888y Privacy
Policy

1.1 For the purposes of this Privacy Policy, 888y ("the Company," "we," "us," "our") is the data controller in respect of personal data collected through the 888y Platform at 888y.bid and all associated services, mobile interfaces and applications (collectively "the Platform").

1.2 888y operates under an international gaming license. Our regulatory obligations under that license inform and underpin our data processing activities — particularly in relation to identity verification, anti-money laundering checks and responsible gaming monitoring.

1.3 For all privacy-related enquiries, data subject rights requests and complaints, you may contact the 888y Data Protection function by email at [email protected] with the subject line "Privacy Request — [Your Account Reference]". All privacy requests are handled separately from general customer support tickets.

2.1 888y collects the following categories of personal data from Account Holders and Platform visitors:

2.2 888y does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data or biometric data except where biometric liveness checks are required as part of enhanced KYC procedures — in which case such data is processed solely for identity verification and not retained beyond the verification event.

3.1 Directly from You. The majority of personal data 888y holds is provided directly by you during account registration, identity verification, payment processing, gameplay, support interactions and when updating your account profile or responsible gaming settings.

3.2 Automatically. When you access the 888y Platform, certain technical and behavioural data is collected automatically through server logs, session tracking and first-party analytics tools. This includes IP addresses, device identifiers, page interaction data and session timing.

3.3 From Third-Party Service Providers. 888y receives data from third-party service providers engaged to support Platform operations, including:

• Identity Verification Providers: confirmation of CNIC validity and age from accredited KYC partners;
• Payment Processors: transaction confirmation data from JazzCash, EasyPaisa and banking partners;
• Fraud Detection Services: risk scoring signals based on device and behavioural patterns;
• Game Providers: game outcome and session data from certified third-party gaming studios.

3.4 From Regulatory Authorities. In limited circumstances, 888y may receive data from regulatory or law enforcement authorities in connection with its licensing obligations or in response to legally binding requests.

4.1 888y processes personal data on the following legal bases and for the corresponding purposes:

• Contract Performance: Processing necessary to operate your 888y account, process deposits and withdrawals in PKR, settle bets, credit bonuses and provide all contracted Platform services.
• Legal Obligation: Processing required to comply with 888y's regulatory obligations under its gaming license, including anti-money laundering (AML) checks, counter-terrorism financing (CTF) screening, age verification and regulatory reporting.
• Legitimate Interests: Processing to prevent fraud, detect bonus abuse and multi-accounting, maintain Platform security, conduct responsible gaming monitoring and improve Platform services through anonymised analytics.
• Consent: Processing for optional marketing communications (email newsletters, SMS promotions) where you have provided specific, freely-given, unambiguous consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

4.2 888y does not make solely automated decisions that produce legal or similarly significant effects on Account Holders, except as expressly required by our AML compliance obligations, in which case affected players are entitled to request human review.

5.1 888y does not sell personal data. 888y shares personal data only in the following controlled circumstances:

• Service Providers: Carefully selected third-party processors operating under binding data processing agreements — including KYC providers, payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan), cloud hosting infrastructure providers, fraud detection services and game studios. These providers are contractually restricted to processing data only as instructed by 888y and for no other purpose.
• Regulatory Authorities: 888y's gaming license regulator, tax authorities and financial intelligence bodies as required by applicable law. 888y will notify you of such disclosures where legally permitted to do so.
• Law Enforcement: Where required by valid legal process including court orders, subpoenas and lawful requests from competent Pakistani or international authorities.
• Business Transfers: In the event of a merger, acquisition or sale of substantially all of 888y's assets, personal data held by 888y may be transferred to the successor entity subject to the same or substantially equivalent privacy protections.

5.2 Where 888y engages sub-processors, we conduct due diligence on their data security practices and require contractual commitments equivalent to those imposed on 888y by its regulatory framework. A list of current sub-processors is available upon written request.

6.1 888y's primary data infrastructure is hosted within jurisdictions that maintain adequate data protection standards. Where personal data is transferred outside Pakistan for processing by service providers — such as cloud infrastructure providers or game studios — 888y implements appropriate transfer safeguards including contractual clauses that impose equivalent data protection obligations on the receiving party.

6.2 In all cases of international data transfer, 888y satisfies itself that the destination jurisdiction or the contractual arrangements in place provide a level of protection that is substantially equivalent to that which would apply within Pakistan and under our regulatory framework.

6.3 You may request information about the specific safeguards applied to any international transfer of your personal data by contacting 888y at [email protected].

7.1 888y retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following minimum retention requirements imposed by our regulatory obligations:

7.2 Upon expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical analysis and Platform improvement.

8.1 888y implements a layered security programme to protect personal data against unauthorised access, accidental loss, destruction and disclosure. Key technical and organisational measures include:

• Encryption: 256-bit SSL/TLS encryption for all data in transit; AES-256 encryption for data at rest on 888y servers.
• Access Controls: Role-based access control restricting personal data access to authorised personnel on a strict need-to-know basis; privileged access management for administrative systems.
• Authentication: Multi-factor authentication required for all 888y staff accessing personal data systems; two-factor authentication available to Account Holders on the Platform.
• Network Security: Firewalls, intrusion detection systems, DDoS mitigation and regular third-party penetration testing of 888y infrastructure.
• Monitoring: 24/7 automated security monitoring and anomaly detection across Platform systems with defined incident response procedures.
• Staff Training: Mandatory data protection and information security training for all 888y personnel with access to personal data.

8.2 No security system is impenetrable. While 888y takes all reasonable steps to protect your data, we cannot guarantee absolute security against all threats. You are responsible for maintaining the security of your 888y account credentials — including your password and any 2FA devices — and for ensuring your own device security.

9.1 888y uses cookies and similar tracking technologies (local storage, session tokens, pixel tags) on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication tokens, CSRF protection cookies and load balancer cookies. These cannot be disabled without preventing Platform use.
• Functional Cookies: Remember your language preferences, game lobby settings, responsible gaming tool configurations and "Remember Me" login state.
• Analytical Cookies: First-party analytics only — 888y uses own-infrastructure analytics to understand aggregate Platform usage patterns, game popularity and performance metrics. No third-party analytics platforms are used that would share your data with external parties.
• Security Cookies: Device fingerprinting and session integrity cookies used to detect fraudulent access, bot activity and suspicious login patterns.

9.2 888y does not use third-party advertising cookies or behavioural tracking cookies for retargeting purposes.

9.3 You may control functional and analytical cookies through your browser settings. Disabling strictly necessary cookies will prevent Platform access. Disabling security cookies may trigger additional verification requirements on login.

10.1 The 888y Platform is strictly restricted to individuals who are 21 years of age or older. 888y does not knowingly collect personal data from persons under 21. CNIC-based age verification is applied during account registration and must be successfully completed before an account becomes fully active.

10.2 If 888y becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended, all personal data associated with the account will be securely deleted, and any balance will be handled in accordance with applicable regulatory guidance.

10.3 If you are a parent or guardian and believe that a person under your care has registered an 888y account, please contact [email protected] immediately with relevant details. 888y will investigate and act on such notifications with priority.

11.1 Subject to applicable law and 888y's regulatory retention obligations, you have the following rights in respect of personal data 888y holds about you:

• Right of Access: You may request a copy of the personal data 888y holds about you, including the categories of data, purposes of processing and any third parties with whom your data has been shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. For certain data categories (e.g., name as per CNIC), supporting documentation may be required.
• Right to Erasure: You may request deletion of personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to override by regulatory retention obligations — 888y cannot delete AML-required records ahead of their mandatory retention period.
• Right to Restrict Processing: You may request that 888y restricts processing of your data in certain circumstances — for example, while the accuracy of data is contested.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to 888y, where processing is based on consent or contract performance.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring, where your particular circumstances override 888y's interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted before withdrawal.

11.2 To exercise any of the above rights, contact 888y at [email protected] with the subject line "Data Rights Request." 888y will acknowledge your request within 48 hours and respond substantively within 30 days. Complex requests may require an extension of up to a further 60 days — you will be notified if this applies.

11.3 888y may require you to verify your identity before processing a data rights request to prevent fraudulent access to another individual's data.

12.1 888y may send you marketing communications about Platform promotions, new game launches, PSL betting specials, bonus offers and responsible gaming information by email or SMS, where you have provided explicit consent at registration or have opted in via Account Settings.

12.2 You may withdraw consent for marketing communications at any time by: (a) using the unsubscribe mechanism included in every marketing email; (b) updating your communication preferences in Account Settings; or (c) contacting [email protected] requesting removal from marketing lists. Removal from marketing communications does not affect delivery of transactional account messages (deposit confirmations, withdrawal notifications, security alerts).

12.3 888y does not engage in SMS marketing without express prior consent. Marketing SMS messages will always include a clear opt-out instruction. Standard network messaging rates apply.

13.1 If you have a concern about how 888y handles your personal data, you are encouraged to contact us in the first instance so we can investigate and resolve the matter. Privacy complaints should be submitted to [email protected] with the subject line "Privacy Complaint." 888y will acknowledge your complaint within 48 hours and provide a substantive response within 20 working days.

13.2 If you are not satisfied with 888y's response to your privacy complaint, you may escalate the matter to the data protection supervisory authority in the applicable jurisdiction under which 888y's gaming license is issued. Contact details for the relevant supervisory authority are available in 888y's license documentation.

13.3 For all data-related enquiries that are not formal complaints — including general questions about this Privacy Policy, requests for information about data processing activities and requests for copies of sub-processor agreements — the same email address applies: [email protected].

14.1 888y reviews this Privacy Policy at least annually and whenever material changes to data processing activities, regulatory requirements or service operations require an update. The current version is always available at 888y.bid/privacy-policy. The effective date at the head of this document identifies the version in force.

14.2 Material changes to this Privacy Policy — defined as changes that materially affect how 888y uses your personal data or materially affect your privacy rights — will be notified to Account Holders by email to their registered address at least 14 days before the change takes effect.

14.3 Minor amendments, including corrections of typographical errors, clarifications that do not materially alter the substance of the Policy, and updates required to reflect straightforward operational changes, may be made without specific individual notification beyond updating the document with a revised effective date.

14.4 Continued use of the 888y Platform after the effective date of any amended Privacy Policy constitutes acceptance of the revised terms. If you do not accept material changes, you should request account closure and withdrawal of any remaining balance before the effective date of those changes.