cr777 Privacy
Policy

1. Introduction & Scope

This Privacy Policy ("Policy") is issued by cr777 ("cr777," "we," "our," "us"), the operator of the online gaming platform at cr777.biz. It describes how cr777 collects, processes, stores, shares, and protects personal data relating to individuals ("Players," "Users," "you") who access or use the cr777 platform, including its cricket betting sportsbook, live casino, slot games, payment services, promotional systems, and customer support channels.

This Policy applies to all cr777 platform touchpoints — the desktop website, mobile-optimised browser, and any other interface through which cr777 services are accessed. By registering an account on cr777 or continuing to use the cr777 platform after this Policy has been published, you acknowledge that you have read and understood this Policy in its entirety.

2. Data Controller

For the purposes of applicable data protection legislation, cr777 is the data controller of personal data collected through the cr777 platform. cr777 operates under an international gaming licence and is subject to data protection obligations imposed by that licence, which include maintaining appropriate technical and organisational safeguards for personal data.

Where cr777 engages third-party service providers to process personal data on its behalf — for example, payment processors, KYC verification providers, and game content suppliers — those third parties act as data processors and are contractually required to process data only on cr777's documented instructions, under confidentiality obligations, and in accordance with applicable data protection law.

3. Personal Data We Collect

cr777 collects the following categories of personal data:

3.1 Registration & Identity Data

When you register a cr777 account, we collect your full legal name, date of birth, Pakistani CNIC number, registered mobile number, residential city (e.g., Karachi, Lahore, Islamabad, Faisalabad), and email address (if provided). This data is required to create your account, verify your age (21+ requirement), and fulfil KYC obligations under our licence.

3.2 Financial & Transaction Data

cr777 collects records of all financial transactions processed through your account, including deposit amounts and dates, withdrawal requests and outcomes, bonus credits issued and used, and the payment methods used (e.g., JazzCash account reference, EasyPaisa number, HBL/UBL/Meezan Bank account details). cr777 does not store full bank account numbers or payment card details on its own servers — these are handled by our licensed payment processing partners under their respective security protocols.

3.3 Gaming & Betting Activity Data

cr777 maintains a complete record of your gaming and betting activity on the platform, including games played, bets placed, amounts wagered, outcomes, session durations, and responsible gaming tool settings. This data is required for account management, dispute resolution, regulatory reporting, and responsible gaming monitoring.

3.4 Technical & Device Data

When you access cr777, we automatically collect certain technical data including your IP address, device type and operating system, browser type and version, screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

3.5 KYC Verification Documents

Prior to processing withdrawal requests, cr777 requires players to submit identity verification documents, which may include a clear photograph or scan of your CNIC (front and back), a selfie holding your CNIC, and proof of ownership of your registered payment method. These documents are processed by cr777's licensed KYC partner and stored in encrypted form with restricted access.

4. How We Collect Your Data

cr777 collects personal data through the following mechanisms:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or update your account settings on cr777;
• Automatically: Through cookies, web beacons, and server logs when you access the cr777 platform — see Section 8 for full cookie information;
• From third-party service providers: cr777 may receive identity verification results from our licensed KYC partner, fraud risk scores from our anti-fraud provider, and payment verification confirmations from JazzCash, EasyPaisa, and our banking partners;
• From publicly available sources: In limited circumstances required by our AML obligations, cr777 may cross-reference publicly available information to verify the identity or source of funds of high-value account holders.

5. Lawful Basis for Processing

cr777 processes personal data only where a valid lawful basis exists. The lawful bases applicable to cr777's data processing activities are:

• Contractual necessity: Processing required to provide you with the cr777 gaming and betting services you have registered for — account management, transaction processing, game delivery, and customer support;
• Legal obligation: Processing required to comply with cr777's international gaming licence, anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and other applicable regulatory requirements;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and product improvement — where such interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing communications — SMS, email, and in-platform notifications — where you have expressly opted in to receiving such communications from cr777. You may withdraw consent at any time through your account notification settings.

6. How cr777 Uses Your Data

cr777 uses the personal data it collects for the following purposes:

• Creating and managing your cr777 account, including verifying your identity and enforcing the 21+ age restriction;
• Processing deposits and withdrawals in PKR through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and general bank transfer;
• Delivering gaming and betting services, including displaying personalised game recommendations based on your activity on cr777;
• Detecting and preventing fraud, account takeovers, money laundering, and bonus abuse;
• Operating responsible gaming features, including monitoring gaming behaviour for signs of problem gambling and enforcing player-set limits;
• Responding to customer support queries and resolving disputes regarding bet settlements or account transactions;
• Sending you promotional offers, bonus notifications, and product updates where you have provided consent or where permitted under cr777's legitimate interests — see Section 14 for marketing opt-out information;
• Complying with reporting and audit requirements imposed by cr777's international gaming licence;
• Improving the cr777 platform through analysis of anonymised or aggregated usage data.

7. Data Sharing & Third Parties

cr777 does not sell, rent, or trade your personal data to any third party. cr777 shares personal data only in the following limited circumstances:

7.1 Service Providers

cr777 engages licensed third-party service providers who process personal data on cr777's behalf as data processors. These include our KYC identity verification partner, payment processing partners (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank), anti-fraud and security monitoring providers, game content suppliers (including Evolution Gaming and Pragmatic Play), and cloud infrastructure providers. All service providers are contractually bound to process data only on cr777's instructions and to maintain appropriate security standards.

7.2 Regulatory & Legal Disclosure

cr777 may disclose personal data to its licensing authority, law enforcement agencies, or other regulatory bodies where required to do so by applicable law, a court order, or a mandatory regulatory request. cr777 will notify affected players of any such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of cr777 or a material portion of its assets, personal data held by cr777 may be transferred to the acquiring entity as part of the transaction. In such cases, cr777 will notify affected players and the acquiring entity will be required to honour the commitments made in this Policy.

8. Cookies & Tracking Technologies

cr777 uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Essential Cookies: Required for the cr777 platform to function. These include session authentication cookies that keep you logged into your account and security cookies that protect against cross-site request forgery. Essential cookies cannot be disabled without breaking the platform.
• Performance Cookies: Used to collect anonymised data about how players navigate the cr777 platform — which games are viewed, how long sessions last, and which features are used. This data is used exclusively to improve platform performance and user experience.
• Functional Cookies: Remember your platform preferences, such as language settings, responsible gaming tool configurations, and notification preferences.
• Analytics Cookies: cr777 uses first-party analytics to understand aggregate usage patterns. This data is anonymised before analysis and is not used to identify individual players.

You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent access to the cr777 platform. Disabling other categories will reduce certain platform functionality but will not prevent access to gaming services.

9. Data Retention Periods

cr777 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by our licence obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship, plus a minimum of 5 years following account closure, as required by our AML and KYC regulatory obligations;
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, in accordance with anti-money laundering reporting requirements;
• Gaming activity records: Retained for 3 years from the date of the activity, or longer if required for an open regulatory investigation or player dispute;
• KYC verification documents: Retained for 5 years following account closure;
• Customer support correspondence: Retained for 3 years from the date of the final communication;
• Technical and device logs: Retained for 12 months, then permanently deleted unless required in connection with an active security investigation;
• Marketing consent records: Retained for the duration of consent plus 3 years, for regulatory audit purposes.

Upon expiry of the applicable retention period, cr777 will securely delete or irreversibly anonymise the relevant personal data.

10. Data Security Measures

cr777 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between your device and cr777 servers;
• AES-256 encryption at rest for sensitive stored data including CNIC numbers, KYC documents, and payment method references;
• Role-based access controls restricting cr777 staff access to personal data to only those whose job function requires it, with full audit logging of all access events;
• Multi-factor authentication required for all cr777 staff accessing systems containing personal data;
• Regular penetration testing by independent security researchers to identify and remediate vulnerabilities before they can be exploited;
• 24/7 automated security monitoring with alert escalation procedures for suspected data incidents.

11. Your Privacy Rights

As a cr777 player, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of all personal data cr777 holds about you, free of charge, within 30 days of the request;
• Right to Rectification: You may request correction of inaccurate personal data held by cr777 — for example, a misspelled name or incorrect date of birth;
• Right to Erasure: In certain circumstances, you may request deletion of your personal data. Note that cr777 may be unable to fulfil erasure requests where data must be retained for regulatory compliance purposes (see Section 9);
• Right to Restriction: You may request that cr777 restricts its processing of your data while an accuracy or legitimate-interest dispute is under review;
• Right to Object: You may object to processing of your data based on cr777's legitimate interests at any time, including profiling for direct marketing purposes;
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to cr777 for the purposes of transferring it to another service provider;
• Right to Withdraw Consent: Where cr777 processes your data based on your consent — primarily for marketing communications — you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact cr777 via the in-platform live chat or by emailing [email protected] (plain text — not a clickable link). cr777 will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days.

12. Children's Privacy & Underage Protection

The cr777 platform is strictly prohibited to persons under the age of 21. cr777 does not knowingly collect personal data from individuals under 21 years of age. The identity verification procedures at registration — including CNIC verification — are specifically designed to prevent underage registration.

In the event that cr777 discovers that personal data has been collected from a person under 21 without verifiable parental consent, cr777 will immediately close the relevant account and permanently delete all associated personal data, except where retention is required for regulatory reporting purposes.

If you have reason to believe that a person under 21 has registered or is using a cr777 account, please notify cr777 immediately via live chat. cr777 also provides parental control guidance on the Responsible Gaming page.

13. International Data Transfers

cr777 operates under an international gaming licence, and certain personal data may be transferred to and processed in countries outside Pakistan, including the jurisdiction in which cr777's licence is held and the locations of cr777's cloud infrastructure and third-party service providers.

When cr777 transfers personal data internationally, it ensures that appropriate safeguards are in place — including contractual data processing agreements that impose equivalent data protection standards on recipients, and where applicable, reliance on recognised transfer mechanisms such as standard contractual clauses or binding corporate rules.

cr777 does not transfer personal data to countries that lack adequate data protection frameworks without first implementing the contractual safeguards described above.

14. Marketing Communications & Opt-Out

cr777 may send you promotional communications — including bonus offers, free spin promotions, PSL betting specials, and platform updates — via SMS to your registered Pakistani mobile number and, where provided, by email. cr777 sends marketing communications only where you have expressly consented to receive them at registration or have subsequently opted in through your account notification settings.

You may opt out of all cr777 marketing communications at any time by:

• Updating your notification preferences in the Account Settings section of your cr777 account;
• Replying STOP to any cr777 SMS communication from your registered mobile number;
• Contacting cr777 live support and requesting removal from all marketing lists.

Opting out of marketing communications will not affect your ability to receive transactional and security notifications from cr777, such as withdrawal confirmation SMS messages or account security alerts. These communications are essential to the safe operation of your account and cannot be disabled.

15. Amendments to This Policy

cr777 reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, regulatory requirements, and platform features. Where changes are material, cr777 will notify active players via SMS to their registered Pakistani mobile number at least 7 calendar days before the updated Policy takes effect, except where more immediate changes are required by regulatory obligation.

The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the cr777 platform following publication of an updated Policy constitutes acceptance of the revised terms. If you do not accept the updated Policy, you must cease using the cr777 platform and close your account.

16. Contact & Data Enquiries

For any questions regarding this Privacy Policy, to exercise your data rights, or to report a suspected privacy concern, please contact cr777 through the following channels:

• Live Chat: Available 24/7 within the cr777 platform — the fastest route for urgent privacy or security concerns, with a typical first response under 2 minutes;
• Email: [email protected] — written privacy requests acknowledged within 1 business day and resolved within 30 calendar days;
• Languages: Privacy enquiries are handled in English and Urdu.

Where you have concerns about cr777's data processing practices that have not been resolved through direct contact with our support team, you may refer your complaint to the data protection supervisory authority associated with cr777's international gaming licence jurisdiction.