Privacy Policy – RummyBD Data Protection for Pakistan Players

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings set out below:

Personal Data — any information that identifies or could identify you as an individual, including your name, mobile number, CNIC number, IP address, and device identifiers.
Processing — any operation performed on personal data, including collection, storage, use, transmission, and deletion.
Data Controller — rummybd, the entity that determines the purposes and means of processing your personal data.
Third Party — any individual or organisation outside of rummybd that may receive personal data in defined circumstances described in this policy.
Platform — the rummybd website at https://rummybd.app and all associated products and services.
KYC — Know Your Customer, the identity verification process required to comply with anti-money laundering standards.
Cookies — small data files placed on your device by the rummybd platform that enable session management, analytics, and personalisation features.

2. Data We Collect

rummybd collects personal data in three main ways: information you provide directly, information collected automatically when you use the platform, and information received from third parties such as payment processors.

2.1 Information You Provide

Full name and date of birth (collected at registration);
Pakistani mobile number and email address;
CNIC number and document images (collected during KYC verification);
Payment method details such as Easypaisa or JazzCash wallet number, or bank account reference for IBFT;
Selfie photograph for identity comparison during KYC;
Communications you send to rummybd support via live chat or email.

2.2 Automatically Collected Data

IP address and approximate geographic location;
Device type, operating system, and browser version;
Session duration, pages visited, and navigation patterns within the platform;
Gameplay data including bet amounts, game titles accessed, session times, and win/loss records;
Login timestamps and authentication events;
Cookie identifiers as described in Section 7.

2.3 Data from Third Parties

rummybd may receive data from payment processors confirming transaction status, from identity verification partners confirming document authenticity, and from fraud prevention services flagging unusual activity. This data is used exclusively within the context described in this policy.

Data Category	Examples	Purpose
Identity Data	Name, CNIC, date of birth, selfie	Account registration, KYC compliance
Contact Data	Mobile number, email	Account verification, support, communications
Financial Data	Wallet numbers, transaction records	Deposit/withdrawal processing, AML compliance
Technical Data	IP address, device ID, browser type	Security, fraud prevention, platform optimisation
Usage Data	Pages visited, session duration, game logs	Platform improvement, responsible gaming monitoring
Marketing Data	Communication preferences	Personalised promotions (opt-in only)

3. How rummybd Uses Your Data

rummybd uses personal data for specific, clearly defined purposes. We do not use your data for any purpose not listed below without first notifying you and, where required, obtaining your consent.

Account creation and management — verifying your identity, maintaining your account, and enabling you to log in securely;
Payment processing — processing PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and card payments;
Compliance with legal obligations — fulfilling KYC, AML, and age verification requirements;
Customer support — responding to queries, resolving disputes, and managing account issues;
Security and fraud prevention — detecting and preventing unauthorised access, fraudulent transactions, and abuse of platform services;
Platform improvement — analysing usage data to identify performance issues, improve navigation, and prioritise feature development;
Responsible gaming — monitoring gameplay patterns to identify behaviour that may indicate problem gambling and intervening appropriately;
Marketing communications — sending promotional offers and platform updates to players who have opted in to receive them. You can withdraw consent at any time.

4. Legal Basis for Processing

rummybd processes personal data on one of the following legal bases depending on the purpose:

Contract performance — processing necessary to provide the gaming and payment services you have signed up for;
Legal obligation — processing required to comply with KYC, AML, and applicable regulatory requirements;
Legitimate interest — processing for fraud prevention, platform security, and responsible gaming monitoring where our interest does not override your rights;
Consent — processing for marketing communications and optional analytics cookies, where you have explicitly opted in and may withdraw consent at any time.

Right to withdraw consent: Where rummybd processes your data on the basis of consent, you can withdraw that consent at any time by updating your communication preferences in account settings or by emailing contact@rummybd.app. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third Parties

rummybd does not sell, rent, or commercially trade your personal data. Your information is shared only in the limited circumstances set out below, and only with parties who are contractually obligated to handle it with appropriate security measures.

5.1 Game Software Providers

Game studios that supply titles to the rummybd platform — such as Pragmatic Play, PG Soft, and Play'n GO — receive limited technical data necessary to deliver game sessions, including session tokens and bet records. They do not receive your name, CNIC, or contact details.

5.2 Payment Processors

Payment providers including Easypaisa, JazzCash, and card processing partners receive the transaction data necessary to complete deposits and withdrawals. rummybd does not store full card numbers. Card processing is handled by PCI-DSS compliant processors.

5.3 Identity Verification Partners

When KYC verification is required, rummybd uses certified identity verification services to authenticate CNIC documents and selfie photographs. These partners operate under strict data processing agreements and may not use your data for any purpose other than the verification task.

5.4 Fraud Prevention & Security

rummybd works with fraud detection services that analyse technical data such as IP addresses and device fingerprints to identify suspicious activity. No name, contact, or financial data is shared for this purpose.

5.5 Legal & Regulatory Disclosure

rummybd will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by a valid legal order. Where legally permitted, rummybd will notify affected players before such disclosure.

rummybd will never share your data with advertising networks, data brokers, or social media platforms for commercial purposes.

6. Payment Data & PKR Transactions

Because rummybd operates entirely in Pakistani Rupees and uses Pakistani payment methods, the way payment data is handled is particularly relevant to our players.

6.1 Easypaisa & JazzCash

When you deposit or withdraw via Easypaisa or JazzCash, your mobile wallet number is shared with the respective payment provider to process the transaction. rummybd retains a record of the transaction amount, timestamp, and transaction reference for account balance purposes and AML compliance. Your wallet PIN and account credentials are never visible to rummybd.

6.2 Bank Transfer (IBFT)

For IBFT deposits, rummybd retains your bank name and the last four digits of the account number as a reference for transaction matching. Full account numbers are not stored on rummybd's systems beyond the immediate processing window.

6.3 Visa / Mastercard

Card payments are handled entirely by PCI-DSS Level 1 certified processing partners. rummybd does not store, process, or transmit full card numbers on its own infrastructure. The card processor returns only a transaction status confirmation and tokenised reference to rummybd's system.

6.4 Transaction History

Your full PKR transaction history — deposits, withdrawals, bets, and winnings — is stored in your rummybd account and accessible from your account history at any time. This data is retained for the period described in Section 9.

7. Cookies & Tracking Technologies

rummybd uses cookies and similar technologies to keep your session active, understand how the platform is used, and — with your consent — deliver relevant promotional content. Below is a breakdown of the cookie categories used.

You can manage optional cookie preferences from your browser settings or by contacting rummybd support. Disabling essential cookies will prevent the platform from functioning correctly.

8. Data Security

rummybd implements a layered approach to data security that covers technical infrastructure, access controls, and operational practices.

8.1 Technical Measures

SSL/TLS encryption on all data transmissions between your device and rummybd's servers;
Encrypted storage for sensitive fields including passwords (stored as one-way hashes that cannot be reversed) and CNIC data;
Firewalls and intrusion detection systems monitoring platform infrastructure around the clock;
Regular security audits and penetration testing conducted by independent security professionals.

8.2 Access Controls

Access to personal data within rummybd is restricted on a strict need-to-know basis. KYC documents are accessible only to the compliance team and only during active verification. Support agents can view account details necessary to resolve your query but do not have access to payment credentials or full CNIC data.

8.3 Data Breach Response

In the event of a data breach that poses a significant risk to your rights or freedoms, rummybd will notify affected players as quickly as practicable and take immediate steps to contain and remediate the breach. rummybd will cooperate with any applicable regulatory notification requirements.

Your responsibility: rummybd's security measures protect data on our end. Keep your password unique and confidential, enable two-factor authentication if offered, and never share your login credentials. rummybd will never ask for your password.

9. Data Retention

rummybd retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by legal and regulatory obligations.

Account & identity data

Name, CNIC, contact details

5 years after account closure

Financial transaction records

Deposits, withdrawals, bets

7 years (AML compliance)

KYC documents

CNIC images, selfie photos

7 years (AML compliance)

Support communications

Live chat logs, emails

3 years

Analytics & usage data

Session logs, navigation data

13 months (rolling)

When the retention period expires, data is securely deleted or anonymised so it can no longer be linked to you as an individual.

10. Your Privacy Rights

As a rummybd player, you have the following rights over your personal data. To exercise any of these rights, contact rummybd at contact@rummybd.app or via live chat. rummybd will respond within 30 days.

1

Right of Access

You can request a copy of all personal data rummybd holds about you. This is provided in a structured, readable format at no charge. A first request is always free; subsequent requests within a twelve-month period may incur a nominal administrative fee.

2

Right to Rectification

If any personal data rummybd holds about you is inaccurate or incomplete, you have the right to request a correction. For most fields, you can update data directly in account settings. For name and CNIC corrections, contact support with supporting documentation.

3

Right to Erasure

You can request deletion of your personal data. Where data is required to be retained for legal or compliance reasons (such as AML record-keeping), rummybd will explain which data cannot be deleted and why. All remaining data will be deleted or anonymised upon account closure request.

4

Right to Data Portability

You can request your personal data in a machine-readable format (CSV or JSON) to transfer to another service. This applies to data you provided directly and data generated by your use of the platform.

5

Right to Restrict Processing

You can ask rummybd to pause processing of your personal data in certain circumstances — for example, while the accuracy of data is being disputed or while you are considering whether to request erasure.

6

Right to Object to Marketing

If you have previously consented to receiving promotional communications from rummybd, you can withdraw that consent at any time by updating your notification preferences in account settings or by replying STOP to any marketing message.

11. Children's Privacy

rummybd is an adults-only platform. We do not knowingly collect personal data from anyone under 18 years of age. Registration requires confirmation that you are 18 or older, and this is verified as part of the KYC process.

If rummybd discovers that a player is under 18, the account will be closed immediately, any deposited funds will be returned to the payment source, and all personal data associated with the account will be securely deleted. If you have reason to believe a minor has registered on rummybd, please contact us immediately at contact@rummybd.app.

12. Third-Party Services Within the Platform

Game software provided by studios such as Pragmatic Play, PG Soft, and Evolution Gaming runs within the rummybd interface but is technically delivered from the studio's own servers. These studios operate under their own privacy practices as they relate to game session data. rummybd's contractual agreements with all game providers require them to handle session data in a manner consistent with this policy and applicable data protection standards.

rummybd does not embed third-party advertising SDKs, social media tracking pixels, or external analytics platforms that would share your data with advertising networks. Any analytics used by rummybd is first-party and described in Section 7.

13. Changes to This Privacy Policy

rummybd reviews this Privacy Policy regularly. When material changes are made — changes that affect how your data is collected, used, or shared — rummybd will notify registered players via the mobile number or email address on file at least seven days before the updated policy takes effect.

The updated policy will be published on this page with a revised "Last Updated" date. Your continued use of rummybd after the effective date of an amendment constitutes your acknowledgement of the updated policy. If you do not agree with a change, you may contact support to close your account before the effective date.

Version in force: This Privacy Policy is effective from 1 June 2025. It supersedes all prior versions of the rummybd Privacy Policy.

14. Contact & Complaints

For all privacy-related questions, data access requests, or complaints about how rummybd handles your personal data, contact the rummybd privacy team through any of the following channels:

Email: contact@rummybd.app (include "Privacy" in the subject line)
Live Chat: Available 24/7 from your rummybd account dashboard
Languages: English and Urdu

rummybd aims to respond to all privacy queries within five business days and to resolve them within thirty days. If you are not satisfied with the response, you have the right to escalate your complaint through applicable regulatory channels in your jurisdiction.

For responsible gaming concerns related to your account data, visit the rummybd Responsible Gaming page for additional support resources and self-exclusion tools.