3rrr Privacy Policy — How We Protect & Handle Your Data

1Introduction & Scope

3rrr is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy sets out in clear terms exactly what personal information 3rrr collects from you, the purposes for which it is processed, the legal grounds that permit that processing, and the rights you hold over your own data.

This Policy applies to all personal data collected through the 3rrr website at 3rrr.bid, through any related mobile-optimised web experience, through direct communications between you and our customer support team, and through any transaction or gaming activity conducted on the 3rrr Platform. It covers data collected from Pakistani players and any other users accessing the Platform regardless of their location.

This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are published on the 3rrr Platform. These documents together constitute the full agreement governing your relationship with 3rrr.

2Data Controller

For the purposes of applicable data protection legislation, 3rrr acts as the data controller in respect of all personal information collected and processed through the 3rrr Platform. As data controller, 3rrr determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection standards and the requirements of our international gaming licence.

In certain circumstances — for example, where 3rrr uses third-party game providers, payment processors (including JazzCash and EasyPaisa), or identity verification services — those third parties may act as independent data controllers or as data processors acting on 3rrr's behalf. Section 7 of this Policy provides further detail on data sharing with such third parties.

3Information We Collect

3.1 Registration & Account Data

When you create a 3rrr account, we collect:

• Identity information: Full legal name, date of birth, Pakistani CNIC number or passport number;
• Contact information: Pakistani mobile number, email address, residential address;
• Login credentials: Username and hashed password (your actual password is never stored in readable form);
• Account preferences: Language settings, communication preferences, and responsible gaming tool configurations.

3.2 KYC Verification Data

To comply with our international gaming licence requirements and to prevent fraud and underage access, 3rrr collects:

• Photographic identity documents (CNIC, passport);
• Proof of address documentation;
• Proof of payment method ownership (bank statement, mobile wallet screenshot);
• Selfie or liveness verification images where required by our KYC process.

3.3 Financial Transaction Data

• PKR deposit amounts, dates, and payment method identifiers (JazzCash wallet number, EasyPaisa number, bank account last four digits);
• Withdrawal requests, amounts, processing dates, and destination account details;
• Transaction history and balance movements within your 3rrr PKR wallet.

3.4 Gaming & Betting Activity Data

• Bet history, stake amounts, game selection, session durations, win/loss records;
• Live casino hand histories, slot spin records, and instant game results;
• Cricket and sports betting market selections and settlement records;
• Bonus and promotion usage and wagering completion data.

3.5 Technical & Usage Data

• IP address, device type, operating system, and browser information;
• Pages visited on the 3rrr Platform, session duration, and navigation patterns;
• Login timestamps and geographic location data derived from IP address;
• Cookies and tracking data as described in Section 6 of this Policy.

3.6 Communications Data

• Records of all communications between you and 3rrr customer support, including live chat transcripts, email correspondence, and any complaint submissions;
• Survey responses and feedback submitted voluntarily through the Platform.

4How We Use Your Data

3rrr uses personal data collected from you for the following specific purposes:

5Legal Basis for Processing

3rrr processes your personal data on the following legal grounds, each of which applies to the corresponding processing activities:

• Contractual necessity: Processing required to perform the contract between you and 3rrr — including account creation, payment processing, game access, and customer support;
• Legal obligation: Processing required to comply with our international gaming licence conditions, anti-money laundering obligations, and applicable regulatory requirements — including KYC verification and transaction monitoring;
• Legitimate interests: Processing necessary for 3rrr's legitimate interests in operating a secure, compliant, and commercially viable gaming platform — including fraud prevention, security monitoring, responsible gaming oversight, and platform analytics, provided such interests are not overridden by your fundamental rights;
• Consent: Processing based on your explicit, freely given consent — primarily marketing communications and certain non-essential cookies. You may withdraw consent for consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.

6Cookies & Tracking Technologies

The 3rrr Platform uses cookies and similar tracking technologies to provide, maintain, and improve the Platform's functionality and to enable certain analytics and marketing features. A cookie is a small text file placed on your device by the Platform when you visit. Cookies do not directly identify you as an individual but are linked to your session or account.

6.1 Categories of Cookies Used by 3rrr

• Essential cookies: Strictly necessary for the Platform to function — session management, login authentication, security tokens, and fraud detection. These cannot be disabled without materially impairing your ability to use 3rrr;
• Functional cookies: Remember your preferences, language settings, and account configurations to provide a personalised experience across sessions;
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the 3rrr Platform — pages visited, session lengths, error reports — to help us improve performance;
• Marketing cookies: Used with your consent to personalise promotional communications and measure the effectiveness of marketing campaigns directed to 3rrr players.

You may control cookie settings through your browser preferences. Disabling non-essential cookies will not prevent you from accessing the 3rrr Platform but may affect certain personalisation and analytics features. Essential cookies cannot be disabled through browser settings without rendering the Platform non-functional.

7Data Sharing & Disclosure

3rrr shares your personal data only in the following circumstances and only with the categories of recipients identified below:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment processors receive the minimum personal and financial data necessary to process your PKR deposits and withdrawals;
• Identity verification providers: Specialist KYC and age verification service providers receive identity documentation to conduct required verification checks on 3rrr's behalf;
• Game providers and technology partners: Licensed game studios and software providers that supply games to the 3rrr Platform receive session data necessary to deliver, operate, and audit those games;
• Regulatory and licensing authorities: Our gaming licensing authority and any other competent regulatory body may receive data as required by our licence conditions and applicable law;
• Law enforcement and fraud prevention: We may disclose data to law enforcement agencies, regulatory bodies, or financial intelligence units where required by law, court order, or where we have a legitimate basis to report suspected criminal activity;
• Professional advisers: Legal, financial, and audit advisers may access personal data strictly within the scope of the professional engagement;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 3rrr's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom 3rrr shares personal data are required — either by contractual obligation or by applicable law — to process that data solely for the specified purpose, to maintain appropriate security measures, and not to use it for any independent commercial purpose.

8International Data Transfers

As 3rrr operates under an international gaming licence and works with technology providers, game studios, and service partners located in multiple countries, your personal data may be transferred to and processed in countries outside Pakistan. These may include countries whose data protection laws differ from those applicable in Pakistan.

Where personal data is transferred internationally, 3rrr takes appropriate measures to ensure that adequate protection is afforded to your data. These measures include: contractual clauses that require data recipients to apply equivalent data protection standards; use of providers that are certified under recognised international privacy frameworks; and processing arrangements that comply with the data protection obligations of our gaming licence jurisdiction.

9Data Retention

3rrr retains personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with our legal and regulatory obligations. The following general retention standards apply:

• Active account data: Retained for the full duration of your account relationship with 3rrr and for a period of five (5) years after account closure, in compliance with anti-money laundering record-keeping requirements;
• KYC verification documents: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, whichever is later, as required by our international gaming licence;
• Transaction records: Retained for seven (7) years from the date of the relevant transaction to meet financial record-keeping obligations;
• Customer support communications: Retained for three (3) years from the date of the communication or from the resolution of any dispute to which the communication relates;
• Marketing consent records: Retained until the consent is withdrawn and for a reasonable period thereafter as evidence of the consent previously given;
• Self-exclusion records: Retained for the full duration of the self-exclusion period and for five (5) years thereafter to prevent re-registration during exclusion.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

10Your Data Rights

Subject to the applicable legal framework and any overriding obligations 3rrr has under its gaming licence or applicable law, you hold the following rights in respect of your personal data held by 3rrr:

To exercise any of these rights, contact 3rrr's Data Protection contact at the email address provided in Section 16. We will respond to all verifiable data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days with prior notification.

Please note that certain rights — particularly the right to erasure — may be limited by our legal obligations under the gaming licence (including AML record-keeping requirements) and applicable law. Where 3rrr is unable to fulfil a data rights request in full, we will explain the reason in our response.

11Children & Minors

The 3rrr Platform is strictly intended for adults aged 21 years and above. 3rrr does not knowingly collect personal data from any individual under the age of 21. Age verification is a core component of the 3rrr registration process, and all account holders are required to confirm their age and submit identity verification confirming their date of birth.

If 3rrr discovers or has reasonable grounds to believe that an account is held by a person under the age of 21, that account will be immediately suspended, all gaming activity will be voided, and any funds held in the account will be returned to the depositing payment method. The personal data associated with the underage account will be retained only for the period necessary to complete this remediation process, after which it will be securely deleted, subject to any mandatory record-keeping obligations.

If you believe that a minor has registered on the 3rrr Platform, please contact our support team immediately so that prompt action can be taken.

12Security Measures

3rrr implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption of all data transmitted between your device and the 3rrr Platform;
• Password hashing using modern cryptographic algorithms — your actual password is never stored in readable form in our systems;
• Access controls limiting access to personal data to authorised personnel on a strict need-to-know basis;
• Regular security audits conducted by independent third-party security assessors;
• Intrusion detection and monitoring systems operating continuously to identify and respond to potential security incidents;
• Segregated data storage ensuring that player funds and player personal data are held in separate secure environments.

Despite these measures, no internet-based platform can guarantee absolute security against all possible attack vectors. In the unlikely event of a personal data breach that is likely to result in a high risk to your rights and freedoms, 3rrr will notify affected individuals promptly and will report the breach to the relevant supervisory authority in accordance with its obligations under applicable data protection law.

13Marketing Communications

With your explicit consent, 3rrr may send you promotional communications relating to 3rrr products, bonuses, game releases, seasonal campaigns (including Eid and Ramadan promotions conducted with full cultural sensitivity), and VIP programme updates. These communications may be delivered via email, SMS to your registered Pakistani mobile number, or in-platform notifications.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email from 3rrr;
• Updating your communication preferences within your 3rrr account settings;
• Contacting 3rrr support and requesting removal from marketing communications.

Withdrawal of marketing consent does not affect the delivery of transactional communications that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, bet settlement results, and account security alerts. These operational communications are sent on the basis of contractual necessity and cannot be disabled while your account remains active.

14Third-Party Links & Services

The 3rrr Platform may contain references to third-party services, game providers, or payment processors. While 3rrr carefully selects its third-party partners, we are not responsible for the privacy practices or content of third-party websites or services that are operated independently of 3rrr. This Privacy Policy applies solely to data collected and processed by 3rrr through the 3rrr Platform.

Where 3rrr engages third-party data processors, appropriate data processing agreements are in place requiring those processors to implement equivalent data protection standards and to process personal data only on 3rrr's documented instructions.

15Changes to This Privacy Policy

3rrr may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, updates to our licensing obligations, or improvements to the 3rrr Platform. The effective date displayed at the top of this document will always reflect the date of the most recent revision.

Where changes are material — meaning they substantially affect your rights or how your data is used — we will notify you by email to the address registered on your 3rrr account and by displaying a prominent notice on the Platform, providing at least fourteen (14) calendar days' notice before the changes take effect. For non-material changes such as editorial clarifications, the updated Policy will be published with the revised effective date without individual notification.

Your continued use of the 3rrr Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the changes. If you do not accept the revised Privacy Policy, you should discontinue use of the Platform and contact support to request account closure.

16Contact & Data Protection Enquiries

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, wish to report a suspected data breach, or have any other privacy-related concerns about 3rrr's data processing activities, please contact our data protection team using the details below:

Please include your full name, registered email address, a description of your request or concern, and — where applicable — the specific right you wish to exercise. We may be required to verify your identity before processing a data rights request to ensure that personal data is not disclosed to an unauthorised party.

If you are not satisfied with 3rrr's response to a privacy concern or data rights request, you have the right to escalate your complaint to the relevant supervisory authority designated under the data protection framework applicable to your situation. Details of the relevant authority are available upon request.