Privacy Policy — How y887 Collects, Uses, and Protects Your Personal Data

1. Introduction

1.1 y887 is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Policy sets out the types of personal data we collect, the purposes for which we collect and use that data, the conditions under which we may share it with third parties, and the rights available to you as a data subject.

1.2 y887 operates the online casino and sports betting platform accessible at y887.io, serving players based in Bangladesh. We recognise our responsibility to handle personal data with transparency, care, and strict security controls appropriate to the nature of the financial and identity information entrusted to us by our players.

1.3 This Policy applies to all personal data collected through the y887 website, any mobile-optimised browser interface, customer support communications, KYC submissions, payment transactions, and promotional interactions. It does not apply to third-party websites or services that may be linked from the y887 platform — those are governed by their own privacy policies.

2. Data Controller

2.1 For the purposes of this Privacy Policy, the data controller responsible for your personal data is the operator of the y887 platform. All enquiries regarding the processing of your personal data, requests to exercise your data rights, and privacy-related complaints should be directed to the y887 data protection contact at: [email protected]

2.2 When you contact us regarding a data-related matter, please include your registered username, the email address associated with your y887 account, and a clear description of your request. This enables us to locate your records promptly and respond within our target timeframe of 30 calendar days.

3. Personal Data We Collect

3.1 The categories of personal data y887 collects, and the specific data points within each category, are described in the table below:

3.2 y887 does not collect or store sensitive data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data beyond photographic identity documents, or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request. Such disclosures are handled with the strictest confidentiality.

4. How We Collect Your Data

4.1 Directly from You. The majority of personal data y887 holds is provided directly by you during account registration, the KYC verification process, deposit and withdrawal requests, customer support interactions, and promotional opt-ins.

4.2 Automatically via Technology. When you visit y887.io or use the platform, certain technical and usage data is collected automatically through server logs, session cookies, and analytics tools. This includes your IP address, device identifiers, browser information, and gameplay behaviour. See Section 9 (Cookies and Tracking) for further detail.

4.3 From Payment Service Providers. When you process a transaction via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, y887 receives transaction confirmation data from the respective payment provider, including transaction reference numbers, amounts, and timestamps. Full payment credentials (mobile wallet PINs, card CVV numbers) are never transmitted to y887.

4.4 From Identity Verification Partners. Where y887 uses third-party KYC verification services to authenticate identity documents, those services may return verification results and flagged risk indicators to y887. The underlying document images are processed in accordance with the third-party provider's own privacy obligations.

4.5 From Fraud Prevention Services. y887 may receive risk signals and device fingerprint assessments from fraud detection partners to protect the platform against account takeovers, payment fraud, and multi-accounting abuse.

5. How We Use Your Personal Data

5.1 y887 uses the personal data described in Section 3 for the following specific purposes:

• Account Creation and Management: To register your account, maintain accurate account records, process password resets, and manage account settings and preferences.
• Identity and Age Verification: To confirm that you are at least 21 years of age and that the personal details you have provided are accurate and complete, as required prior to enabling real-money features.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; to maintain transaction records; and to investigate disputed or failed transactions.
• Game and Betting Services: To operate all casino games, live dealer tables, and sports betting markets; to record bet outcomes; and to calculate and credit winnings to your account balance.
• Bonus and Promotion Administration: To credit eligible bonuses, track wagering requirement progress, manage promotional campaigns including BPL, IPL, and T20 betting promotions, and prevent bonus abuse.
• Customer Support: To respond to enquiries, investigate complaints, resolve disputes, and maintain a record of support interactions for quality assurance purposes.
• Fraud and Security Monitoring: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, unauthorised access, and other prohibited conduct described in our Terms & Conditions.
• Legal and Regulatory Compliance: To fulfil anti-money-laundering record-keeping obligations, respond to lawful requests from competent authorities, and maintain records required by applicable financial regulations.
• Platform Improvement: To analyse anonymised usage patterns, game performance data, and platform behaviour to improve the quality, reliability, and range of features available on y887.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, administer self-exclusion and deposit limit requests, and deliver responsible gaming communications where appropriate.
• Marketing Communications: To send you promotional emails or SMS messages about new games, seasonal offers (such as Eid, Pohela Boishakh, and BPL promotions), and special bonuses — but only where you have opted in to receive such communications and in accordance with your current marketing preferences.

5.2 y887 does not use personal data for automated decision-making that produces legal or similarly significant effects without human oversight, except in the limited context of automated fraud risk scoring. Where automated fraud scoring results in an account action, a human review is conducted before any permanent account restriction is applied.

6. Legal Basis for Processing

6.1 y887 processes your personal data on the following legal bases:

• Contract Performance: Processing necessary to fulfil our obligations to you under the y887 Terms & Conditions, including account management, payment processing, and game operation.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money-laundering regulations, age verification obligations, and financial record-keeping duties.
• Legitimate Interests: Processing carried out for y887's legitimate business interests, including fraud prevention, platform security, product analytics, and responsible gaming monitoring, where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your explicit consent, specifically the sending of direct marketing communications. You may withdraw your consent to marketing communications at any time by contacting [email protected] or adjusting your account notification preferences.

7. Data Sharing and Third-Party Disclosure

7.1 y887 does not sell, rent, or trade your personal data to any third party. We share personal data only in the limited circumstances described below:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and card processing partners receive the minimum transaction data necessary to process your deposits and withdrawals. These providers are contractually bound to use your data solely for payment processing purposes.
• KYC and Identity Verification Partners: Third-party identity verification services receive identity document data solely to perform age and identity verification checks on behalf of y887.
• Fraud Detection Services: Fraud prevention partners may receive device and behavioural data to assess risk signals and protect the integrity of the y887 platform.
• Game Technology Providers: Certified game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi operate their game software on the y887 platform. These providers may receive session identifiers and bet data necessary to operate their games but do not receive your full identity or contact data.
• Legal and Regulatory Authorities: y887 will disclose personal data to competent law enforcement agencies, courts, or regulatory bodies where required by a lawful order, court subpoena, or applicable legal obligation. y887 will notify affected players of such disclosures where legally permitted to do so.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by y887 may access personal data on a strictly need-to-know basis subject to confidentiality obligations.

7.2 All third-party service providers with whom y887 shares personal data are required by contract to implement appropriate technical and organisational security measures and to process personal data only in accordance with y887's written instructions.

8. Payment Data and Financial Security

8.1 y887 does not store full payment card numbers, card verification values (CVV), mobile wallet PINs, or mobile banking passwords on its own servers at any point. All sensitive payment credentials are handled exclusively by the relevant payment service provider (bKash, Nagad, Rocket, Upay, Visa processing network, or Mastercard processing network) within their own PCI-DSS compliant environments.

8.2 y887 retains transaction records — including deposit amounts in BDT (৳), withdrawal amounts, transaction reference numbers, timestamps, and the last four digits of a registered card or the registered mobile wallet number — solely for the purpose of account reconciliation, dispute resolution, and financial record-keeping compliance.

8.3 Where a withdrawal is requested to a mobile wallet or bank card, y887 will verify that the destination account is registered in the same name as the y887 account holder. This name-matching check is a financial security control designed to prevent unauthorised fund diversion and is not used for any other purpose.

9. Cookies and Tracking Technologies

9.1 y887 uses cookies and similar tracking technologies on the y887.io platform. Cookies are small text files stored on your device that help the platform function correctly, remember your preferences, maintain your login session, and collect anonymised usage analytics.

9.2 Categories of Cookies Used by y887

• Essential Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your account preferences such as display settings and notification preferences so that you do not need to re-configure them on each visit.
• Analytics Cookies: Collect anonymised data about how players navigate the platform — which games are most visited, which pages generate the highest exit rates, and how long sessions last. This data is used solely to improve the y887 platform and is not linked to individual player identities.
• Fraud Prevention Cookies: Generate a device fingerprint that assists our fraud detection systems in identifying suspicious login attempts and multi-accounting behaviour. These are essential security cookies and cannot be disabled.

9.3 y887 does not use third-party advertising cookies or behavioural targeting cookies. No cookie data is shared with advertising networks or social media platforms for retargeting purposes.

9.4 You may manage or delete cookies through your browser settings at any time. Note that disabling essential or fraud prevention cookies may prevent you from logging in or using certain platform features.

10. Data Security Measures

10.1 y887 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS/SSL encryption on all data transmissions between player devices and y887 servers.
• Encrypted storage of passwords using industry-standard hashing algorithms. y887 does not store plaintext passwords.
• Role-based access controls limiting internal access to personal data to authorised personnel with a documented business need.
• Regular security assessments and vulnerability scans of the y887 platform infrastructure.
• Two-factor authentication (2FA) options available to players for enhanced account login security.
• Automated monitoring for unusual login activity, including logins from new devices, multiple failed login attempts, and logins from unexpected geographic locations.
• Regular staff training on data handling obligations and information security best practices.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, y887 will notify affected players without undue delay, providing details of the nature of the breach, the categories of data affected, and the steps y887 is taking to address the breach and mitigate its potential impact.

11. Data Retention

11.1 y887 retains personal data for the periods set out below, after which data is securely deleted or anonymised:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, to satisfy anti-money-laundering record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following completion of the KYC verification process or account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction.
• Customer Support Communications: Retained for three (3) years following the resolution of the relevant support interaction or complaint.
• Usage and Analytics Data: Anonymised after two (2) years. Anonymised data does not constitute personal data and is retained indefinitely for aggregate platform analytics purposes.
• Marketing Preferences: Retained until you withdraw your consent to marketing communications or until your account is permanently closed, whichever occurs first.

11.2 Where data is retained beyond the periods above due to an active legal dispute, regulatory investigation, or law enforcement request, y887 will retain the relevant data until the matter is resolved and will not use such data for any other purpose during that period.

12. Your Data Rights

12.1 As a data subject, you have the following rights in relation to the personal data y887 holds about you:

• Right of Access: You may request a copy of all personal data y887 holds about you. We will respond within 30 calendar days of a verified request.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete. Minor account details such as contact information can be updated directly within your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Note that y887 is legally obliged to retain certain categories of data (identity records, financial records) for the minimum periods described in Section 11, and erasure requests cannot override those obligations.
• Right to Restriction of Processing: You may request that y887 restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is being contested or while an objection to processing is being assessed.
• Right to Data Portability: You may request a copy of the personal data you have provided to y887 in a structured, commonly used, and machine-readable format.
• Right to Object: You may object at any time to processing of your personal data for direct marketing purposes. Upon receipt of an objection to marketing, y887 will cease all direct marketing communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

12.2 To exercise any of the rights above, please submit your request in writing to [email protected] from the email address registered to your y887 account. Include your full name, registered username, and a clear description of the right you wish to exercise. y887 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

12.3 y887 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive, in which case y887 may charge a reasonable administrative fee or decline to act on the request, providing written reasons for that decision.

13. Minors and Age Policy

13.1 The y887 platform is strictly for individuals aged 21 years and above. y887 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the y887 KYC process, and account registration cannot be completed without confirmation that the player meets the 21+ age requirement.

13.2 If y887 discovers or is notified that personal data has been collected from an individual under the age of 21, all data associated with that individual's account will be immediately and permanently deleted, any funds deposited will be returned to the originating payment method, and the account will be permanently closed.

13.3 If you believe that a minor has registered an account on y887 or that personal data of a minor is being processed by y887, please notify us immediately at [email protected]. We will investigate and take appropriate remedial action without delay.

14. Changes to This Privacy Policy

14.1 y887 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, platform features, legal obligations, or applicable regulations. Where amendments are material — meaning they significantly affect how your personal data is used or your rights as a data subject — y887 will provide registered players with at least 14 days' advance notice by email or in-platform notification before the changes take effect.

14.2 Minor amendments such as corrections of typographical errors, clarifications of existing provisions, or updates to contact information may take effect immediately upon publication on the y887 platform.

14.3 The current version of this Privacy Policy is always accessible at y887.io/privacy-policy. The "Last Updated" date at the top of this page reflects when the most recent version took effect. We encourage you to review this Policy periodically to stay informed about how y887 protects your data.

14.4 Your continued use of the y887 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept the amended Policy, please cease using the platform and contact [email protected] to request account closure.

15. Contact Us

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which y887 processes your personal data, please contact our support team using the details below. We are available 24 hours a day, 7 days a week, and aim to acknowledge all privacy-related enquiries within 24 hours and provide a substantive response within 30 calendar days.

Email (plain text — not a clickable link): [email protected]

15.2 When submitting a privacy enquiry, please include your registered username and the email address associated with your y887 account so that we can locate your records and respond accurately. For requests relating to the exercise of data rights under Section 12, please specify clearly which right you wish to exercise.

15.3 y887 takes all privacy concerns seriously. If you are not satisfied with our response to a privacy complaint, you may escalate your concern to the appropriate data protection authority in your jurisdiction.