r3r3 Privacy Policy — Your Data, Your Rights

This Privacy Policy ("Policy") describes how r3r3 ("r3r3", "we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("Player", "User", "you") who access or use the r3r3 website, mobile interface, gaming services, sportsbook, and all related features available at r3r3.app and its sub-domains (collectively, the "Platform").

r3r3 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We have designed this Policy to be clear and readable — not buried in legalese — so that Pakistani players understand exactly what information r3r3 holds about them and what rights they have over it.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. By creating an r3r3 account, making a deposit, or placing a wager, you acknowledge that you have read and understood this Policy.

r3r3 collects personal data across several categories depending on how you interact with the Platform. The table below sets out those categories and specific data points:

r3r3 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where a Player voluntarily discloses health-related information in connection with a responsible gaming request (e.g., a self-exclusion application citing a medical condition), in which case that data is handled with heightened care and used solely for that purpose.

r3r3 collects your personal data through the following means:

3.1 Direct Provision. You provide data directly when you register an r3r3 account, complete our KYC verification process, make a deposit or withdrawal request, contact customer support, submit a formal dispute, or respond to a promotional survey.

3.2 Automated Technical Collection. When you visit and interact with the r3r3 Platform, our servers and analytics systems automatically record technical and usage data. This includes your IP address, device fingerprint, session duration, and game interaction patterns. This collection is necessary for Platform security, fraud prevention, and performance optimisation.

3.3 Third-Party Sources. r3r3 may receive personal data about you from third-party sources in limited circumstances, including:

• Identity verification and KYC providers who cross-check your submitted documents against official databases;
• Payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay) who confirm the validity and ownership of payment instruments;
• Fraud detection and AML screening providers who flag accounts against sanctions lists or known fraud databases;
• Responsible gaming databases, where you have registered a self-exclusion with an external scheme that notifies r3r3.

3.4 Cookies and Tracking Technologies. r3r3 uses cookies, pixel tags, and similar technologies as described in Section 6 below.

r3r3 uses your personal data for the following purposes:

4.1 Account Management. To create, maintain, and administer your r3r3 player account, including processing your registration, verifying your identity, and enabling secure login.

4.2 Service Delivery. To provide you with access to r3r3 casino games, the cricket and PSL sportsbook, live dealer tables, fishing games, and all other Platform features. Your game history and balance data are required to operate these services.

4.3 Payment Processing. To process PKR deposits via JazzCash, EasyPaisa, and bank transfer, and to process withdrawals to your nominated payment method. Financial data is a prerequisite for any monetary transaction on the Platform.

4.4 KYC and AML Compliance. To verify your age (21+ requirement), confirm your identity, conduct due diligence, monitor for money laundering and terrorist financing indicators, and comply with any applicable regulatory reporting obligations.

4.5 Fraud Prevention and Security. To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, collusion, and other prohibited conduct as defined in our Terms & Conditions. Technical and usage data are central to our fraud detection systems.

4.6 Customer Support. To respond to your queries, complaints, and formal disputes. Communications data is retained to ensure continuity of support and to maintain an accurate dispute record.

4.7 Responsible Gaming. To monitor gameplay patterns for indicators of problem gambling, to administer self-exclusion and deposit limit requests, and to fulfil our safeguarding obligations toward vulnerable players.

4.8 Marketing and Promotions. Where you have provided consent, to send you promotional communications about r3r3 offers, new games, PSL betting markets, and platform updates. You may withdraw marketing consent at any time via your account settings.

4.9 Platform Improvement. To analyse aggregated and anonymised usage data for the purpose of improving Platform performance, game selection, and the overall player experience for users across Pakistan.

r3r3 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — operating your account, processing transactions, and delivering gaming services — is carried out on the basis that it is necessary to fulfil our obligations under the Terms & Conditions you accepted at registration.
• Legal Obligation: KYC, AML, and responsible gaming data processing is carried out to comply with applicable legal and regulatory requirements. r3r3 has no discretion to opt out of these obligations.
• Legitimate Interests: Fraud prevention, Platform security, technical data collection, and aggregated analytics are carried out on the basis of r3r3's legitimate interest in operating a secure, fair, and sustainable gaming platform, provided those interests do not override your fundamental rights.
• Consent: Marketing communications and optional cookies are processed only where you have given clear, informed, and freely withdrawable consent. Withdrawing consent does not affect the lawfulness of prior processing.

6.1 What Are Cookies. Cookies are small text files placed on your device when you visit the r3r3 Platform. They allow the Platform to recognise your device, remember your preferences, and collect usage data to improve your experience.

6.2 Types of Cookies r3r3 Uses.

6.3 Managing Cookies. You can control and delete cookies through your browser settings at any time. Disabling strictly necessary cookies will affect Platform functionality and may prevent you from logging in. For all other cookie types, you may update your consent preferences via the cookie settings panel accessible from the footer of every r3r3 page.

r3r3 does not sell your personal data. We share it only in the following controlled circumstances:

7.1 Service Providers. r3r3 engages trusted third-party service providers who process data on our behalf under strict data processing agreements. These include:

• KYC and identity verification partners;
• Payment processing partners (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, USDT processors);
• Cloud hosting and infrastructure providers;
• Fraud detection and AML monitoring providers;
• Customer support platform providers;
• Game software providers whose games are hosted on the r3r3 Platform.

All service providers are contractually prohibited from using your data for any purpose beyond the specific service they are providing to r3r3.

7.2 Legal and Regulatory Authorities. r3r3 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by law, where necessary to comply with a legal obligation, or where disclosure is necessary to protect the rights, safety, or property of r3r3 or third parties.

7.3 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of r3r3's assets, your personal data may be transferred as part of that transaction. r3r3 will notify you via email and a platform notice at least 14 days before any such transfer takes effect, and you will have the option to close your account and withdraw your balance before the transfer completes.

7.4 Responsible Gaming Databases. Where required or appropriate, r3r3 may share self-exclusion data with third-party responsible gaming schemes to ensure that self-excluded players cannot circumvent their exclusion by opening accounts on partner platforms.

8.1 Cross-Border Processing. r3r3 operates as an international online gaming platform. This means that your personal data may be processed on servers located outside of Pakistan. Where data is transferred internationally, r3r3 takes appropriate measures to ensure that the receiving jurisdiction or entity provides an adequate level of data protection.

8.2 Safeguards. International transfers are protected through one or more of the following mechanisms: contractual clauses that bind the recipient to data protection standards equivalent to those applied by r3r3; selection of service providers who maintain internationally recognised security certifications (e.g., ISO 27001); and encryption of data in transit using TLS 1.2 or higher so that the data cannot be read in an intercepted state.

8.3 Player Rights on Transfers. Regardless of where your data is processed, your rights under Section 11 of this Policy remain fully applicable. You may contact r3r3 at any time to request information about the specific safeguards applied to the international transfer of your personal data.

9.1 Retention Principles. r3r3 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory retention obligations, and to resolve any disputes or enforce our agreements.

9.2 Retention Periods. The following general retention periods apply:

9.3 Deletion. At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you. Anonymised, aggregated data may be retained indefinitely for statistical purposes.

10.1 Technical Safeguards. r3r3 implements a multi-layered security architecture to protect your personal data. Key measures include:

• Encryption: All data transmitted between your device and r3r3 servers is encrypted using TLS 1.2 or higher. Sensitive data at rest — including CNIC scans, financial data, and passwords — is encrypted using AES-256.
• Access Controls: Access to systems that hold personal data is restricted on a strict need-to-know basis. All r3r3 staff with data access undergo background screening and are bound by confidentiality obligations.
• Two-Factor Authentication: r3r3 offers and strongly recommends 2FA for all player accounts via your registered Pakistani mobile number (OTP via SMS).
• Intrusion Detection: r3r3 operates 24/7 security monitoring systems designed to detect and respond to unauthorised access attempts, DDoS activity, and abnormal data access patterns.
• Regular Penetration Testing: The r3r3 Platform undergoes regular independent penetration testing to identify and remediate vulnerabilities before they can be exploited.

10.2 Breach Response. In the event of a personal data breach that poses a risk to your rights and freedoms, r3r3 will notify affected Players without undue delay — and in any event within 72 hours of becoming aware of the breach — via email to your registered address. The notification will describe the nature of the breach, the categories and approximate number of players affected, and the steps r3r3 is taking to address it.

r3r3 respects your rights in relation to your personal data. The following rights are available to all Players:

11.1 Right of Access. You have the right to request a copy of the personal data r3r3 holds about you. We will respond to verified access requests within 30 days. The first copy is provided free of charge; subsequent requests within a 12-month period may attract a reasonable administrative fee.

11.2 Right to Rectification. If any personal data r3r3 holds about you is inaccurate or incomplete, you have the right to request correction. Most identity and contact data can be updated directly via your account settings; for data requiring documentary evidence (e.g., a name change), please contact support.

11.3 Right to Erasure. You may request deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and no other legal basis applies; or (c) you object to processing and there are no overriding legitimate grounds. r3r3 will balance erasure requests against mandatory retention obligations — for example, KYC and transaction data subject to AML retention requirements cannot be deleted before the mandatory period expires.

11.4 Right to Restriction. You may request that r3r3 restrict processing of your data in certain circumstances, such as while the accuracy of data is being verified or while an objection is being assessed.

11.5 Right to Data Portability. Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another service provider.

11.6 Right to Object. You have the right to object to processing based on legitimate interests — including profiling for fraud detection and marketing analytics. r3r3 will cease that processing unless we demonstrate compelling legitimate grounds that override your interests.

11.7 Withdrawing Marketing Consent. You may withdraw consent to receive marketing communications at any time by: (a) updating your notification preferences in account settings; or (b) clicking the unsubscribe link in any marketing email. Withdrawal does not affect prior processing.

12.1 Age Restriction. r3r3 is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process requires all Players to confirm they are 21 years of age or older, and our KYC verification process is designed to identify and reject underage applicants.

12.2 Discovery of Underage Data. If r3r3 discovers or is notified that personal data has been collected from a Player who was under 21 at the time of registration, we will immediately suspend the account, initiate a refund of any net deposits, and permanently delete all personal data associated with that account within 14 days of discovery, subject only to any overriding legal obligation to retain records of the underage registration incident itself.

12.3 Parental or Guardian Reports. If you believe a minor in your household has registered on the r3r3 Platform, please contact our support team immediately via live chat in your account dashboard or at [email protected]. We will treat such reports as a priority and respond within 24 hours.

13.1 Safeguarding Data Use. r3r3 uses certain categories of your personal data — particularly gameplay frequency, session duration, deposit patterns, and wager size — to power our responsible gaming monitoring systems. This is one of the most important ways we use your data, and we treat it with the utmost care.

13.2 Self-Exclusion Records. Where you elect to self-exclude from r3r3, your self-exclusion record is retained for the full duration of the exclusion period and for a minimum of five (5) years thereafter. This data is never deleted early, even if you request account erasure, because the retention of self-exclusion records is essential to protect your wellbeing and to prevent circumvention of the exclusion.

13.3 Data Shared With Support Agents. r3r3 customer support and responsible gaming agents may access your gameplay data, deposit history, and responsible gaming flags when assisting you with a safeguarding concern. This access is strictly limited to what is necessary to help you and is subject to confidentiality obligations.

For full details of r3r3's responsible gaming tools, self-exclusion options, and support resources, please visit our Responsible Gaming page.

14.1 Right to Update. r3r3 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. We are committed to keeping this Policy current and accurate.

14.2 Notice of Material Changes. Where a proposed change is material — meaning it substantively affects your rights or the ways in which we use your data — r3r3 will provide at least seven (7) days' advance notice via: (a) an email to your registered address; and (b) a prominent notice on the r3r3 Platform. For non-material changes such as typographical corrections or clarifications that do not alter the substance of the Policy, r3r3 may update the Policy without advance notice, updating the "Last Updated" date at the top of this page.

14.3 Continued Use as Acceptance. Your continued use of the r3r3 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to a material change, you have the right to close your account and withdraw your balance before the change takes effect.

14.4 Version Archive. r3r3 maintains an internal archive of all prior versions of this Privacy Policy. Players may request a copy of a previous version by contacting support.

15.1 Data Controller. The data controller responsible for your personal data is r3r3, operating the Platform at r3r3.app. All data protection queries, rights requests, and privacy complaints should be directed to our Data Protection team.

15.2 How to Reach Us. You may contact r3r3 regarding any privacy matter through the following channels:

• Live Chat: Available 24/7 via your r3r3 account dashboard — the fastest way to reach us.
• Email: [email protected] — include "Privacy Request" in the subject line for priority routing.

15.3 Identity Verification. To protect your privacy, r3r3 will verify your identity before processing any data rights request. You may be asked to confirm your registered email address, your full name as it appears on your account, and to complete an additional authentication step.

15.4 Response Timeframe. r3r3 aims to acknowledge all privacy-related contacts within 48 hours and to fully resolve requests within 30 days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, and we will notify you of the extension and the reason for it.

15.5 Complaints. If you are not satisfied with r3r3's handling of your personal data or response to a data rights request, you have the right to escalate your complaint. r3r3 takes all privacy complaints seriously and has an internal escalation process. Details of how to escalate a complaint are available from our support team.