y288 Privacy Policy – How We Handle Your Data

y288 ("the Platform", "we", "us", "our") is committed to protecting the privacy and personal data of every player who registers and uses the y288 online gaming platform. This Privacy Policy sets out in clear, plain terms how y288 collects, processes, stores, shares, and protects your personal information in connection with the delivery of cricket betting, live casino, slot, fishing arcade, and sports betting services available at y288.net.

y288 operates with a specific focus on Pakistani players. All accounts are denominated in Pakistani Rupees (PKR), and the platform's payment infrastructure is built around Pakistani financial services including JazzCash, EasyPaisa, Raast, HBL, UBL, and Meezan Bank. The personal data we collect and process reflects this context — for example, we collect CNIC numbers for identity verification and Pakistani mobile numbers for account security and two-factor authentication.

This policy should be read alongside the y288 Terms & Conditions and the Responsible Gaming Policy. Where those documents address data processing matters, this Privacy Policy provides the full detail. In the event of any conflict, this Privacy Policy governs data protection matters.

For the purposes of applicable data protection legislation, y288 acts as the data controller in respect of all personal data collected from players via the y288 platform. As data controller, y288 determines the purposes and means by which your personal data is processed.

y288 operates under international gaming licensing standards. The platform's registered operational entity is responsible for all data processing activities described in this policy. Where y288 engages third-party service providers to process data on its behalf, those providers act as data processors and are subject to contractual data processing obligations that reflect the standards described in this policy.

y288 collects personal data from you directly — through registration, account use, and communications — and indirectly through automated technical means during your use of the platform. The categories of data we collect are set out below.

3.1 Registration & Identity Data

• Full name as it appears on your CNIC
• Date of birth (used to verify 21+ age eligibility)
• CNIC number and copies of CNIC documentation submitted during KYC verification
• Pakistani mobile number (used for account security and two-factor authentication)
• Email address
• City of residence (e.g., Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi)

3.2 Financial & Payment Data

• JazzCash or EasyPaisa account details used for deposits or withdrawals
• Bank account details (HBL, UBL, Meezan Bank, or other Pakistani commercial banks) where used for transactions
• Raast payment ID where applicable
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method references

3.3 Gaming Activity Data

• Betting history across all markets including PSL cricket, international cricket, slots, and live casino
• Casino game session data including game titles played, session durations, and outcomes
• Bonus claims, wagering progress, and promotional activity associated with your account
• Responsible gaming tool usage, including any deposit limits, cooling-off periods, or self-exclusion requests you have activated

3.4 Technical & Device Data

• IP address at time of login and during active sessions
• Device type, operating system, and browser version
• Mobile network operator (relevant for JazzCash and EasyPaisa transaction verification)
• Session timestamps and login history
• Cookie identifiers and similar tracking data as described in Section 9

3.5 Communications Data

• Records of live chat conversations with y288 customer support
• Email correspondence submitted to the y288 support team
• Complaint submissions and their resolution history
• Feedback and survey responses where voluntarily provided

y288 uses the personal data it collects only for specified, legitimate purposes directly connected to the operation of the platform and the delivery of services to Pakistani players. The table below maps each processing activity to the data categories involved and the purpose served:

y288 processes your personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to perform the contract between y288 and you as a registered player — including account creation, payment processing, game delivery, and customer support.
• Legal obligation: Processing required to comply with applicable anti-money laundering regulations, age verification obligations, and licensing requirements — including CNIC-based KYC verification and transaction monitoring.
• Legitimate interests: Processing carried out in y288's legitimate interests where those interests are not overridden by your rights — including fraud prevention, platform security, responsible gaming monitoring, and analytical improvements to the platform's mobile performance for Pakistani users.
• Consent: Processing based on your explicit, freely given consent — specifically, the sending of marketing communications and the use of non-essential analytical cookies. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

y288 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Personal data is shared only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, EasyPaisa, Raast, HBL, UBL, and Meezan Bank receive the transaction data necessary to process your deposits and withdrawals. Each payment provider is bound by its own regulatory and contractual data protection obligations.
• KYC & identity verification providers: CNIC data is shared with certified third-party identity verification services to confirm your identity and age as required under y288's licensing obligations.
• Fraud prevention partners: Transaction patterns and account behaviour data may be shared with specialist fraud detection and AML screening services to identify and prevent financial crime.
• IT infrastructure providers: Cloud hosting and database management providers who store and process platform data on y288's behalf under strict data processing agreements.
• Customer support platforms: Support communication tools used to manage live chat and email interactions with players.
• Regulatory and law enforcement authorities: Where y288 is legally obligated to disclose information — for example, in response to a valid regulatory request, court order, or law enforcement enquiry — personal data will be disclosed to the extent required by law.

All third-party service providers who process y288 player data are subject to contractual data processing agreements that require them to maintain confidentiality, implement appropriate security measures, and use player data only for the purposes specified by y288.

y288 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active y288 account plus a minimum of 5 years following account closure. This reflects standard AML record-keeping requirements applicable to online gaming operators.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required under applicable anti-money laundering regulations.
• KYC documentation: Retained for a minimum of 5 years following the completion of verification, or longer where required by applicable regulatory obligations.
• Gaming activity records: Retained for a minimum of 3 years from the date of each gaming session or bet placement.
• Customer support communications: Retained for 2 years from the date of the communication, or longer where the communication relates to an unresolved complaint or legal matter.
• Marketing consent records: Retained for the duration of your active consent and for 2 years following withdrawal of consent, as evidence of the consent status at any given time.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be associated with any individual player. Anonymised and aggregated data may be retained indefinitely for statistical and analytical purposes.

y288 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key measures include:

• Encryption in transit: All data transmitted between your device and the y288 platform is encrypted using TLS 1.2 or higher. This applies to all connections including those made from Pakistani mobile networks on JazzCash or EasyPaisa-linked devices.
• Encryption at rest: Personal data stored on y288 servers is encrypted using AES-256 encryption. Financial data and CNIC documentation receive the highest level of storage security.
• Access controls: Access to personal data within y288 is governed by role-based access controls. Staff members can access only the data necessary for their specific job function, and all access is logged and auditable.
• Two-factor authentication: y288 accounts support two-factor authentication via your registered Pakistani mobile number. Players are strongly encouraged to enable 2FA to protect their accounts.
• Penetration testing: y288 commissions regular independent security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: y288 maintains a documented data breach response procedure. Where a breach is identified that is likely to result in risk to your rights, y288 will notify affected players and relevant authorities within the timeframes required by applicable law.

y288 uses cookies and similar technologies to operate the platform, maintain your session, and — with your consent — analyse how Pakistani players interact with the site so that we can improve the mobile experience. Cookies are small text files placed on your device when you visit y288.net.

Types of cookies used by y288:

• Strictly necessary cookies: Required for the platform to function. These cookies maintain your login session, remember your language preference, and enable core security features including CSRF protection. These cookies cannot be disabled without preventing the platform from functioning correctly.
• Analytical cookies: Used to understand how players navigate the y288 platform — which pages are most visited, how long sessions last, and which games are most popular among Pakistani mobile users. This data is used in aggregate and anonymised form to improve platform performance. Analytical cookies require your consent.
• Preference cookies: Remember settings you have configured on the platform — such as odds format preferences or notification settings — so you do not need to reconfigure them on every visit.

y288 does not use third-party advertising cookies, social media tracking pixels, or cross-site tracking technologies of any kind. Your gaming activity on y288 is not shared with external advertising networks.

You can manage and delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the y288 platform. Instructions for managing cookies are available in the help documentation of all major browsers including Chrome for Android, which is commonly used by Pakistani mobile users.

As a y288 player whose personal data is processed by the platform, you have the following rights in relation to your personal information. To exercise any of these rights, contact the y288 support team using the details in Section 15.

• Right of access: You may request a copy of the personal data y288 holds about you. y288 will provide this in a structured, commonly used format within 30 days of receiving a valid request.
• Right to rectification: If the personal data y288 holds about you is inaccurate or incomplete, you may request that it be corrected. Account details can also be updated directly through your y288 account settings.
• Right to erasure: You may request that y288 delete your personal data in certain circumstances — for example, where data is no longer necessary for the purpose for which it was collected. This right is subject to y288's legal retention obligations, which may require certain data to be retained for defined periods regardless of an erasure request.
• Right to restrict processing: In certain circumstances, you may request that y288 restrict the processing of your data — for example, while a complaint about the accuracy of your data is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that y288 provide your personal data in a machine-readable format suitable for transfer to another service.
• Right to object: You may object to processing carried out on the basis of y288's legitimate interests. y288 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent — specifically marketing communications and non-essential cookies — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

y288 will respond to all rights requests within 30 days. Where a request is complex or y288 receives a high volume of requests, the response period may be extended by a further 60 days — in which case y288 will notify you of the extension and the reason for it within the initial 30-day period.

y288 operates a strict 21+ age policy. The platform is not intended for, and must not be used by, any person under the age of 21. y288 does not knowingly collect or process personal data from individuals under 21 years of age.

Age verification is conducted at the point of KYC verification using CNIC documentation. Where y288 discovers or suspects that a registered account belongs to a person under 21, the account will be immediately suspended and the player's personal data will be reviewed in accordance with applicable legal requirements. Any balance associated with an underage account will be handled in accordance with y288's Terms & Conditions.

y288 also recommends that parents and guardians in Pakistan make use of device-level parental control software to restrict access to online gaming platforms on shared devices. This is particularly relevant for mobile devices where the y288 mobile platform is accessible.

y288 may send you marketing communications about promotions, bonuses, PSL cricket betting offers, and new platform features where you have given your explicit consent to receive such communications during registration or at any subsequent point via your account settings.

Marketing communications from y288 may be delivered via:

• Email to your registered email address
• SMS to your registered Pakistani mobile number
• Push notifications via the y288 mobile platform (where notifications are enabled on your device)

You may withdraw your consent to receive marketing communications at any time by:

• Updating your marketing preferences in your y288 account settings
• Clicking the unsubscribe link in any marketing email
• Contacting y288 support directly with a request to opt out

Opting out of marketing communications will not affect your ability to use any y288 service, nor will it prevent y288 from sending you service-related communications — such as account verification messages, withdrawal confirmations, security alerts, and responsible gaming notifications — which are sent on the basis of contractual necessity rather than consent.

y288 is an internationally operated platform. In the course of delivering services to Pakistani players, your personal data may be transferred to and processed in countries outside Pakistan. y288 takes the following steps to ensure that all international transfers of personal data are conducted with appropriate safeguards in place:

• Transfers to countries that provide an adequate level of data protection — comparable to or exceeding the standards applicable in Pakistan — are made without additional safeguards where adequacy is established.
• Where transfers are made to countries that do not offer an equivalent level of protection, y288 implements standard contractual clauses or equivalent contractual mechanisms to ensure that your data remains protected to the standards described in this policy.
• All third-party processors receiving Pakistani player data in other jurisdictions are contractually required to implement appropriate technical and organisational security measures consistent with the standards set out in Section 8.

You may request further information about the specific safeguards in place for any particular international transfer by contacting y288's support team.

y288 reviews this Privacy Policy periodically and may update it to reflect changes in the platform's data processing activities, updates to applicable data protection law, or improvements to our privacy practices. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Where changes to this policy are material — meaning they significantly affect how y288 processes your personal data or alter your rights — y288 will notify you via your registered email address or through a prominent notice on the platform at least 14 days before the changes take effect.

Minor clarifications or administrative updates may be made with immediate effect. Your continued use of the y288 platform following the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not agree with a revised policy, you must cease using the platform and may request account closure in accordance with the y288 Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the way y288 handles your personal data — including data access requests, erasure requests, and marketing opt-out requests — please contact the y288 support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly from the y288 platform
• Response Time: y288 aims to acknowledge all privacy-related communications within 24 hours and provide a substantive response within 5 business days