Privacy Policy — y 333 Pakistan Data Protection Commitment

1. Who We Are — Data Controller

The data controller responsible for your personal information is y 333, the operator of the y333.im platform. When we say "data controller" we mean the organisation that determines the purposes and means of processing your personal data — in plain terms, the one accountable for how your information is handled.

For any privacy-related enquiries, requests, or complaints, you can reach the y 333 privacy team directly:

2. What Personal Data y 333 Collects

The information y 333 collects falls into three broad categories. We collect only what is genuinely necessary — we don't collect data for the sake of it.

2.1 Information You Provide Directly

• Registration data: Full name, date of birth, gender, email address, mobile phone number (Pakistani number), and a chosen username and password.
• Identity verification (KYC) documents: Scanned copy or photograph of your Pakistani CNIC, passport, or driving licence. This is required once before your first withdrawal can be processed at y 333.
• Payment details: Mobile wallet account numbers (Easypaisa, JazzCash, NayaPay, SadaPay), bank account details for IBFT transfers, or card details for Visa/Mastercard deposits. Full card numbers are never stored at y 333 — see Section 6 for details.
• Communications: Content of messages you send to y 333 customer support, including live chat logs and email correspondence.
• Responsible gaming preferences: Any deposit limits, loss limits, cooling-off periods, or self-exclusion settings you configure in your y 333 account.

2.2 Information Collected Automatically

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution.
• Usage data: Pages visited on y 333, betting history, game session data, login timestamps, navigation patterns within the platform.
• Location data: Approximate location derived from your IP address. y 333 does not collect GPS or precise location data.
• Cookies and similar technologies: Session identifiers, analytics identifiers — see Section 9 for full cookie details.

2.3 Information from Third Parties

• Payment processors: Transaction status confirmations from Easypaisa, JazzCash, NayaPay, SadaPay, IBFT systems, and card processing networks.
• Fraud detection services: Risk scores and flagged device identifiers from third-party fraud prevention tools used to protect y 333 players and the platform.
• Referral data: If you were referred to y 333 by another player via the Refer a Friend programme, we receive the referrer's account ID alongside your registration to attribute the referral reward.

3. How y 333 Uses Your Personal Data

Every piece of data collected at y 333 serves a specific, legitimate purpose. The table below maps each data type to its use:

4. Legal Basis for Processing

y 333 processes your personal data on the following legal grounds:

• Contractual necessity: Most processing at y 333 is necessary to fulfil the contract formed when you register an account — operating your wallet, settling bets, processing withdrawals, and providing customer support all fall under this basis.
• Legal obligation: KYC identity verification, age confirmation, and anti-money-laundering checks are legal requirements that y 333 must comply with. Processing for these purposes is not optional.
• Legitimate interests: Fraud detection, platform security monitoring, and service improvement analytics are processed under the legitimate interest basis — our genuine business need to protect the platform and its players. We balance this against your privacy rights and collect only what is proportionate.
• Consent: Where we send promotional communications by email or SMS, we do so only where you have explicitly opted in. You can withdraw consent at any time by updating your notification preferences in your y 333 account settings.

5. When and With Whom y 333 Shares Your Data

y 333 does not sell your personal data. We share your information only in the following limited, necessary circumstances:

• Payment processors: Your payment account details are shared with Easypaisa, JazzCash, NayaPay, SadaPay, your bank (for IBFT), or the card processing network (for Visa/Mastercard) solely to execute transactions you have initiated.
• Identity verification providers: CNIC images and personal details required for KYC are processed by our third-party identity verification partner under strict data processing agreements. They are not permitted to use your data for any purpose other than verifying your identity for y 333.
• Fraud prevention services: Anonymised device fingerprints and risk indicators may be shared with fraud detection partners to protect against account takeover and payment fraud.
• Legal authorities: y 333 may disclose personal data to law enforcement or regulatory authorities where required by applicable law, a court order, or a legally binding request. We do not volunteer information beyond what is legally required.
• Business successors: In the event of a merger, acquisition, or transfer of y 333 business assets, personal data may be transferred to the successor entity. You will be notified if this affects how your data is handled.

All third-party data processors engaged by y 333 are bound by data processing agreements that require them to handle your information securely, use it only for the specified purpose, and comply with applicable data protection requirements.

6. Payment Data & PKR Transactions

The security of your payment data at y 333 is handled with particular care because it is especially sensitive. Here is exactly how it works:

• Card data: When you deposit via Visa or Mastercard, your card number, expiry date, and CVV are entered directly on the payment processor's encrypted form — not on y 333's own servers. y 333 receives only a tokenised reference and a transaction result (success or failure). Full card numbers are never stored by y 333 at any point.
• Mobile wallet data: Your Easypaisa or JazzCash account number is stored in encrypted form within your y 333 account to facilitate future withdrawals to the same wallet. It is accessible only to the payment processing system and is not visible to customer support agents.
• IBFT bank details: Bank account details provided for IBFT withdrawals are stored encrypted and used solely for processing the withdrawal you requested. They are not used for any other purpose.
• Transaction history: A record of all deposits and withdrawals is maintained in your y 333 account history for your own reference and for dispute resolution purposes. This history is retained as part of your account data and is governed by the retention policy in Section 8.

7. KYC & Identity Verification

Before processing your first withdrawal, y 333 is required to verify your identity. This is a standard anti-money-laundering (AML) and age verification requirement. Here is what this involves and how your documents are protected:

• What to submit: A clear photograph or scan of your Pakistani CNIC (both sides), or alternatively a valid Pakistani passport or driving licence.
• How it is used: KYC documents are used only to confirm your identity, verify that you are 18 or older, and check that your name matches your registered payment methods. They are not used for any other purpose.
• Storage: KYC documents are stored in encrypted form on secure servers with access restricted to y 333's compliance team. They are not shared with any party other than the verification service provider bound by a data processing agreement.
• Retention: KYC documents are retained for the period required by applicable anti-money-laundering regulations, typically five years from account closure. After the mandatory retention period, they are securely deleted.
• Verification timeline: KYC review is typically completed within 24 hours of submission. If additional information is required, y 333 support will contact you by the email address on your account.

8. Data Retention — How Long We Keep Your Data

y 333 keeps personal data only for as long as necessary to fulfil the purposes described in this Policy or to comply with applicable legal obligations. The following retention periods apply:

• Active account data: Retained for the duration of your active y 333 account plus five years following account closure. This covers registration details, betting history, and communications records.
• KYC and identity documents: Retained for the period required by AML regulations from the date of account closure, currently five years.
• Payment transaction records: Retained for seven years from the transaction date in line with standard financial record-keeping requirements.
• Customer support communications: Retained for three years from the date of the interaction, except where the communication forms part of an ongoing dispute or legal matter.
• Analytics and usage data: Aggregate anonymised analytics data is retained indefinitely. Individual-level usage data linked to your account is deleted when your account data is deleted.

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Backups containing personal data are purged on the same schedule as live data systems.

9. Cookies & Tracking Technologies

y 333 uses cookies and similar technologies to operate the platform and understand how it is being used. The cookies y 333 uses fall into the following categories:

• Essential cookies: Required for the platform to function. These include your session authentication cookie (keeps you logged in during your visit), security tokens, and preferences you set during your session. These cannot be disabled without breaking core y 333 functionality.
• Analytics cookies: Used to understand how players navigate y 333 — which pages are most visited, how long sessions last, and where users encounter difficulties. Analytics data is aggregated and anonymised before analysis. These cookies are opt-in.
• Functional cookies: Remember your display preferences, language settings, and notification preferences so you don't have to reset them every visit.

You can manage cookie settings through your browser. Blocking essential cookies will prevent you from logging in to y 333. You can find cookie management instructions in the help documentation of all major browsers (Chrome, Firefox, Safari, Edge).

10. Data Security at y 333

Protecting your personal data is a technical and organisational priority at y 333. The security measures in place include:

• Encryption in transit: All data transmitted between your device and y 333 is encrypted using TLS 1.3. The connection is authenticated with an SSL certificate so you can verify you are connected to the genuine y 333 platform.
• Encryption at rest: Personal data stored on y 333 servers — including account details, KYC documents, and payment references — is encrypted using AES-256, the same standard used by major financial institutions.
• Access control: Access to personal data within y 333 is governed by role-based access control. Staff members can access only the data required for their specific function. All access is logged and monitored.
• Regular security audits: The y 333 platform and its data systems undergo regular penetration testing and security assessments by independent security specialists.
• Incident response: In the unlikely event of a data breach that risks harm to users, y 333 will notify affected players within 72 hours of discovery and provide clear guidance on protective steps to take.
• Your responsibility: Keep your y 333 login credentials private. Use a strong, unique password. Enable two-factor authentication if offered. y 333 cannot be held responsible for unauthorised access resulting from a player sharing their credentials or using a compromised device.

11. Your Privacy Rights

As a y 333 player you have meaningful rights over your personal data. These are real rights with real processes behind them, not just words on a policy page:

12. Children's Privacy

y 333 is strictly an adults-only platform for players aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If y 333 becomes aware that personal data has been collected from a minor, that data will be deleted immediately and the associated account closed.

Parents or guardians who believe a minor may have registered at y 333 should contact support@y333.im immediately. We will investigate and take appropriate action within 24 hours. We also encourage parents to make use of internet filtering and parental control software to prevent underage access to online betting platforms generally.

13. Changes to This Privacy Policy

y 333 may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or platform features. When we make material changes that affect how your data is handled, we will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to your registered y 333 email address summarising the key changes.
• Display a notification banner on the y 333 platform when you next log in.

Minor updates that do not materially affect your rights — such as clarifications of existing practices or formatting corrections — may be made without a separate notification. You are encouraged to review this Policy periodically. Continued use of y 333 following the effective date of any update constitutes your acknowledgement of the updated Policy.

14. Contact Us About Privacy

If you have any question, concern, or request relating to your privacy at y 333, please get in touch. We take privacy queries seriously and every message is read by a human, not an automated system:

You may also review our related policies: Terms and Conditions, Responsible Gaming, and FAQ.