ar888 Privacy Policy — Your Data Rights & Our Obligations as a Regulated Operator

1.1 This Privacy Policy is issued by ar888, the operator of the ar888 platform at ar888.bio ("ar888", "we", "us", "our"). ar888 operates under international gaming regulatory oversight and is subject to data protection obligations as a condition of its operating licence.

1.2 This Policy describes the categories of personal data ar888 collects from players ("you", "your") who register an account on the ar888 platform, the purposes for which that data is used, the legal bases on which ar888 relies to process it, and the rights you hold in relation to your data.

1.3 ar888 is the data controller in respect of personal data collected through the ar888 platform. By registering an account on ar888, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you should not register an account or continue to use the ar888 platform.

1.4 This Policy applies to Pakistani players accessing the ar888 platform and is written in English. Where there is any inconsistency between a translated version of this Policy (if provided for convenience) and the English original, the English version shall prevail.

2.1 ar888 collects personal data in several ways: directly from you during registration and ongoing platform use, automatically through technical systems, and in limited circumstances from third-party sources such as payment providers and fraud prevention services.

2.2 Registration and Identity Data: When you register an ar888 account, we collect:

2.3 Financial and Transaction Data: In connection with deposits, withdrawals, and gaming activity on ar888, we collect:

• JazzCash or EasyPaisa account number associated with your deposits and withdrawals
• Bank account details for HBL, UBL, or Meezan Bank transactions
• Debit or credit card details (card number, expiry, billing address) where card payments are used
• Complete history of deposits, withdrawals, bonuses, and wagers including amounts in PKR, timestamps, and payment method used
• Pending transaction data and failed payment attempt records

2.4 Technical and Device Data: ar888 automatically collects the following when you access the platform:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session duration, login timestamps, and logout events
• Pages visited, games played, and features accessed within the platform
• Crash reports and error logs where they occur during your session

2.5 Communications Data: When you contact ar888 support via live chat, email, or any other channel, we retain records of those communications including the content of messages, agent interaction logs, and complaint or dispute records.

2.6 Responsible Gaming Data: Where you use ar888's responsible gaming tools — including deposit limits, self-exclusion, cooling-off periods, or session controls — we maintain records of those elections and their effective dates. This data is used to enforce the restrictions you have set and to comply with our regulatory obligations regarding player protection.

3.1 ar888 uses personal data collected from players for the following purposes:

3.2 ar888 does not use personal data for automated individual decision-making that produces legal or similarly significant effects on players, except where required by fraud detection or AML compliance processes. Where automated decisions are made in such contexts, players have the right to request human review of any decision affecting their account.

4.1 ar888 processes personal data on one or more of the following legal bases:

• Contract Performance: Processing is necessary for the performance of the agreement between ar888 and the Player — including providing gaming services, processing PKR transactions, and operating the Player's account.
• Legal Obligation: Processing is required by ar888's regulatory licence conditions, including KYC identity verification, age verification (21+), AML transaction monitoring, and retention of records for regulatory audit purposes.
• Legitimate Interests: Processing is necessary for ar888's legitimate interests in fraud prevention, platform security, product improvement, and the detection of multi-accounting or bonus abuse — provided those interests are not overridden by the Player's privacy interests.
• Consent: For direct marketing communications, ar888 relies on the Player's freely given, specific, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5.1 ar888 does not sell Player personal data to third parties for commercial or marketing purposes. Data is shared with third parties only in the following specific circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card processing providers receive the minimum financial data required to process your PKR deposits and withdrawals. These providers are bound by their own regulatory obligations regarding data security.
• KYC Verification Providers: ar888 may use third-party identity verification services to assist with CNIC validation and age verification. These providers receive only the data necessary to conduct the verification and are contractually prohibited from retaining or using it for independent purposes.
• Fraud Prevention Services: ar888 shares device and behavioural data with fraud detection service providers to identify and prevent fraudulent activity, multi-accounting, and bonus abuse. This is a legitimate interests processing activity.
• Gaming Software Providers: Game studios and platform providers may receive gameplay data in connection with the operation and maintenance of their certified games on the ar888 platform.
• Regulatory Authorities: ar888 is required by its gaming licence to provide player data, transaction records, and compliance information to its regulatory authority upon demand. This is a non-discretionary legal obligation.
• Law Enforcement: ar888 will disclose personal data to law enforcement or government authorities where required to do so by applicable law, court order, or legitimate governmental request — including in connection with AML or counter-terrorism financing obligations.

6.1 ar888 uses cookies and similar tracking technologies on the ar888 platform to ensure the website functions correctly, to measure performance, and to deliver a relevant experience to Players. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the ar888 platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without severely impairing your ability to use the platform.
• Functional Cookies: Enable personalisation features such as remembering your preferred language, game lobby sort order, and responsible gaming settings between sessions.
• Analytics Cookies: Used by ar888 to understand how Players navigate the platform — which pages are most visited, where users encounter errors, and how gameplay flows are used. Data collected is aggregated and used to improve platform design and performance.
• Fraud Prevention Cookies: Used to identify and track device fingerprints for the purpose of detecting multi-accounting, bonus abuse, and fraudulent access attempts. These cookies are a security measure and cannot be disabled without risk to account integrity.

6.2 Most browsers allow you to control cookie settings. However, disabling strictly necessary or fraud prevention cookies may impair critical platform functionality, including the ability to log in, make deposits, or access games. ar888 is not liable for platform dysfunction caused by user-side cookie blocking.

7.1 ar888 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to regulatory minimum retention requirements. The following retention periods apply:

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in a manner that renders re-identification impossible. Regulatory-mandated retention periods cannot be shortened in response to erasure requests — this is a legal obligation ar888 is not in a position to waive.

8.1 ar888 implements technical and organisational security measures appropriate to the nature of the personal data held and the risks posed by its processing. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between Players' devices and ar888 servers
• Encryption at rest for stored personal data, including CNIC documents and financial records
• Role-based access controls limiting ar888 staff access to personal data on a strict need-to-know basis
• Multi-factor authentication requirements for all ar888 internal systems accessing Player data
• Regular penetration testing and security audits of the ar888 platform infrastructure
• Incident response procedures for data breach detection, containment, and notification

8.2 In the event of a personal data breach that poses a risk to Players, ar888 will notify affected Players and the relevant regulatory authority in accordance with applicable breach notification requirements as soon as reasonably practicable following discovery of the breach.

9.1 As an internationally regulated gaming operator, ar888 may transfer personal data to service providers, regulatory authorities, and system infrastructure located outside Pakistan. Such transfers are conducted in accordance with the data protection requirements of ar888's regulatory framework.

9.2 Where personal data is transferred to third-party processors outside Pakistan, ar888 ensures that appropriate safeguards are in place — including contractual data processing agreements incorporating data protection obligations equivalent to those applicable to ar888 under its regulatory licence.

9.3 ar888 does not transfer Player personal data to jurisdictions that do not provide an adequate level of data protection without the implementation of appropriate safeguards. Players may request information about the specific safeguards applicable to international transfers by contacting ar888 at the address below.

10.1 The ar888 platform is strictly restricted to individuals who are 21 years of age or older. ar888 does not knowingly collect personal data from any individual under the age of 21. Age verification is conducted via CNIC during mandatory KYC.

10.2 If ar888 discovers that personal data has been collected from an individual under 21 — whether through failed age verification, fraudulent misrepresentation, or any other means — that account will be immediately and permanently closed, all associated data will be deleted except where retention is required by law, and any funds will be returned to the verified payment source.

10.3 Parents and guardians in Pakistan are encouraged to use device-level parental controls and to monitor internet access to prevent minors from accessing the ar888 platform or any other online gambling service.

11.1 ar888 may send marketing communications — including promotional offers, bonus notifications, event alerts, and PSL / cricket betting specials — to Players who have provided consent to receive such communications at the time of registration or subsequently through account settings.

11.2 Consent to marketing is entirely voluntary and separate from acceptance of these Terms. Refusal to consent does not affect your ability to use the ar888 platform or to receive essential service communications (such as transaction confirmations, account security alerts, and regulatory notices).

11.3 You may withdraw your consent to marketing communications at any time by: updating your notification preferences in ar888 account settings; or by contacting ar888 support via live chat or email. Withdrawal of consent will be processed within 5 business days. Please note that withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

11.4 ar888 will not send marketing communications to Players who have activated a responsible gaming self-exclusion, regardless of their marketing consent status. This is a mandatory player protection measure.

12.1 To exercise any of the data rights described in this Privacy Policy — including rights of access, rectification, erasure, restriction, portability, or objection — please contact ar888's support team as follows:

12.2 ar888 will acknowledge your data rights request within 5 business days and will aim to fulfil it within 30 days. For complex requests, this period may be extended by a further 30 days, of which you will be notified in advance.

12.3 ar888 will verify your identity before processing any data rights request. This typically requires confirmation of your registered mobile number and CNIC — a necessary step to prevent unauthorised access to your personal data.

12.4 Data rights requests are processed at no charge, unless requests are manifestly unfounded, repetitive, or excessive — in which case ar888 reserves the right to charge a reasonable administrative fee.

13.1 If you have a complaint about how ar888 handles your personal data, please contact ar888 support in the first instance. ar888 will acknowledge your privacy complaint within 48 hours and aim to resolve it within 14 business days.

13.2 If your privacy complaint is not resolved to your satisfaction through ar888's internal process, you have the right to escalate your complaint to the relevant supervisory authority or data protection regulator under ar888's operating jurisdiction. Details of the applicable authority are available from ar888 support upon request.

13.3 ar888 takes privacy complaints seriously and views them as an opportunity to improve data handling practices. All privacy complaints are reviewed by ar888's compliance team and may result in process updates applicable to all players.

14.1 ar888 reserves the right to update this Privacy Policy at any time to reflect changes in regulatory requirements, data processing practices, or platform functionality. When material changes are made, ar888 will notify Players via the platform or via their registered contact details, where practicable, prior to the changes taking effect.

14.2 The current version of this Privacy Policy is always available at ar888.bio/privacy-policy. The effective date and version number at the top of this document indicate the currently applicable version.

14.3 Continued use of the ar888 platform following the effective date of any updated Privacy Policy constitutes acceptance of the revised terms. Players who do not agree with material changes to this Policy should close their account before the changes take effect.

15.1 All queries, requests, and complaints relating to this Privacy Policy or ar888's data processing practices should be directed to:

15.2 ar888 will never contact you unsolicited to request your password, OTP, full card details, or CNIC scan via email, SMS, or live chat. Any communication purporting to be from ar888 and requesting such information should be treated as fraudulent and reported to ar888 immediately.