Privacy Policy

This Privacy Policy ("Policy") is published by y288 ("y288", "we", "us", "our") and applies to all personal data collected from individuals ("Members", "Users", "you") who access or use the y288 platform at https://y288.org, including all related games, betting services, account features and promotional content.

y288 is committed to handling your personal data with transparency, integrity and in full compliance with applicable international data protection standards. This Policy sets out in clear terms what data we collect, the purposes for which it is processed, the legal basis on which we rely, and the rights available to you as a data subject.

By registering an account, depositing funds, placing bets or otherwise using the y288 platform, you acknowledge that you have read and understood this Privacy Policy. Please also refer to our Terms and Conditions and Responsible Gaming Policy, both of which form part of your agreement with y288.

y288 collects the following categories of personal data from Members and platform visitors:

y288 does not collect special category data (such as racial or ethnic origin, religious beliefs, health data or biometric data) unless strictly required by applicable law and with your explicit consent.

y288 collects personal data through the following methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically through cookies, server logs, and platform analytics tools each time you access the y288 website or use platform features.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, and Visa/Mastercard when you process payments.
• Third-party identity verification providers: Data received from identity verification services used to confirm your age and identity as required by our regulatory obligations.
• Fraud prevention services: Risk signals and device fingerprint data shared by fraud detection partners to protect the platform and its Members.

y288 processes your personal data for the following specific purposes:

• Account management: Creating and maintaining your Member account, processing logins, managing account settings and preferences.
• Identity and age verification: Confirming that you meet the minimum age requirement of 21 years and verifying your identity in compliance with our anti-money laundering (AML) and know-your-customer (KYC) obligations.
• Payment processing: Facilitating PKR deposits and withdrawals via your chosen payment method, reconciling transactions and maintaining financial records.
• Platform operation: Delivering the games, betting markets, live casino, cricket betting, slots and all other features you access on y288.
• Customer support: Responding to your enquiries, resolving complaints, and maintaining records of our communications with you.
• Regulatory compliance: Meeting our obligations under applicable gaming regulations, AML laws, and data protection requirements, including reporting to relevant authorities where legally required.
• Responsible gaming: Monitoring your gaming activity to identify potential problem gambling patterns and administering self-exclusion, deposit limits and other responsible gaming tools.
• Security and fraud prevention: Detecting, investigating and preventing fraudulent activity, unauthorised account access, and abuse of promotional offers.
• Platform improvement: Analysing aggregated usage data to improve platform performance, user experience and game offerings.
• Marketing communications: Sending you promotional offers, bonus notifications and news about y288 — only where you have provided your consent to receive such communications, and only via the channel you have agreed to.

y288 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and y288, including account creation, payment processing and game delivery. Without this processing, we cannot provide you with platform services.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, KYC requirements, age verification mandates and regulatory reporting obligations.
• Legitimate interests: Processing carried out for y288's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring and platform improvement, provided those interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific and informed consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting any prior lawful processing.

y288 does not sell, rent or trade your personal data to third parties for their own marketing purposes. We share your data only in the following limited circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK and card networks receive the financial data necessary to process your PKR transactions securely.
• Identity verification providers: Third-party KYC and age verification service providers receive identity documents and personal details solely to confirm your eligibility to use the platform.
• Fraud and risk management partners: Specialist fraud prevention services receive technical and behavioural data to identify and block fraudulent activity targeting y288 Members.
• Game software providers: Where technically required, limited usage data may be shared with licensed game developers and live casino studio operators whose products are hosted on y288.
• Regulatory and law enforcement authorities: y288 will disclose personal data to competent authorities where required by law, court order, or as necessary to protect the rights, property or safety of y288, its Members or the public.
• Corporate transactions: In the event of a merger, acquisition or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party service providers who process personal data on y288's behalf are bound by contractual obligations to process data only on our instructions, maintain appropriate security measures, and not use your data for any other purpose.

y288 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting and reporting obligations.

• Active accounts: Personal data is retained throughout the period your account is active and for a minimum of five (5) years after account closure, in compliance with AML record-keeping requirements.
• Financial transaction records: Transaction data and payment records are retained for a minimum of five (5) years following the transaction date.
• KYC and identity documents: Verification documents are retained for the duration of account activity plus five (5) years, or longer where required by applicable law.
• Support communications: Live chat and email records are retained for up to three (3) years from the date of the communication.
• Marketing data: Where you have consented to marketing, your preferences are retained until you withdraw consent. Following withdrawal, your data is removed from marketing lists within 30 days.
• Technical and usage logs: Server logs and session data are retained for up to 12 months for security and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any individual.

y288 applies industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. Our security framework includes:

• Encryption in transit: All data transmitted between your device and y288's servers is protected by TLS/SSL encryption (256-bit).
• Encryption at rest: Sensitive personal and financial data stored in y288's databases is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All y288 staff with access to Member data undergo background checks and are bound by confidentiality obligations.
• Two-factor authentication: y288 supports and encourages the use of two-factor authentication (2FA) on all Member accounts to add an additional layer of security beyond your password.
• Regular security audits: y288's systems and infrastructure are subject to regular independent security assessments and penetration testing.
• Incident response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, y288 will notify you and applicable regulatory authorities within the timeframes required by law.

y288 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how the site is used. A cookie is a small text file placed on your device when you visit a website.

y288 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the platform to function. These enable core features such as session management, login authentication and security. They cannot be disabled without disrupting platform functionality.
• Functional cookies: Remember your preferences such as language settings, game display preferences, and notification choices to improve your experience.
• Analytical cookies: Collect aggregated, anonymised data about how Members use the platform, which pages are visited most frequently, and where errors occur. This data is used solely to improve platform performance.
• Marketing cookies: Used to show you relevant promotional offers and content based on your platform activity. These are only placed with your consent.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect platform functionality. For marketing cookies, you may also update your preferences via Account Settings.

As a y288 Member, you hold the following rights with respect to your personal data. To exercise any of these rights, contact y288's Data Protection team at [email protected] with "Data Rights Request" in the subject line. We will respond within 30 days.

y288 will not charge a fee for processing data rights requests unless they are manifestly unfounded or excessive. Where a request cannot be fulfilled due to a conflicting legal obligation, y288 will explain the reason clearly and in writing.

The y288 platform is strictly intended for adults aged 21 years and over. y288 does not knowingly collect or process personal data from individuals under the age of 21.

Age verification is a mandatory step in the y288 registration and withdrawal process. Where y288 becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the account will be closed. Any funds held in such an account will be handled in accordance with applicable regulations.

If you are a parent or guardian and believe that a minor has registered an account with y288, please contact our support team immediately at [email protected] so that appropriate action can be taken without delay.

As an internationally operated platform serving Members in Pakistan and other jurisdictions, y288 may transfer your personal data to servers or service providers located outside of Pakistan. Such transfers may include countries whose data protection laws differ from those in Pakistan.

Where personal data is transferred internationally, y288 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under international data protection principles. These safeguards may include:

• Contractual clauses obligating the recipient to process data to the same standard as y288.
• Transfer to jurisdictions recognised as providing an adequate level of data protection.
• Binding corporate rules where applicable within corporate group structures.

By using the y288 platform, you acknowledge and consent to the transfer of your personal data on the basis described above.

y288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, y288 will notify registered Members by posting a prominent notice within the platform dashboard and updating the "Last Updated" date at the top of this page.

Your continued use of the y288 platform after any revised Policy has been published constitutes your acknowledgment of the changes. If you do not agree with the revised Policy, you should cease using the platform and request account closure. We encourage you to review this Policy periodically to stay informed about how y288 protects your data.

If you have any questions, concerns or requests relating to this Privacy Policy or y288's handling of your personal data, please contact us through the following channels:

• Data Rights Requests & Privacy Enquiries: [email protected] (subject line: "Privacy / Data Rights Request")
• General Support: Live Chat available 24/7 via the y288 account dashboard

y288 will acknowledge your enquiry within 48 hours and endeavour to provide a full response within 30 days. For complex requests, we may require additional time and will inform you accordingly.

This Privacy Policy was last reviewed and updated in January 2026. © 2026 y288. All rights reserved.