number, passport number, selfie photograph	Account registration, KYC/age verification, fraud prevention
Contact Data	Pakistani mobile number, email address, residential address (city, district)	Account communication, OTP verification, support correspondence
Financial Data	JazzCash/EasyPaisa account number, bank account details (HBL, UBL, Allied Bank), USDT wallet address, deposit and withdrawal history	Payment processing, AML compliance, withdrawal verification
Gaming Activity Data	Bet history, game sessions, win/loss records, bonus usage, wagering patterns	Service delivery, responsible gaming monitoring, dispute resolution
Technical Data	IP address, device type, browser type and version, operating system, session timestamps	Platform security, fraud detection, geolocation compliance
Communications Data	Live chat transcripts, support email threads, feedback submissions	Customer support, quality assurance, dispute records
Marketing Preferences	Communication opt-in/opt-out status, preferred contact channel	Sending relevant promotions and updates where consented

4 How Personal Data Is Collected

99ar collects personal data through the following channels:

• Direct Registration: Information you provide when completing the 99ar registration form, including your name, CNIC number, mobile number, email address, and date of birth.
• Identity Verification (KYC): Documents you submit to fulfil 99ar's know-your-customer obligations, including copies of your CNIC, passport, selfie photographs, and proof of payment method.
• Payment Transactions: Data generated when you make deposits via JazzCash, EasyPaisa, HBL, UBL, Allied Bank, SadaPay, or USDT TRC20, or when you request a withdrawal.
• Platform Usage: Data automatically generated through your use of the Platform, including game play sessions, bet placement, login timestamps, and navigation patterns.
• Technical Collection: Data collected automatically by our servers and analytics systems, including IP addresses, device identifiers, browser information, and session data.
• Customer Support: Information you provide when contacting 99ar's support team via live chat or email correspondence.
• Third-Party Service Providers: Data received from identity verification providers, payment processors, and fraud detection services in connection with your 99ar account.

5 How & Why We Use Your Personal Data

99ar uses your personal data for the following defined purposes:

• Account Creation and Management: To register and maintain your 99ar Member account, including authentication, password reset, and account settings management.
• Identity and Age Verification: To verify that you are who you say you are and that you meet the 99ar minimum age requirement of 21 years, in compliance with applicable regulations.
• Service Delivery: To operate the Platform, process bets, settle game outcomes, credit winnings, and provide you with the full range of 99ar's casino and sports betting products.
• Payment Processing: To process your deposits and withdrawal requests via your chosen payment method and to verify that transactions are authorised and legitimate.
• Responsible Gaming: To monitor your gaming activity for patterns that may indicate problem gambling and to facilitate the operation of voluntary responsible gaming tools such as deposit limits, session reminders, and self-exclusion.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, identity theft, bonus abuse, and any other form of Platform misuse.
• Regulatory Compliance: To fulfil 99ar's obligations under applicable anti-money laundering (AML), know-your-customer (KYC), and other regulatory requirements.
• Customer Support: To respond to your queries, complaints, and support requests promptly and effectively.
• Marketing and Promotions: To send you relevant promotional offers, bonus notifications, and platform updates — but only where you have provided valid consent or where such communication is permitted under applicable law.
• Platform Improvement: To analyse usage patterns and technical performance data to improve the reliability, security, and feature set of the 99ar Platform.
• Legal Proceedings: To establish, exercise, or defend legal claims where necessary.

6 Legal Basis for Processing

99ar processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — including account management, bet processing, payment processing, and customer support — is based on contractual necessity. Without this processing, 99ar cannot provide you with the Platform's services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including AML/KYC verification, age verification, and regulatory reporting, is based on legal obligation.
• Legitimate Interests: Processing for fraud prevention, Platform security, responsible gaming monitoring, and general Platform improvement is based on 99ar's legitimate business interests, provided those interests do not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications and the use of non-essential cookies is based on your explicit consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Third Parties

99ar does not sell your personal data. We share your data with third parties only to the extent necessary and only in the following circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Allied Bank, SadaPay, and cryptocurrency processing partners receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable financial regulations.
• Identity Verification Providers: Third-party KYC and identity verification service providers receive copies of identity documents you submit, for the purpose of verifying your identity and age in compliance with regulatory requirements.
• Fraud and Security Providers: Specialist fraud detection and cybersecurity vendors may receive technical data including IP addresses, device identifiers, and session data for the purpose of protecting the Platform and its Members.
• Game Software Providers: Casino game and sportsbook software providers may receive anonymised or pseudonymised session and gameplay data necessary to operate their games on the 99ar Platform. These providers do not receive personally identifiable information beyond what is technically required.
• Regulatory and Law Enforcement Authorities: 99ar will disclose personal data to competent regulatory authorities, law enforcement agencies, or other public bodies where required or permitted by applicable law, including in response to court orders or statutory reporting obligations.
• Professional Advisers: Legal, financial, and compliance advisers engaged by 99ar may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of 99ar's business assets, your personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

8 International Data Transfers

As an international online gaming platform serving Pakistani players, 99ar may transfer certain personal data to countries outside Pakistan for processing by our service providers. Where such transfers occur, 99ar ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data protection clauses binding recipient third parties to equivalent data protection standards
• Transfer only to jurisdictions that maintain adequate data protection regimes recognised under applicable international standards
• Encryption of data in transit and at rest, regardless of transfer destination

You may request details of the specific safeguards applied to international transfers of your personal data by contacting 99ar's data team at the address provided in Section 17.

9 Data Retention

99ar retains personal data for the periods set out below. Retention periods are determined by the nature of the data and the legal or regulatory requirements associated with it:

Data Category	Retention Period	Basis
Identity & KYC documents	5 years from account closure	AML regulatory obligation
Financial transaction records	5 years from transaction date	AML / financial regulation
Gaming activity records	3 years from account closure	Regulatory compliance, dispute resolution
Support communications	2 years from last interaction	Legitimate interest, dispute resolution
Marketing consent records	Until consent is withdrawn + 1 year	Legal obligation to evidence consent
Technical / log data	12 months from generation	Security and fraud prevention
Self-exclusion records	Indefinitely (or minimum exclusion period)	Responsible gaming obligation

Upon expiry of the relevant retention period, personal data is securely deleted or irreversibly anonymised. Data that has been anonymised and can no longer identify an individual is no longer subject to this Privacy Policy.

10 Security Measures

99ar implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS Encryption: All data in transit between your device and 99ar's servers is encrypted using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive personal data and financial information stored on 99ar's servers is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within 99ar's organisation is restricted on a strict need-to-know basis. All staff with access to personal data undergo regular data protection training.
• Two-Factor Authentication: 99ar's internal systems require multi-factor authentication for all staff accessing Member data or account management systems.
• Penetration Testing: 99ar's Platform and data infrastructure undergo regular independent security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response: 99ar maintains a documented data breach incident response plan. In the event of a data breach that poses a risk to your rights and freedoms, 99ar will notify you and the relevant regulatory authority within the timeframes required by applicable law.

11 Cookies & Tracking Technologies

99ar uses cookies and similar tracking technologies on the Platform. A cookie is a small data file placed on your device when you visit a website. 99ar uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable core functionality such as session management, login authentication, and security features. They cannot be disabled without disrupting the Platform's operation.
• Functional Cookies: Used to remember your preferences and settings (such as language preference and responsible gaming limits) to personalise your experience on return visits.
• Analytics Cookies: Used to collect anonymised data about how Members use the Platform — including pages visited, time on site, and navigation paths — to help 99ar improve the Platform's usability and performance.
• Marketing Cookies: Used to deliver relevant promotional content to you based on your interests and Platform activity. These cookies are only placed where you have provided valid consent.

You may manage your cookie preferences at any time through the cookie settings panel accessible from the footer of the Platform. Note that disabling certain categories of cookies may affect the functionality of the Platform.

12 Your Data Protection Rights

Subject to applicable law, you have the following rights in relation to the personal data 99ar holds about you:

• Right of Access: You have the right to request a copy of the personal data 99ar holds about you. We will provide this within 30 days of a valid request.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by 99ar. Basic account details (such as contact number or address) can often be updated directly within your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to 99ar's legal obligations to retain certain data (e.g. AML records) for mandatory retention periods.
• Right to Restriction: You have the right to request that 99ar restricts processing of your personal data in certain circumstances, for example while a dispute regarding data accuracy is being resolved.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to 99ar in a structured, commonly used, machine-readable format, where processing is based on consent or contract.
• Right to Object: You have the right to object to processing of your personal data where 99ar relies on legitimate interests as its legal basis, and where your individual circumstances outweigh those interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit your request in writing to support@99ar.bio with the subject line "Data Rights Request — [your account username]". 99ar will acknowledge your request within 5 business days and provide a substantive response within 30 days.

13 Minors & Age Verification

The 99ar Platform is strictly for adults aged 21 years and above. 99ar does not knowingly collect or process personal data belonging to individuals under the age of 21. If 99ar discovers or has reason to believe that personal data belonging to a person under 21 has been collected, that data will be deleted immediately, the associated account will be permanently closed, and any funds held in the account will be dealt with in accordance with applicable regulations.

Parents and guardians are encouraged to use parental control tools and internet filtering software to prevent minors from accessing online gambling platforms. If you believe a minor has registered an account with 99ar, please contact our support team immediately at support@99ar.bio.

14 Anti-Money Laundering & Regulatory Disclosure

99ar is subject to applicable anti-money laundering (AML) and counter-financing of terrorism (CFT) regulations. In fulfilment of these obligations, 99ar may be legally required to:

• Verify the source of funds used to make deposits, particularly for large or unusual transactions
• File Suspicious Transaction Reports (STRs) with the relevant financial intelligence authority where transactions or account behaviour meets the applicable reporting threshold
• Disclose Member information to law enforcement or regulatory authorities upon receipt of a lawful demand
• Retain financial and identity records for the mandatory statutory retention period

In circumstances where 99ar is legally required to disclose your personal data to a regulatory or law enforcement authority, 99ar may be legally prohibited from informing you that such a disclosure has taken place. 99ar will not be in breach of this Privacy Policy in complying with such mandatory legal obligations.

15 Marketing Communications

Where you have provided valid consent during registration or subsequently through your account settings, 99ar may send you marketing communications including promotional offers, bonus notifications, new game announcements, and platform updates. These communications may be delivered via SMS to your registered Pakistani mobile number, or via email to your registered address.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in the Notifications section of your 99ar account settings
• Clicking the unsubscribe link included in any marketing email from 99ar
• Contacting 99ar support and requesting removal from marketing lists

Opting out of marketing communications will not affect the delivery of transactional communications related to your account, such as deposit confirmations, withdrawal notifications, and security alerts — these are sent on the basis of contractual necessity and will continue regardless of your marketing preferences.

16 Changes to This Privacy Policy

99ar reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, 99ar will notify registered Members via email and/or prominent in-platform notification prior to the changes taking effect, with a minimum of 7 days' advance notice for significant changes.

The "Last Updated" date at the top of this Policy indicates when the most recent version was published. The current version of this Privacy Policy is always accessible at 99ar.bio/privacy-policy and supersedes all prior versions. Continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

17 Contact Us & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or have a concern about how 99ar handles your personal data, please contact our data team through the following channels:

• Email: support@99ar.bio — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate
• Live Support: 24/7 in-platform live chat at 99ar.bio

99ar will acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within 30 days. If you are not satisfied with 99ar's response to your complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.