Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out the basis on which patti3 ("patti3," "we," "us," or "our") collects, processes, stores, and discloses personal information about individuals who register for or use the patti3 online casino and sportsbook platform, accessible at patti3.net ("Platform").

patti3 takes data privacy seriously. We are committed to handling your personal data with transparency, integrity, and respect. This Policy is designed to give you a clear and honest picture of our data practices so that you can make informed decisions about your use of the patti3 Platform.

This Policy applies to all users of the patti3 Platform, including registered players, prospective registrants who have partially completed the sign-up process, and visitors who browse patti3.net without creating an account. It covers all data collected through the website, any associated mobile applications, live chat, email correspondence, and all other channels through which you interact with patti3.

This Policy should be read alongside patti3's Terms & Conditions and Responsible Gaming Policy, which collectively govern your relationship with the Platform.

2 Who We Are

patti3 is an internationally licensed online gaming platform operating the website at patti3.net. For the purposes of this Privacy Policy, patti3 is the data controller responsible for the personal data you provide when using the Platform.

As data controller, patti3 determines the purposes and means of processing your personal data. Where we engage third-party service providers to process data on our behalf, those parties act as data processors under our instructions and are bound by contractual data protection obligations consistent with this Policy.

If you have any questions about how patti3 handles your personal data, you can contact our Data Protection point of contact at [email protected]. We aim to respond to all privacy-related enquiries within 5 business days.

3 Data We Collect

patti3 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (used to verify the mandatory 21+ age requirement);
• Residential address, including city, province, and postcode;
• CNIC (Computerised National Identity Card) number or equivalent national identification number, collected during KYC verification;
• Username and encrypted password.

3.2 Contact Data

• Email address (primary communication channel);
• Mobile phone number (used for 2FA verification and account security alerts).

3.3 Financial & Transaction Data

• JazzCash, EasyPaisa, or bank account reference details sufficient to process PKR deposits and withdrawals;
• Transaction history including deposit amounts, withdrawal requests, and bonus activity;
• Cryptocurrency wallet addresses where USDT TRC20 is used as a payment method.

3.4 Gaming & Behavioural Data

• Gameplay history — games played, bet amounts, win/loss records, session durations;
• Responsible gaming tool usage — deposit limits set, cooling-off periods activated, self-exclusion requests;
• Bonus and promotion activity — offers claimed, wagering progress.

3.5 Technical & Device Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system, browser type and version;
• Session timestamps, page views, click-stream data, and referral source.

3.6 Communications Data

• Content of live chat conversations, email correspondence, and support tickets submitted to patti3;
• Survey responses and feedback submitted voluntarily through the Platform.

4 How We Collect Data

patti3 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey;
• Automatically via the Platform: Through cookies, web beacons, server logs, and similar tracking technologies as you navigate patti3.net and interact with games;
• From payment providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 processors may share transaction reference data with patti3 for reconciliation and fraud prevention purposes;
• From identity verification providers: Third-party KYC services may return verification status, document authenticity assessments, and watchlist screening results to patti3;
• From fraud prevention and analytics partners: Risk scoring data and device fingerprinting signals used to detect and prevent fraudulent activity on the Platform.

5 Why We Use Your Data

patti3 uses the personal data it collects for the following purposes:

6 Legal Basis for Processing

patti3 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil patti3's obligations to you under the Terms & Conditions — including account management, payment processing, and game provision;
• Legal obligation: Processing required for compliance with applicable laws — including KYC, AML, and regulatory reporting obligations imposed by patti3's licensing authority;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where patti3's legitimate interests are not overridden by your rights and freedoms;
• Consent: Processing for optional marketing communications, where you have given explicit consent. You may withdraw consent at any time by contacting [email protected] or using the unsubscribe function in any marketing email.

7 Data Sharing & Disclosure

patti3 may share your personal data with the following categories of recipients:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and cryptocurrency gateway providers — solely for the purpose of processing your PKR transactions;
• KYC and identity verification providers: Third-party services that verify the authenticity of identity documents and perform watchlist screening as required by our licensing obligations;
• Game software providers: Casino game studios and sportsbook data feed providers that deliver games and market odds through the patti3 Platform may receive anonymised session data necessary for game delivery;
• Fraud prevention and cybersecurity partners: Services that assist patti3 in detecting and preventing fraudulent activity, account takeover attempts, and bot traffic;
• Regulatory authorities: patti3's licensing authority and, where legally required, law enforcement agencies or financial intelligence units;
• Professional advisers: Legal counsel, auditors, and accountants operating under strict confidentiality obligations;
• Business successors: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same data protection standards described in this Policy.

All third-party data processors engaged by patti3 are required to implement appropriate technical and organisational security measures and to process your data only in accordance with patti3's documented instructions.

8 Payment Data & KYC

patti3 operates a comprehensive Know Your Customer (KYC) programme as part of its regulatory compliance obligations. The KYC process requires you to submit a copy of a valid government-issued identity document — typically a Pakistani CNIC — and may additionally require proof of address and source of funds documentation depending on your transaction levels.

KYC documents submitted to patti3 are:

• Stored using encryption at rest on secure, access-controlled infrastructure;
• Processed by authorised patti3 compliance personnel and/or our contracted KYC verification partner;
• Never shared with third parties for any purpose other than regulatory compliance and fraud prevention;
• Retained for a minimum period as required by applicable law, typically five to seven years from the date of account closure.

With respect to payment data specifically, patti3 does not store full JazzCash or EasyPaisa account credentials, full bank account numbers, or cryptocurrency private keys on its own servers. Payment transactions are routed through our payment processor partners' secure infrastructure, and patti3 retains only the transaction reference information necessary for reconciliation and dispute resolution.

9 Cookies & Tracking Technologies

patti3 uses cookies and similar technologies (including web beacons and local storage objects) to operate the Platform effectively and to improve your experience. The following categories of cookies are used:

You can manage or delete cookies through your browser's privacy settings. Please note that disabling functional or analytics cookies may affect certain Platform features. Disabling strictly necessary or fraud prevention cookies may prevent you from accessing the Platform altogether.

patti3 does not use cookies to serve third-party advertising on external websites, and does not participate in cross-site behavioural advertising networks.

10 Data Retention

patti3 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status plus a minimum of five years following permanent account closure, in accordance with anti-money laundering legislation;
• KYC and identity documents: Retained for a minimum of five to seven years from the date of account closure, as required by licensing and AML regulations;
• Transaction records: Retained for a minimum of five years following each transaction for regulatory and audit purposes;
• Customer support communications: Retained for three years from the date of the last communication;
• Technical and device data (logs): Retained for up to 12 months, after which they are deleted or anonymised;
• Marketing consent records: Retained until consent is withdrawn and for one year thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original personal information.

11 Security Measures

patti3 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption at rest and in transit: Sensitive data fields — including passwords, identity document images, and financial references — are encrypted using strong cryptographic algorithms both when stored and when transmitted;
• Access controls: Access to personal data is restricted to patti3 employees and contractors with a documented business need to access that data. All access is logged and subject to periodic review;
• Two-factor authentication (2FA): patti3 strongly recommends and supports 2FA for all player accounts to prevent unauthorised account access;
• Intrusion detection and monitoring: patti3's infrastructure is continuously monitored for suspicious activity, with automated alerts and incident response procedures in place;
• Regular security assessments: patti3 conducts periodic security reviews, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses;
• Staff training: All patti3 staff with access to personal data receive data protection and security awareness training as part of their onboarding and on an ongoing basis.

While patti3 employs all reasonable measures to protect your data, no internet transmission or electronic storage system is entirely infallible. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, patti3 will notify affected players and relevant authorities in accordance with applicable breach notification requirements.

12 Your Data Rights

As a patti3 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request." We will acknowledge your request within 5 business days and aim to respond fully within 30 days.

• Right of Access: You may request a copy of the personal data patti3 holds about you, together with information about how it is processed;
• Right to Rectification: If any personal data patti3 holds about you is inaccurate or incomplete, you have the right to request correction;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to patti3's legal retention obligations — note that AML and KYC data cannot be deleted before the applicable statutory retention period expires;
• Right to Restrict Processing: You may ask patti3 to pause processing of your personal data in certain circumstances, such as while a rectification request is under review;
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, machine-readable format;
• Right to Object: You may object to processing based on legitimate interests. You may also withdraw consent to marketing communications at any time;
• Rights in Relation to Automated Decision-Making: Where patti3 makes decisions about you solely through automated means that have a significant effect on you — such as an account suspension triggered by fraud detection algorithms — you have the right to request human review of that decision.

patti3 will not charge a fee for handling data rights requests unless requests are manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may be applied or the request may be declined with explanation.

13 Minors & Age Verification

patti3 takes the protection of minors extremely seriously. As part of the registration process, all applicants are required to declare their date of birth. Where patti3 has reason to believe that a player may be under the minimum age of 21, the account will be suspended immediately pending age verification. If age verification cannot be completed, or if the player is confirmed to be under 21, the account will be permanently closed and any deposited funds will be returned to the source payment method after deduction of any bonuses already used.

If you are a parent or guardian and believe that your child has registered on patti3 without your knowledge, please contact us immediately at [email protected]. We will investigate and take appropriate action, including permanent closure of the minor's account.

patti3 also recommends that parents and guardians who share devices with minors use parental control software to restrict access to online gaming platforms.

14 International Data Transfers

As an internationally operating online gaming platform, patti3 may transfer your personal data to servers or service providers located outside of Pakistan. Such transfers are necessary for the operation of the Platform, including game delivery, KYC processing, fraud prevention, and customer support.

Where personal data is transferred internationally, patti3 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that bind the receiving party to data protection standards consistent with this Policy;
• Transfer to jurisdictions that maintain an adequate level of data protection as assessed by patti3's legal team;
• Binding corporate rules where data is transferred within a group of companies of which patti3 forms part.

By using the patti3 Platform, you acknowledge that your personal data may be transferred to and processed in countries outside of Pakistan where data protection laws may differ. patti3 commits to taking all reasonable steps to ensure your data remains protected wherever it is processed.

15 Changes to This Policy

patti3 may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or the services we offer. When we make material changes — meaning changes that meaningfully affect how we collect, use, or share your personal data — we will notify you by email to the address associated with your patti3 account and/or by posting a prominent notice on the Platform prior to the changes taking effect.

Non-material changes, such as typographical corrections or minor clarifications that do not alter the substance of the Policy, may be made without individual notification. The "Last Revised" date at the top of this Policy will always reflect the date of the most recent update.

Your continued use of the patti3 Platform following the publication of any updated Privacy Policy constitutes your acknowledgement and acceptance of the revised terms. If you do not accept the updated Policy, you should cease using the Platform and request account closure.

16 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or patti3's handling of your personal data, please contact us through the following channels:

• Email: [email protected] — mark your subject line "Privacy Enquiry" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 on the patti3 Platform — average first response under 2 minutes
• Response Time: Privacy-related email enquiries are typically responded to within 5 business days

If you are not satisfied with patti3's response to your privacy concern, you have the right to escalate the matter by submitting a formal complaint to [email protected] with the subject line "Formal Privacy Complaint." patti3 will acknowledge formal complaints within 48 hours and provide a final written response within 14 days.