3r3r Privacy Policy

This Privacy Policy ("Policy") describes how 3r3r ("we", "us", "our", or "3r3r") collects, processes, stores, and protects the personal data of users ("you" or "your") who access or use the 3r3r platform, website located at https://3r3r.bio, mobile applications, and all associated services (collectively, the "Platform").

3r3r operates as Pakistan's premier online casino and sports betting platform, offering cricket betting, live dealer casino games, slots, and a full range of PKR-denominated gaming services. Given the financial and sensitive nature of our services, we take our data protection responsibilities very seriously and have designed this Policy to be straightforward, comprehensive, and honest about our practices.

By registering an account on 3r3r, accessing the Platform, or otherwise providing us with your personal information, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

For the purposes of applicable data protection legislation, 3r3r is the data controller in respect of all personal data collected through the Platform. As data controller, 3r3r determines the purposes for which and the means by which your personal data is processed.

If you have any questions about how 3r3r processes your personal data, or if you wish to exercise any of your data protection rights, you may contact our Data Protection team using the contact details set out in Section 15 of this Policy.

3r3r collects different categories of personal data depending on how you interact with the Platform. The following table summarises the main categories of data we collect and specific examples within each category:

We do not intentionally collect any special categories of personal data (such as health data, racial or ethnic origin, political opinions, or religious beliefs) unless you voluntarily provide such information in the context of a responsible gaming request or support query, in which case it is processed solely for the purpose for which it was provided.

3r3r collects personal data through the following channels:

• Direct provision by you: When you register an account, complete identity verification (KYC), make a deposit or withdrawal, contact our support team, or fill in any form on the Platform.
• Automated technical collection: When you browse the Platform, our servers automatically record technical and usage data including your IP address, device identifiers, and navigation behaviour.
• Cookies and similar technologies: As described in Section 10 of this Policy, we use cookies, local storage, and similar technologies to collect data about your interactions with the Platform.
• Identity verification providers: When you submit identity documents, our third-party KYC verification partner processes your documents and returns a verification result to 3r3r. The KYC provider is contractually prohibited from using your data for any other purpose.
• Payment processors: JazzCash, EasyPaisa, and our other payment partners share transaction confirmation data with 3r3r to enable your deposits and withdrawals to be processed correctly.
• Anti-fraud and AML systems: Our fraud detection and anti-money laundering systems generate risk scores and flags based on your account activity, which are used to protect all players on the Platform.

3r3r uses the personal data we collect for the following specific purposes:

• Account creation and management: To register your account, verify your identity, and maintain your player profile on the 3r3r Platform.
• Service delivery: To operate your account wallet, process PKR deposits and withdrawals via JazzCash, EasyPaisa, Raast, and banking channels, and to provide access to all 3r3r gaming and betting products.
• Age and identity verification: To confirm that you are 21 years of age or older, as required by our licensing conditions, and to verify that your identity matches the payment method registered to your account.
• Legal and regulatory compliance: To fulfil our obligations under applicable anti-money laundering laws, gaming regulations, and financial crime prevention requirements, including filing reports with relevant authorities where legally required.
• Customer support: To respond to your support queries, resolve disputes, and handle responsible gaming requests including self-exclusion and deposit limit changes.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, bonus abuse, money laundering, underage gambling, and other prohibited conduct on the Platform.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the features, performance, and user experience of the 3r3r Platform.
• Personalisation: To tailor the gaming experience to your preferences, such as displaying cricket and PSL markets prominently for users who regularly bet on cricket.
• Marketing communications: Where you have opted in, to send you information about relevant bonuses, promotions, new games, and PSL season offers via email or SMS. You can withdraw consent at any time.
• Responsible gaming: To monitor your gaming activity for signs of problem gambling and to proactively offer responsible gaming tools where our systems flag a concern.

3r3r relies on the following legal bases for processing your personal data, depending on the specific purpose:

• Contractual necessity: Processing that is necessary to perform our contract with you — including operating your account, processing transactions, and delivering gaming services.
• Legal obligation: Processing required to comply with applicable law — including age verification, anti-money laundering checks, and regulatory reporting.
• Legitimate interests: Processing necessary for our legitimate business interests — including fraud prevention, platform security, and service improvement — where those interests are not overridden by your data protection rights.
• Consent: Processing based on your explicit consent — including marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

3r3r does not sell your personal data to any third party. We share your data only in the following limited and controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and USDT processing partners receive only the transaction-specific data necessary to process your deposit or withdrawal request.
• Identity verification (KYC) providers: When you submit identity documents for account verification, your documents are processed by our contracted KYC partner. This partner acts as a data processor under our instruction and may not use your data for any independent purpose.
• Fraud and AML service providers: Transaction monitoring, fraud detection, and AML compliance tools operated by specialist third-party providers may process your data as part of our regulatory compliance programme.
• Regulatory authorities and law enforcement: We may be required by law, court order, or regulatory direction to disclose your personal data to government authorities, law enforcement bodies, or our gaming regulator. We will notify you of such disclosures where we are legally permitted to do so.
• IT infrastructure and hosting providers: Our Platform is hosted on secure cloud infrastructure. Hosting providers process data on our behalf under strict data processing agreements.
• Professional advisers: Legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis, subject to professional confidentiality obligations.

All third parties with whom 3r3r shares personal data are required to maintain appropriate security standards and are prohibited from using your data for any purpose beyond what is strictly necessary to deliver the relevant service to 3r3r.

3r3r retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, and in any case for no longer than required by applicable law or our regulatory obligations.

• Active account data: Retained for the full duration that your 3r3r account remains open and active.
• Account closure: Following account closure (whether initiated by you or by 3r3r), we retain your personal data for a minimum period of five (5) years to comply with anti-money laundering record-keeping requirements and to defend against any claims arising from your use of the Platform.
• Financial transaction records: Retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• Identity verification documents: Retained for the period required by our gaming licence and AML obligations, typically five (5) years from the date of verification or account closure, whichever is later.
• Marketing data: If you withdraw consent for marketing, your preference is recorded and your contact details are suppressed from marketing lists. We retain a suppression record to prevent accidental re-contact.
• Support communications: Live chat transcripts and support tickets are retained for three (3) years from the date of the interaction.

When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be associated with you as an individual.

3r3r implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security programme includes, but is not limited to:

• TLS 1.2+ encryption for all data transmitted between your browser or app and our servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records.
• Bcrypt hashing for all account passwords — your password is never stored in a recoverable form.
• Multi-factor authentication (MFA) options available to all account holders for additional login security.
• Role-based access controls ensuring that 3r3r staff can only access the personal data necessary for their specific job function.
• Regular penetration testing and security audits conducted by independent cybersecurity specialists.
• Real-time intrusion detection and 24/7 security monitoring of our infrastructure.
• Secure development practices including code review, dependency scanning, and vulnerability patching on a defined schedule.

3r3r uses cookies and similar browser-based storage technologies to operate the Platform effectively. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on 3r3r:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account authentication state, and enable secure PKR transactions. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming configurations — so you do not need to re-enter them on every visit.
• Analytics Cookies: We use first-party analytics to understand how players navigate the Platform, which games are most popular, and where technical issues may occur. Analytics data is aggregated and not used to identify individuals. No third-party analytics platforms that track behaviour across external websites are used.
• Security Cookies: These cookies support our fraud detection systems by detecting unusual login patterns, rapid account switching, or other behaviours associated with unauthorised access attempts.

We do not use advertising or tracking cookies that follow your activity across websites other than 3r3r. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from accessing your 3r3r account.

Depending on your jurisdiction and the legal basis on which your data is processed, you may have the following rights in relation to your personal data held by 3r3r:

• Right of Access: You may request a copy of the personal data 3r3r holds about you (commonly known as a Subject Access Request). We will provide this within 30 days of receipt of a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request that we delete your personal data. Note that this right is subject to our overriding legal obligations — for example, we cannot erase transaction records that we are legally required to retain under AML law.
• Right to Restriction: You may request that we temporarily restrict the processing of your personal data while a dispute or complaint is being resolved.
• Right to Data Portability: Where processing is based on consent or contract, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling for personalisation purposes. You also have an unconditional right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request". Please include your full name and the email address registered to your 3r3r account so we can identify you correctly. We may need to verify your identity before processing your request.

The 3r3r Platform is strictly for adults aged 21 years and over. We do not knowingly collect, process, or retain personal data relating to any person under the age of 21. Registration by persons under 21 is prohibited under our Terms and Conditions and constitutes a material breach of our user agreement.

If 3r3r becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void any transactions, and permanently delete all associated personal data to the extent permitted by our legal obligations.

3r3r's primary infrastructure is operated within secure data centre facilities. In certain circumstances, personal data may be transferred to or accessed by service providers located outside Pakistan — for example, cloud infrastructure providers or specialist KYC verification platforms.

Whenever personal data is transferred internationally, 3r3r ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy. These safeguards include:

• Contractual data processing agreements incorporating internationally recognised standard contractual clauses.
• Transferring only to jurisdictions or service providers that maintain demonstrably adequate data protection standards.
• Applying data minimisation principles so that only the minimum necessary data is transferred in each case.

3r3r reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will notify you by posting a prominent notice on the Platform and, where we hold your email address, by sending you a notification to your registered email address at least 14 days before the changes take effect.

Minor or non-material changes (such as clarifications of existing practices, correction of typographical errors, or structural formatting updates) may be made without prior notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the 3r3r Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you disagree with any changes, you should stop using the Platform and contact our support team to close your account.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 3r3r handles your personal data, please reach out to our team. We are committed to resolving all data protection enquiries promptly and transparently.

You may contact our Data Protection team via the following channel:

• Email: [email protected] (subject line: "Data Protection Request")
• Live Chat: Available 24/7 directly on the 3r3r Platform
• Response Time: We acknowledge all data protection enquiries within 72 hours

Our support team is available around the clock — whether you are in Karachi, Lahore, Islamabad, or Faisalabad — and will direct your enquiry to the appropriate member of our Data Protection team without delay.