rr33 Privacy Policy

This Privacy Policy ("Policy") describes how rr33 ("rr33", "we", "us", or "our") collects, uses, discloses, stores, and protects personal information obtained from individuals ("you", "your", "player") who access or use the rr33 platform, including the website at rr33.bar, any associated mobile-optimised interface, and all services provided through the rr33 platform.

This Policy is incorporated by reference into the rr33 Terms & Conditions. By registering an rr33 account or otherwise using the rr33 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

rr33 is committed to handling personal data responsibly and in accordance with applicable data protection legislation. We review and update this Policy periodically to reflect changes in our practices, platform features, or applicable law. The current version is always published at rr33.bar/privacy-policy with its effective date displayed at the top of the page.

rr33 is the data controller responsible for the personal data collected through the rr33 platform. As data controller, rr33 determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable data protection obligations under our international gaming licence.

All data-related enquiries, access requests, and complaints should be directed to the rr33 Data Privacy team via live chat support at rr33.bar or by email at [email protected]. Please mark your subject line clearly as "Privacy Request" so that the appropriate team member handles your query promptly.

rr33 collects personal data through several channels: directly from you during registration and platform use, automatically through your device and browser, and from third-party service providers involved in identity verification and fraud prevention. The categories of personal data we collect include the following:

rr33 does not collect sensitive personal data such as biometric identifiers, health information, or political opinions. We do not collect data from social media profiles unless you choose to contact rr33 through a social media channel.

rr33 uses your personal data only for the purposes described in this Policy and does not use it in any manner that is incompatible with those purposes. The primary uses of your personal data are:

• Account administration: Creating and managing your rr33 account, authenticating your identity on login, and maintaining accurate account records.
• Service delivery: Processing your PKR deposits and withdrawals via JazzCash, EasyPaisa, and Pakistani banking partners; settling your sports bets including PSL and international cricket markets; making casino game outcomes available to you.
• Identity and age verification: Confirming that you are at least 21 years of age and that the information you have provided is accurate, as required under our international gaming licence.
• Fraud prevention and security: Detecting and investigating suspicious account activity, multi-accounting, bonus abuse, and unauthorised access attempts.
• Regulatory and legal compliance: Meeting anti-money laundering, counter-terrorism financing, and know-your-customer obligations under our international gaming licence. This includes reporting obligations where legally required.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviour and administering any responsible gaming tools — such as deposit limits, session timers, and self-exclusion — that you have requested.
• Customer support: Responding to your enquiries, resolving disputes, and maintaining records of communications for quality assurance purposes.
• Platform improvement: Analysing aggregated, anonymised usage data to improve rr33's product features, interface design, and service quality.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may opt out at any time via your rr33 account settings or by contacting support.

rr33 processes your personal data only where a valid legal basis exists. The legal bases applicable to rr33's processing activities are as follows:

• Contractual necessity: Processing required to perform the contract between rr33 and you — including account creation, bet settlement, deposit and withdrawal processing, and customer support — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, know-your-customer requirements, and gaming licence conditions, is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and anonymised analytics is carried out on the basis of rr33's legitimate interests, provided those interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications and non-essential cookies is carried out on the basis of your consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

rr33 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data only in the following limited circumstances and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the transaction data necessary to process your deposits and withdrawals. These processors handle your data under their own privacy terms and applicable financial regulations.
• Identity verification providers: rr33 engages third-party KYC and age-verification services to confirm the accuracy of the identity information you provide on registration. These providers receive only the minimum data required for verification.
• Fraud and AML screening services: rr33 uses third-party fraud detection and anti-money laundering screening tools that may process your financial and identity data to flag suspicious activity patterns.
• Regulatory and law enforcement authorities: rr33 may be required to disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where legally compelled to do so. rr33 will notify you of such disclosure where legally permitted.
• Group entities and service providers: rr33 may share data within its corporate group and with contracted technology service providers (such as cloud hosting and data storage providers) who process data strictly on rr33's instructions under data processing agreements.

All third parties who receive personal data from rr33 are contractually required to maintain its confidentiality, use it only for the specific purpose for which it was shared, and apply security standards consistent with those maintained by rr33.

rr33 uses cookies and similar tracking technologies to ensure the platform functions correctly, maintain your logged-in session, remember your preferences, and gather anonymised analytics about how the platform is used. The categories of cookies we use are:

• Strictly necessary cookies: Required for the rr33 platform to operate. These include session authentication cookies and security tokens. They cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your language preferences, responsible gaming settings, and display preferences to provide a more personalised experience on return visits.
• Analytics cookies: Collect anonymised data about pages visited, time on site, and navigation paths to help rr33 improve platform performance and usability. No personally identifiable information is included in analytics reports.
• Marketing cookies: Used only with your consent to deliver relevant promotional content based on your platform activity. You can opt out of marketing cookies at any time via the rr33 cookie preference centre.

rr33 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes the following controls:

• Encryption in transit: All data transmitted between your device and the rr33 platform is encrypted using TLS 1.2 or higher. This protects your login credentials, payment information, and session activity from interception.
• Encryption at rest: Sensitive personal data stored within rr33's infrastructure — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within rr33's systems is restricted to authorised personnel with a documented operational need. Role-based access controls and multi-factor authentication are applied to all internal systems that handle player data.
• Security audits: rr33 conducts regular vulnerability assessments and penetration tests of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Incident response: rr33 maintains a data breach incident response plan. In the event of a security incident that affects your personal data, rr33 will notify affected players and relevant authorities within the timeframes required under applicable law.

While rr33 takes all reasonable steps to protect your data, no digital platform can guarantee absolute security. You also play a role in protecting your account by maintaining a strong, unique password for your rr33 login and not sharing your credentials with any third party.

rr33 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and transaction data: Retained for a minimum of five years following the closure or last active use of your rr33 account, in accordance with anti-money laundering and gaming licence record-keeping requirements.
• Identity verification documents: Retained for five years following account closure or the completion of the verification process for which they were collected, whichever is later.
• Customer support communications: Retained for three years following the closure of the support interaction, unless the interaction relates to a dispute or legal claim, in which case data is retained until the matter is fully resolved.
• Marketing preference records: Consent records are retained for the duration of your rr33 account and for three years following account closure, to demonstrate compliance with opt-in obligations.
• Technical and analytics data: Anonymised analytics data may be retained indefinitely as it contains no personally identifiable information. Raw technical log data (including IP address logs) is retained for up to 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any identifiable individual.

You have the following rights in relation to your personal data held by rr33. To exercise any of these rights, contact the rr33 Data Privacy team via live chat or at [email protected] with the subject line "Privacy Request". rr33 will respond within 30 days of receiving a valid request.

The rr33 platform is strictly intended for individuals aged 21 and above. rr33 does not knowingly collect personal data from any person under the age of 21. Age verification is conducted as part of the rr33 account registration process, and accounts found to be registered by underage individuals are immediately closed, with any deposits returned and data securely deleted to the extent permitted by law.

rr33 recommends that parents and guardians in Pakistan make use of parental control software to restrict access to online gambling platforms for users under the age of 21 in their household.

rr33 operates under an international gaming licence and uses technology infrastructure and service providers located in multiple countries. As a result, your personal data may be transferred to and processed in countries outside Pakistan. Where such transfers occur, rr33 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applied within rr33's principal jurisdiction of operation.

Safeguards for international data transfers may include contractual clauses that require the recipient to apply equivalent data protection standards, or transfers to jurisdictions that maintain data protection frameworks recognised as adequate under international standards.

By using the rr33 platform, you consent to the transfer of your personal data to countries outside Pakistan for the purposes described in this Policy, subject to the safeguards described above.

rr33 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, platform features, or applicable law. When material changes are made, rr33 will notify registered account holders via the rr33 platform interface or by email to the address registered to your account, with reasonable notice before the changes take effect.

The current version of this Policy, together with its effective date, is always accessible at rr33.bar/privacy-policy. Your continued use of the rr33 platform following the publication of an updated Policy constitutes acceptance of the revised terms. If you do not accept a material change, you should cease using the rr33 platform and may contact support to request account closure.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to raise a complaint about rr33's handling of your personal data, please contact the rr33 Data Privacy team through any of the following channels:

• Live Chat: Available 24/7 via the rr33 platform at rr33.bar — click the live chat icon in the bottom-right corner of any page.
• Email: [email protected] — please use the subject line "Privacy Request" or "Privacy Complaint" so your message reaches the correct team.

rr33 will acknowledge your request within 5 business days and provide a substantive response within 30 days. Where a request is complex or involves a large volume of data, rr33 may extend the response period by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with rr33's response to a privacy complaint, you may escalate your complaint to the relevant data protection authority or gaming regulatory body in the jurisdiction under which rr33's international gaming licence is issued.