ar789 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

For the purposes of this Privacy Policy, the data controller responsible for the personal data collected through the ar789 Platform is ar789 — the internationally licensed online gaming operator accessible at ar789.net. As the data controller, ar789 determines the purposes and means of processing personal data collected from registered users and visitors to the Platform.

ar789 processes personal data in accordance with the data protection obligations imposed by our international gaming licence, which includes requirements relating to the collection, storage, security, and disclosure of personal data. Our licensing authority may audit our data processing practices as part of ongoing compliance oversight.

For all privacy-related enquiries, data subject rights requests, and complaints regarding ar789's data processing activities, please contact our support team at the details specified in Section 12 of this Policy.

2.1 Registration Data

When you create an ar789 account, we collect the following information: full legal name, date of birth, Pakistani mobile number (in 03xx format), chosen username, and account password (stored in hashed form — ar789 never stores plaintext passwords). You may optionally provide an email address for secondary account communications.

2.2 Identity Verification (KYC) Data

To comply with our international gaming licence's know-your-customer requirements and to process withdrawals, ar789 requires submission of identity documents. This includes image captures of the front and back of your CNIC, which ar789 processes to extract your full name, CNIC number, date of birth, and to confirm the document's authenticity. Additional documentation may be requested in specific circumstances.

2.3 Financial and Transaction Data

ar789 records all deposits, withdrawals, wagers, bonus transactions, and account balance movements. Payment method identifiers — such as your JazzCash mobile number, EasyPaisa account reference, Raast identifier, or bank account details — are recorded for transaction processing and regulatory compliance purposes.

2.4 Gaming Activity Data

ar789 records your gaming activity on the Platform, including: game sessions and outcomes, bet amounts and results, bonus usage and wagering progress, and session timestamps. This data is used for account management, responsible gaming monitoring, dispute resolution, and regulatory reporting.

2.5 Technical and Device Data

ar789 automatically collects certain technical information when you access the Platform, including: IP address, browser type and version, operating system, device type, screen resolution, session duration, and pages accessed. This information is used for security monitoring, fraud prevention, and Platform performance optimisation.

2.6 Communications Data

Records of all communications between you and ar789 support — including live chat transcripts, email correspondence, and any documents or screenshots you submit as part of a support interaction — are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

ar789 processes personal data only for the following documented purposes. Each processing activity is linked to a specific legal basis as detailed in Section 4:

ar789 processes personal data on one or more of the following recognised legal bases:

• Contract Performance: Processing that is necessary to deliver the ar789 service to you — including account management, game delivery, and payment processing. Without this processing, ar789 cannot provide the Platform to you.
• Legal Obligation: Processing required to comply with ar789's international gaming licence conditions — including KYC identity verification, anti-money laundering transaction monitoring, and regulatory reporting to our licensing authority.
• Legitimate Interest: Processing where ar789 has a genuine and proportionate operational interest that is not overridden by your data protection rights — including fraud prevention, platform security monitoring, and aggregated analytics for service improvement.
• Consent: Processing that ar789 undertakes only with your explicit, freely given, specific, and informed consent — primarily marketing communications. You may withdraw consent for consent-based processing at any time via your account settings or by contacting support.

Where ar789 relies on legitimate interest as a legal basis, we have conducted and documented a balancing test to confirm that the processing is necessary, proportionate, and does not override the fundamental rights and interests of our users.

ar789 is required under the terms of its international gaming licence to verify the identity of all account holders before withdrawal privileges are activated and at any point during the account lifecycle where the licensing authority deems verification necessary. This process — commonly known as Know Your Customer (KYC) — involves the collection and review of identity documentation.

5.1 Documents Required

• A clear, legible photographic image of the front of your Pakistani National Identity Card (CNIC)
• A clear, legible photographic image of the rear of your CNIC
• Confirmation of ownership of the payment method registered to the account (e.g., JazzCash or EasyPaisa account in your name)
• Any additional documentation reasonably requested by ar789 in accordance with our licensing authority's requirements

5.2 How KYC Data Is Processed

CNIC images submitted for KYC are processed by ar789's verification team and, where applicable, by our licensed third-party identity verification service provider. Processing is limited to confirming the authenticity of the document, extracting the name and date of birth to match against registration data, and confirming that the account holder is 21 years of age or older.

5.3 Failed Verification

If KYC verification cannot be completed due to document quality issues or inconsistencies, ar789 will contact you via your registered mobile number to request resubmission. ar789 reserves the right to suspend withdrawal access on accounts where KYC verification remains outstanding beyond a reasonable timeframe.

ar789 processes payment data — including JazzCash account references, EasyPaisa wallet identifiers, Raast IDs, and bank account details — solely for the purposes of processing deposits, executing withdrawal requests, and maintaining the transaction records required by our international gaming licence and applicable anti-money laundering regulations.

ar789 does not store full bank account numbers, debit or credit card numbers, or any payment credential in plaintext. Where payment processing is handled via a third-party payment gateway, that gateway operates under its own security standards and data protection obligations, and your payment credentials are processed within that gateway's secure environment rather than transmitted to or stored by ar789 directly.

All financial transaction records — including deposit amounts, withdrawal amounts, dates, and payment method references — are retained for a minimum period of five years in accordance with our licensing authority's anti-money laundering record-keeping requirements. This retention obligation applies regardless of whether your ar789 account is subsequently closed.

ar789 does not sell, rent, or otherwise commercially transfer personal data to third parties. Data sharing is limited to the following categories of recipient, each engaged for a specific operational purpose:

• Licensing Authority: ar789's international gaming licence requires periodic regulatory reporting. Data shared with our licensing authority is limited to what is necessary for compliance oversight and is governed by the licensing authority's own data protection framework.
• Identity Verification Service Providers: ar789 may engage a licensed third-party KYC verification provider to assist in processing CNIC documents. Any such provider operates under a data processing agreement that restricts processing to the KYC purpose only.
• Payment Processing Partners: Transaction data is shared with JazzCash, EasyPaisa, Raast, and banking partners to the extent necessary to execute payment instructions you have authorised.
• Fraud Prevention Services: ar789 may share IP addresses, device fingerprints, and transaction patterns with licensed fraud detection services to identify and prevent fraudulent activity. No personally identifiable information beyond what is operationally necessary is shared for this purpose.
• Legal and Regulatory Authorities: ar789 will disclose personal data to Pakistani or international law enforcement, regulatory authorities, or judicial bodies where required to do so by a legally binding order or where disclosure is necessary to protect the safety of users or the public.

All third-party service providers engaged by ar789 are contractually required to: process data only for the documented purpose; implement appropriate technical and organisational security measures; not retain data beyond the period necessary for the stated purpose; and notify ar789 promptly in the event of any data security incident.

ar789 retains personal data for the minimum period necessary for the documented processing purpose, subject to any longer retention periods required by our licensing authority or applicable law. The following retention periods apply:

ar789 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to, the following:

• Transport Encryption: All data transmitted between your device and the ar789 Platform is encrypted using TLS 1.2 or higher (256-bit). No personal data is transmitted in plaintext over any network channel.
• Storage Encryption: Sensitive personal data — including KYC documents and financial records — is encrypted at rest using industry-standard symmetric encryption. Encryption keys are managed separately from the encrypted data.
• Password Security: Account passwords are never stored in plaintext or reversible formats. ar789 uses bcrypt hashing with appropriate work factors to store password credentials.
• Access Controls: Access to personal data within ar789's operational systems is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit review.
• Two-Factor Authentication: SMS-based two-factor authentication is available for all ar789 accounts and is strongly recommended for all users, particularly those with active PKR balances.
• Intrusion Detection and Monitoring: ar789's platform is monitored continuously for unusual access patterns, brute-force attempts, and other indicators of compromise. Automated rate limiting and account lockout mechanisms are active at all times.
• Incident Response: ar789 maintains a documented data breach response procedure. In the event of a data security incident affecting your personal data, ar789 will notify you and our licensing authority within the timeframe required by applicable regulatory obligations.

ar789 uses cookies and similar local storage technologies to enable core Platform functionality, maintain login sessions, protect against cross-site request forgery, and gather aggregated analytics data to improve the Platform experience for Pakistani players. ar789 does not use third-party advertising or behavioural tracking cookies.

10.1 Cookie Categories Used by ar789

10.2 Managing Cookies

Strictly necessary cookies cannot be disabled as they are essential for Platform functionality — disabling them would prevent you from maintaining a login session or using the Platform securely. Functional and analytics cookies can be managed via your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Note that blocking functional cookies may affect your user experience on the Platform.

As an ar789 account holder, you have the following rights with respect to your personal data. ar789 will respond to verified data subject rights requests within 30 days of receipt. Complex requests may require an extension of up to a further 60 days, in which case ar789 will notify you of the extension and the reason for it.

To exercise any of the rights listed below, submit a request via the ar789 live chat or email support channel. ar789 will require identity verification before processing any data rights request, to protect against fraudulent submissions.

12.1 Privacy Enquiries

For all privacy-related enquiries — including data subject rights requests, questions about this Policy, or concerns about ar789's data processing activities — please contact the ar789 support team via live chat available on all pages of the Platform, or by emailing [email protected]. Please include "Privacy Enquiry" in your subject line to ensure your message reaches the appropriate team.

12.2 Response Timeframes

ar789 aims to acknowledge all privacy enquiries within 2 business days and to provide a substantive response within 30 calendar days. For complex requests — particularly those involving data subject access requests that require compilation of extensive records — we may extend this period by a further 60 days with notification to you.

12.3 Complaints

If you are dissatisfied with ar789's handling of your personal data or with our response to a data subject rights request, you have the right to escalate your complaint to ar789's international licensing authority, which operates an independent oversight and complaints function. Details of the applicable escalation process are available on request from ar789 support.

12.4 Policy Updates

ar789 will notify registered users of material changes to this Privacy Policy via in-account notification before any amended policy takes effect. The "last updated" date at the top of this Policy reflects the date of the most recent revision. Continued use of the Platform following the effective date of any updated Policy constitutes acceptance of that Policy.