rr3 Privacy Policy — How We Collect, Use & Protect Your Personal Data

This Privacy Policy ("Policy") applies to all individuals who access or interact with the rr3 platform at rr3.bio ("Platform"), including registered account holders ("Players"), visitors who browse the rr3 website without registering, and individuals who contact rr3 through any communication channel including email and live chat support.

This Policy should be read in conjunction with the rr3 Terms & Conditions, which govern the broader relationship between rr3 and its Players. By accessing the rr3 Platform, creating an Account, or submitting any personal information to rr3, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection and processing of your personal data as described herein.

rr3's primary user base comprises English-speaking individuals located in Pakistan. Where applicable, references to regulatory frameworks in this Policy reflect rr3's obligations under its international gaming licence and applicable data protection standards. rr3 takes its privacy obligations seriously and commits to handling all Player data with honesty and care.

rr3 collects personal data through several channels: directly from you during registration and account operation, automatically through your interaction with the rr3 Platform (technical and behavioural data), and in limited circumstances from third-party verification services used for KYC compliance.

When you access and use the rr3 Platform, certain technical and behavioural data is collected automatically through server logs, cookies, and similar tracking technologies:

• Device Data: Device type (mobile / tablet / desktop), operating system, browser type and version, screen resolution, mobile carrier (e.g., Jazz, Telenor, Zong, Ufone);
• Network Data: IP address, approximate geographic location derived from IP, connection type (mobile data / Wi-Fi);
• Behavioural Data: Pages visited on rr3, games played, betting markets accessed, session duration, login timestamps, features interacted with;
• Performance Data: Page load times, error logs, crash reports — used to identify and resolve technical issues.

rr3 may receive supplementary identity verification data from third-party KYC service providers engaged to confirm the authenticity of CNIC documents submitted during account verification. rr3 may also receive fraud risk indicators from payment processors (JazzCash, EasyPaisa, and banking partners) as part of transaction security screening. All third-party data providers engaged by rr3 are contractually bound to handle data securely and to share only the minimum information necessary for the stated verification purpose.

rr3 processes your personal data only for purposes that are necessary, proportionate, and lawful. We do not use your data for any purpose not described in this Policy without obtaining your prior consent. The primary purposes for which rr3 processes Player data are:

• Account Administration: Creating, maintaining, and managing your rr3 Account, including processing rr3 login authentication, verifying identity, and enabling access to all Platform features.
• Service Delivery: Processing deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank; crediting winnings; processing withdrawal requests; maintaining accurate transaction records.
• KYC & Regulatory Compliance: Verifying player age (21+), confirming identity through CNIC documentation, and fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) obligations imposed by rr3's international gaming licence.
• Fraud Prevention & Platform Security: Detecting and preventing unauthorised account access, bonus abuse, multi-accounting, money laundering, and other forms of fraud or prohibited conduct.
• Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behaviour; administering deposit limits, self-exclusion requests, and other responsible gaming tools.
• Customer Support: Responding to enquiries, resolving disputes, and improving support quality through review of previous interactions.
• Platform Improvement: Analysing aggregated, anonymised behavioural data to understand how Players use rr3 and to guide product development, game catalogue decisions, and UX improvements.
• Marketing Communications: Sending promotional offers, bonus notifications, and rr3 news updates — but only where you have explicitly opted in to receiving marketing communications. You may withdraw marketing consent at any time via your Account Settings or by emailing [email protected].
• Legal Obligations: Complying with valid legal orders, court directions, or requests from regulatory and law enforcement bodies operating in jurisdictions where rr3 holds authority to operate.

rr3 processes personal data under the following legal bases, in accordance with applicable international data protection principles:

• Contractual Necessity: The majority of data processing on rr3 is necessary for the performance of the contract between rr3 and you as a registered Player — specifically, for Account creation and management, game access, and payment processing. Without this data, rr3 cannot provide its services to you.
• Legal Obligation: rr3 is required by its international gaming licence to conduct KYC verification, maintain records of financial transactions, and report certain activities to regulatory authorities. Processing in this category is non-optional — it is a regulatory obligation that rr3 must fulfil.
• Legitimate Interest: rr3 processes certain data — including fraud detection signals, security logs, and anonymised platform analytics — on the basis of legitimate interest. In each case, rr3 has assessed that its legitimate interest does not override the privacy rights of individual Players.
• Consent: Marketing communications and optional personalisation features are processed exclusively on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time with immediate effect on future processing (without affecting the lawfulness of processing carried out prior to withdrawal).

rr3 may share your personal data with carefully vetted third-party service providers and authorities in the following specific circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT network operators receive the minimum financial data necessary to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and applicable financial regulation.
• Game Studios & Content Providers: Providers such as Evolution Gaming and Pragmatic Play receive anonymised game session data necessary for game operation, RNG certification, and technical auditing. No directly identifying Player information is shared with game studios beyond what is technically required for session management.
• Identity Verification Services: Third-party KYC providers receive CNIC images and identity data exclusively for the purpose of age and identity verification. These providers are bound by strict data processing agreements.
• Fraud Prevention Platforms: Transaction data and behavioural signals may be shared with specialist fraud prevention services to detect and prevent financial crime on the rr3 Platform.
• Regulatory & Law Enforcement Bodies: rr3 will disclose Player data to competent authorities where required by a valid legal order, court direction, regulatory demand, or where rr3 is under a mandatory reporting obligation related to AML/CTF compliance.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by rr3 may access Player data on a strictly confidential, need-to-know basis in connection with specific engagements.

All third parties with whom rr3 shares data are contractually required to process that data only for the specified purpose, to maintain appropriate security standards, and to delete or return the data upon completion of the relevant engagement.

rr3 retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable regulatory and legal obligations. The following retention schedule reflects rr3's standard data retention framework:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with rr3's data disposal protocols. Anonymous or aggregated data that cannot be linked back to individual Players may be retained indefinitely for statistical and platform improvement purposes.

rr3 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate core platform functions, maintain login sessions, analyse Platform usage, and — where you have provided consent — to deliver relevant promotional communications. The following categories of cookies are used on rr3:

• Strictly Necessary Cookies: Essential for the rr3 Platform to function. These enable your rr3 login session to remain active, maintain your game session state, and ensure payment pages load correctly. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences — such as your chosen game lobby view, notification settings, and language preferences — to personalise your rr3 experience across sessions.
• Analytics Cookies: Collect anonymised data about how Players navigate the rr3 Platform — which pages are most visited, where players exit, and how long sessions last. This data informs Platform improvement decisions. Analytics cookies require your consent.
• Marketing & Tracking Cookies: Used to track activity across sessions for the purpose of delivering relevant promotional offers and measuring the effectiveness of rr3's marketing activities. These cookies are only placed with your explicit consent and can be withdrawn via your Account settings or browser controls at any time.

rr3 implements a comprehensive, multi-layered security framework to protect Player personal data against unauthorised access, disclosure, alteration, and destruction. Our primary security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and rr3's servers — including rr3 login credentials, payment details, and personal information — is encrypted using 256-bit TLS, the same standard used by international banking institutions.
• Data Encryption at Rest: Sensitive data stored on rr3's servers — including CNIC data, financial records, and password hashes — is encrypted at rest using AES-256 encryption. Passwords are stored exclusively as salted cryptographic hashes and are irrecoverable even by rr3's own technical team.
• Access Controls: rr3 operates a strict role-based access control system. Staff access to Player data is granted on a strict need-to-know basis and is logged for audit purposes. No staff member has blanket access to the full Player database.
• Two-Factor Authentication (2FA): rr3 offers SMS-based 2FA to all Players. Internal administrative systems require 2FA for all staff access.
• Fraud Detection Systems: rr3 operates real-time transaction monitoring and login anomaly detection systems that flag suspicious activity patterns for review by the rr3 security team.
• Penetration Testing & Security Audits: rr3 conducts periodic independent security assessments to identify and remediate vulnerabilities in the Platform and its data infrastructure.

As an rr3 Player, you hold meaningful rights over your personal data. rr3 is committed to facilitating the exercise of these rights in a timely and cooperative manner. Your rights include:

• Right of Access: You may request a copy of all personal data rr3 holds about you. Requests will be processed within thirty (30) days of receipt.
• Right to Rectification: If any personal data rr3 holds about you is inaccurate or incomplete, you may request that it be corrected. Contact [email protected] with the correction you require and supporting evidence where applicable.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other lawful basis applies. Note that rr3 may be unable to erase certain data that it is legally required to retain under its gaming licence obligations.
• Right to Restrict Processing: You may request that rr3 restrict the processing of your data in certain circumstances, such as where you contest the accuracy of the data while rr3 verifies it.
• Right to Data Portability: You may request that rr3 provide your personal data in a structured, commonly used, machine-readable format for transmission to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interest, and to withdraw consent for processing carried out on a consent basis at any time.
• Right to Withdraw Marketing Consent: You may opt out of marketing communications at any time via your rr3 Account Settings or by emailing [email protected]. Withdrawal of marketing consent does not affect transactional or service communications related to your Account.

To exercise any of the above rights, contact the rr3 Data Privacy team at [email protected] with the subject line "Privacy Rights Request." rr3 will acknowledge your request within five (5) business days and will complete the response within thirty (30) days. Identity verification may be required before certain requests can be processed.

rr3 applies mandatory age verification at registration — no Account can be created without confirmation that the registrant is at least 21 years of age. Where rr3 has reasonable grounds to suspect that an Account holder may be under 21, the Account is immediately suspended pending CNIC-based identity verification. If it is confirmed that an Account was created by an individual under 21 years of age, all data associated with that Account will be deleted in its entirety (with the exception of records retained for regulatory reporting purposes related to the underage access event), and any Real Money deposits will be returned.

rr3 strongly encourages all Pakistani households to implement device-level parental controls to prevent underage individuals from accessing online gambling platforms. Information on parental control software is available from your device manufacturer or mobile carrier.

rr3 reserves the right to amend this Privacy Policy at any time to reflect changes in data processing practices, regulatory requirements, or Platform functionality. When material amendments are made to this Policy, rr3 will provide advance notice to all registered Players via email to their registered address and/or a notice displayed upon login to the rr3 Platform, at least fourteen (14) days prior to the effective date of the changes (except where a shorter notice period is required by law).

The current version and effective date of this Privacy Policy are displayed at the top of this page. rr3 recommends that Players periodically review the Privacy Policy to stay informed of any changes. Your continued use of the rr3 Platform following the effective date of any amendment to this Policy constitutes your acceptance of the revised Privacy Policy. If you do not agree with any change to this Policy, you must cease use of the rr3 Platform and may close your Account by contacting rr3 support.

rr3 takes all privacy enquiries seriously and maintains a dedicated privacy response process. If you have any questions, concerns, or complaints regarding this Privacy Policy or rr3's handling of your personal data, please contact us through the following channel:

• Email: [email protected] — Subject line: "Privacy Policy Enquiry" or "Privacy Rights Request"
• Support Hours: 24 hours a day, 7 days a week
• Response Target: All privacy-related enquiries will receive an acknowledgement within five (5) business days and a substantive response within thirty (30) days

If you believe that rr3 has failed to adequately address your privacy concern, you have the right to escalate your complaint to the relevant regulatory authority under rr3's applicable gaming licence jurisdiction. rr3 cooperates fully with regulatory investigations and takes all compliance findings seriously.