rrr5 Privacy Policy

rrr5 ("we", "us", "our", or "the Platform") operates the online betting and casino service accessible at rrr5.io, which is primarily directed at adult players located in Bangladesh and other permitted offshore markets. This Privacy Policy governs the collection, processing, storage, and disclosure of personal data submitted by or collected from users ("Players" or "you") in connection with your use of the rrr5 platform.

rrr5 operates as an offshore entity. The data-handling practices described in this Privacy Policy reflect industry best practice for offshore gaming operators serving the Bangladesh market and are designed to align with internationally recognised privacy principles including those expressed in the General Data Protection Regulation (GDPR) framework, which rrr5 adopts voluntarily as a baseline standard of data stewardship.

All references to "personal data" in this document mean any information that identifies or could reasonably identify a natural person, whether directly (e.g., your full name, email address) or indirectly (e.g., an account ID paired with a device fingerprint). This Policy covers all such data regardless of the medium in which it is held — electronic records, support ticket transcripts, KYC document scans, and any other format.

This Privacy Policy should be read alongside the rrr5 Terms & Conditions, which govern your overall contractual relationship with the Platform, and the Responsible Gaming policy, which addresses how we use behavioural data to identify and assist players at risk.

rrr5 collects personal data across several categories depending on the nature of your interaction with the Platform. The following table summarises the categories of data collected and typical examples within each category:

rrr5 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for identification purposes beyond what is strictly required for age and identity verification during KYC. Where KYC document images incidentally contain such data (e.g., religious information on a national ID card), that data is processed only to verify identity and age and is not stored separately or used for any other purpose.

rrr5 collects personal data through the following mechanisms:

• Direct Submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal request, submitting a support ticket, or communicating with our team via email.
• Automated Technical Collection: Data collected automatically as you interact with the rrr5 website, including IP addresses, session cookies, browser fingerprint data, and clickstream analytics. This data is collected via server logs and first-party analytics tools.
• Payment Processor Data: When you initiate a transaction via bKash, Nagad, Rocket, Upay, or another supported payment method, the payment processor provides rrr5 with a transaction reference and confirmation that the payment was made from a verified account in your name. rrr5 does not receive your full payment account credentials — only the reference and confirmation data required to credit or debit your rrr5 account Balance.
• KYC Verification Partners: Where rrr5 uses a third-party identity verification service to assist with document authentication, that service may return structured identity data (e.g., confirmed name, date of birth, document validity status) to rrr5 as part of the verification result. The raw document images are handled in accordance with the verification partner's own privacy policy, which rrr5 reviews as part of its vendor onboarding process.
• Game Provider Data: Third-party game providers (including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe) may share session-level data with rrr5 such as game round identifiers, stake amounts, and round outcomes. This data is used solely for account crediting, dispute resolution, and responsible gaming monitoring purposes.

rrr5 processes personal data only for the following defined and legitimate purposes:

• Account Creation and Management: To register your account, maintain your account profile, process password resets, and provide you with access to the rrr5 platform.
• Transaction Processing: To process BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment methods, and to maintain an accurate record of your account Balance.
• Identity and Age Verification (KYC): To confirm that you are who you claim to be, that you are at least 21 years of age, and that the payment methods you use are registered in your name. KYC is both a platform integrity measure and a responsible gaming requirement.
• Customer Support: To respond to your support queries, investigate complaints, and maintain records of communications for quality assurance and dispute resolution purposes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent account activity, money laundering, multi-accounting, bonus abuse, and other forms of prohibited conduct as defined in the rrr5 Terms & Conditions.
• Responsible Gaming Monitoring: To monitor betting and deposit patterns for signs of problem gambling behaviour, to enforce self-exclusion and deposit-limit settings, and to proactively reach out to players who display indicators of gambling harm.
• Legal and Regulatory Compliance: To meet any applicable legal obligations, respond to lawful requests from authorities, and maintain records as required by applicable offshore operating regulations.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the user experience, optimising platform performance, and developing new features.
• Marketing Communications (Opt-In Only): To send you promotional emails, bonus notifications, and seasonal offers (such as Eid, Pohela Boishakh, or IPL / BPL season promotions) where you have explicitly opted in to receive such communications. You may withdraw your marketing consent at any time by contacting [email protected].

For Players in jurisdictions that require a defined legal basis for the processing of personal data, rrr5 relies on the following bases as applicable:

• Contractual Necessity: Processing that is required to perform the contract between you and rrr5 — including account management, deposit and withdrawal processing, bet settlement, and KYC verification — is carried out on the basis of contractual necessity. Without this processing, rrr5 cannot provide the services described in the Terms & Conditions.
• Legitimate Interests: Processing carried out for fraud prevention, security monitoring, responsible gaming analytics, and platform improvement is based on rrr5's legitimate interest in operating a secure, fair, and sustainable platform. These interests have been assessed and are not overridden by your fundamental privacy rights.
• Legal Obligation: Processing required to comply with applicable law, respond to lawful authority requests, or maintain mandatory transaction records is carried out on the basis of legal obligation.
• Consent: Processing for optional marketing communications is carried out on the basis of your freely given, specific, and informed consent at the time of opt-in. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

rrr5 does not sell your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners receive only the minimum transaction data required to process your deposit or withdrawal. These partners operate under their own privacy policies and data-processing standards.
• KYC and Identity Verification Partners: Where rrr5 uses a third-party verification service to authenticate identity documents, that service will process your identity data on our behalf under a data-processing agreement that prohibits secondary use of your data.
• Game Content Providers: Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and other game providers receive session data (e.g., Player ID, stake amount, game round ID) as required to operate the game and return round outcomes. These providers do not receive your full personal profile.
• Technology and Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity service providers who process data on our behalf under strict contractual obligations and are prohibited from using your data for any purpose other than providing the contracted service.
• Legal and Regulatory Authorities: rrr5 may disclose personal data to law-enforcement agencies, courts, or regulatory bodies when required to do so by applicable law or a valid legal order. rrr5 will, where legally permissible, notify affected Players of such disclosures.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of rrr5's business, Player data may be transferred to the acquiring entity. rrr5 will provide notice to affected Players in advance of any such transfer where reasonably practicable.

All third-party service providers that process personal data on behalf of rrr5 are subject to data-processing agreements that require them to implement appropriate technical and organisational security measures and prohibit them from processing your data for any purpose beyond the contracted service.

rrr5 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device by your browser. The following categories of cookies are used on rrr5.io:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They include session authentication tokens that keep you logged in during a browsing session, anti-fraud security tokens, and load-balancing cookies. These cannot be disabled without preventing use of the Platform.
• Functional Cookies: These cookies remember your Platform preferences such as language settings, preferred display options, and responsible gaming tool configurations (e.g., your session-limit setting). Disabling these cookies will result in your preferences not being saved between sessions.
• Analytical Cookies: rrr5 uses first-party analytics to collect aggregated data about how Players interact with the Platform — which pages are visited, how long sessions last, and which game categories are most accessed. This data is used exclusively to improve the user experience and is not linked to your personal identity.
• Security Cookies: These cookies support our fraud-detection and bot-prevention systems by generating a fingerprint of your device session for comparison against known fraud patterns.

rrr5 does not use third-party advertising cookies or allow advertising networks to set cookies on rrr5.io. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform.

rrr5 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and research purposes without restriction, as it no longer constitutes personal data.

rrr5 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• SSL/TLS Encryption: All data transmitted between your browser and the rrr5 platform is encrypted using industry-standard 256-bit SSL/TLS encryption. The rrr5.io domain is served exclusively over HTTPS.
• Credential Hashing: Account passwords are stored using a one-way cryptographic hashing algorithm. rrr5 does not store plaintext passwords and cannot retrieve your password — only reset it.
• Access Controls: Access to personal data within rrr5's systems is restricted on a strict need-to-know basis. Employees and contractors with access to personal data are subject to confidentiality obligations and receive regular data-security training.
• Intrusion Detection: rrr5's infrastructure is monitored continuously for unauthorised access attempts, anomalous traffic patterns, and known attack signatures. Security incidents are logged, investigated, and remediated in accordance with our incident-response procedure.
• KYC Document Security: Identity verification documents are stored in encrypted, access-controlled environments separate from the main platform database. Access to document stores is restricted to the KYC review team and is fully audited.
• Vendor Security Assessment: All third-party service providers that process personal data on our behalf are assessed for their data-security practices prior to engagement and are contractually required to maintain security standards consistent with those applied by rrr5.

Despite the above measures, no internet transmission or electronic storage system is 100% secure. rrr5 cannot guarantee absolute security but commits to maintaining industry-standard protections and to notifying affected Players promptly in the event of a material data breach that affects their personal data.

Subject to applicable law and the legitimate operational requirements of the rrr5 platform, you hold the following rights in respect of your personal data:

• Right of Access: You have the right to request a copy of the personal data rrr5 holds about you, the purposes for which it is processed, the categories of data held, and the third parties with whom it has been shared.
• Right to Rectification: If any personal data held about you is inaccurate or incomplete, you have the right to request that it be corrected. Where corrections affect your identity verification record, you may be required to submit updated KYC documentation.
• Right to Erasure ("Right to be Forgotten"): You may request that rrr5 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing based on legitimate interests. This right is subject to rrr5's legal obligation to retain certain records for defined periods as described in Section 8.
• Right to Restrict Processing: You may request that rrr5 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling conducted for responsible gaming monitoring purposes. rrr5 will assess such objections on a case-by-case basis; where responsible gaming monitoring is involved, rrr5 may need to maintain certain processing to fulfil its duty of care obligations.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Privacy Request". rrr5 will acknowledge your request within 5 business days (BST) and will aim to fulfil verified requests within 30 days. We may require identity verification before actioning requests that involve the disclosure or deletion of personal data.

The rrr5 platform is strictly restricted to individuals aged 21 years and above. rrr5 does not knowingly collect personal data from any person under the age of 21.

Where rrr5 becomes aware, or has reasonable grounds to suspect, that an Account is held by a person under 21 years of age, the Account will be suspended immediately, all activity will be investigated, and any personal data associated with the underage account will be handled in accordance with our obligations to protect minors — including deletion of unnecessary data and, where required, referral to appropriate safeguarding authorities.

If you are a parent or guardian and believe that a minor in your care has registered an account with rrr5 or has provided personal data to the Platform without your consent, please contact us immediately at [email protected] and we will take prompt corrective action.

rrr5 enforces age verification as a mandatory step of the KYC process. No withdrawal will be processed from an account that has not passed age verification. This policy exists not only to comply with responsible gaming standards but to fulfil our duty of care to the communities in which we operate, including Bangladesh.

The rrr5 platform may contain references to third-party game providers, payment services, and sports data sources. While rrr5 exercises care in selecting its service partners, this Privacy Policy applies only to data collected and processed by rrr5 itself. Any data submitted directly to third-party platforms (for example, directly to your bKash or Nagad application when initiating a payment) is governed by that third party's own privacy policy.

rrr5 is not responsible for the privacy practices, content, or security of third-party services. We encourage all Players to review the privacy policies of any third-party service with which they interact in connection with their use of the rrr5 platform.

rrr5 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. When material changes are made, the "Last updated" date at the top of this page will be revised accordingly.

Where a change is considered significant — for example, a new category of data collection, a new third-party sharing arrangement, or a change to the legal basis for processing — rrr5 will provide advance notice to registered Players via email or an on-platform notification, where reasonably practicable.

Your continued use of the rrr5 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any update to this Policy, you should stop using the platform and may request Account closure by contacting [email protected].

rrr5 recommends that Players review this Privacy Policy periodically to remain informed of how their personal data is being managed.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way rrr5 handles your personal data, please contact us using the details below. All privacy-related correspondence is handled in English and responses are provided during Bangladesh Standard Time (UTC+6) operating hours.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line (recommended): "Data Privacy Request" or "Privacy Policy Query"
• Support Language: English
• Response Time: rrr5 aims to acknowledge all privacy-related queries within 5 business days (BST) and to resolve them within 30 days
• Operating Hours: 24 hours a day, 7 days a week, including Bangladesh public holidays

For urgent data-security concerns — such as suspected unauthorised access to your account or a potential data breach — please mark your email subject line as "URGENT — Security" to ensure immediate escalation to the relevant team.