y222 Privacy Policy – How We Protect Your Data in Pakistan

1Who We Are

y222 operates the online gaming and betting platform accessible at y222.biz. For the purposes of this Privacy Policy, y222 is the data controller — meaning y222 is the entity that determines why and how your personal data is collected and used.

y222 is built specifically for Pakistani players. All accounts are denominated in Pakistani Rupees (PKR) and all payment integrations are with local providers including Easypaisa, JazzCash, NayaPay and SadaPay. This Privacy Policy therefore addresses data practices that are specifically relevant to Pakistani users, including the use of local mobile payment identifiers and the storage of CNIC data where identity verification is conducted.

Any questions about this Privacy Policy or about y222's data practices can be directed to the support team, whose contact details are in Section 12 of this document. y222 will always respond to privacy-related queries promptly and in plain language.

2Data We Collect from Pakistani Players

y222 collects personal data through several distinct channels. Here is a breakdown of when collection occurs and what is collected at each point:

At registration — When you create a y222 account, we collect your name, mobile number, date of birth and the city or province you are registering from in Pakistan. You choose your own username and password at this stage.

During identity verification — If y222 requests identity verification, you may be asked to submit a copy of your CNIC (Computerised National Identity Card), a selfie photograph, and proof of your registered payment method. This data is used exclusively for verification and compliance purposes.

When you deposit or withdraw — y222 records the payment method used (e.g. your Easypaisa mobile number or JazzCash wallet ID), the amount in PKR, the date and time of the transaction, and the transaction reference number. Full card numbers are processed by certified third-party payment processors — y222 never stores complete card details on its own servers.

While you play — y222's systems automatically log all bets placed, games played, session start and end times, game outcomes and bonus usage. This data is essential for account management, dispute resolution and responsible gaming monitoring.

Through your device — When you access y222, our servers automatically record technical information including your IP address, device type (Android, iOS, desktop), browser or app version, operating system, and connection type. This data is used for security, fraud prevention and platform optimisation.

From cookies and tracking technologies — y222 uses cookies and similar technologies on the platform. Full details are in Section 6.

3How y222 Uses Your Data

y222 uses the personal data we collect only for the purposes described below. We do not use your data for anything that is not listed here, and we do not sell your data to any third party — ever.

• Account management: Creating and maintaining your y222 account, processing logins, managing your balance and bet history.
• Payment processing: Processing deposits and withdrawals in PKR via your chosen local payment method, reconciling transactions and investigating payment disputes.
• Identity verification: Confirming your age (18+), verifying your identity where required and confirming ownership of registered payment methods.
• Security and fraud prevention: Detecting and preventing unauthorised account access, identifying suspicious betting patterns, enforcing the one-account-per-player policy and monitoring for money laundering activity.
• Responsible gaming: Monitoring session durations, bet sizes and win/loss patterns to identify signs of problem gambling and to administer self-imposed limits, cooling-off periods and self-exclusions.
• Customer support: Reviewing your account history and transaction records to resolve queries, disputes and complaints submitted to y222 support.
• Platform improvement: Analysing anonymised and aggregated usage data to improve game selection, mobile performance, payment processing speed and overall user experience on y222.
• Marketing (opt-in only): Sending promotional offers, bonus notifications and tournament alerts via SMS or email — only to players who have opted in to marketing communications.

4Legal Basis for Processing

y222 processes your personal data on the following legal grounds:

• Contract performance: Processing your registration data, payment data and gaming data is necessary to fulfil the contract between you and y222 — i.e. to operate your account and allow you to use the platform.
• Legal obligation: Processing your identity and payment data for age verification, anti-money laundering checks and fraud prevention is required to comply with legal and regulatory obligations.
• Legitimate interests: Collecting technical and usage data for security monitoring, fraud detection and platform improvement is in the legitimate interests of both y222 and its players, provided those interests do not override your privacy rights.
• Consent: Sending marketing communications is done only on the basis of your explicit opt-in consent. You can withdraw that consent at any time by updating your communication preferences in your y222 account settings or by contacting support.

Where y222 relies on legitimate interests as a legal basis, we have assessed that our interests do not outweigh your rights, given that the data involved is processed for security and operational purposes rather than commercial exploitation.

5Who y222 Shares Your Data With

y222 does not sell your personal data. We share it only with the following categories of third parties, strictly on a need-to-know basis:

• Payment processors: When you deposit or withdraw in PKR, your payment data is shared with the relevant payment processor (e.g. the Easypaisa or JazzCash API infrastructure, card payment gateways). These processors are contractually bound to process your data only for payment completion purposes.
• Identity verification providers: Where y222 requests CNIC verification or age verification, your documents may be processed by a certified third-party identity verification service. These providers operate under strict data processing agreements.
• Game software providers: When you play a game from a third-party provider such as Evolution, Pragmatic Play or Spribe, your session data (bet amounts, outcomes) is shared with the relevant provider for the purpose of running the game. These providers do not receive your personal identity data.
• Fraud and security services: Anonymised technical data may be shared with fraud detection systems to identify suspicious patterns across the platform.
• Regulatory and law enforcement authorities: Where required by applicable law, y222 will disclose your personal data to government authorities, financial regulators or law enforcement agencies. y222 will notify you of such disclosures where legally permitted to do so.

6Cookies & Tracking Technologies

y222 uses cookies and similar browser storage technologies to operate the platform correctly, maintain your logged-in session and understand how players use the site. Cookies do not contain your name, CNIC or payment details — they store session identifiers and preference data only.

y222 does not use third-party advertising cookies or tracking pixels that share your behaviour data with external advertising networks. You can clear all cookies associated with y222 at any time through your browser settings. Clearing essential cookies will require you to log in again.

7How Long y222 Keeps Your Data

y222 retains your personal data only for as long as it is necessary for the purpose it was collected, or for as long as required by applicable legal obligations. The following retention periods apply:

Following account closure — whether at your request, following self-exclusion or as a result of a Terms breach — y222 will anonymise or delete personal data beyond the minimum retention periods listed above. You may request confirmation of the deletion of your data beyond the legal minimum by contacting y222 support.

8How y222 Keeps Your Data Secure

y222 takes data security seriously and has implemented the following technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration or destruction:

• 256-bit SSL encryption: All data transmitted between your device and the y222 platform — including login credentials, payment instructions and personal information — is protected by 256-bit TLS/SSL encryption.
• Segregated data storage: Player personal data is stored in database systems that are logically segregated from operational systems, with access restricted to authorised personnel only.
• Access controls: y222 staff access to player data is governed by role-based access controls. Only staff with a legitimate operational need can access specific categories of player data, and all access is logged.
• No full card storage: y222 never stores complete payment card numbers. Card payments are tokenised through certified third-party processors, so even in the event of a breach of y222's systems, full card numbers are not exposed.
• Regular security testing: y222's platform undergoes regular penetration testing and security audits by qualified third-party security professionals.
• Breach notification: In the event of a data breach that is likely to result in a risk to your rights, y222 will notify affected players as quickly as practically possible and will take immediate steps to contain the breach.

9Your Rights Over Your Personal Data

As a y222 player and a person whose data is being processed, you have the following rights. You can exercise any of these rights by contacting y222 support — no special form is required, just a clear written request:

• Right of access: You have the right to request a copy of all personal data that y222 holds about you. We will provide this within 30 days of a verified request.
• Right to correction: If any of your personal data held by y222 is inaccurate or outdated, you have the right to request that it be corrected. You can update basic account information directly in your y222 account settings.
• Right to deletion: You have the right to request the deletion of personal data that y222 is no longer required to retain. Note that financial transaction records, verification documents and gaming history must be retained for the minimum periods described in Section 7 for legal reasons, so deletion requests may be partially fulfilled.
• Right to restrict processing: In certain circumstances, you can ask y222 to restrict processing of your data — for example, while a dispute about accuracy is being resolved.
• Right to object to marketing: You can withdraw your consent to marketing communications at any time by updating your preferences in y222 account settings or by asking support to opt you out. This will not affect your ability to use the platform.
• Right to data portability: You can request a machine-readable copy of the personal data you provided to y222 during registration and account use.

y222 will not charge a fee for handling your data rights requests. If a request is particularly complex or numerous, y222 will inform you within 30 days and explain any extension to the response timeline. y222 will always verify your identity before fulfilling a data subject rights request to prevent fraudulent access to another person's data.

10Children's Privacy

y222 is strictly an 18+ platform. y222 does not knowingly collect or process personal data from anyone under the age of 18. Registration on the y222 platform requires confirmation that you are at least 18 years old, and this is enforced through age verification procedures.

If y222 discovers that an account has been created by a person under 18, the account will be immediately and permanently closed, all funds will be forfeited, and any personal data associated with the account will be deleted from y222's systems as quickly as legally possible.

If you have reason to believe that a minor has registered an account on y222, please notify the support team immediately. y222 takes underage gambling extremely seriously and will act on any such notification without delay.

11Updates to This Privacy Policy

y222 may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, changes to our payment integrations or improvements to the platform. When material changes are made, y222 will:

• Update the "Last updated" date displayed at the top of this page
• Display a notice on the y222 homepage when the update is published
• Where changes significantly affect your rights, send a notification to your registered mobile number or email address

Continued use of the y222 platform after any Privacy Policy update constitutes your acknowledgment of the revised policy. If you do not accept the changes, you should stop using the platform and contact support to close your account. Your real-money balance will be returned to your registered payment method upon account closure.

Minor changes — including corrections of typographical errors, formatting updates or clarifications that do not change how your data is actually used — may be made without formal notification. The date in the "Last updated" field is always current.

12Contact y222 About Privacy

If you have any questions, concerns or requests relating to this Privacy Policy or to how y222 handles your personal data, you can reach us through the following channels. Privacy queries are treated as high priority and you will receive a substantive response — not an automated acknowledgement — within 48 hours for standard queries.

• Live Chat: Available 24/7 on the y222 platform. The fastest way to reach us for any query.
• Email: support@y222.biz — for formal privacy requests, subject-access requests or data deletion requests, email is recommended so there is a written record.

For formal data subject rights requests (access, deletion, portability), please include your registered mobile number and a brief description of your request. y222 will verify your identity before processing the request. Responses will be provided within 30 days. Where a request is complex, y222 will notify you within 30 days and explain any extension.