y4444 Privacy Policy — How We Handle Your Personal Data

1.1   The y4444 Platform, accessible at y4444.bio, is operated by the y4444 entity holding the applicable international gaming licence (hereinafter "y4444", "we", "us", or "our"). For the purposes of this Privacy Policy, y4444 acts as the data controller in respect of personal data collected from players using the Platform.

1.2   As data controller, y4444 is responsible for determining the purposes and means by which personal data is processed. y4444 is committed to handling all personal data in accordance with applicable data protection laws and with the principles set out in this Policy.

1.3   References in this Policy to "you" or "your" refer to any individual who accesses the y4444 Platform, registers an account, or otherwise provides personal data to y4444 in the context of using our services. References to "personal data" mean any information that directly or indirectly identifies you as a natural person, including your name, mobile number, email address, Pakistani CNIC number, payment account details, and device identifiers.

2.1   y4444 collects and processes the following categories of personal data from players:

2.2   Sensitive Data. y4444 does not intentionally collect special categories of sensitive personal data — such as health information, racial or ethnic origin, political opinions, or religious beliefs — from its players. In the event that such data is incidentally disclosed in a support communication, it will be handled with additional care and not used for any processing purpose beyond resolving the immediate query.

3.1   y4444 collects personal data through the following channels and mechanisms:

• Direct Collection — Account Registration: When you complete the y4444 registration form at y4444.bio/y4444-login, you provide your name, Pakistani mobile number or email address, date of birth, and chosen password directly to y4444.
• Direct Collection — KYC Verification: When you submit identity documents for KYC verification prior to withdrawals, you provide Identity Data and potentially selfie or video verification data directly.
• Direct Collection — Payment Transactions: When you make deposits or withdrawal requests, your Financial Data is provided to y4444 or to our payment processing partners in order to execute the transaction.
• Direct Collection — Support Interactions: When you contact y4444 via live chat or email, the content of your communication and any supporting information you provide is collected as Communications Data.
• Automated Collection — Platform Usage: y4444's systems automatically collect Technical Data during each login session, including your IP address, device identifiers, browser fingerprint, session duration, and navigation patterns within the Platform.
• Automated Collection — Cookies and Similar Technologies: y4444 uses cookies and similar tracking technologies to maintain session state, recognise returning players, and analyse Platform performance. See Section 9 for full details.
• Third-Party Sources: In certain circumstances, y4444 may receive supplementary identity verification data from third-party KYC service providers used to verify the authenticity of documents you have provided. y4444 may also receive fraud-risk data from payment processing partners.

4.1   y4444 processes your personal data only where there is a valid legal basis for doing so. The following table sets out the primary purposes for which y4444 processes personal data and the applicable legal basis in each case:

5.1   y4444 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared with external parties only in the following specific circumstances:

• Payment Processing Partners: JazzCash, EasyPaisa, HBL, UBL Omni, Meezan Bank, and bank transfer partners receive your Financial Data to the extent necessary to execute deposit and withdrawal transactions. These partners are bound by their own privacy and data security obligations and are not permitted to use your data for any purpose beyond processing the specific transaction.
• KYC and Identity Verification Providers: Third-party KYC service providers receive copies of identity documents you submit for verification. These providers operate under strict data processing agreements and are authorised only to verify document authenticity and return a verification result to y4444.
• Game Technology Providers: Casino game software providers may receive your Player ID and session data in order to deliver game content and maintain game integrity. These providers do not receive your name, CNIC, or payment details.
• Regulatory Authorities: y4444 may be required to disclose personal data to its gaming regulatory authority, financial regulators, or law enforcement agencies in connection with licensing compliance, AML obligations, or lawful investigation requests. y4444 will fulfil such requests only to the extent legally required.
• Fraud Prevention Agencies: Where fraud is suspected, y4444 may share relevant account data with fraud prevention agencies or payment network operators to protect the Platform and its players from financial crime.
• Professional Advisers: y4444 may share personal data with legal, accounting, or auditing advisers where disclosure is necessary for the performance of their professional services, subject to strict confidentiality obligations.

5.2   Where y4444 engages third-party data processors, it does so only under written data processing agreements that require processors to protect personal data in accordance with applicable privacy standards and to process data only on y4444's documented instructions.

6.1   y4444 operates as an internationally licenced online gaming platform. This means that some personal data processed by y4444 may be transferred to, stored in, or accessed from servers and systems located outside of Pakistan. y4444 takes steps to ensure that any such international transfer is subject to appropriate safeguards.

6.2   Where personal data is transferred internationally, y4444 ensures that such transfers are protected by one or more of the following safeguards: contractual data transfer provisions (equivalent to applicable data protection standards), the receiving entity's participation in a recognised data protection compliance framework, or the transfer being necessary for the performance of your contract with y4444 (for example, payment processing through an international payment network).

6.3   If you have questions about the specific safeguards applied to any particular international transfer of your personal data, you may submit a request to the y4444 Data Protection contact detailed in Section 15.

7.1   y4444 retains personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory requirements, or to protect y4444's legal interests. The following retention principles apply:

• Account Data: Retained for the duration of the active account relationship plus a period of five (5) years following account closure, to satisfy AML and gaming regulatory record-keeping obligations.
• Transaction and Game History: Retained for a minimum of five (5) years following the date of each transaction or game session, in accordance with gaming licence and AML requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years following account closure, in compliance with applicable financial crime prevention regulations.
• Support Communications: Retained for a period of three (3) years following resolution of the relevant query or complaint, or longer where the matter is subject to ongoing legal proceedings.
• Marketing Preference Data: Retained until you withdraw consent or opt out of marketing communications, at which point marketing data is suppressed (but the record of opt-out may be retained to prevent inadvertent re-subscription).
• Technical and Session Data: Retained for a period of thirteen (13) months for analytics purposes, after which it is aggregated and anonymised.

7.2   Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or anonymised so that it can no longer be used to identify you.

8.1   y4444 implements a multi-layered security framework to protect your personal data from unauthorised access, accidental loss, destruction, or alteration. Key security measures in place include:

• 256-bit SSL Encryption: All data transmitted between your browser or device and y4444's servers is protected by 256-bit SSL/TLS encryption — the same standard used by major international financial institutions.
• AES Encryption at Rest: Personal data stored on y4444's servers is encrypted using AES-256 encryption at rest. Encryption keys are managed separately from the encrypted data.
• Access Controls: Access to personal data systems is restricted to authorised personnel only, on a strict role-based access control basis. Access logs are maintained and reviewed regularly.
• Two-Factor Authentication: All y4444 staff members with access to personal data systems are required to use multi-factor authentication to access those systems.
• Regular Security Audits: y4444's technical infrastructure undergoes regular security assessments by qualified independent security professionals to identify and remediate vulnerabilities.
• Incident Response: y4444 maintains a documented data breach incident response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, y4444 will notify affected players without undue delay as required by applicable law.

9.1   y4444 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your browser or device when you visit the y4444 website. Cookies serve the following functions on the y4444 Platform:

9.2   You can manage and control cookie preferences through your browser settings. Most browsers allow you to refuse new cookies, accept only certain cookies, or delete existing cookies. Note that disabling Strictly Necessary or Security cookies will impair your ability to use the y4444 Platform.

10.1   Subject to applicable law, you have the following rights in relation to the personal data y4444 holds about you. All rights may be exercised by contacting y4444's Data Protection team using the contact details in Section 15:

• Right of Access: You have the right to request confirmation of whether y4444 holds personal data about you, and if so, to receive a copy of that data along with information about how it is being used.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by y4444 be corrected. Where possible, you can update certain account information directly in your y4444 account settings without needing to contact support.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (where consent is the legal basis), or where you object to processing and there are no overriding legitimate grounds. Note that y4444 may be unable to delete all data immediately where we have legal retention obligations — for example, five-year AML records.
• Right to Restriction: You have the right to request that y4444 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive personal data you have provided to y4444 in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where y4444 is relying on legitimate interest as the legal basis, including profiling based on legitimate interest.
• Right to Withdraw Consent: Where y4444 processes your data based on your consent — for example, for marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.2   y4444 will respond to all verified data rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, y4444 may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it.

10.3   y4444 will not charge a fee for processing data rights requests unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may be applied or the request may be refused, with explanation provided.

11.1   The y4444 Platform is strictly intended for adults aged 21 years and over. y4444 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The 21+ requirement is enforced through the mandatory KYC age verification process applied to all accounts prior to the processing of any withdrawal.

11.2   If y4444 discovers or has reasonable grounds to believe that an Account has been registered by or is being used by a person under the age of 21, the Account will be immediately suspended, all Bonus Funds forfeited, and any Real Money Play winnings voided pending regulatory review. Any deposits made by a minor will be returned to the deposit source.

11.3   If you are a parent or guardian and believe that a person under 21 in your care has registered a y4444 Account or provided personal data to y4444, please contact us immediately at [email protected] so that the matter can be investigated and the Account suspended without delay.

12.1   y4444 may send you promotional communications — including bonus offers, PSL season promotions, free spin offers, and platform news — via SMS to your registered Pakistani mobile number or via email to your registered email address, but only where you have provided clear consent to receive such communications at the time of registration or subsequently in your account settings.

12.2   You may withdraw consent to receive marketing communications from y4444 at any time by:

• Updating your communication preferences in your y4444 Account Settings panel;
• Clicking the unsubscribe link included in any marketing email;
• Contacting y4444 support by email or live chat and requesting removal from marketing lists.

12.3   Opting out of marketing communications does not affect transactional communications — y4444 will continue to send you account-related messages such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts regardless of your marketing preferences, as these are necessary for the operation of your account.

13.1   The y4444 Platform may contain links to third-party websites or embed content from third-party game providers. This Privacy Policy applies exclusively to personal data processed by y4444 in connection with the y4444 Platform. y4444 is not responsible for the privacy practices of any third-party website or service, including game software providers, payment partners' own websites, or any other external service that you may access via a link from the y4444 Platform.

13.2   y4444 recommends that you review the privacy policies of any third-party services you access independently to understand how those services collect and use your data.

14.1   y4444 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or changes to the Platform's features and functionality. The effective date at the top of this page indicates when the current version came into effect.

14.2   Where changes to this Privacy Policy are material — meaning they significantly affect how your data is used or your rights in relation to that data — y4444 will notify you of the changes via your registered email address or via a prominent in-platform notification before the changes take effect. Less material updates will be reflected by updating the effective date without separate individual notification.

14.3   Continued use of the y4444 Platform following notification of a material Privacy Policy change constitutes your acceptance of the revised Policy. If you do not agree with a change, you should stop using the Platform and may request account closure in accordance with the y4444 Terms and Conditions.

15.1   For any privacy-related questions, to exercise any of your data rights set out in Section 10, or to raise a complaint about how y4444 has handled your personal data, please contact the y4444 Data Protection Team through the following channels:

• Email: [email protected] — Please include "Privacy Request" or "Data Rights Request" in the subject line to ensure prompt routing to the appropriate team. Include your registered mobile number or Player ID so your account can be located efficiently.
• Live Chat: Available 24/7 from within your logged-in y4444 account. For data rights requests, live chat is suitable for initial enquiries; formal requests should be submitted by email for documentation purposes.

15.2   y4444 aims to acknowledge all privacy-related requests within 48 hours of receipt and to provide a substantive response within 30 days, as set out in Section 10.2.

15.3   Regulatory Complaints. If you are not satisfied with y4444's response to your privacy complaint, you have the right to escalate your complaint to the data protection supervisory authority in the jurisdiction in which y4444 holds its gaming licence. Contact details for the applicable supervisory authority are available on request from the y4444 compliance team.