rr3 Privacy Policy – Data Protection Statement

rr3 ("we", "us", "the Platform") operates the online gaming and sports betting website located at rr3.asia. rr3 is the data controller responsible for the personal data of its registered users ("you", "the User"). This Privacy Policy applies to all personal data collected through your use of rr3.asia, including account registration, deposits, betting activity, customer support communications, and any other interaction with our platform.

If you are a Pakistani player using rr3 – whether based in Karachi, Lahore, Islamabad, Rawalpindi, or anywhere else in Pakistan – this Policy governs how your data is handled every time you access your rr3 account or use any service on rr3.asia.

rr3 collects only the personal data necessary to operate the platform, verify user identity, process payments, and comply with applicable legal obligations. The categories of data we collect are as follows:

rr3 does not collect sensitive personal data beyond what is strictly necessary for KYC verification and regulatory compliance. We do not store full payment card numbers.

rr3 collects personal data through the following channels:

• Direct submission – Information you enter when creating your rr3 account, completing KYC, making a deposit, or contacting support
• Automated collection – Technical data (IP address, device information, browser type) collected automatically when you access rr3.asia
• Payment providers – Transaction confirmation data received from JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and other integrated payment services
• Cookies and similar technologies – Session and preference data collected via cookies on rr3.asia (see Section 9)
• Third-party verification services – Identity verification data returned by KYC service providers engaged by rr3

rr3 uses your personal data for the following purposes:

• To create and manage your rr3 account, including authentication and profile maintenance
• To verify your identity and age in compliance with our 18+ policy and KYC requirements
• To process PKR deposits and withdrawals via JazzCash, Easypaisa, and bank transfers
• To monitor account activity for fraud prevention, anti-money laundering compliance, and security
• To personalise your experience on rr3, including game recommendations and relevant promotions
• To deliver account-related communications including transaction confirmations, security alerts, and support responses
• To monitor responsible gaming indicators and enforce deposit limits, loss limits, and self-exclusion
• To comply with applicable legal and regulatory obligations
• To analyse platform performance and improve rr3 services

rr3 processes your personal data on the following legal grounds:

• Contractual necessity – Processing required to perform the rr3 user agreement, including account creation, payment processing, and game provision
• Legal obligation – Processing required to comply with KYC, AML, and other applicable regulatory requirements
• Legitimate interests – Processing for fraud prevention, security monitoring, responsible gaming enforcement, and platform improvement, where these interests are not overridden by your rights
• Consent – Processing for optional activities such as marketing communications, where you have given specific consent that can be withdrawn at any time

rr3 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share data only in the following circumstances and only to the extent necessary:

• Payment processors – JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, and similar payment providers receive only the data required to process your transactions
• KYC and identity verification providers – Specialist third-party services that assist rr3 in verifying user identity documents in compliance with regulatory requirements
• Gaming software providers – Game studios and RNG certification bodies whose games are hosted on rr3 may receive anonymised session data for technical purposes
• Legal authorities – rr3 will disclose personal data to law enforcement, regulatory bodies, or courts when legally required to do so
• Business transfers – In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections

All third parties engaged by rr3 are bound by contractual data protection obligations and are not permitted to use your data for their own purposes beyond the scope of their engagement with rr3.

rr3 is required to collect and retain Know Your Customer ("KYC") documentation for all accounts prior to withdrawal processing. This includes copies of your CNIC, selfie verification images, and proof of payment method.

KYC documents are stored in encrypted form on secure servers. Access is restricted to authorised rr3 compliance personnel and our contracted KYC verification provider. Documents are not shared with any other third party except where legally required.

KYC documents are retained for the duration of your rr3 account relationship and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping obligations.

If your KYC submission is rejected, rr3 will securely delete the rejected documents within 30 days and notify you of the reason for rejection so you can resubmit with correct documentation.

rr3 processes all transactions in Pakistani Rupees (PKR). When you make a deposit via JazzCash or Easypaisa, rr3 receives a transaction reference and your mobile wallet number for reconciliation purposes. For bank transfers, rr3 receives the transaction reference, amount, and originating bank details.

rr3 does not store full bank account credentials or payment card numbers. Financial data is processed over SSL-encrypted connections. Your JazzCash or Easypaisa number is stored only in your rr3 account profile in encrypted form and is used solely for payment processing and withdrawal verification.

All financial transaction records are retained for a minimum of seven (7) years in compliance with financial record-keeping obligations.

rr3.asia uses cookies and similar technologies to operate the platform, remember your preferences, and analyse usage patterns. The following cookie categories are used:

• Essential cookies – Required for the rr3 platform to function. These include session authentication cookies that keep you logged in to your rr3 account. These cannot be disabled.
• Functional cookies – Remember your preferences such as language settings, display choices, and game history within your session.
• Analytics cookies – Collect anonymised data about how users interact with rr3.asia to help us improve the platform. Data collected is aggregated and not linked to individual identities.
• Security cookies – Help detect and prevent fraudulent login attempts and automated bot activity on rr3.

You can manage non-essential cookie preferences through your browser settings. Note that disabling functional cookies may affect your rr3 experience. Essential and security cookies cannot be disabled without preventing platform access.

rr3 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data – Retained for the duration of your active rr3 account plus 5 years after closure
• KYC documents – Minimum 5 years after account closure
• Financial transaction records – Minimum 7 years in compliance with financial regulations
• Customer support communications – 3 years from the date of the communication
• Technical/log data – 12 months from collection, unless retained longer for active security investigations

On expiry of the applicable retention period, rr3 will securely delete or anonymise your personal data in accordance with our internal data destruction procedures.

rr3 implements technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption across all rr3.asia connections
• Passwords stored using industry-standard hashing algorithms (not reversible or readable by staff)
• Two-factor authentication available for all rr3 accounts
• Role-based access controls limiting internal data access to authorised personnel only
• Regular security assessments and penetration testing of the rr3 platform
• Encrypted storage of sensitive documents including KYC files

Notwithstanding these measures, no internet-based platform can guarantee absolute security. In the event of a data breach affecting your personal data, rr3 will notify you and the relevant regulatory authorities in accordance with applicable legal obligations and within the timeframes prescribed by law.

Subject to applicable law, you have the following rights in relation to your personal data held by rr3:

• Right of access – Request a copy of the personal data rr3 holds about you
• Right to rectification – Request correction of inaccurate or incomplete data in your rr3 account
• Right to erasure – Request deletion of your personal data, subject to retention obligations that override this right
• Right to restrict processing – Request that rr3 restricts processing of your data in certain circumstances
• Right to data portability – Request your data in a structured, machine-readable format where technically feasible
• Right to object – Object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent – Withdraw consent for any processing activity based on your consent (e.g., marketing emails) at any time

To exercise any of these rights, contact rr3 using the details in Section 15. rr3 will respond to verified requests within 30 days. Note that some rights are subject to overriding legal obligations – for example, rr3 cannot delete financial transaction records within the mandatory 7-year retention period.

rr3 does not knowingly collect personal data from any person under the age of 18. Our platform is strictly for adults only, and all account registrations are subject to age verification through the KYC process.

If rr3 discovers that personal data has been collected from a person under 18, the associated account will be immediately closed, all data will be securely deleted, and any deposited funds will be returned subject to verification of the depositing payment method. Any winnings accumulated by an underage user will be forfeited.

If you believe that an underage person has registered an rr3 account, please contact us immediately using the details in Section 15.

rr3 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, rr3 will notify registered users via their account email address and update the "Last updated" date at the top of this page.

Continued use of rr3.asia following notification of a Policy update constitutes your acceptance of the revised terms. If you do not accept the updated Privacy Policy, you should cease use of rr3 and contact us to request account closure.

For any questions, data subject requests, or privacy concerns regarding this Policy or your personal data held by rr3, please contact our data protection team:

Email: [email protected]

Please include your registered rr3 account email address in your correspondence so we can identify your record promptly. rr3's team will respond to privacy enquiries within 30 calendar days of receipt.