rc777 Privacy Policy —
How We Handle Your Personal Data

This Privacy Policy is issued by rc777 ("the Platform", "rc777", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at rc777.bio. rc777 acts as the data controller in respect of all personal data collected from users ("Players", "you") of the rc777 platform.

As data controller, rc777 determines the purposes and means of processing your personal data in accordance with the obligations imposed by our international gaming license and applicable data protection laws. Our commitment to lawful, fair, and transparent data processing is a condition of our licensing and is monitored through our quarterly compliance audits.

This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming Policy, which collectively govern your relationship with rc777.

rc777 collects personal data from you through several channels — directly from you during registration, from your use of the platform, from our payment processors, and from identity verification processes. The categories of personal data we collect are as follows:

rc777 does not intentionally collect special category personal data (such as health data, racial or ethnic origin, or political opinions) unless specifically required for responsible gaming assessment purposes and with your explicit consent.

rc777 uses your personal data for the following purposes. Each purpose is tied to a specific legal basis as described in Section 4:

• Account Creation and Management: To create, maintain, and manage your rc777 player account, including enabling login access, wallet functionality, and account security features including two-factor authentication;
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with the requirements of our international gaming license and anti-money laundering (AML) obligations using your CNIC and supporting documentation;
• Payment Processing: To process PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, including reconciling transaction records and investigating payment disputes;
• Game Delivery and Platform Operation: To provide access to casino games, live dealer tables, slot titles, and sportsbook markets including PSL cricket betting and UFC, and to log gaming activity for dispute resolution purposes;
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, apply deposit limits and session restrictions where you have set them, process self-exclusion requests, and fulfil our responsible gaming obligations under the gaming license;
• Fraud and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited conduct outlined in our Terms & Conditions;
• Customer Support: To respond to support queries submitted via live chat or email, including resolving payment issues, account access problems, and game disputes;
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates via email or SMS, where you have provided your consent and have not subsequently withdrawn it;
• Legal and Regulatory Compliance: To comply with our obligations under our gaming license, applicable anti-money laundering regulations, and any lawful request from a competent authority.

rc777 processes your personal data in accordance with the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and rc777 — i.e., to operate your account, process payments, deliver games, and provide customer support;
• Legal Obligation: Processing required to comply with our gaming license obligations, KYC and AML requirements, and any lawful order from a competent regulatory or law enforcement authority;
• Legitimate Interests: Processing carried out in the legitimate interests of rc777 that are not overridden by your fundamental rights — including fraud detection, platform security, and responsible gaming monitoring;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily marketing communications and optional platform features. Consent may be withdrawn at any time without affecting prior processing.

rc777 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following circumstances and only with parties that are subject to appropriate data protection safeguards:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the transaction data necessary to process your deposits and withdrawals. These processors operate under their own privacy policies and are subject to applicable Pakistani banking regulations;
• Identity Verification Providers: Where rc777 uses a third-party KYC verification service to assist with CNIC validation, that provider receives only the data necessary for identity verification and is contractually bound to process it solely for that purpose;
• Gaming Platform Providers: Game studios and live casino operators that provide game content accessible through rc777 may receive anonymised session data required for game delivery and technical support. No personally identifiable information is shared with game studios beyond what is technically necessary;
• Fraud Prevention Services: rc777 may use third-party fraud detection tools that process technical data (IP addresses, device fingerprints) to identify and prevent fraudulent account activity;
• Legal and Regulatory Authorities: rc777 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required by law, by our gaming license, or pursuant to a lawful order. rc777 will notify you of any such disclosure where we are legally permitted to do so.

rc777 uses cookies and similar tracking technologies on its website and mobile platform to deliver a functional, secure, and personalised experience. The following categories of cookies are used by rc777:

You may manage non-essential cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the rc777 platform and may prevent you from logging in or processing payments. rc777 does not use advertising or third-party retargeting cookies.

rc777 retains personal data for no longer than necessary to fulfil the purpose for which it was collected, subject to any mandatory minimum retention periods required by applicable law or by our gaming license. The following retention periods apply:

• Account and Identity Data (active accounts): Retained for the duration of your active account plus a minimum of five (5) years following account closure, as required by our gaming license for audit and regulatory compliance purposes;
• KYC and Verification Documents (CNIC, address proof): Retained for a minimum of five (5) years from the date of submission or account closure (whichever is later), in compliance with AML record-keeping obligations;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction in accordance with applicable financial record-keeping requirements;
• Gaming Session Logs: Retained for eighteen (18) months from the date of the session for dispute resolution purposes, and for up to five (5) years where required for license compliance or legal proceedings;
• Customer Support Communications: Retained for two (2) years from the date of the last communication in the thread;
• Marketing Preference Records: Retained until you withdraw consent, and for a further two (2) years following withdrawal for legal compliance purposes.

rc777 operates under an international gaming license and may use service providers — including payment processors, KYC verification tools, and cloud infrastructure providers — whose systems are located outside Pakistan. Where personal data is transferred internationally, rc777 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities, contractually binding the recipient to data protection standards equivalent to those applied by rc777;
• Transfers to recipients in jurisdictions recognised as providing an adequate level of data protection under internationally accepted frameworks;
• Binding corporate rules where data is transferred within a group of companies of which rc777's processor is a member.

Irrespective of where your data is processed, rc777 applies consistent data protection standards across all processing activities and all jurisdictions in which our processors operate.

rc777 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, accidental loss, destruction, or alteration. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your device and the rc777 platform is encrypted using 256-bit SSL/TLS protocols — the same standard used by major international banking institutions;
• Encryption at Rest: Personal data stored in rc777's databases is encrypted using AES-256 encryption. Encryption keys are managed under a separate, hardware-secured key management system;
• Access Controls: Access to personal data systems is restricted by role-based access controls, multi-factor authentication for all administrative access, and comprehensive audit logging of all data access events;
• Penetration Testing: rc777's platform undergoes regular security penetration testing by qualified third-party cybersecurity specialists to identify and remediate vulnerabilities before they can be exploited;
• Incident Response: rc777 maintains a formal data breach response procedure. In the event of a breach affecting your personal data that creates a high risk to your rights and freedoms, rc777 will notify you without undue delay and within the timeframe required by our license obligations.

As a data subject whose personal data is processed by rc777, you have the following rights. These rights may be subject to certain limitations where mandatory legal obligations require rc777 to retain or continue processing data despite a request to the contrary.

rc777 is strictly an adult platform. Our services are not directed at, and are not intended for use by, any individual under the age of 21. rc777 does not knowingly collect personal data from individuals under 21 years of age.

Our KYC process, which requires submission and verification of a valid CNIC, is specifically designed to prevent underage access. The CNIC system in Pakistan includes the date of birth, enabling rc777's verification process to confirm that every registered player meets the 21+ age requirement before account activation.

rc777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, platform features, or applicable data protection law. The effective date at the top of this document and the "Last Updated" date in the Table of Contents will be updated whenever material changes are made.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — rc777 will notify registered account holders by email to the address on file no less than fourteen (14) days before the changes take effect. Non-material changes (such as corrections to wording, formatting, or clarifications that do not alter the substantive meaning of any provision) may be published without advance notice.

Your continued use of the rc777 platform after any amended Privacy Policy takes effect constitutes your acknowledgement of and agreement to the updated terms. If you disagree with the changes, you should cease using rc777 and contact our support team to request account closure.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or have a concern about how rc777 handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly on the rc777 platform. Urdu and English support available. Average response time: 3–5 minutes for standard queries; up to 2 business days for formal data protection requests.
• Email: [email protected] — Our compliance and data protection team monitors this address and aims to respond to privacy-related queries within 5 business days, and to formal data subject rights requests within 30 calendar days.