y333 Privacy Policy —
Your Data, Explained Plainly

Introduction

y333 takes the privacy of its registered players seriously. Operating under an international gaming license means y333 is subject to data protection obligations that go beyond simply publishing a privacy notice. Those obligations directly shape how your personal information is collected, handled, stored, and — when required — shared with regulated third parties.

This Privacy Policy is written in plain English because we believe you have the right to understand what happens to your data without needing a law degree to work through the document. We have organised it into clear sections so you can navigate directly to the topics most relevant to you. If you have any questions about a specific section, our support team is available 24/7 and will always connect you with a compliance team member for data-related queries.

This Policy should be read alongside the y333 Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated into our agreement with you.

Who We Are

y333 is an internationally licensed online casino and sports betting platform accessible at y333.bid. The y333 platform serves registered players from Pakistan, offering cricket and PSL betting, live dealer casino games, online slots, Teen Patti, Big Hammer, and related services — all denominated in Pakistani Rupees (PKR), with JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank as primary payment methods.

For the purposes of this Privacy Policy, y333 acts as the data controller in relation to the personal information you provide when registering, verifying, depositing, playing, or contacting support on the platform. As data controller, y333 is responsible for determining the purposes and means of processing your personal data, and for ensuring that processing complies with applicable data protection obligations under the terms of our international gaming license.

References to "y333", "we", "us", or "our" in this Policy refer to the y333 platform and its licensed operators. For formal data controller identification details, contact us at [email protected].

Data We Collect

y333 collects personal data in several categories. The table below provides an overview of what is collected, at which point it is collected, and why it is required:

How We Collect Your Data

y333 collects personal data through three principal channels:

• Directly from you: Information you provide voluntarily when registering a y333 account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account preferences. This includes all identity, contact, financial, and account data categories listed in Section 3.
• Automatically from your device and browser: Technical data including IP address, device identifiers, browser type, operating system, session duration, and navigation patterns is collected automatically each time you access the y333 platform. This data is collected via server logs, session tracking technology, and first-party cookies. See Section 10 for full details on cookies and tracking technologies.
• From verified third parties: y333 may receive data from third-party identity verification providers used to complete KYC checks, from payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank) confirming transaction status, from fraud detection services flagging account risk signals, and from analytics providers. Where we receive data from third parties, we ensure that appropriate data sharing agreements are in place and that the transfer complies with applicable data protection requirements.

Why We Use Your Data

y333 uses the personal data it collects for the following clearly defined purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or updating this Policy:

• Account Registration & Management: Creating and maintaining your y333 account, authenticating your identity at login, and managing your account settings and preferences.
• KYC & Age Verification: Verifying that you are at least 21 years of age and that the identity you have provided is genuine, as required under the terms of y333's international gaming license.
• Payment Processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT — including verifying payment method ownership and maintaining transaction records.
• Platform Service Delivery: Enabling you to access and participate in cricket betting, live casino, slots, Teen Patti, Big Hammer, and all other y333 gaming products.
• Responsible Gaming: Monitoring gaming activity to identify patterns that may indicate problem gambling behaviour, enforcing any self-imposed responsible gaming limits (deposit caps, session timers, loss limits, self-exclusion), and complying with regulatory requirements relating to player protection.
• Anti-Fraud & Security: Detecting, investigating, and preventing fraudulent account activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the y333 Terms & Conditions.
• Regulatory Compliance & AML: Maintaining transaction and gaming records as required by y333's international gaming license, including Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) obligations.
• Customer Support: Processing and responding to your support queries, dispute submissions, and feedback.
• Marketing Communications (Opt-In Only): Sending promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. You may withdraw consent at any time via account settings.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, user experience, game library, and payment processing reliability.

Legal Basis for Processing

y333 processes your personal data on the following legal bases, consistent with the obligations under our international gaming license and applicable data protection frameworks:

• Contractual Necessity: Processing required to fulfil the agreement between you and y333 — including account management, payment processing, game access, and dispute resolution — is carried out on the basis that it is necessary to perform the contract you entered into by registering a y333 account.
• Legal Obligation: Processing required to comply with regulatory obligations under y333's international gaming license — including KYC verification, AML record-keeping, age verification, and responsible gaming monitoring — is carried out on the basis that it is required to comply with applicable legal and regulatory requirements.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, multi-account detection, and aggregated analytics is conducted on the basis of y333's legitimate interest in operating a secure, fair, and commercially viable gaming platform. y333 has assessed that these interests are not overridden by your individual privacy rights in relation to these specific processing activities.
• Consent: Marketing communications and non-essential cookie usage are processed exclusively on the basis of your explicit, informed consent. Consent for these purposes is obtained at registration or at the point of first cookie encounter, and may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing

y333 does not sell your personal data to any third party. We share your data only in the following specific, limited, and contractually governed circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT gateway providers receive the minimum necessary payment and identity data required to process your deposit or withdrawal transaction securely and in compliance with financial regulations.
• KYC & Identity Verification Providers: Third-party identity verification services receive your CNIC and selfie data to perform the automated and/or manual identity checks required under our gaming license. These providers are contractually bound to use this data solely for verification purposes and to delete it upon completion of the verification process.
• Fraud Prevention & AML Services: Specialised fraud detection and anti-money laundering screening providers may receive account and transaction data for risk-scoring and screening purposes. These providers operate under strict data processing agreements.
• Gaming Software Providers: Game studios and platform technology providers may receive pseudonymised gaming session data to deliver their games and settle outcomes correctly. These providers do not receive your full identity or financial data.
• Regulatory Authorities: y333's licensing authority and other competent regulatory bodies may receive account, transaction, and gaming data as required under the terms of our international gaming license, in response to lawful regulatory inquiries, or as part of mandatory regulatory reporting.
• Law Enforcement: y333 will disclose personal data to law enforcement agencies where required by a valid legal order, court order, or where disclosure is necessary to prevent, detect, or investigate criminal activity — including fraud and money laundering.

International Data Transfers

y333 operates an internationally licensed platform, which means your personal data may be processed in countries outside Pakistan. This includes the jurisdiction in which y333 holds its gaming license, as well as the locations of our payment processing and KYC verification partners.

Where personal data is transferred internationally, y333 ensures that appropriate safeguards are in place to protect your data to a standard consistent with the requirements of our licensing framework. These safeguards include:

• Standard contractual clauses incorporated into data processing agreements with all international recipients.
• Transfer only to jurisdictions or service providers where adequate data protection standards are in place.
• Limiting the scope of data transferred to the minimum necessary for the specific processing purpose.

You may request further information about the international transfer safeguards applicable to your personal data by contacting our support team at [email protected].

Data Retention

y333 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable regulatory obligations. The following retention guidelines apply:

• Active Account Data: Maintained for the duration of your active y333 account and for a period of five (5) years following account closure, in compliance with the record-keeping requirements of our international gaming license.
• KYC & Identity Documents: Retained for five (5) years from the date of verification, or from the date of account closure where closure occurs later, as required for AML compliance purposes.
• Transaction Records: Maintained for five (5) years from the date of each transaction, as required by our licensing authority and standard financial record-keeping obligations.
• Gaming Session Logs: Retained for three (3) years from the date of each session, for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• Support Communications: Retained for two (2) years from the date of closure of the relevant support case.
• Technical & Device Logs: Retained for ninety (90) days for fraud detection and security monitoring purposes, unless a specific investigation requires longer retention.
• Marketing Consent Records: Retained for the duration of consent plus two (2) years as evidence of lawful processing.

Upon expiry of the applicable retention period, y333 will securely delete or anonymise your personal data. Anonymised data (which can no longer identify you) may be retained indefinitely for statistical and platform improvement purposes.

Cookies & Tracking Technologies

y333 uses cookies and similar technologies on the y333.bid platform. A cookie is a small text file placed on your device by a website to enable certain functionality and to collect usage data. y333 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function correctly — including maintaining your login session, remembering your account preferences, and enabling secure payment form functionality. These cookies cannot be disabled without breaking core platform features.
• Performance & Analytics Cookies: Collect anonymised information about how users navigate the y333 platform — which pages are most visited, how long sessions last, and where players encounter errors. This data is used solely to improve platform performance and user experience. These cookies are activated only with your consent.
• Security Cookies: Used by y333's fraud detection systems to recognise device fingerprints associated with legitimate account sessions and to flag anomalous login behaviour. These are considered strictly necessary for platform security.
• Marketing Cookies (Opt-In): Used to attribute your y333 registration to a marketing channel and to personalise promotional communications where you have opted in. These are never shared with third-party advertising networks. Activated only with explicit consent.

You may manage your cookie preferences at any time through your browser settings. Disabling all cookies may impair some y333 platform functionality. y333 does not use third-party tracking pixels or share cookie data with external advertising platforms.

Security Measures

y333 implements a layered technical and organisational security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• TLS 1.3 Encryption: All data transmitted between your browser or device and the y333 platform is encrypted using TLS 1.3, the current industry standard for transport-layer security. This prevents interception of data in transit, including login credentials and payment information.
• Bcrypt Password Hashing: y333 never stores passwords in plaintext. All user passwords are processed through bcrypt with per-user salting before storage, meaning that even in the event of a database breach, your actual password cannot be recovered from stored data.
• Database Encryption: Sensitive personal data fields — including CNIC numbers and financial account identifiers — are encrypted at rest using AES-256 encryption within y333's secure database infrastructure.
• Access Controls: y333 staff access to personal data is governed by role-based access controls, meaning that only staff with a legitimate operational need can access any given category of personal data. All staff access is logged and audited.
• Device Fingerprinting & Anomaly Detection: y333's security systems monitor login sessions for anomalous patterns — including logins from unrecognised devices or unusual geographic locations — and apply additional verification steps automatically when risk thresholds are exceeded.
• Regular Security Audits: y333 commissions independent security assessments of its platform infrastructure on a regular basis, consistent with the requirements of our international gaming license.

Your Data Rights

As a y333 player, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact y333 at [email protected] with the subject line "Data Rights Request" and we will respond within 30 days:

Minors & Age Verification

y333 does not knowingly collect or process personal data belonging to individuals under the age of 21. The y333 platform is exclusively for adult users who have reached the age of 21 at the time of registration, consistent with the responsible gaming standards required by our international gaming license.

y333 enforces the 21+ age restriction through mandatory CNIC-based identity verification. All accounts must complete KYC before any withdrawal is processed, and any account where the identity documents reveal the account holder is under 21 years of age is immediately and permanently closed. Any deposited balance belonging to such an account is returned to the originating payment method.

Parents and guardians in Pakistan who are concerned about underage access to online gaming platforms are encouraged to use parental control software and to keep their JazzCash, EasyPaisa, and bank account details secure and inaccessible to minors.

Updates to This Privacy Policy

y333 may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or platform functionality. When we make changes, we will update the "Last Updated" date displayed at the top of this page and in the sidebar.

Where changes are material — meaning they significantly affect the way in which y333 processes your personal data or the rights available to you — y333 will notify registered users via email to the address registered with their y333 account, providing at least 14 days' advance notice before the changes take effect.

Your continued use of the y333 platform following the effective date of any Privacy Policy update constitutes your acceptance of the revised Policy. If you do not agree with any update, you must cease using y333 Services and may close your account by contacting our support team.

Contact Us Regarding Your Privacy

For any questions, concerns, or requests relating to this Privacy Policy or y333's data practices — including requests to exercise any of the rights described in Section 12 — please contact us through the following channel. All data-related enquiries will be directed to the y333 compliance team: