8yyy Privacy Policy

This Privacy Policy ("Policy") describes how 8yyy ("8yyy", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the 8yyy online casino and sports betting platform at https://8yyy.org and all associated services (collectively, the "Platform").

8yyy is an internationally licensed online gaming platform built specifically for the Pakistani market. Our services are delivered in Pakistani Rupees (PKR) and are designed to meet the practical needs of players across Pakistan — including those in Karachi, Lahore, Islamabad, Faisalabad, and Rawalpindi — with support for local payment methods including JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection standards. This Policy explains in plain English — with a Pakistani audience in mind — exactly what data we collect, why we collect it, and how you can exercise control over it.

By registering an account on 8yyy or continuing to use the Platform after this Policy has been published or updated, you confirm that you have read and understood this Policy and that you consent to the collection, use, and processing of your personal data as described herein. If you do not agree to this Policy, please discontinue use of the 8yyy Platform.

For the purposes of this Privacy Policy, 8yyy acts as the data controller in respect of the personal data of its registered players and website visitors. As data controller, 8yyy determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

Where 8yyy engages third-party service providers — such as payment processors, identity verification providers, or game suppliers — to process personal data on its behalf, those providers act as data processors under binding contractual obligations that require them to process data only on 8yyy's instructions and to maintain appropriate security standards.

8yyy collects personal data through several channels: directly from you during registration and account use, automatically through your use of the Platform, and from third-party identity verification and payment processing providers. The categories of data we collect are described below.

8yyy processes your personal data only for specific, legitimate purposes. We do not use your data in any way that is incompatible with the purposes for which it was originally collected. The following table sets out the primary purposes for which your data is processed on the 8yyy Platform.

• Account creation and authentication: We use your identity and contact data to create and maintain your 8yyy account, verify your login credentials, and authenticate your identity when you sign in from a new device or location.
• Age and identity verification (KYC): We are required under our international gaming licence to verify that all players are at least 21 years of age and that their identity information is accurate. CNIC and document data is processed specifically for this purpose.
• Payment processing: Financial data is used to process your PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and debit card. We verify that payment methods are registered in your name to prevent fraud.
• Platform delivery and game operation: Gaming activity data and technical data are used to deliver the 8yyy gaming experience — ensuring games load correctly, bets are recorded accurately, and session history is maintained.
• Fraud detection and AML compliance: Transaction data, technical data, and gaming activity data are analysed by our risk and compliance systems to detect suspicious activity, prevent money laundering, and identify potential fraud patterns. This is a legal obligation under our licensing framework.
• Responsible gaming monitoring: Gaming activity data and session data are used to identify players who may be exhibiting signs of problem gambling. Where such signs are detected, 8yyy may proactively contact the player or apply account-level protections in accordance with our responsible gaming obligations.
• Customer support: Communications data is used to manage, respond to, and resolve your support queries, complaints, and account-related requests.
• Legal and regulatory compliance: We may process and retain certain data categories as required by applicable law, licensing conditions, or formal requests from regulatory authorities.
• Platform improvement: Aggregated, anonymised technical and gaming activity data is used to improve the performance, reliability, and usability of the 8yyy Platform. This processing uses data that cannot be traced back to any individual player.

8yyy processes personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing that is necessary to perform the contract between you and 8yyy — i.e., the Terms and Conditions you accepted at registration — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with 8yyy's legal and regulatory obligations under its international gaming licence, including KYC verification, AML screening, and data retention requirements.
• Legitimate interests: Processing carried out in pursuit of 8yyy's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and platform improvement — where those interests are not overridden by your data protection rights.
• Consent: Where consent is the applicable legal basis — for example, for certain optional communications or cookies beyond strictly necessary categories — we will obtain your clear, affirmative consent before processing. You may withdraw consent at any time without affecting the lawfulness of prior processing.

8yyy does not sell, rent, or commercially transfer your personal data to any third party. We share personal data externally only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment processors: Financial data is shared with JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and card processing partners solely to facilitate your PKR deposits and withdrawals. These providers are independently regulated and operate under their own privacy and security standards.
• Identity verification providers: CNIC details and verification documents may be shared with authorised third-party KYC and age verification service providers who process this data exclusively on 8yyy's instruction to verify player eligibility.
• Game suppliers: Technical data and limited gaming session data may be shared with game providers including Pragmatic Play, PG Soft, Play'n GO, and Evolution Gaming, to the extent necessary to deliver their games within the 8yyy Platform environment.
• Regulatory and law enforcement authorities: 8yyy may disclose personal data to our licensing regulator, financial intelligence authorities, or law enforcement agencies where required by law, court order, or formal regulatory request. We do not make voluntary disclosures beyond what is legally required.
• Professional advisers: Legal, accounting, and audit professionals engaged by 8yyy may have access to personal data on a strictly confidential and need-to-know basis.

8yyy retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your active account relationship with 8yyy, and for a defined period after account closure to meet our legal and regulatory obligations.
• KYC and identity verification data: Retained for a minimum of five (5) years following account closure in accordance with our international licence requirements relating to anti-money laundering record keeping.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, consistent with standard AML record-keeping obligations.
• Gaming activity logs: Retained for a minimum of three (3) years following the date of the activity, and longer where records are relevant to an outstanding dispute or investigation.
• Customer support communications: Retained for two (2) years following the closure of the relevant support case, and longer where records are relevant to an outstanding complaint or legal proceedings.
• Technical and device data: Server logs and IP records are typically retained for ninety (90) days, after which they are automatically purged unless flagged for a security investigation.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

8yyy implements a multi-layered approach to data security designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security architecture includes both technical and organisational measures.

• Encryption at rest: All personal data stored in 8yyy databases is encrypted using AES-256, one of the strongest symmetric encryption standards available. Even in the event of unauthorised physical access to storage infrastructure, data cannot be read in plaintext.
• Encryption in transit: All data transmitted between your browser and the 8yyy Platform is protected using TLS 1.2 or higher. HTTPS is enforced across all pages of the 8yyy website.
• Access controls: Access to personal data within 8yyy's internal systems is restricted on a strict need-to-know basis using role-based access control. Staff cannot access player data beyond what is required for their specific job function.
• Intrusion detection: 8yyy's infrastructure is monitored continuously for suspicious access patterns, unusual query volumes, and potential intrusion attempts. Automated alerts trigger immediate security review.
• Password hashing: Player account passwords are never stored in plaintext. They are stored as salted cryptographic hashes using modern hashing algorithms, meaning even 8yyy's own staff cannot see your password.
• Penetration testing: 8yyy conducts periodic third-party security assessments and penetration tests of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

The 8yyy Platform uses cookies and similar tracking technologies to ensure the website functions correctly, to maintain your authenticated session, and to collect anonymised analytical data about how the Platform is used. The following categories of cookies are used on 8yyy:

8yyy does not use third-party advertising cookies or behavioural targeting cookies. No cookie data collected on the 8yyy Platform is shared with external advertising networks or social media platforms.

You can manage optional cookie preferences through your browser settings. Please note that disabling functional or analytical cookies will not affect your ability to access or use the core features of the 8yyy Platform, but may result in some personalisation features being unavailable.

As a data subject whose personal data is processed by 8yyy, you have the following rights in relation to your personal data. These rights are available to all registered 8yyy players regardless of their location within Pakistan:

• Right of access: You have the right to request a copy of the personal data that 8yyy holds about you. We will provide this data in a structured, readable format within a reasonable timeframe following identity verification.
• Right to rectification: If any personal data held by 8yyy about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most account details directly from within your 8yyy account settings. For identity and KYC data corrections, contact support.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent is the applicable legal basis). Please note that this right is subject to legal and regulatory retention obligations — certain data categories cannot be deleted before the applicable retention period expires.
• Right to restriction: You have the right to request that processing of your personal data be restricted in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing.
• Right to data portability: You have the right to receive the personal data you have provided to 8yyy in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another data controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. 8yyy will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Rights related to automated decision-making: Where 8yyy uses automated systems to make decisions that significantly affect you — such as automated fraud detection leading to account suspension — you have the right to request human review of such decisions.

8yyy strictly prohibits access to its Platform by individuals under 21 years of age. The 8yyy Platform is intended exclusively for adult players who meet the eligibility criteria set out in our Terms & Conditions. We enforce the 21+ age requirement through mandatory identity verification at registration and at the withdrawal stage.

8yyy does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data belonging to a person under 21 has been submitted to our Platform — whether through an attempted registration, a fraudulent account, or any other means — we will:

• Immediately suspend the relevant account.
• Delete all personal data associated with the underage individual as promptly as practicable, subject to any legal obligation to retain evidence of the underage access attempt.
• Refund any deposits to the verified originating payment source and forfeit any associated gaming activity.
• Where required, report the incident to relevant authorities.

As an internationally licensed gaming platform, 8yyy may process and store personal data on servers and infrastructure located outside of Pakistan. Where personal data is transferred internationally — for example, to data centres hosting our gaming infrastructure, or to the servers of third-party game providers — we take appropriate steps to ensure that your data remains protected to a standard consistent with this Policy.

International transfers of personal data by 8yyy are governed by contractual arrangements with receiving parties that require them to process data only for the purposes described in this Policy and to maintain security standards equivalent to those applied by 8yyy itself .

8yyy does not transfer personal data to any jurisdiction that does not provide an adequate level of data protection without first putting in place appropriate safeguards, such as standard contractual clauses or equivalent data transfer mechanisms recognised under applicable law.

8yyy reserves the right to update, amend, or replace this Privacy Policy at any time. Changes may be made to reflect updates to our services, changes in applicable law or our licensing obligations, improvements to our data practices, or clarifications to existing provisions.

When material changes are made to this Policy, 8yyy will notify registered players via the email address associated with their account at least seven (7) days before the changes take effect, except where immediate changes are required by law or regulatory instruction. The updated Policy will always be available at https://8yyy.org/privacy-policy with the effective date clearly noted at the top of the page.

If you have any questions, concerns, or complaints about this Privacy Policy, about the way 8yyy processes your personal data, or if you wish to exercise any of your data rights as described in Section 10, please contact us using the details below.

We are committed to resolving all privacy concerns raised by 8yyy players as promptly and thoroughly as possible. If after contacting us you remain unsatisfied with the resolution of your complaint, you may have the right to raise the matter with the relevant data protection authority or dispute resolution body under 8yyy's licensing framework.

For responsible gaming concerns, self-exclusion requests, or deposit limit adjustments, please also contact our support team at the same address. Responsible gaming requests are treated as high priority and will be actioned as quickly as possible. More information on responsible gaming tools available to Pakistani players is available on our Responsible Gaming page.