y222 Privacy Policy —
How We Protect Your Data & Your Rights

1 Who We Are & How to Contact Us

y222 ("we," "us," "our," or "the Platform") is an online gaming operator accessible at y222.bid, holding an international gaming licence and serving registered players in Pakistan. y222 acts as the data controller in respect of all personal data collected through the Platform.

For all data-related enquiries, requests, or complaints, you may contact the y222 Data Team at: [email protected]. Please mark the subject line of any data rights request clearly as "Data Privacy Request" to ensure it reaches the correct team and is processed within the required timeframe.

2 Personal Data We Collect

y222 collects personal data that is necessary to provide you with a safe, verified, and functional gaming experience. The categories of data we collect, and examples of the specific items within each category, are set out in the table below:

y222 does not collect biometric data beyond photographs submitted voluntarily for enhanced KYC purposes. y222 does not collect data relating to your racial or ethnic origin, political opinions, religious beliefs, or health status, except where health-related information is voluntarily provided in the context of a responsible gaming self-exclusion request.

3 How We Collect Your Data

y222 collects personal data through the following channels:

• Direct Submission: Data you provide during account registration, KYC verification, payment setup, support interactions, and bonus claims. This represents the primary source of personal data processed by y222.
• Automated Technical Collection: Technical and behavioural data collected automatically when you access and use the Platform, including through cookies, server logs, and session tracking tools. See Section 8 for full details on our cookie practices.
• Payment Processors: Transaction confirmation data received from JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and other approved payment processors when you deposit or withdraw funds.
• Identity Verification Providers: Confirmation results from third-party KYC and identity verification service providers used to validate CNIC documents and confirm age eligibility. These providers return a verification status to y222 — the underlying document is not stored by y222 beyond what is required by law.
• Fraud Prevention Services: Risk signals and flagged behaviour patterns from fraud prevention systems used to protect the Platform and its players from account takeover, payment fraud, and bonus abuse.

4 How y222 Uses Your Personal Data

y222 uses the personal data it collects strictly for the purposes for which it was collected and for compatible purposes that a reasonable person would expect given the context of the collection. The primary purposes for which y222 processes your data are:

1. Account Registration and Authentication: Creating and maintaining your y222 Account, verifying your identity and age (21+), and managing login security including two-factor authentication.
2. Game and Betting Services: Processing your cricket bets, casino wagers, and slot game sessions; settling outcomes; crediting winnings; and managing your PKR Wallet balance in real time.
3. Payment Processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, Raast, and Pakistani bank transfers; verifying that payment methods are registered in your name; and maintaining accurate financial records.
4. Legal and Regulatory Compliance: Fulfilling y222's obligations under its international gaming licence, including KYC, anti-money-laundering (AML), and counter-terrorism financing (CTF) requirements.
5. Responsible Gaming: Monitoring gaming patterns to identify potential signs of problem gambling behaviour, administering deposit limits, session reminders, cooling-off periods, and self-exclusion requests at your instruction.
6. Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, account takeover, multi-accounting, bonus abuse, and other prohibited conduct defined in the y222 Terms and Conditions.
7. Customer Support: Responding to your queries, resolving disputes, processing complaints, and verifying your identity when you contact the support team.
8. Platform Improvement: Analysing aggregated, anonymised usage patterns to improve the y222 interface, game selection, and support processes — without identifying individual players in this analysis.
9. Marketing Communications: Sending promotional communications, bonus notifications, and seasonal offers (such as PSL betting promotions) where you have consented to receive them. You may withdraw marketing consent at any time through your Account settings.

5 Legal Basis for Processing

y222 processes your personal data on the following legal bases, depending on the nature of the processing activity:

• Contract Performance: Processing necessary to fulfil the contractual obligations of the y222 Terms and Conditions you accepted at registration — including account management, payment processing, bet settlement, and support services.
• Legal Obligation: Processing required to comply with y222's obligations under its gaming licence, KYC regulations, anti-money-laundering legislation, and applicable data protection frameworks. This data is processed irrespective of your preferences.
• Legitimate Interests: Processing carried out for y222's legitimate operational interests, including fraud prevention, security monitoring, and platform improvement, where those interests are not outweighed by your privacy rights.
• Consent: Processing based on your specific, freely given, and informed consent — principally for marketing communications and optional platform personalisation features. You may withdraw consent for consent-based processing at any time without affecting the lawfulness of prior processing.

6 Who y222 Shares Your Data With

y222 may share your personal data with the following categories of recipients:

• Payment Processors: JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, and other approved payment service providers, limited to the transaction data necessary to process your specific deposit or withdrawal.
• KYC and Identity Verification Providers: Third-party services that verify the authenticity of CNIC documents and confirm age eligibility on y222's behalf. These providers are contractually bound to use the data only for the purpose of providing verification results to y222.
• Regulatory and Licensing Authorities: y222's gaming licence regulator and any other competent regulatory or law enforcement authority where disclosure is required by law, court order, or regulatory direction.
• Fraud Prevention Networks: Industry fraud prevention services that cross-reference account and transaction signals to detect and prevent financial crime. Data shared with such networks may be retained and used by them for fraud prevention purposes in accordance with their own privacy policies.
• Technology Service Providers: Cloud infrastructure, data storage, security monitoring, and customer support technology providers operating on y222's behalf under strict data processing agreements that prohibit any independent use of your data.
• Professional Advisers: Legal counsel, auditors, and insurers where disclosure is necessary in the context of a legal claim, compliance review, or business audit, subject to professional confidentiality obligations.

7 International Data Transfers

As a platform operating under an international gaming licence, y222 may store and process personal data on servers located outside Pakistan. Where data is transferred internationally, y222 ensures that appropriate safeguards are in place to protect your information to a standard equivalent to that which applies within Pakistan.

Safeguards employed for international transfers include: contractual data protection clauses incorporated into agreements with all international service providers; technical security measures including encryption at rest and in transit; and access controls limiting which personnel can access personal data to those with a documented operational need.

8 Cookies & Tracking Technologies

y222 uses cookies and similar tracking technologies to operate the Platform, maintain your login session, remember your preferences, and analyse Platform usage. The following categories of cookies are used on y222:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged into your y222 Account and security cookies that prevent cross-site request forgery. These cannot be disabled without preventing core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, notification configurations, and game lobby view selections. These improve your experience but are not strictly required for the Platform to operate.
• Analytical Cookies: Collect anonymised data about how players navigate the Platform — which sections are visited, how long sessions last, and where errors occur. This data is used to improve Platform performance and is not used to identify individual players.
• Security and Fraud Prevention Cookies: Identify and track device characteristics to detect suspicious login activity, multiple-account creation from a single device, and other fraud indicators.

You may manage cookie preferences through your browser settings. Note that disabling functional or analytical cookies may affect your Platform experience. Strictly necessary cookies cannot be disabled through browser settings without preventing login functionality.

9 How Long y222 Keeps Your Data

y222 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, whichever is longer. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active Account plus a minimum of 5 years following account closure, as required by anti-money-laundering and gaming licence regulations.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of the transaction in compliance with standard financial record-keeping requirements applicable under y222's licence.
• Gaming Activity Logs: Retained for a minimum of 5 years for dispute resolution, regulatory reporting, and responsible gaming monitoring purposes.
• Support Communications: Retained for 3 years from the date of the most recent interaction, or longer where the communication relates to an ongoing dispute or regulatory matter.
• Marketing Consent Records: Retained for the duration of your Account plus 3 years, to demonstrate that consent was validly obtained and to process any subsequent withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised data may be retained indefinitely for statistical and research purposes.

10 How y222 Secures Your Data

y222 applies a layered technical and organisational security framework to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-Bit SSL Encryption: All data transmitted between your device and y222's servers is encrypted in transit. HTTPS is enforced across all Platform domains without exception.
• Encryption at Rest: Sensitive personal data — including CNIC records and financial data — is encrypted when stored in y222's database systems, ensuring that even authorised internal access requires decryption credentials.
• Access Controls: Personal data access within y222 is restricted to staff with a documented operational need. Role-based access controls prevent staff from accessing data categories beyond the scope of their function.
• Penetration Testing: y222 commissions independent security testing of its Platform infrastructure on a scheduled basis and following significant system updates.
• Incident Response: y222 maintains a documented data breach incident response procedure. In the event of a security incident affecting personal data, y222 will notify affected players and relevant regulatory authorities within the timelines required by applicable law.

11 Exercising Your Data Rights

As a y222 player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the y222 Data Team at [email protected] with the subject line "Data Privacy Request" and a clear description of the right you wish to exercise:

• Right of Access: Request a copy of all personal data y222 holds about you. y222 will respond within 30 calendar days of receiving a verified request. The first copy is provided free of charge; further copies may be subject to a reasonable administrative fee.
• Right to Rectification: Request correction of any inaccurate personal data held by y222. Standard profile data may be updated directly in your Account settings. Corrections to identity or KYC data require support verification.
• Right to Erasure: Request deletion of personal data that y222 no longer requires for its stated purposes, subject to any overriding legal obligation to retain the data (particularly gaming licence and AML retention requirements).
• Right to Restriction: Request that y222 temporarily suspend processing of your personal data — for example, while the accuracy of the data is being contested or while a complaint is under investigation.
• Right to Data Portability: Request that personal data you have provided to y222 be transmitted to you or to a nominated third party in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, and withdraw consent for any processing carried out on a consent basis. Note that withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.
• Right to Complain: Lodge a complaint with the relevant data protection supervisory authority if you believe y222 has not handled your personal data in accordance with applicable law.

y222 will acknowledge all data rights requests within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or voluminous, we may extend this period by a further 60 days with notification to you.

12 Minors & Age Verification

Where y222 discovers or has reason to believe that a registered Account belongs to a person under the age of 21, the following actions will be taken without delay:

1. The Account will be immediately suspended pending investigation;
2. All Bonus Funds associated with the Account will be forfeited;
3. Real Funds deposited will be returned to the verified payment source used to make those deposits;
4. All personal data associated with the underage Account will be deleted or anonymised, except where retention is required for legal compliance purposes;
5. The incident will be reported to the relevant licensing authority as required under the applicable regulatory framework.

If you believe that a person under the age of 21 has registered on y222, please notify us immediately at [email protected]. y222 will investigate all credible reports within 24 hours.

13 Responsible Gaming Data Processing

y222 processes gaming activity data for responsible gaming purposes in addition to the operational purposes described in Section 4. Specifically, y222 may use automated analysis of your gaming patterns — including session frequency, stake escalation, net loss trajectories, and self-exclusion history — to identify potential indicators of gambling-related harm.

Where y222's responsible gaming monitoring identifies a pattern that warrants proactive intervention, a member of the y222 Responsible Gaming team may contact you directly to discuss the available support tools — deposit limits, cooling-off periods, and self-exclusion — available through your Account settings and described in detail on the Responsible Gaming page.

Responsible gaming data — including records of any self-exclusion requests, deposit limit histories, and cooling-off period records — is retained for the duration of your Account plus a minimum of 5 years following account closure, to support regulatory compliance and to prevent circumvention of exclusion periods through re-registration.

14 Changes to This Privacy Policy

y222 may update this Privacy Policy from time to time to reflect changes in the Platform's data practices, applicable law, or regulatory requirements. When material changes are made to this Policy, y222 will notify registered players via the mobile number or email address associated with their Account, and the updated Policy will be published on this page with a revised effective date.

For minor updates — including typographical corrections, clarifications of existing practices, and amendments required to reflect regulatory changes — the Policy will be updated without individual notification, and the revised version will take effect from the updated effective date shown at the top of the Policy.

Your continued use of y222 following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms. Where a material change affects the legal basis for any processing, y222 will obtain fresh consent where required by applicable law before proceeding with the updated processing.

15 How to Contact y222 About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the way y222 handles your personal data, please reach out through the following channel:

For complaints that cannot be resolved through direct contact with y222, you have the right to refer the matter to the relevant data protection authority or to the dispute resolution body designated under y222's gaming licence. y222 commits to cooperating fully with any such process and to implementing any binding determination within the required timeframe.