y388 Privacy Policy

01 Introduction

y388 ("we", "us", "our") operates Pakistan's premier online casino and sports betting platform at y388.net. As the data controller for personal information collected through this platform, y388 is committed to handling your data transparently, securely, and in accordance with applicable data protection standards.

This Privacy Policy describes how y388 collects, uses, stores, shares, and protects personal data relating to registered players and visitors to the y388 website. It also sets out your rights as a data subject and explains how to exercise them.

This policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which contain additional provisions that affect how we manage your information.

If you have any questions about this policy or about how y388 handles your personal data, please contact our support team at [email protected] before using the platform.

02 Data We Collect

y388 collects personal data through several channels: directly from you during registration and account use, automatically through your device and browsing behaviour, and from trusted third parties where necessary for verification or payment processing.

Information you provide directly:

• Full legal name, date of birth, and gender.
• Residential address, city, and country (e.g., Karachi, Lahore, Islamabad, Faisalabad).
• Email address and mobile phone number.
• Username and password (password is stored in hashed form only — y388 staff cannot view your password).
• Government-issued identity document details submitted for KYC verification (e.g., CNIC number, passport number).
• Payment method details including JazzCash account numbers, EasyPaisa wallet identifiers, HBL, UBL, or Meezan Bank account references, and other payment credentials necessary to process deposits and withdrawals.
• Communications you send to y388 support, including emails, chat transcripts, and complaint records.
• Responsible gaming preferences and self-set limits you configure on your account.

Information collected automatically:

• IP address and approximate geolocation derived from it.
• Device type, operating system, browser type and version.
• Pages visited on y388.net, time and duration of visits, and navigation paths.
• Game activity logs, including games played, bet amounts, outcomes, and session durations.
• Transaction history, deposit and withdrawal records, and bonus activity.
• Cookies and similar tracking technologies (see Section 6).

Information from third parties:

• Identity and document verification results from KYC service providers.
• Payment confirmation and fraud screening data from payment processors.
• Sanctions screening results from AML compliance tools.

03 How We Use Your Data

y388 uses the personal data it holds for the following clearly defined purposes:

y388 does not use your personal data to make fully automated decisions that produce significant legal effects without human oversight. Where automated tools are used for fraud detection or responsible gaming monitoring, a human review is conducted before any account restriction is applied.

04 Legal Basis for Processing

y388 relies on the following legal grounds for processing your personal data, depending on the specific purpose:

• Contractual necessity: Processing your registration details, managing your account, and processing financial transactions are all necessary to perform the contract between you and y388 (i.e., the Terms & Conditions you agreed to upon registration).
• Legal obligation: KYC identity verification, AML transaction monitoring, sanctions screening, and certain record-keeping requirements are carried out because y388 is legally required to do so under applicable gaming and financial regulations.
• Legitimate interests: Fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services are carried out on the basis of y388's legitimate interest in operating a safe, fair, and compliant platform. These interests have been assessed against your rights and freedoms and do not override them.
• Consent: Sending you promotional emails, SMS offers, or bonus notifications is done only where you have given explicit consent. You may withdraw this consent at any time by contacting [email protected] or using the communication preference settings in your account.

05 Data Sharing

y388 does not sell, rent, or exchange your personal data with third parties for their own commercial purposes. We share data only in the limited circumstances described below, and only with parties who are contractually bound to handle it securely and in accordance with this policy:

• Payment processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and other payment service providers receive the minimum data necessary to process your deposits and withdrawals.
• Identity verification providers: KYC and document verification partners receive identity document data to confirm your age and identity as required by our operating obligations.
• Game software providers: Third-party game studios and platform providers who supply the games available on y388 receive anonymised session and transaction data necessary to deliver game content and settle outcomes.
• AML and fraud screening tools: Compliance technology providers receive transaction and behavioural data to screen for money laundering indicators and fraudulent activity.
• Regulatory and law enforcement authorities: y388 will disclose personal data to regulators, law enforcement agencies, or courts when legally required to do so or when necessary to investigate a specific suspected criminal matter.
• Business transfers: In the event of a merger, acquisition, or sale of y388's business or assets, personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your choices in relation to your data.

06 Cookies & Tracking

y388 uses cookies and similar tracking technologies on the y388.net website to deliver the platform's core functions, remember your preferences, and understand how players use the site so we can improve it.

Types of cookies we use:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit. They cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as language settings, display options, and responsible gaming limits you have set.
• Analytics cookies: Help y388 understand aggregate player behaviour — which pages are visited most, where users drop off, and how long sessions last. This data is used to improve the platform. No individual is identified through analytics data.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your y388 account. y388 does not use third-party advertising cookies or cross-site tracking technologies.

07 Data Retention

y388 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your y388 account's active status plus a minimum period after closure as required by gaming regulations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction to meet AML record-keeping requirements.
• KYC and identity documents: Retained for the period required by the applicable licensing and AML framework, typically five (5) years from the end of the customer relationship.
• Support communications: Retained for three (3) years to allow investigation of any complaint or dispute that may arise after the fact.
• Self-exclusion records: Retained indefinitely to prevent re-registration by excluded players, even after a voluntary account closure.
• Marketing consent records: Retained for as long as you remain a registered player or until you withdraw consent, whichever is earlier.

When personal data is no longer required, it is securely deleted or anonymised so it can no longer be linked to an individual. Anonymised aggregate data may be retained indefinitely for statistical and business analytics purposes.

08 Your Rights

As a y388 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and include your registered account username and a description of your request.

• Right of access: You may request a copy of the personal data y388 holds about you. We will provide this within 30 days of a valid request, free of charge for the first request in any 12-month period.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor details such as address updates can also be made directly through your account settings.
• Right to erasure: You may request that y388 delete your personal data where it is no longer necessary for the purposes for which it was collected and where no legal obligation requires us to retain it. Note that certain data (e.g., transaction records, self-exclusion records) cannot be deleted due to regulatory requirements.
• Right to restriction: You may request that y388 restrict processing of your data while a dispute is being resolved or while you contest the accuracy of information we hold.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests at any time. You also have an unconditional right to object to direct marketing communications at any time.
• Right to withdraw consent: Where y388 processes your data on the basis of consent (e.g., marketing), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

09 Data Security

y388 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and y388's servers.
• AES-256 encryption for sensitive data stored at rest, including payment credentials and identity documents.
• Bcrypt hashing for all account passwords — y388 staff cannot view or retrieve your password in plain text.
• Role-based access controls ensuring that only authorised y388 personnel can access personal data, and only to the extent required by their job function.
• Regular independent security audits and penetration testing of y388 infrastructure.
• Multi-factor authentication requirements for internal y388 systems that access player data.
• Intrusion detection systems and real-time security monitoring of platform infrastructure.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, y388 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

You also play an important role in keeping your y388 account secure. Never share your password with anyone, use a strong and unique password for y388, and contact [email protected] immediately if you suspect your account has been accessed without your authorisation.

10 Children & Minors

y388 operates a strict minimum age policy. The platform is available only to individuals aged 21 years and above. y388 does not knowingly collect personal data from any person under the age of 21.

During the registration process, all applicants are required to confirm that they meet the 21+ age requirement. Where y388 has reasonable grounds to suspect that a registered user is under the age of 21, the account will be immediately suspended and subject to mandatory age verification. Any funds deposited by a player who is subsequently confirmed to be under 21 will be returned, and any winnings generated during the unverified period will be voided.

11 Third-Party Links

The y388 website may contain references to third-party game software providers, payment partners, and other services. This Privacy Policy applies only to the y388 platform and does not cover the data practices of any third-party websites or services that may be accessible through links on the platform.

y388 is not responsible for the privacy practices or content of any third-party services. We encourage you to review the privacy policies of any third-party services you interact with in connection with your y388 account, including your payment provider's privacy terms (e.g., JazzCash's or EasyPaisa's own policies).

12 Policy Changes

y388 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, y388 will:

• Update the "Last Updated" date at the top of this page.
• Notify registered players via the email address associated with their y388 account.
• Display a prominent notice on the y388.net platform for a reasonable period following the change.

Your continued use of the y388 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to a material change in this policy, you should stop using the platform and may request account closure in accordance with the Terms & Conditions.

We encourage you to check this page periodically so you remain informed about how y388 protects your personal data.

13 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about how y388 handles your personal data, please contact our Data Protection team using the details below. We take all privacy-related queries seriously and will respond promptly.

Please include your registered y388 username, a clear description of your query or concern, and any relevant account or transaction references to help us respond as efficiently as possible.

y388 will acknowledge all privacy-related enquiries within two (2) business days and provide a substantive response within fourteen (14) business days. If your concern relates to a data rights request, the timeframes in Section 8 apply.

If you are not satisfied with y388's response to your privacy complaint, you may escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to your situation.