222r Privacy Policy

222r ("we", "us", "our" or "the Platform") is committed to protecting the privacy and security of all personal data we hold about registered users and visitors to our platform. This Privacy Policy sets out our practices with respect to the collection, use, processing, storage and disclosure of personal data in connection with the services offered through the 222r website and any associated applications.

This Policy applies to all users of the 222r platform, including players based in Pakistan — whether in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar or elsewhere — and all other jurisdictions from which the platform is lawfully accessible.

222r processes personal data in accordance with the data protection obligations imposed by its international gaming licence and the applicable data protection legislation of the licensing jurisdiction. While Pakistan does not currently have a comprehensive personal data protection law in force at the time of writing, we apply internationally recognised data protection standards to all user data regardless of the user's location.

222r collects personal data across several categories depending on how you interact with the platform. The following categories describe the data we may hold about you:

3.1 Registration & Identity Data

• Full legal name;
• Date of birth (used for age verification);
• Residential address, including city and postcode;
• Email address and mobile telephone number;
• Username and encrypted account credentials.

3.2 Verification & KYC Data

• Government-issued identity document (CNIC, passport or equivalent);
• Proof of address documentation where required;
• Selfie or liveness verification image submitted during the KYC process;
• Source of funds documentation where requested in accordance with AML obligations.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records;
• Payment method details (wallet IDs, bank account references — not full card numbers, which are not stored);
• Account balance history and bonus redemption records;
• Wagering activity records required for responsible gambling compliance.

3.4 Technical & Usage Data

• IP address and approximate geolocation derived therefrom;
• Browser type, operating system and device identifiers;
• Session logs including login timestamps, pages visited and actions taken;
• Cookie and tracking data as described in Section 8.

3.5 Communications Data

• Records of customer support interactions via live chat and email;
• Marketing preferences and communication history.

We collect personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make deposits or withdrawals, contact support or respond to surveys;
• Automatically — through cookies, session tracking and server logs when you browse or interact with the platform;
• From third-party KYC providers — identity verification services process your documents and return a verification result to us, subject to their own privacy policies;
• From payment processors — transaction confirmation data is shared with us when you use a payment method in the cashier;
• From fraud detection and AML screening services — where required to satisfy our licensing obligations.

222r processes personal data on the following legal bases as applicable under the data protection framework of its licensing jurisdiction:

Personal data collected by 222r is used for the following purposes:

• Registering, verifying and managing your player account;
• Processing deposits, withdrawals and in-platform transactions;
• Conducting KYC and AML checks in compliance with licensing obligations;
• Detecting, investigating and preventing fraud, money laundering and platform abuse;
• Enforcing the platform's Terms and Conditions and Responsible Gambling policies;
• Monitoring account activity to identify potential problem gambling indicators;
• Providing customer support via live chat and email;
• Sending transactional communications including deposit confirmations and withdrawal notifications;
• Sending marketing communications where you have given consent;
• Analysing platform usage to improve user experience, fix bugs and develop new features;
• Complying with requests from regulatory authorities, courts or law-enforcement agencies where legally required.

222r does not sell, rent or trade your personal data to any third party. Data sharing is restricted to the following categories of recipient, each of whom processes your data only as necessary for the stated purpose:

7.1 Service Providers

Third-party providers engaged to support platform operations, including KYC and identity verification providers, payment processors, cloud hosting and infrastructure providers, and customer-support software platforms. All service providers are subject to data-processing agreements that restrict their use of your data to the specified service function.

7.2 Fraud Prevention & AML Services

Where required by our licensing obligations, transaction and identity data may be shared with fraud-detection systems and AML screening databases to identify suspicious activity. This processing is carried out as a legal obligation.

7.3 Regulatory & Legal Authorities

We may disclose personal data to our licensing regulator, law enforcement agencies, courts or government bodies where we are legally required to do so or where disclosure is necessary to protect the rights, property or safety of 222r, its users or the public.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of the 222r business, personal data held about users may be transferred to the relevant successor entity. Users would be notified of any such transfer and of any material changes to data handling practices that would result.

222r uses cookies and similar tracking technologies on the platform. A cookie is a small text file stored on your device that helps the platform function correctly and understand how it is being used. The following categories of cookie are used:

Most browsers allow you to control cookies through their settings. Blocking strictly necessary or security cookies may impair platform functionality. Blocking analytics and marketing cookies will not affect core platform access.

222r retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to minimum retention periods imposed by applicable law and licensing requirements. The following general principles apply:

• Account and registration data is retained for the duration of the account relationship and for a minimum period following account closure as required by AML and licensing regulations;
• KYC and identity documents are retained for the minimum period required by our licensing jurisdiction's AML framework, typically five years from the end of the business relationship;
• Transaction records are retained in accordance with the operator's financial record-keeping obligations, typically a minimum of five years;
• Customer support communications are retained for a period sufficient to resolve disputes and fulfil any related legal obligations;
• Marketing consent records are retained for as long as is necessary to demonstrate compliance with marketing regulations.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an individual.

222r implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration or disclosure. These measures include:

• HTTPS encryption for all data transmitted to and from the platform;
• Encryption of sensitive data fields at rest within platform databases;
• Access controls restricting data access to authorised personnel on a need-to-know basis;
• Regular security assessments and penetration testing of platform infrastructure;
• Two-factor authentication options available to all registered users;
• Incident response procedures in place to detect, contain and notify affected parties in the event of a data breach.

As an international operator, 222r may process and store personal data on servers located outside Pakistan and outside your country of residence. Transfers to jurisdictions outside the operator's primary licensing territory are carried out under appropriate safeguards including contractual data-transfer mechanisms recognised under the applicable privacy framework.

Pakistan does not currently have an adequacy decision framework equivalent to those operated under EU/UK data protection regimes. However, 222r applies the internationally recognised principles of purpose limitation, data minimisation, storage limitation and security to all personal data regardless of where it is processed.

Subject to applicable law and the operator's licensing obligations, registered users have the following rights in relation to their personal data. To exercise any of these rights, contact us at [email protected] from your registered email address:

222r is strictly an adults-only platform. The platform is not directed at individuals under the age of 18, or the higher minimum age required by the operator's licensing jurisdiction. We do not knowingly collect personal data from minors.

Age verification is conducted as part of the KYC process for all registered accounts. If we become aware that an account has been registered by a person under the applicable minimum age, the account will be immediately suspended, any associated balance held pending investigation, and the personal data of the minor will be handled in accordance with applicable child data protection requirements.

Parents and guardians who believe a minor may have accessed or registered on the platform are encouraged to contact support immediately via live chat or at [email protected].

222r will only send marketing communications — including promotional emails, bonus offers, PSL season notifications and other commercial messages — where you have given explicit consent to receive them. Consent is obtained during the registration process and can be updated at any time in your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your account settings;
• Clicking the unsubscribe link included in any marketing email;
• Contacting support via live chat or email with a request to opt out.

Withdrawal of marketing consent will be processed without delay. Transactional communications — including deposit confirmations, withdrawal notifications, security alerts and account management messages — are not marketing communications and will continue to be sent regardless of marketing preferences, as they are necessary for the operation of your account.

222r reserves the right to update this Privacy Policy at any time. Where changes are material — for example, where new categories of data are collected, new third-party processors are engaged, or the legal basis for processing changes — registered users will be notified through the platform at login and the "Last Updated" date at the top of this document will be revised accordingly.

Your continued use of the platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept a material change to this policy, you must cease using the platform and may request account closure and data erasure as described in Section 12.

We recommend bookmarking this page and reviewing it periodically to remain aware of our current data practices.

If you have any questions, concerns or requests relating to this Privacy Policy, your personal data or your data rights, please contact the 222r data and privacy team through the following channels: