Privacy Policy

This Privacy Policy ("Policy") describes how oy888 ("we", "us", "our", "the Platform") collects, processes, stores, shares and protects the personal data of individuals ("you", "the User", "the Player") who access or use the oy888 website and associated services available at https://oy888.cam.

This Policy forms part of the agreement between you and oy888 and should be read in conjunction with the Terms & Conditions. By registering an account, making a deposit, placing a bet or otherwise using the Platform, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein.

oy888 is an English-language platform operated for users who access it in the English language. Platform content is written in English and amounts are displayed in PKR (Pakistani Rupees). This Policy is likewise written in English. Urdu language assistance is available through customer support on request.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

oy888 acts as the data controller in respect of personal data collected through and in connection with the Platform. As data controller, oy888 determines the purposes for which personal data is processed and the means by which that processing takes place.

Where oy888 engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers and hosting infrastructure providers — those parties act as data processors under contractual obligations that require them to process data only on oy888's documented instructions and to maintain appropriate security measures.

For all data-related enquiries, requests to exercise your rights, or concerns about how your data is handled, please contact oy888 using the details provided in Section 15 of this Policy.

oy888 collects personal data from Users through the following mechanisms and in the following categories:

4.1 Data Provided Directly by You

• Registration data: Full name, date of birth, email address, residential address, username and password.
• KYC documentation: Copy of government-issued identity document (e.g., CNIC, passport), proof of address, and where required, proof of payment method.
• Payment data: Bank account details, mobile wallet references and transaction amounts submitted to facilitate deposits and withdrawals. Full payment card numbers are not stored by oy888 — card processing is handled by certified payment processors.
• Support communications: Content of messages, emails or live-chat transcripts submitted to the oy888 support team.
• Responsible gambling data: Limit settings, cooling-off requests and self-exclusion instructions submitted by you.

4.2 Data Collected Automatically

• Device data: Device type, operating system version, browser type, screen resolution and device identifiers.
• Network data: IP address, approximate geographic location derived from IP address, and internet service provider information.
• Usage data: Pages visited, session duration, buttons clicked, game titles accessed, bet amounts placed and wagering history.
• Cookie and tracking data: Session cookies, preference cookies and analytics data as described in Section 7.

4.3 Data Received from Third Parties

• Identity verification services: Confirmation of identity document authenticity and age verification results from third-party KYC providers.
• Fraud and risk screening: Risk scores and flagged indicators from third-party fraud prevention services.
• Payment processors: Transaction status confirmations and charge-back notifications from payment service providers.

oy888 processes personal data only where there is a lawful basis for doing so. The following table sets out the primary purposes of processing and the corresponding legal basis:

oy888 does not sell, rent or trade your personal data to third parties for their own commercial purposes. Your data may be shared in the following limited circumstances:

• Service providers acting as data processors: Third-party providers who assist in operating the Platform, including payment processors, cloud hosting providers, KYC/identity verification services and customer support platform providers. These parties are bound by data processing agreements and may not use your data for their own purposes.
• Regulatory and law-enforcement authorities: Where oy888 is required by applicable law, court order or regulatory instruction to disclose personal data to a competent authority, we will comply with that obligation. Where legally permissible, we will notify you of such a disclosure.
• Fraud prevention and risk management networks: Where necessary to prevent or detect fraud, money laundering or other unlawful activity, information may be shared with relevant industry fraud-prevention bodies.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial portion of oy888's assets, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and any material change to data handling practices.

Payment method names referenced on the Platform — including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are cited as familiar payment context for Pakistani users only. None of these providers receive your personal data from oy888 unless they are the specific payment processor handling your transaction and only to the extent necessary for that transaction.

oy888 uses cookies and similar tracking technologies to operate the Platform, remember your preferences and analyse usage patterns. The categories of cookies used are as follows:

You may manage your cookie preferences through your browser settings or through any cookie preference tool provided on the Platform. Disabling non-essential cookies will not prevent you from using the Platform's core features.

oy888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory and compliance retention requirements. Key retention principles include:

• Active Account data is retained for the duration of your Account's active status plus any legally required post-closure retention period.
• KYC and identity verification records are retained for a minimum period following Account closure as required by the operator's applicable compliance framework. This is typically five to seven years, or longer if required by a regulatory authority.
• Transaction records are retained for a minimum period to satisfy financial reporting and anti-money laundering obligations.
• Support communications are retained for a reasonable period to assist with follow-up enquiries and quality review.
• Self-exclusion records are retained for the duration of the exclusion period and a further reasonable period thereafter to prevent re-registration during the exclusion term.

Data that is no longer required and is not subject to a legal retention obligation will be securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

oy888 implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include:

• Encryption of data in transit using industry-standard TLS/SSL protocols.
• Encryption of sensitive data at rest within our storage infrastructure.
• Restricted access controls ensuring that personal data is accessible only to authorised personnel with a documented operational need.
• Regular review of access permissions and revocation of access upon role changes or staff departures.
• Ongoing monitoring of systems for anomalous activity or potential security incidents.
• Third-party processors are required to maintain security standards commensurate with the sensitivity of the data they handle on our behalf.

The operation of oy888 may involve the transfer of personal data to countries or jurisdictions outside your country of residence, including to countries where data protection laws may differ from those in your jurisdiction.

Where personal data is transferred to third-party processors located outside the jurisdiction in which it was collected, oy888 takes reasonable steps to ensure that appropriate contractual protections are in place. These may include standard contractual clauses, binding corporate rules or other transfer mechanisms recognised under applicable data protection frameworks.

By using the oy888 Platform, you acknowledge that your personal data may be processed in jurisdictions other than your own. If you have concerns about international data transfers, please contact us using the details in Section 15.

Subject to applicable law and the specific circumstances of your request, you may have the following rights in respect of your personal data held by oy888:

The oy888 Platform is strictly available to adults aged 18 years and above, or the higher minimum age required by the operator's licence jurisdiction. The Platform is not intended for use by minors and oy888 does not knowingly collect or process personal data relating to individuals under the applicable minimum age.

Age verification is conducted as part of the KYC process. Accounts where there is a reasonable indication that the holder does not meet the minimum age requirement will be suspended and any balance held pending investigation. If a minor has accessed the Platform, we ask that the responsible adult contact us immediately at the address in Section 15 so that the Account can be closed and data deleted.

oy888 may send promotional and marketing communications to registered Users. You may receive marketing communications by email, SMS or in-platform notification, depending on the preferences set on your Account.

Marketing communications are sent on the basis of either your explicit opt-in consent or, where applicable, oy888's legitimate interest in informing existing Users about relevant promotions, features and offers. You have the right to withdraw consent or opt out of marketing communications at any time by:

• Adjusting your communication preferences in your Account settings.
• Clicking the unsubscribe link in any marketing email you receive from oy888.
• Contacting customer support directly at the address provided in Section 15.

Opting out of marketing communications does not affect the receipt of transactional or service communications, such as deposit confirmations, withdrawal notifications or security alerts, which are sent on the basis of your contract with oy888 and cannot be opted out of while your Account is active.

Users who have completed the self-exclusion process will be removed from all marketing communications as part of the exclusion procedure, without a separate opt-out request being required.

oy888 reserves the right to update or amend this Privacy Policy at any time. The "Last Updated" date at the top of this page will be revised whenever material changes are made. Where changes are significant, oy888 will provide prominent notice on the Platform and, where reasonably practicable, notify you by email to the address registered on your Account.

Your continued use of the Platform after the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should cease using the Platform and request that your Account be closed.

We recommend reviewing this Policy periodically to stay informed about how oy888 handles your personal data. Previous versions of this Policy are available on request from our support team.

If you have any questions about this Privacy Policy, wish to exercise a data right, raise a concern about how your personal data has been handled, or wish to withdraw consent for any processing activity, please contact the oy888 data team:

Please include your registered Account email address and a clear description of your request when contacting us. We may need to verify your identity before processing a data rights request to ensure we do not disclose or modify data in response to an unauthorised request.