3pitt Privacy Policy —
How We Protect Your
Personal Information

3pitt ("we", "us", "our", "the Platform") is an online gaming platform operating at 3pitt.app, providing sports betting, live dealer casino, slot gaming, and related entertainment services primarily to users in Pakistan. For the purposes of this Privacy Policy, 3pitt is the data controller — meaning we are the entity responsible for determining how and why personal data collected through the Platform is processed.

All data protection enquiries, access requests, and complaints should be directed to 3pitt's designated data contact at [email protected] with the subject line "Data Protection Enquiry".

This Privacy Policy applies to all personal data collected by 3pitt through the following channels:

• The 3pitt website accessible at 3pitt.app and all sub-pages thereof.
• Any future 3pitt mobile applications available for iOS or Android devices.
• Direct communications with 3pitt — including emails sent to [email protected], live chat interactions within the Platform, and feedback or complaint submissions.
• Participation in 3pitt promotional programmes, surveys, or loyalty schemes.
• Third-party identity verification, payment processing, and gaming provider services accessed through the 3pitt Platform.

This Policy does not apply to third-party websites, services, or platforms that may be referenced in 3pitt's content. 3pitt is not responsible for the privacy practices of any third-party service, even where access to that service is facilitated through the 3pitt Platform.

3pitt collects personal data in the following categories. We collect only what is necessary for the specific purposes described in Section 4 of this Policy:

3pitt does not collect or store full payment card numbers. Where identity documents such as CNIC scans are submitted for KYC purposes, these are processed by 3pitt's approved identity verification partner and are not stored in raw form on 3pitt's primary databases beyond the verification period.

3pitt uses personal data exclusively for the following defined purposes. We do not use your data for purposes not listed here without first updating this Policy and, where required, obtaining your consent:

• Account Creation and Management: Processing your registration, maintaining your 3pitt account profile, authenticating your identity at login, and managing account settings and preferences.
• Service Delivery: Enabling access to sports betting markets (including PSL cricket, UFC, football), live casino games, slot titles, and all other 3pitt gaming products. Displaying your PKR balance, bet history, and gaming records accurately.
• Payment Processing: Facilitating PKR deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank. Processing withdrawal requests and maintaining transaction records required for financial compliance.
• Identity Verification (KYC): Verifying your identity and age (21+) in accordance with responsible gaming obligations and international gaming compliance standards. This process is mandatory before withdrawals above defined thresholds are processed.
• Fraud Prevention and Security: Monitoring for suspicious login patterns, duplicate account detection, unusual financial transaction patterns, and potential money laundering activity. Protecting the integrity of 3pitt's gaming environment for all Pakistani players.
• Responsible Gaming: Monitoring gaming behaviour data to identify patterns that may indicate problem gambling. Applying user-requested deposit limits, cooling-off periods, and self-exclusion instructions. Enforcing the 21+ age restriction.
• Customer Support: Responding to account queries, processing complaints, and maintaining records of support interactions for quality and compliance purposes.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, identify bugs, optimise feature placement, and enhance the overall player experience for users across Pakistan.
• Legal and Regulatory Compliance: Fulfilling obligations under applicable gaming regulations, anti-money laundering requirements, and responding to lawful requests from competent regulatory or law enforcement authorities.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to users who have provided marketing consent. This is always opt-in and can be withdrawn at any time. See Section 13.

3pitt processes personal data under one or more of the following legal bases, in alignment with GDPR-standard principles applied internationally:

• Contractual Necessity: Processing required to perform the contract between 3pitt and the User — i.e., delivering gaming services, processing payments, and managing your account. Without this processing, 3pitt cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC/AML obligations, responsible gaming mandates, and responses to lawful regulatory requests.
• Legitimate Interests: Processing for purposes of fraud prevention, platform security, technical improvement, and the protection of 3pitt's and other Users' interests — provided these do not override your fundamental privacy rights.
• Consent: Processing for marketing communications, optional analytics, and non-essential cookies — where you have provided explicit, freely given, and withdrawable consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

3pitt does not sell, rent, or trade personal data. Data is shared with third parties only in the limited circumstances described below, and only under strict contractual data protection obligations:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum necessary financial data to process deposits and withdrawals on your behalf. These organisations maintain their own data protection policies and are independently regulated financial entities in Pakistan.
• Identity Verification Partners: 3pitt uses internationally certified KYC/identity verification service providers to process CNIC and identity document verification. These partners act as data processors under strict data processing agreements and may not use your data for any purpose beyond identity verification on 3pitt's behalf.
• Gaming Providers: Game software providers — such as those supplying live casino and slot titles to the 3pitt Platform — receive technical session data necessary to deliver gameplay. These providers are independently licensed and operate under their own data protection frameworks.
• Analytics Providers: Aggregated, pseudonymised Platform usage data may be processed by analytics service providers to help 3pitt understand Platform performance. Individual user data is not shared in identifiable form for analytics purposes.
• Legal and Regulatory Authorities: 3pitt will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or where necessary to prevent or detect fraud and criminal activity.

All third-party data processors engaged by 3pitt are bound by contractual data processing agreements that prohibit them from processing your data for any purpose other than those specified by 3pitt. 3pitt remains responsible for ensuring that all processors maintain appropriate data protection standards.

3pitt uses cookies and similar tracking technologies on the Platform. Cookies are small data files stored on your device that enable the Platform to function correctly, remember your preferences, and help 3pitt understand how the Platform is used. The following categories of cookies are used on 3pitt:

• Strictly Necessary Cookies: Essential for Platform operation — authentication, session management, security functions, and maintaining your logged-in state. These cannot be disabled without affecting core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, display preferences, and remembered login details where you have selected "Remember Me". These enhance your experience but are not strictly necessary for the Platform to function.
• Analytics Cookies: Collect pseudonymised data about how you interact with 3pitt — pages visited, time spent on each section, navigation paths, and technical performance data. This data is used in aggregated form to improve the Platform. These cookies require your consent.
• Marketing Cookies: Used to track whether you have interacted with specific promotional content. Enabled only with explicit consent and may be disabled via your browser settings or by contacting 3pitt support.

You can manage or delete cookies through your browser settings at any time. Most browsers allow you to refuse new cookies, delete existing cookies, and receive warnings before cookies are set. Disabling strictly necessary cookies will impair the functionality of the 3pitt Platform.

3pitt implements a layered security architecture designed to protect personal and financial data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Transport Layer Security: All data transmitted between your device and 3pitt's servers is encrypted using 256-bit SSL/TLS — the same standard used by major international financial institutions.
• At-Rest Encryption: Personal data stored in 3pitt's databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised personnel only, and all access is logged and audited.
• Password Protection: User passwords are never stored in plain text on 3pitt's systems. All passwords are processed through bcrypt hashing — a one-way cryptographic function — before storage.
• Two-Factor Authentication: 3pitt offers and strongly recommends two-factor authentication (2FA) for all user accounts, adding a second layer of protection against unauthorised login attempts.
• Penetration Testing: 3pitt's Platform undergoes regular security penetration testing by independent third-party security professionals to identify and remediate vulnerabilities before they can be exploited.
• Access Controls: Internal access to personal data is governed by a strict "need to know" principle. Support staff see only the minimum data necessary to resolve your specific query. Senior compliance personnel have broader access, which is subject to audit logging.

Notwithstanding the above, no data security system is entirely impenetrable. 3pitt cannot guarantee the absolute security of data transmitted over public internet connections. Users are responsible for maintaining the security of their own devices and login credentials. In the event of a confirmed data breach affecting Users' personal data, 3pitt will notify affected Users promptly in accordance with applicable regulatory requirements.

3pitt retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data set no longer constitutes personal data and may be retained indefinitely for statistical and product improvement purposes.

3pitt recognises and facilitates the following rights in relation to your personal data. These rights are exercisable by submitting a written request to [email protected]. 3pitt will respond to all valid requests within 30 days of receipt, and will not charge a fee for standard requests:

3pitt operates a strict 21+ age policy across all Platform services. The 3pitt Platform is not directed at, and must not be used by, any individual under the age of 21 years. 3pitt does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If 3pitt becomes aware that personal data has been collected from an individual under the age of 21, the following actions will be taken immediately:

• The associated Account will be permanently closed.
• All personal data associated with the Account will be deleted, subject to any mandatory legal retention obligations relating to the detection of underage access.
• Any funds deposited will be returned to the source payment method to the extent technically and legally possible.
• Any winnings generated by the underage account will be voided in accordance with 3pitt's Terms and Conditions.

Parents or guardians who believe their child may have accessed the 3pitt Platform or created an Account should contact [email protected] immediately. 3pitt takes all reports of underage access seriously and will investigate and respond within 48 hours.

As an internationally operated online gaming platform, some of 3pitt's data processing partners — including gaming software providers and identity verification services — are based outside Pakistan. When personal data is transferred internationally, 3pitt ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements that impose data protection obligations equivalent to those described in this Policy on all international data processors.
• Where applicable, reliance on adequacy decisions or standard contractual clauses that provide equivalent protection for cross-border data transfers.
• Limiting the scope of international data transfers to the minimum information necessary for the specific processing purpose — for example, a gaming provider receives only the technical session data necessary to deliver gameplay, not your full identity profile.

By using 3pitt, you acknowledge that your data may be transferred to and processed in countries outside Pakistan. 3pitt will always ensure that such transfers occur under appropriate protective frameworks as described above.

3pitt sends promotional communications — including bonus offers, platform updates, cricket betting specials, and PSL season promotions — only to users who have explicitly opted in to receive marketing at the time of account registration or subsequently through their Account settings.

You may withdraw marketing consent and opt out of all 3pitt promotional communications at any time through the following methods:

• Account Settings: Navigate to your 3pitt account settings and update your marketing preferences to "Off" for all channels (email, SMS, push notifications).
• Unsubscribe Link: Click the unsubscribe link present at the bottom of every 3pitt marketing email. Opt-outs via this method are processed within 48 hours.
• Email Request: Send a written opt-out request to [email protected] with the subject line "Marketing Opt-Out" and your registered email address. 3pitt will confirm opt-out within 5 business days.

Withdrawing marketing consent does not affect the receipt of service communications — such as deposit confirmations, withdrawal notifications, security alerts, and account verification requests — which are necessary for the operation of your 3pitt account and are not subject to marketing opt-out.

3pitt reserves the right to update this Privacy Policy at any time to reflect changes in data practices, legal requirements, or Platform services. The following process applies to all amendments:

• The "Last Updated" date at the top of this Policy will be revised with each amendment.
• Material changes that affect Users' privacy rights or the way personal data is processed will be communicated via email to all registered Users at least fourteen (14) days before the changes take effect.
• Minor updates — such as clarifications, formatting improvements, or corrections that do not alter the substance of the Policy — may be made without direct notification, though the "Last Updated" date will always reflect the most recent revision.
• Users who do not agree with an amended Policy should close their account before the revised Policy takes effect. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

3pitt encourages all Users to review this Privacy Policy periodically to remain informed about how their personal data is protected. The current version of this Policy is always accessible at 3pitt.app/privacy-policy.

For any questions, concerns, or formal requests relating to this Privacy Policy or 3pitt's data practices, please contact:

3pitt Data Protection Contact
Email: [email protected]
Subject line: "Data Protection Enquiry"
Response time: Within 5 business days for general enquiries; within 30 days for formal data rights requests.

If you are dissatisfied with 3pitt's response to a data protection complaint, you have the right to escalate your complaint to the relevant data protection regulatory authority in the jurisdiction governing 3pitt's operations. Details of the applicable regulatory authority are available upon written request to the above contact.