3patta Privacy Policy

1. Data Controller

For the purposes of this Privacy Policy, the data controller responsible for your personal data is the operator of the 3patta Platform at https://3patta.org, operating under an international gaming licence. When this policy refers to "3patta," "we," "us," or "our," it refers to this entity in its capacity as data controller.

As data controller, 3patta determines the purposes and means by which your personal data is processed. Where third-party service providers process data on our behalf — such as payment processors including JazzCash and EasyPaisa, or KYC verification providers — they do so as data processors acting under our written instructions and subject to contractual data protection obligations.

Any questions regarding how your data is handled, or requests to exercise your data rights, should be directed to [email protected] with the subject line "Data Privacy Request."

2. How We Collect Your Data

2.1 Data You Provide Directly

The majority of personal data 3patta holds about you is information you provide voluntarily during your interaction with the Platform:

• Registration: When you create a 3patta account, you provide your full legal name, date of birth, residential address, CNIC number, email address, and Pakistani mobile number.
• KYC Verification: To comply with our licensing obligations and process withdrawals, you submit identity documents such as a copy of your CNIC, proof of address, and payment method ownership verification.
• Financial Transactions: When you make a deposit or withdrawal via JazzCash, EasyPaisa, HBL, UBL, SadaPay, or USDT TRC20, transaction reference data is captured and linked to your account.
• Support Interactions: Any messages you send to the 3patta support team via live chat or email are retained as part of your communication record.
• Responsible Gaming Tools: When you set deposit limits, request a cooling-off period, or activate self-exclusion, we record those instructions and the dates they were applied.

2.2 Data Collected Automatically

When you access the 3patta Platform, certain technical data is collected automatically by our systems:

• Device & Browser Data: Device type, operating system, browser version, screen resolution, and language settings.
• Connection Data: IP address, approximate geographic location derived from IP, internet service provider, and connection timestamps.
• Session & Gameplay Data: Pages visited, games launched, bet amounts, outcomes, session start and end times, and navigation patterns within the Platform.
• Cookie Data: Data stored via cookies and similar tracking technologies as described in Section 7 of this policy.

2.3 Data From Third Parties

In limited circumstances, 3patta may receive data about you from third parties, including: identity verification results from our KYC service provider, fraud risk signals from payment processors, and — where you have given consent — data from responsible gaming third-party databases that maintain self-exclusion registers.

3. How We Use Your Data

3patta uses your personal data only for the purposes set out in this policy. The primary uses are:

• Account Management: Creating, maintaining, and operating your 3patta account, including processing login authentication and account security alerts.
• Payment Processing: Facilitating deposits and withdrawals in PKR through your chosen payment method and reconciling transaction records.
• Identity & Age Verification: Confirming that you are who you say you are and that you meet the 21+ age requirement as a condition of using the Platform.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, duplicate accounts, money laundering, and other prohibited activities.
• Regulatory Compliance: Meeting our obligations under the terms of our international gaming licence, including anti-money laundering (AML) reporting, responsible gaming monitoring, and record-keeping requirements.
• Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling indicators and intervening appropriately, including enforcing player-set limits and self-exclusion instructions.
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions for quality and compliance purposes.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, design, and content of the 3patta Platform.
• Marketing (with consent only): Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive marketing communications.

4. Data Sharing & Disclosure

3patta does not sell your personal data. We share your data with third parties only in the following defined circumstances:

4.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to assist in operating the Platform. These include payment processing partners (JazzCash, EasyPaisa, HBL, UBL, SadaPay, and USDT TRC20 infrastructure providers), KYC and identity verification providers, cloud hosting and infrastructure providers, customer support platform providers, and fraud detection and analytics services. All processors are contractually bound to handle your data securely and only for the specified purpose.

4.2 Regulatory & Legal Disclosure

3patta is obligated to disclose player data to its licensing regulatory authority upon request, and to law enforcement or financial intelligence authorities where required by applicable law. This includes suspicious transaction reports under anti-money laundering obligations. Such disclosures are made without prior notice to you where legally required.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of 3patta's assets, player data may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to data handling practices via the email address on your account.

4.4 Responsible Gaming Registers

Where you activate self-exclusion on the 3patta Platform, your details may be shared with third-party responsible gaming self-exclusion register services to help enforce your exclusion across participating operators. This sharing is in your interest and forms part of our responsible gaming obligations.

5. Data Retention

3patta retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by our licensing and legal obligations:

• Account and KYC records: Retained for a minimum of five (5) years after account closure, as required by anti-money laundering regulations applicable under our international gaming licence.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Responsible gaming records: Self-exclusion records are retained indefinitely to prevent circumvention through re-registration. Limit and cooling-off records are retained for five years.
• Support communications: Retained for three (3) years after the resolution of the relevant issue.
• Marketing consent records: Retained for the duration of the consent plus three years following withdrawal of consent.
• Technical and session logs: Retained for twelve (12) months for security and fraud detection purposes, then anonymised.

Once the applicable retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you as an individual.

6. Security Measures

3patta implements a layered security framework to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in Transit: All communications between your device and 3patta's servers are encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at Rest: Sensitive personal data, including identity documents and financial data, is encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and regular data protection training.
• Two-Factor Authentication: 3patta offers 2FA for all player accounts via Pakistani mobile number OTP, and requires 2FA for all internal administrative access to production systems.
• Penetration Testing: The Platform undergoes regular third-party security penetration testing and vulnerability assessments.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, 3patta will notify the relevant regulatory authority within 72 hours and affected players without undue delay.

7. Cookies & Tracking Technologies

3patta uses cookies and similar tracking technologies on the Platform for operational, security, and analytical purposes. The categories of cookies used are:

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including session management, login authentication, and security tokens. These cannot be disabled without preventing you from using the Platform.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method display, and UI customisations. These improve your experience but are not essential.
• Analytical Cookies: Help us understand how players use the Platform — which pages are visited most, where sessions are abandoned, and how game lobbies are navigated. This data is aggregated and anonymised.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and duplicate account creation.

3patta does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect the Platform's functionality. Your continued use of the Platform constitutes consent to our use of cookies as described above.

8. Minors & Age Verification

The 3patta Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under this age. Age verification is a mandatory step of the 3patta registration and KYC process.

If 3patta discovers that personal data has been collected from an individual under 21 years of age, that account will be immediately closed, all associated data will be deleted, and any deposited funds will be returned to the originating payment method after completing standard anti-money laundering checks. If you believe a minor has registered on the Platform, please contact us immediately at [email protected].

9. International Data Transfers

As an internationally licensed gaming operator, 3patta's data infrastructure may involve the transfer of your personal data to servers or service providers located in countries outside your country of residence, including outside Pakistan. Where such transfers occur, 3patta ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this policy.

Safeguards used for international transfers include contractual clauses equivalent to internationally recognised standard contractual clauses, data processing agreements with all third-party processors, and selection of service providers located in jurisdictions with recognised adequate data protection frameworks.

10. Exercising Your Rights

To exercise any of your data rights described in this policy — including access, rectification, erasure, restriction, portability, objection, or withdrawal of consent — please contact our data team at [email protected] with the subject line "Data Privacy Request." Please include your registered account username and a clear description of the right you wish to exercise.

3patta will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days. Where a request is complex or there are multiple requests, we may extend this period by a further thirty days, with notice to you explaining the reason for the extension.

Most rights requests are fulfilled free of charge. Where a request is manifestly unfounded or excessive — particularly if repetitive — 3patta reserves the right to charge a reasonable administrative fee or refuse to act on the request, providing written reasons for that decision.

Where your request cannot be fulfilled due to a conflicting legal obligation (such as the requirement to retain KYC records for five years), we will explain the specific legal basis preventing fulfilment of your request in full.

11. Marketing Communications

3patta will only send you promotional emails, SMS messages, or in-platform notifications about bonuses, offers, and new games if you have given explicit consent to receive such communications during registration or via your account preferences settings.

You can withdraw your marketing consent at any time by updating your notification preferences in the 3patta account dashboard, clicking the unsubscribe link in any marketing email, or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect your ability to continue using the Platform.

Note that certain account-related communications — such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts — are operational in nature and are not subject to marketing opt-out preferences. These will be sent regardless of your marketing consent status as they are necessary for the operation of your account.

12. Changes to This Policy

3patta reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. Material changes will be communicated to registered players via the email address on record at least fourteen (14) days before the amended policy takes effect.

The "Last Updated" date at the top of this policy reflects when the current version became effective. We encourage you to review this policy periodically. Your continued use of the 3patta Platform after the effective date of any amendments constitutes your acceptance of the updated policy.

13. Contact Our Data Team

For any questions, concerns, or requests relating to this Privacy Policy or the way 3patta handles your personal data, please reach out through the following channels:

• Email: [email protected] (subject line: "Data Privacy Request")
• Live Chat: Available 24/7 inside your 3patta account dashboard — typical response time under 30 minutes.
• Postal: Contact details available upon written request to the support email above.

If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the data protection supervisory authority in the jurisdiction applicable to 3patta's international gaming licence. Details of the relevant authority are available upon request from the support team.

3patta is committed to resolving all privacy concerns fairly, transparently, and in a timely manner. We take every data rights request seriously as part of our obligations as a responsible and internationally licensed gaming operator serving players across Karachi, Lahore, Islamabad, Faisalabad, and beyond.