We are straightforward about what data CardRummy collects, why we need it, and exactly how we protect it. Pakistani players deserve full transparency — this policy gives you that.
This Privacy Policy explains how CardRummy ("we", "us", "the platform") collects, uses, stores and protects the personal information of players who register and play at cardrummy.biz. We have written this policy in plain, straightforward English so that every Pakistani player — regardless of technical background — can understand exactly how their data is handled. If anything is unclear, our support team is available around the clock to explain any section in more detail.
CardRummy is committed to protecting the privacy of every player on the platform. We recognise that when you share your name, mobile number, payment details, and identity documents with CardRummy, you are placing genuine trust in us. That trust is something we take seriously and work actively to deserve.
This Privacy Policy applies to all personal data we collect through cardrummy.biz, our mobile-optimised site, our customer support channels, and any other way you interact with CardRummy. It should be read alongside our Terms and Conditions, which govern the overall relationship between you and CardRummy.
By registering an account on CardRummy, you confirm that you have read and understood this Privacy Policy and consent to the data processing activities described herein. If you do not agree with any part of this policy, please do not register or continue using the platform.
Plain-language commitment: CardRummy will never sell your personal data. We will never share it with advertisers. We only share the minimum necessary data with the third-party service providers that help us operate the platform safely, and all such sharing is governed by written data processing agreements.
CardRummy collects only the personal data that is genuinely necessary to provide our services, verify your identity, process payments, and keep the platform secure. Below is a full breakdown of what we collect and why.
CardRummy does not collect or store sensitive personal data categories such as biometric data, health information, religious beliefs or political affiliations. The only biometric-adjacent data we may hold is a verification photograph used solely to confirm identity against a government-issued document.
CardRummy uses your personal data for the following purposes. We do not use data for any purpose beyond what is described here without obtaining your explicit consent first.
| Purpose | Data Used | Necessary? |
|---|---|---|
| Create and manage your CardRummy account | Registration data, contact details | Yes |
| Verify your age (18+ requirement) | Date of birth, CNIC data | Yes |
| Process deposits and withdrawals in PKR | Financial data, payment method details | Yes |
| Detect and prevent fraud and money laundering | Financial data, IP address, transaction history | Yes |
| Provide customer support | Account data, communications data | Yes |
| Improve platform features and game offerings | Usage data, session data (anonymised) | Optional |
| Send account and transaction notifications | Mobile number, email address | Yes |
| Send promotional communications (with consent) | Email address, mobile number | Optional |
| Comply with legal and regulatory obligations | All relevant personal data | Yes |
CardRummy processes your personal data on one or more of the following legal bases:
CardRummy does not sell, rent or trade your personal data to any third party for any commercial purpose whatsoever. Data is shared with third parties only in the following limited circumstances, all of which are governed by written data processing agreements that require those parties to protect your data to at least the same standard as CardRummy:
All third-party data processors used by CardRummy are contractually bound to process your data only for the specific purpose for which it was shared, to implement appropriate security measures, and to delete or return data when the processing relationship ends.
CardRummy uses cookies and similar technologies to make the platform function correctly, remember your preferences, and understand how players use the site so we can improve it. Here is a breakdown of the types of cookies we use:
CardRummy does not use third-party advertising cookies or share cookie data with advertising networks. You can manage cookie preferences through your browser settings at any time. Note that disabling certain cookies may affect platform functionality.
CardRummy retains personal data only for as long as necessary to fulfil the purpose for which it was collected, comply with legal obligations, and resolve any disputes that arise. The following retention periods apply:
When retention periods expire, CardRummy securely deletes or anonymises personal data so it can no longer be associated with you.
CardRummy implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include:
Despite these measures, no security system is entirely impenetrable. If you believe your CardRummy account has been compromised, contact support immediately at support@cardrummy.biz and change your password without delay.
As a CardRummy player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our data team at privacy@cardrummy.biz. We will respond within 30 days.
Request a complete copy of all personal data CardRummy holds about you at any time.
Request correction of any inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where it is no longer needed and no legal retention obligation applies.
Request that we limit how we use your data while a dispute or correction request is being resolved.
Receive your personal data in a structured, machine-readable format to transfer to another service.
Object to processing based on legitimate interests, including direct marketing communications.
Withdraw consent for any processing based on consent at any time without affecting prior processing.
CardRummy's services are strictly for individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. All registration attempts are subject to age verification, and accounts found to belong to underage users are permanently closed with all associated data deleted in accordance with our retention policy.
If you are a parent or guardian and believe your child has registered a CardRummy account without your knowledge, please contact us immediately at support@cardrummy.biz with details of the account. We will investigate promptly and close the account if the player is confirmed to be under 18.
CardRummy uses age verification tools and manual review processes to identify underage account holders. If you suspect an account belongs to a minor, please report it to us without delay.
CardRummy may send you promotional communications about bonuses, new games, tournaments and platform updates. We will only send marketing communications to you if you have given explicit consent during registration or subsequently opted in through your account settings.
CardRummy may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we provide. When we make material changes, we will notify you via email to your registered address and via an in-platform notification at least 7 days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the most recent revision.
Your continued use of CardRummy after the effective date of any updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree with a change, you may close your account before the effective date and any valid balance will be returned to you via your registered payment method. All data processing activities conducted before your account closure remain governed by the version of this policy in effect at the time they occurred.
We recommend revisiting this Privacy Policy periodically. The most current version is always available at cardrummy.biz/privacy-policy. Older versions are archived and available on request.
CardRummy takes privacy seriously and our data team is available to address any concern or question you have about how we handle your personal information. For all privacy-related matters, the dedicated contact channels are:
We aim to respond to all privacy-related requests within 30 days. For complex requests involving large amounts of data, we may extend this to 60 days with notice to you. There is no fee for exercising any of your data rights.
Our privacy commitments in practice — not just in writing. Here is what they mean for Pakistani players day to day.
Every byte of data transmitted between your phone and CardRummy's servers is protected by 256-bit SSL/TLS encryption — the same standard used by major banks. Your payment details, identity documents and account credentials are never transmitted or stored in plain text at any point.
CardRummy has never sold player data to an advertiser, marketing company, data broker or any other commercial third party — and has a standing policy against doing so. Your mobile number, email address and usage patterns are yours. We use them to serve you, not to profit from selling them to others.
CardRummy gives you seven distinct rights over your personal data. You can request to see it, correct it, delete it, restrict its processing, receive it in portable format, object to certain uses, or withdraw consent. All requests are free and handled within 30 days. Contact privacy@cardrummy.biz any time.
If a data breach affecting your personal information occurs, CardRummy commits to notifying you within 72 hours of becoming aware of it. We do not delay, minimise or conceal security incidents. You will be told what happened, what data was affected, and what steps are being taken to address it.
CardRummy only collects the data that is genuinely necessary to provide our services and comply with our legal obligations. We do not collect data speculatively on the chance it might be useful later. We do not retain data beyond the periods specified in this policy. Less data collected means less risk to you.
This Privacy Policy was written to be genuinely readable, not to obscure what CardRummy does with your data behind walls of legal language. If any section is unclear, our 24/7 support team can explain it in English or Urdu. Privacy should not require a law degree to understand.