cr786 Privacy Policy

This Privacy Policy ("Policy") describes how cr786 ("we," "us," "the Platform") collects, uses, stores, shares, and protects personal data belonging to individuals ("you," "the Member," "the User") who register an account, access the platform, or otherwise interact with cr786's services.

cr786 operates as an internationally licensed online casino and sports betting platform serving Pakistani players across Karachi, Lahore, Faisalabad, Islamabad, and other cities throughout Pakistan. The handling of personal data is governed by the requirements of our international gaming license, applicable data protection obligations imposed by that license, and internal data governance standards.

By registering a cr786 account or continuing to use the platform, you acknowledge that you have read and understood this Policy. If you do not agree to the terms of this Policy, you should not proceed with registration or continued use of cr786.

The data controller for personal data collected and processed by cr786 is the licensed operating entity behind the cr786 platform. Details of the operating entity, including its registered jurisdiction and licensing authority, are available on request via the cr786 support team. Requests for this information will be acknowledged within five business days.

For all data-related enquiries, including subject access requests, correction requests, and deletion requests, the designated contact point is the cr786 support team reachable at the email address set out in Section 15 of this Policy.

cr786 collects the following categories of personal data from members and prospective members:

cr786 does not collect special category data (such as health data or biometric data) except where a KYC selfie is required for identity verification purposes, in which case it is processed solely for that purpose and is not used for biometric identification in any broader sense.

cr786 collects personal data through the following means:

• Direct provision by you: When you register a cr786 account, complete KYC verification, make a deposit or withdrawal, contact support, or set responsible gaming limits, you directly provide us with personal data.
• Automated collection: When you access cr786 from any browser, our systems automatically collect technical data including IP address, device identifiers, and session data. This is necessary for platform security, fraud detection, and compliance monitoring.
• Payment processors: When you transact via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, cr786 receives transaction confirmation data from those payment networks sufficient to credit your PKR account balance.
• Identity verification services: cr786 may use third-party KYC verification providers to validate CNIC documents and confirm identity. These providers process personal data under binding data processing agreements with cr786.
• Fraud prevention agencies: cr786 may receive data from third-party fraud prevention databases where a transaction or registration triggers a review flag, as permitted under its licensing obligations.

cr786 uses your personal data for the following purposes:

• Account creation and management: To register your cr786 account, maintain your player profile, and administer your PKR balance.
• Identity verification (KYC): To verify your identity and age (21+) as required under cr786's international gaming license and AML compliance obligations.
• Payment processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other approved channels in PKR.
• Platform delivery: To provide access to casino games, sports betting markets (including PSL and international cricket), and all other cr786 services.
• Responsible gaming: To monitor gaming behaviour and enforce any limits, time-outs, or self-exclusion orders you have set, and to fulfil cr786's licensing obligations relating to player welfare.
• Fraud detection and AML compliance: To identify suspicious transactions, prevent money laundering, and report to regulatory authorities where required by law.
• Customer support: To respond to your queries, process complaints, and maintain records of communications.
• Legal compliance: To comply with requests from licensing authorities, law enforcement agencies, and financial regulators with appropriate jurisdiction.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the cr786 platform, gaming experience, and payment processes for Pakistani players.
• Communications: To send transactional communications — such as deposit confirmations, withdrawal notifications, and KYC status updates — to your registered contact details.

cr786 processes your personal data on the following legal grounds:

• Contractual necessity: Processing that is required to perform the cr786 Terms & Conditions — including account management, payment processing, and game delivery — is undertaken on the basis of contractual necessity.
• Legal obligation: KYC verification, AML monitoring, responsible gaming controls, and regulatory reporting are undertaken on the basis of legal obligation imposed by cr786's international gaming license.
• Legitimate interests: Fraud detection, platform security monitoring, technical data collection, and aggregated analytics are undertaken on the basis of cr786's legitimate interest in operating a secure, compliant, and functional gaming platform.
• Consent: Where cr786 seeks to send optional marketing communications, we will request explicit consent and provide a straightforward means to withdraw that consent at any time.

cr786 shares personal data only in the circumstances set out below. In all cases involving third-party processors, cr786 requires those parties to handle your data in accordance with applicable data protection standards and under binding contractual obligations.

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other approved payment channels receive the transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party KYC verification services receive your identity documents for the purpose of verifying your CNIC and confirming your age and identity. These providers operate under data processing agreements.
• Game providers: Licensed game studios and aggregators may receive a pseudonymous player identifier and session data necessary to deliver games and calculate outcomes. They do not receive your name or payment details.
• Licensing and regulatory authorities: cr786's licensing authority and relevant regulatory or law enforcement bodies may receive personal data where disclosure is required by law or by the terms of the gaming license.
• Fraud prevention agencies: Where a transaction or account triggers a fraud or AML review, relevant data may be shared with fraud prevention services operating under regulatory compliance frameworks.
• Professional advisers: Legal, audit, and compliance advisers engaged by cr786 may access personal data to the extent necessary for the specific professional engagement, under confidentiality obligations.

cr786 does not share personal data with social media platforms, advertising networks, or data brokers for any commercial purpose.

As an internationally licensed operator, cr786 may process or store personal data on servers located outside Pakistan. Where personal data is transferred internationally, cr786 takes steps to ensure an adequate level of protection applies, consistent with the requirements of its gaming license.

Such steps include the use of contractual clauses with data processors, selection of processors operating in jurisdictions with recognised data protection standards, and encryption of data in transit and at rest. If you wish to obtain further information about the safeguards applied to international transfers of your data, please contact the support team.

cr786 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to overriding legal and regulatory retention obligations. The following retention principles apply:

• Active account data: Retained for the duration of your cr786 membership and for a period of at least five years following account closure, in accordance with AML record-keeping requirements typically imposed under gaming licenses.
• KYC and identity documents: Retained for the period required by cr786's licensing authority from the date of submission or account closure, whichever is later. This is typically five years minimum.
• Transaction records: Retained for a minimum of five years from the transaction date, consistent with financial record-keeping obligations.
• Responsible gaming records: Self-exclusion and limit records are retained for the duration of the restriction plus the regulatory minimum retention period, to prevent circumvention of protections you have set.
• Support communications: Retained for a period of three years from the date of the interaction, unless a longer period is required for an unresolved complaint or regulatory matter.
• Technical and session data: Retained for a period of 12 to 24 months from collection, depending on the specific data type and its fraud-prevention function.

When data reaches the end of its retention period, cr786 securely deletes or anonymises it so that it can no longer be associated with an individual.

cr786 implements technical and organisational security measures proportionate to the sensitivity of the personal data held and the risks associated with its processing. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the cr786 platform.
• Encrypted storage for sensitive personal data, including KYC documents and financial account identifiers.
• Access controls ensuring that cr786 personnel can access personal data only to the extent required for their specific role.
• Intrusion detection systems and regular security reviews of platform infrastructure.
• Pseudonymisation of player identifiers passed to game providers so that studio partners do not receive your name or payment details.

Despite these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your cr786 Login credentials. If you suspect that your account has been accessed without authorisation, you must contact cr786 support immediately.

cr786 uses cookies and similar technologies (local storage, session identifiers) on its platform for the following purposes:

• Essential cookies: Required for the platform to function — maintaining your logged-in session, remembering your preferred currency (PKR), and enabling secure navigation across the platform. These cannot be disabled without disrupting platform functionality.
• Security cookies: Used to detect and prevent fraudulent access, bot activity, and multi-account abuse. These are required for platform integrity and licensing compliance.
• Analytics cookies: Used to collect aggregated, anonymised data about how members navigate the cr786 platform, which pages are visited most frequently, and where technical errors occur. This data is used solely to improve the platform.
• Preference cookies: Used to remember your in-platform settings, such as game category preferences and notification settings, so you do not need to re-configure them on each session.

cr786 does not use third-party advertising cookies or tracking pixels that transmit your data to ad networks. You can manage cookie preferences through your browser settings, though disabling essential cookies may impair platform access.

As a cr786 member, you have the following rights in relation to your personal data, subject to limitations imposed by legal retention obligations and licensing requirements:

To exercise any of these rights, contact the cr786 support team via the details in Section 15. cr786 will acknowledge your request within five business days and aim to resolve it within 30 calendar days. Complex requests may require up to 90 days, in which case you will be informed of the extended timeline and the reason.

Please note that some rights are subject to limitations. For example, cr786 cannot delete AML-related transaction records that it is legally required to retain under its gaming license. In such cases, cr786 will explain the specific legal basis for retaining the data in question.

cr786 is strictly a 21+ platform. We do not knowingly collect personal data from individuals under the age of 21. CNIC-based age verification is conducted on all accounts as a condition of withdrawal processing, and may be initiated at any point during a member's relationship with cr786.

If cr786 becomes aware that personal data has been provided by an individual under 21 years of age, that account will be closed immediately, all personal data associated with it will be deleted as soon as legally permissible, and any deposited funds will be returned to the originating payment method. Depending on the circumstances, the matter may be referred to the relevant authority.

If you are a parent or guardian and believe that a minor in your care has registered a cr786 account, please contact support immediately using the contact details in Section 15.

cr786 reserves the right to update or revise this Privacy Policy at any time. The most current version will always be published on this page with an updated effective date. Where changes are material — for example, changes to data sharing practices, retention periods, or the introduction of new processing purposes — cr786 will use reasonable endeavours to notify active members via their registered contact details in advance of the change taking effect.

Your continued use of cr786 following publication of a revised Privacy Policy constitutes acceptance of the revised terms. We encourage you to review this page periodically, particularly if your circumstances change or if you receive a notification of policy revision.

For all privacy-related queries, data subject access requests, correction requests, deletion requests, and concerns about how cr786 handles your personal data, please contact the cr786 support team through the following channels:

When submitting a data subject access request or any formal privacy request, please include your registered account name and the mobile number associated with your cr786 account so that we can verify your identity before processing the request. cr786 will not process data access requests from unverified individuals to protect account security.

cr786 aims to acknowledge all formal privacy requests within five business days and to provide a substantive response within 30 calendar days. If a request is complex or involves a large volume of data, the response period may be extended to 90 days, in which case you will be informed promptly.