Privacy Policy – Card Rummy Pakistan Data & Security

1Who We Are

Card Rummy is an online card games and sports betting platform operated at cardrummy.im. The platform is built specifically for Pakistani players, offering rummy, poker, cricket betting, PSL betting and a full sports betting section – all with account balances, deposits and withdrawals denominated in Pakistani Rupees (PKR).

For the purposes of this Privacy Policy, "Card Rummy", "we", "our" and "us" refer to the operator of cardrummy.im. "You" and "your" refer to any registered player or visitor to the Card Rummy platform. "Personal data" means any information that can be used to identify you, directly or in combination with other information.

Card Rummy is the data controller for the personal information collected through this platform. This means we determine the purposes and methods of processing your data and bear responsibility for doing so lawfully and transparently.

2Personal Data We Collect

Card Rummy collects different categories of personal data depending on how you interact with the platform. The table below summarises the main data types we hold:

3How We Collect Your Data

Card Rummy collects personal data through several distinct channels:

• Direct from you – when you complete the Card Rummy registration form, submit verification documents, make a deposit, place a bet or contact our support team. The information you type in is collected exactly as you provide it.
• Automatically via the platform – when you visit or use Card Rummy, our systems automatically record technical data including your IP address, device identifiers, browser type and session activity. This happens on every visit whether or not you are logged in.
• From payment processors – when you deposit or withdraw via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or a debit card, the relevant payment provider confirms the transaction and may share limited transaction reference data with Card Rummy for reconciliation purposes.
• From identity verification providers – if Card Rummy uses a third-party service to verify your CNIC or identity documents, that provider may return a verification result and a data summary to Card Rummy.
• Through cookies and tracking technologies – Card Rummy uses cookies and similar technologies to maintain your session, remember preferences and analyse platform performance. See Section 11 for full details.

4Why We Use Your Data

Card Rummy uses your personal data for specific, documented purposes. We do not use your data for anything not described in this policy without first informing you and, where required, obtaining your consent.

5Legal Basis for Processing

Card Rummy processes your personal data under the following legal bases:

• Contractual necessity – most of the data we collect is necessary to deliver the service you signed up for. Without your name and payment details, we cannot process PKR withdrawals. Without identity verification, we cannot comply with age verification obligations.
• Legal obligation – certain data processing is required by law, including anti-money-laundering obligations that require us to record and verify the source of deposits above certain thresholds.
• Legitimate interests – fraud detection, platform security and responsible gaming monitoring are processed on the basis of Card Rummy's legitimate interest in operating a safe and fair platform.
• Consent – where we send you optional marketing communications about Card Rummy promotions, PSL betting offers or new card game releases, we do so only where you have given consent. You can withdraw this consent at any time via your account settings or by contacting [email protected].

6Sharing Your Data

Card Rummy does not sell your personal data to any third party. We do not share your data with advertisers, data brokers or marketing networks. Your data is shared only in the limited circumstances described below:

• Payment processors – Easypaisa, JazzCash, NayaPay, SadaPay, IBFT banks and Visa/Mastercard networks receive the minimum payment data necessary to process your transaction. Card Rummy does not share your full account history with payment processors.
• Identity verification providers – where Card Rummy uses a third-party KYC provider to verify your CNIC or documents, your identification data is shared with that provider solely for the purpose of verification. These providers are contractually prohibited from using your data for any other purpose.
• Fraud prevention services – Card Rummy may cross-reference account data with industry-shared fraud prevention databases to identify known fraudsters or money launderers. This is standard practice across the gaming industry.
• Regulatory and legal authorities – Card Rummy will disclose personal data to government agencies, law enforcement or regulators where required to do so by applicable law or a valid legal order. We will notify you of such disclosures where legally permitted to do so.
• Technology service providers – Card Rummy uses third-party providers for hosting, analytics and platform infrastructure. These providers process data only under our instructions and are bound by confidentiality and data processing agreements.

7Payments & Financial Privacy

All financial transactions at Card Rummy are processed in Pakistani Rupees. Because our payment methods – Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and Visa/Mastercard – are all Pakistani services, your financial data stays within Pakistan-based payment infrastructure in the majority of transactions.

Card Rummy stores the minimum financial information necessary to process transactions and meet anti-money-laundering obligations. We do not store full card numbers – only the last four digits and card type are retained after a transaction is completed. Full mobile wallet credentials are never stored; only the wallet number linked to your account for withdrawal purposes.

Transaction records including deposits, withdrawals and bet settlements are retained for a minimum of five years in line with standard financial record-keeping obligations. This data is accessed only by authorised Card Rummy staff and relevant authorities where required by law.

8Data Retention

Card Rummy retains your personal data for as long as your account is active and for a defined period after account closure. Retention periods are set based on legal obligations and operational necessity:

• Active account data – retained for the duration of your Card Rummy account. You may request deletion of non-essential data at any time (see Section 10).
• Financial and transaction records – retained for a minimum of five years after account closure, as required for anti-money-laundering compliance.
• Identity documents (CNIC, selfie) – retained for three years after account closure or as required by applicable law, whichever is longer.
• Support communications – retained for two years after the matter is resolved.
• Technical logs (IP addresses, session data) – retained for 90 days as standard, or longer where required for an active fraud investigation.
• Responsible gaming data – self-exclusion records are retained indefinitely to prevent re-registration during an exclusion period. Other responsible gaming data is retained for three years after account closure.

After the applicable retention period expires, Card Rummy securely deletes or anonymises your data so it can no longer be associated with you individually.

9Security Measures

Card Rummy implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. Our key security measures include:

• All data transmitted between your device and Card Rummy is encrypted using TLS (Transport Layer Security). The padlock you see in your browser when visiting cardrummy.im confirms this encryption is active.
• Account passwords are stored using one-way hashing. Card Rummy staff cannot retrieve your password – only reset it through a verified process.
• Access to personal data within Card Rummy is restricted to staff who need it for their specific job function. Access is logged and regularly reviewed.
• Payment data is handled through payment processors with their own security certifications. Card Rummy does not store full payment credentials on its own servers.
• Card Rummy's systems are monitored around the clock for unusual activity. Suspicious access attempts trigger automatic security alerts.
• Regular internal security reviews are conducted to identify and remediate potential vulnerabilities before they can be exploited.

10Your Data Rights

As a Card Rummy player, you have rights over your personal data. These rights are described below along with how to exercise each one:

To exercise any of the rights above, email [email protected] from your registered email address. We will verify your identity before processing any data rights request. We aim to respond within 30 days; complex requests may take up to 60 days with prior notice.

11Cookies & Tracking

Card Rummy uses cookies and similar tracking technologies on its platform. A cookie is a small text file stored on your device when you visit a website. Card Rummy uses the following types of cookies:

• Strictly necessary cookies – required for the Card Rummy platform to function. These include session cookies that keep you logged in and security tokens that protect your account. You cannot opt out of these without stopping your use of the platform.
• Functional cookies – remember your preferences such as language setting, preferred stake amount and game lobby layout. Disabling these means Card Rummy cannot remember your settings between sessions.
• Analytics cookies – collect anonymised data about how players use Card Rummy, which pages are visited most, where users drop off and how long typical sessions last. This data helps us improve the platform. These cookies do not identify you personally.

You can manage cookie preferences through your browser settings. Clearing cookies will log you out of Card Rummy and remove saved preferences. Card Rummy does not use third-party advertising cookies – we do not place tracking pixels for retargeting purposes.

12Children & Minors

Card Rummy is strictly an 18+ platform. We do not knowingly collect personal data from anyone under the age of 18. If a minor has registered an account by falsifying their date of birth or identity documents, their account will be closed immediately upon discovery, all funds returned and all associated data deleted except where retention is required for legal purposes.

If you have reason to believe a minor is using a Card Rummy account, please contact us immediately at [email protected]. We take reports of underage gambling seriously and will act swiftly on any credible report.

13Changes to This Privacy Policy

Card Rummy may update this Privacy Policy from time to time to reflect changes in the platform, applicable law or our data practices. The date of the most recent revision is shown at the top of this page.

When we make material changes to this policy – for example, adding a new category of data collection or a new third-party processor – we will notify registered players via their account email address and display a notice on the Card Rummy platform for at least 14 days following the change.

Continued use of Card Rummy after a policy update constitutes your acceptance of the revised terms. If you do not accept the updated policy, you may close your account by contacting [email protected].

14Contact & Privacy Queries

For any question, concern or request related to this Privacy Policy or your personal data at Card Rummy, please contact our privacy team: