y333 Privacy Policy

y333 is Pakistan's premier online gaming and sports betting platform, operated at y333.ws and all associated sub-domains and mobile-optimised versions. In the context of this Privacy Policy, "y333", "we", "us", and "our" refer to the operator of the y333 platform under its internationally recognised gaming licensing framework.

y333 acts as the data controller in respect of all personal data collected from players who register Accounts, make deposits, place wagers, or otherwise interact with the y333 platform. As data controller, y333 determines the purposes for which personal data is processed and the means by which that processing is carried out.

For all privacy-related enquiries, data subject rights requests, and complaints, players may contact y333's data protection point of contact directly:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly on the y333 platform

y333 collects personal data from players across several categories, depending on the stage of your relationship with the platform. The following table sets out the main categories of personal data y333 processes:

y333 does not collect sensitive personal data beyond what is strictly required for identity verification (CNIC) and responsible gaming obligations. We do not process biometric data beyond what is necessary for KYC photograph verification. We do not collect data relating to health, religion, political opinion, or ethnicity.

y333 uses personal data collected from Pakistani players for the following specific purposes. We do not use your data for any purpose that is incompatible with the purpose for which it was originally collected without your prior knowledge and, where required, your explicit consent.

• Account creation and management: To create, maintain, and administer your y333 Account, including processing your registration, authenticating your identity at login, and managing your PKR wallet balance.
• KYC and age verification: To verify that you are who you say you are, that you are at least 21 years of age, and that your payment methods are registered in your own name — as required under y333's licensing framework.
• Payment processing: To process PKR deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and to process withdrawal requests back to your verified payment method.
• Anti-money-laundering and fraud prevention: To monitor transactions and gaming activity for patterns consistent with money laundering, fraud, match-fixing, or bonus abuse, and to report suspicious activity where required under our licensing obligations.
• Responsible gaming monitoring: To identify patterns of gaming behaviour that may indicate problem gambling and to apply proactive responsible gaming interventions where appropriate to protect player welfare.
• Customer support: To respond to your enquiries, resolve disputes, and manage complaints submitted via live chat or email.
• Platform improvement: To analyse aggregated, anonymised gaming and session data for the purpose of improving the y333 platform, identifying technical issues, and enhancing the player experience.
• Legal compliance: To fulfil y333's obligations under its international gaming licence, anti-money-laundering regulations, and any lawful requests from regulatory authorities or law enforcement agencies with jurisdiction over y333's operations.
• Marketing communications: To send you promotional offers, bonus notifications, and y333 news where you have given your explicit consent to receive such communications and have not subsequently withdrawn that consent.

For each category of personal data processing described in Section 3, y333 relies on one or more of the following lawful bases:

• Contract performance: Processing that is necessary to create your Account, process deposits, settle wagers, and facilitate withdrawals — the core functions of the player agreement between you and y333.
• Legal obligation: Processing required by y333's licensing framework, anti-money-laundering obligations, KYC regulations, and age verification requirements. This category of processing cannot be opted out of — if you are unwilling to provide the required documentation, y333 cannot provide real-money gaming services to your Account.
• Legitimate interests: Processing undertaken for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where these interests do not override your fundamental privacy rights. y333 conducts legitimate interests assessments for all processing in this category.
• Consent: Processing for direct marketing communications, optional cookies and tracking technologies beyond those strictly necessary for platform operation. Consent-based processing can be withdrawn at any time without affecting processing that relies on other lawful bases.

y333 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared with third parties only in the following specific circumstances and only to the extent strictly necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to Pakistan's financial sector regulations.
• KYC and identity verification providers: y333 may use third-party KYC service providers to assist with document verification and biometric matching as part of the Account verification process. All such providers are bound by strict data processing agreements.
• Game providers: Third-party game providers whose titles are hosted on y333 receive session and wagering data necessary for game function and RTP certification. They do not receive your identity or financial data.
• Fraud prevention and AML partners: Specialist fraud detection and anti-money-laundering screening services may receive transaction and behavioural data to assist y333 in meeting its compliance obligations.
• Regulatory authorities and law enforcement: y333 will disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where required to do so by a valid legal obligation, court order, or regulatory direction. y333 will notify affected players of such disclosures where legally permitted to do so.
• IT and infrastructure providers: Cloud hosting, data storage, and cybersecurity service providers may process personal data as data processors acting strictly on y333's documented instructions.

y333 uses cookies and similar tracking technologies on y333.ws to enable core platform functionality, maintain session security, prevent fraud, and — where you have consented — to deliver personalised content and measure the effectiveness of marketing campaigns.

The following categories of cookies are used on y333.ws:

• Strictly necessary cookies: These cookies are essential for the y333 platform to function. They maintain your login session, store your PKR wallet session state, and enable security features such as CSRF protection. These cookies cannot be disabled without disabling core platform functionality. No consent is required for strictly necessary cookies.
• Functional cookies: These cookies remember your platform preferences — such as your preferred display language, notification settings, and responsible gaming limit configurations. Disabling functional cookies may reduce platform personalisation.
• Analytics cookies: With your consent, y333 uses anonymised analytics cookies to understand how Pakistani players interact with different areas of the platform, which game categories are most popular, and where technical friction points may exist. This data is used exclusively for internal platform improvement.
• Marketing cookies: With your consent, y333 may use advertising cookies to deliver relevant promotional content across digital channels. You may withdraw consent for marketing cookies at any time via the cookie preference panel accessible from the y333 platform footer.

y333 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and licensing obligations. The following retention periods apply to the main categories of personal data y333 processes:

• Account and identity data (KYC documents, CNIC copies, verification records): Retained for a minimum of five years following Account closure, as required under anti-money-laundering regulations applicable to y333's licensing framework.
• Financial transaction records (deposit and withdrawal histories, PKR wallet statements): Retained for a minimum of five years following the date of each transaction, as required under financial record-keeping obligations.
• Gaming activity records (bet histories, game session logs, bonus redemption records): Retained for the lifetime of the Account plus five years following Account closure.
• Responsible gaming records (self-exclusion, limit-setting, cooling-off records): Retained for a minimum of seven years following Account closure to ensure self-exclusion obligations can be enforced if a player attempts to re-register.
• Customer support communications: Retained for three years following resolution of the relevant support interaction or dispute.
• Marketing consent records: Retained for the duration of the player's Account and for three years following Account closure as evidence of consent status.
• Technical and session data (IP logs, device data): Retained for 12 months from the date of collection for security and fraud prevention purposes, then deleted or anonymised.

Following the expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes without constituting personal data processing.

y333 implements a comprehensive suite of technical and organisational security measures to protect the personal data of Pakistani players against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• Encryption: All personal data at rest is encrypted using AES-256 encryption. All data in transit between your device and y333.ws is protected by TLS 1.3 cryptographic protocol. Payment credentials are handled exclusively through the secure APIs of y333's payment partners and are never stored on y333's servers in unencrypted form.
• Access controls: Access to personal data within y333's operational systems is governed by role-based access controls. Only personnel with a documented operational need to access specific categories of personal data are authorised to do so. All internal access to player data is logged and auditable.
• Network security: y333's platform infrastructure is protected by web application firewalls, distributed denial-of-service mitigation systems, and intrusion detection monitoring. Security events are reviewed by y333's security operations function on a continuous basis.
• Penetration testing: y333 engages qualified independent security firms to conduct regular penetration testing of the y333 platform and its underlying infrastructure.
• Staff training: All y333 personnel with access to player data receive mandatory data protection and security training and are bound by confidentiality obligations.

As a player on y333, you hold meaningful rights over the personal data that y333 processes about you. These rights may be exercised at any time by contacting y333 via live chat or by emailing [email protected]. y333 will respond to all valid rights requests within 30 days of receipt. Where a request is complex or y333 receives a high volume of requests simultaneously, this period may be extended by a further 60 days — in which case y333 will notify you of the extension and the reason for it.

• Right of access: You have the right to request a copy of all personal data that y333 holds about you, together with information about the purposes of processing, the categories of data held, and the recipients to whom your data has been disclosed. This is commonly referred to as a Subject Access Request (SAR).
• Right to rectification: You have the right to request that y333 correct any inaccurate personal data held about you without undue delay. Where personal data is incomplete, you have the right to have it completed.
• Right to erasure: You have the right to request that y333 delete your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and no other lawful basis applies; or (c) the data has been unlawfully processed. This right does not apply where retention is required by y333's legal or regulatory obligations — particularly AML record-keeping requirements.
• Right to restriction of processing: You have the right to request that y333 restrict the processing of your personal data in certain circumstances, such as while a dispute about the accuracy of the data is being resolved.
• Right to data portability: You have the right to receive personal data you have provided to y333 in a structured, commonly used, machine-readable format, where the processing is based on your consent or on contract performance.
• Right to object: You have the right to object to processing based on y333's legitimate interests, including profiling for responsible gaming monitoring purposes. y333 will cease such processing unless compelling legitimate grounds exist that override your interests. You have an absolute right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

y333 may send marketing communications — including promotional offers, bonus notifications, new game announcements, and tournament invitations — to players who have given their explicit consent to receive such communications at the time of Account registration or subsequently via Account settings.

y333 marketing communications are sent via the following channels where consent has been given for each respective channel:

• Email to your registered email address
• SMS to your registered Pakistani mobile number
• Push notifications via the y333 mobile platform
• On-platform promotional messages displayed within your logged-in Account dashboard

You may withdraw consent for marketing communications at any time by: (a) clicking the unsubscribe link in any y333 marketing email; (b) updating your communication preferences in your Account settings; or (c) contacting y333 support via live chat and requesting removal from all marketing lists. Opt-out requests are processed within 72 hours. Note that withdrawing consent for marketing does not affect transactional communications — y333 will continue to send you Account-related messages such as deposit confirmations, withdrawal notifications, and security alerts regardless of your marketing preference settings, as these communications are necessary for the performance of the player contract.

y333 enforces age verification as a mandatory step in the Account activation process. All players are required to provide a copy of their Pakistani CNIC — which contains their date of birth — as part of the KYC verification process before real-money gaming is permitted. Accounts where the KYC documentation reveals that the Account holder is under 21 years of age are immediately and permanently suspended.

If y333 becomes aware that personal data has been collected from a person under the age of 21, y333 will: (a) immediately suspend the relevant Account; (b) delete all personal data associated with the Account that is not required to be retained under legal or regulatory obligations; (c) return any deposited real-money balance to the originating payment method; and (d) void all bonus balances and associated winnings. Where required under y333's licensing obligations, underage access may be reported to the relevant regulatory authority.

Parents and guardians in Pakistan who have reason to believe that a person under 21 in their household has accessed y333.ws or created a y333 Account are encouraged to contact y333 support immediately via live chat so that the matter can be investigated and addressed promptly.

y333 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, changes in applicable law and regulatory guidance, and updates to the y333 platform and its services. The effective date at the top of this page reflects the date on which the current version of the Privacy Policy came into effect.

Where changes to this Privacy Policy are material — for example, where we introduce a new category of data processing, a new purpose for processing existing data, or a new category of third-party data recipient — y333 will notify registered players via the email address associated with their Account and/or via a prominent notice displayed on the y333 platform prior to the changes taking effect. For material changes that require your consent, we will seek that consent separately before proceeding with the new processing.

Minor updates — such as typographical corrections, clarifications of existing policy provisions, and formatting improvements — may be made without prior notice. The updated effective date on this page will reflect all revisions, minor and material alike.

For any questions, concerns, or requests relating to this Privacy Policy or y333's handling of your personal data, please contact y333's data protection point of contact through any of the following channels:

• Live Chat: Available 24/7 on the y333 platform. Average response time is 3–5 minutes.
• Email: [email protected] — plain text only, not a clickable link. Email responses are provided within 24 hours for standard queries and within 72 hours for formal data subject rights requests.

If you are not satisfied with y333's response to a privacy concern or data subject rights request, you have the right to escalate the complaint to y333's formal complaints procedure. Details of this procedure are available from y333 support via live chat. Where a complaint remains unresolved following y333's internal procedure, you may refer the matter to the supervisory authority or dispute resolution body designated under y333's licensing framework.