by888 Privacy Policy

1.1 Identity. The data controller responsible for the personal information you provide to the by888 platform is the operator of by888.im. References to "by888," "we," "us," or "our" throughout this Privacy Policy refer to the by888 platform operator, its affiliates, and authorised data processors acting on its behalf.

1.2 Scope. This Privacy Policy applies to all personal data collected through the by888 website at by888.im, including data collected during account registration, KYC verification, payment processing, customer support interactions, and general platform usage. It applies to all registered players and to visitors who browse the platform without registering.

1.3 Agreement. By accessing or using the by888 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this policy, you should not use the by888 platform.

2.1 Registration Data. When you create a by888 account, we collect your full name, date of birth, email address, mobile number, and chosen username. This information is mandatory — without it, we cannot create or maintain a valid account.

2.2 Identity Verification (KYC) Data. To comply with anti-money laundering and responsible gaming obligations, by888 requires identity documents before processing withdrawals or escalating account privileges. This may include a copy of your national identity card (CNIC), passport, or driver's licence, together with a selfie or live photo for biometric matching. by888 uses vetted third-party KYC providers to process these documents securely.

2.3 Financial Data. When you make a deposit or request a withdrawal, by888 collects transaction details including the payment method used (JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank), transaction reference numbers, amounts, and timestamps. We do not store complete bank account credentials — payment processing is handled by our licensed payment partners.

2.4 Usage and Behavioural Data. We automatically collect data about how you interact with the by888 platform, including pages visited, games played, bet amounts, session durations, click patterns, and feature usage. This data is used to improve platform performance, personalise your experience, and detect anomalous behaviour that may indicate fraud or problem gambling.

2.5 Technical Data. We collect technical information from your device, including IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone. This data is used for security monitoring, fraud prevention, and technical troubleshooting.

2.6 Communications Data. If you contact by888 support via live chat or email, we retain records of those communications, including the content of messages, timestamps, and agent responses. This data is used for quality assurance and dispute resolution purposes.

3.1 Directly from You. The majority of personal data by888 holds about you is provided directly by you — during account registration, when completing KYC verification, when making a payment, when contacting our support team, or when participating in promotions or surveys.

3.2 Automatically. Certain technical and behavioural data is collected automatically as you use the platform through cookies, server logs, and similar tracking technologies. See Section 08 for a full explanation of our cookie practices.

3.3 From Third Parties. We may receive data about you from third-party service providers, including:

• KYC Verification Partners: Identity document verification results and fraud risk scores.
• Payment Processors: Transaction confirmation data from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank.
• Fraud Prevention Providers: Device fingerprint data and behavioural risk assessments.
• Analytics Providers: Aggregated usage statistics (processed in a manner that does not identify individual players).

by888 processes personal data only where a valid legal basis exists. The legal bases on which we rely are as follows:

• Contractual Necessity: Processing your registration data, payment information, and account activity data is necessary to perform our contract with you — i.e., to provide you with the by888 gaming and betting platform.
• Legal Obligation: We are required by applicable law and our operating licence conditions to collect and retain certain data for AML compliance, responsible gaming monitoring, and financial record-keeping. This includes KYC identity verification data.
• Legitimate Interests: We process technical and behavioural data on the basis of our legitimate interest in keeping the platform secure, preventing fraud, improving platform performance, and detecting problem gambling behaviour before it escalates.
• Consent: We rely on your consent for optional marketing communications and non-essential analytics cookies. You may withdraw this consent at any time by updating your account communication preferences or adjusting your cookie settings.

by888 uses your personal data for the following purposes:

• Account Management: Creating and maintaining your player account, processing deposits and withdrawals, and managing account preferences and settings.
• Identity Verification: Confirming that you meet the minimum age requirement of 21 years, verifying your identity in accordance with AML obligations, and preventing the creation of fraudulent or duplicate accounts.
• Payment Processing: Facilitating deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and processing withdrawal requests to your verified payment method.
• Platform Security & Fraud Prevention: Detecting and investigating suspicious activity, preventing account takeovers, identifying bonus abuse, and monitoring for collusion or other forms of gaming fraud.
• Responsible Gaming: Monitoring gameplay patterns for indicators of problem gambling behaviour, enforcing self-exclusion requests, and contacting players who may need support resources.
• Customer Support: Responding to your queries, complaints, and account-related requests via live chat and email.
• Legal Compliance: Fulfilling our obligations under applicable AML, KYC, data protection, and gaming regulations, and responding to lawful requests from regulatory or law enforcement bodies.
• Platform Improvement: Analysing aggregated usage data to identify areas for platform improvement, fix technical issues, and develop new features.
• Marketing (with consent): Sending you promotional offers, bonus notifications, and updates about new games or features on the by888 platform — only where you have opted in to receive such communications.

6.1 We Do Not Sell Your Data. by888 does not sell, rent, or commercially trade your personal data to any third party. Full stop.

6.2 Service Providers. We share personal data with carefully selected third-party service providers who process data on our behalf and are contractually bound to handle it securely and only for the specific purpose for which it was shared. These providers include:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, for the purpose of processing your deposits and withdrawals.
• KYC / Identity Verification Partners: Third-party verification services that validate identity documents and perform age and fraud screening.
• Fraud Prevention & Security Providers: Services that analyse technical and behavioural data to identify suspicious activity and protect platform integrity.
• Cloud Hosting Providers: Secure data centre operators that host the by888 platform infrastructure and associated data storage systems.
• Customer Support Platforms: Systems used to manage live chat and email support interactions.

6.3 Regulatory & Legal Disclosure. by888 may disclose personal data to regulatory authorities, law enforcement agencies, or gaming oversight bodies where required to do so by applicable law, court order, or as part of an investigation into fraud or financial crime. We will notify you of such disclosures where legally permitted to do so.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or part of the by888 business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer and of any material changes to the Privacy Policy that result.

by888 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Once a retention period expires, by888 securely deletes or anonymises the relevant data. Anonymised, aggregated data — which cannot be used to identify you — may be retained indefinitely for statistical analysis and platform development purposes.

8.1 What Are Cookies. Cookies are small text files placed on your device by a website. by888 uses cookies and similar technologies (including localStorage, session tokens, and device fingerprinting) to operate and improve the platform.

8.2 Types of Cookies We Use.

• Strictly Necessary Cookies: These are essential for the platform to function and cannot be disabled. They maintain your login session, remember your language preference, and keep your PKR wallet balance accurate during gameplay.
• Performance & Analytics Cookies: These cookies help us understand how players use by888 — which games are most popular, where players encounter errors, and how long sessions typically last. This data is aggregated and does not identify individual players.
• Functional Cookies: These remember your display preferences, game settings, and last-visited sections of the platform to provide a more personalised experience.
• Security Cookies: These support our fraud detection systems by allowing us to recognise your device across sessions and flag unusual access patterns.

8.3 Managing Cookies. You can control non-essential cookies at any time through your account settings or your browser's cookie management tools. Please note that disabling strictly necessary cookies will prevent you from logging in or using core platform features. Disabling analytics cookies will not affect your ability to play or transact on by888.

9.1 Technical Safeguards. by888 implements a comprehensive set of technical security measures to protect your personal data, including:

• TLS 1.3 encryption for all data in transit between your device and by888 servers.
• AES-256 encryption for sensitive data at rest, including identity documents and financial records.
• Salted cryptographic hashing for all stored passwords — by888 staff cannot view your password in plain text.
• Two-factor authentication (2FA) available for all player accounts, strongly recommended.
• Intrusion detection systems (IDS) and real-time security monitoring on all platform infrastructure.
• Regular independent penetration testing by certified security professionals.

9.2 Organisational Safeguards. Access to personal data within the by888 organisation is restricted on a strict need-to-know basis. Staff who handle personal data receive regular training on data protection obligations. All employees and contractors with access to personal data are bound by confidentiality obligations.

9.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, by888 will notify affected individuals without undue delay and will take all reasonable steps to contain, investigate, and remediate the breach.

9.4 Your Responsibility. While by888 takes robust steps to protect your data, account security is a shared responsibility. You are strongly advised to use a unique, strong password for your by888 account, enable 2FA, and to log out of the platform when using shared devices.

As a by888 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our support team at [email protected]. We will respond to all verified requests within 30 days.

• Right of Access: You have the right to request a copy of all personal data that by888 holds about you, together with information about how it is processed and shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update most account information directly from your account settings page.
• Right to Erasure: In certain circumstances, you have the right to request that by888 delete your personal data. Note that this right is subject to our legal retention obligations — we cannot delete data we are legally required to retain, such as KYC records and transaction histories within their statutory retention periods.
• Right to Restriction: You have the right to request that by888 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being reviewed.
• Right to Data Portability: You may request a copy of the personal data you have provided to by888 in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to Object: You have the right to object to the processing of your personal data where by888 relies on legitimate interests as the legal basis, and where your particular circumstances mean the processing causes an undue impact on your rights.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

11.1 Minimum Age. The by888 platform is strictly intended for individuals aged 21 years or older. We do not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not use the by888 platform or provide us with any personal information.

11.2 Age Verification. by888 actively verifies the age of all players before processing their first withdrawal or granting full account access. This verification is conducted as part of our standard KYC process and may require submission of a government-issued identity document showing your date of birth.

11.3 Discovery of Underage Accounts. If by888 discovers or is informed that an account belongs to a person under the age of 21, the account will be immediately suspended, all balances will be forfeited, and any personal data collected will be securely deleted in accordance with applicable data protection law, subject only to any retention obligations required for regulatory compliance purposes.

11.4 Parental Controls. If you believe a minor in your household has accessed or registered on the by888 platform, please contact us immediately at [email protected]. We take such reports seriously and will act promptly to investigate and close any affected accounts.

12.1 Cross-Border Processing. The by888 platform and its service providers operate infrastructure in multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside of Pakistan. by888 takes steps to ensure that all such transfers are conducted in accordance with applicable data protection standards.

12.2 Transfer Safeguards. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that offered under internationally recognised standards, by888 ensures that appropriate safeguards are in place. These safeguards may include standard contractual clauses, binding corporate rules, or reliance on recognised adequacy decisions where applicable.

12.3 Payment Data Localisation. Transaction data related to JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank payments is processed in accordance with the data residency and handling requirements of each respective payment provider and applicable Pakistani financial regulations.

13.1 Right to Update. by888 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. The "Last Reviewed" date at the top of this document will be updated whenever a material change is made.

13.2 Notification of Changes. Where a change to this Privacy Policy is material — meaning it significantly affects how we collect, use, or share your personal data — by888 will notify registered players via email and/or a prominent notice on the platform at least 14 days before the change takes effect. Continued use of the by888 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.

13.3 Historical Versions. Previous versions of this Privacy Policy are available upon request by contacting our support team. We retain version history for a minimum of three years.

14.1 General Privacy Enquiries. If you have any questions, concerns, or requests relating to this Privacy Policy or the way by888 processes your personal data, please contact our dedicated privacy team:

14.2 Complaints. If you are not satisfied with how by888 has handled your personal data or responded to a data rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. by888 encourages players to contact us directly in the first instance so that we have the opportunity to address any concerns before escalation.