by777 Privacy Policy — How We Collect, Use and Protect Your Personal Data

1Scope & Data Controller

This Policy covers all personal data processed by by777 in connection with the operation of the by777 online casino and sports betting platform, including account management, financial transactions, gameplay activity, customer support interactions, and marketing communications where consent has been given. by777 acts as the data controller for all personal information collected directly through the platform. Third-party service providers integrated with the platform — including payment processors such as JazzCash, EasyPaisa, HBL, UBL and Meezan Bank, and game providers including EVO Live — are independent data controllers in respect of data they collect directly through their own services.

2Data We Collect

by777 collects personal data at multiple touchpoints across the player lifecycle. The categories of personal data collected include:

• Registration Data: Full name, date of birth, Pakistani mobile number, email address, residential city, and a username of your choosing.
• Identity Verification (KYC) Data: CNIC number, CNIC front and back scan or photograph, selfie with CNIC, and any supplementary identity document requested during enhanced due diligence.
• Financial Data: JazzCash or EasyPaisa mobile wallet number, bank account details supplied for withdrawal, transaction history, deposit amounts, withdrawal amounts, and bonus activity.
• Technical Data: IP address, device type and operating system, browser type and version, session timestamps, login history, and geolocation data at the city level.
• Gameplay Data: Games played, bet amounts, game outcomes, session duration, responsible gaming tool usage, and betting history in the sportsbook.
• Communications Data: Support chat transcripts, email correspondence with by777, and records of any complaint or dispute raised by or against the account holder.

3How We Use Your Personal Data

by777 uses your personal data for the following specific purposes:

• To create, manage and secure your by777 player account, including authentication, session management and two-factor verification.
• To process deposits, withdrawals, bonus allocations and related financial transactions in PKR through supported Pakistani payment channels.
• To verify your identity and age (21+) in accordance with our KYC obligations and to prevent fraud, money laundering and the use of the platform by persons under the permitted age.
• To provide and improve customer support, resolve disputes and respond to account queries submitted through any support channel.
• To comply with applicable regulatory, anti-money laundering (AML), and responsible gaming obligations imposed on the platform by its licensing framework.
• To send transactional communications including deposit confirmations, withdrawal processing updates, security alerts and account notices.
• To send marketing and promotional communications, including bonus offers and platform updates, where you have expressly opted in to receive such communications.
• To monitor gameplay patterns for the purposes of responsible gaming intervention, fraud detection and platform integrity.

4Legal Basis for Processing

by777 processes your personal data on the following legal bases:

• Contract Performance: Processing necessary to operate your player account and deliver the services you have registered to receive.
• Legal Obligation: Processing required to meet KYC, AML, age verification and regulatory reporting requirements under the by777 licensing framework.
• Legitimate Interest: Processing carried out to protect the security and integrity of the platform, prevent fraud, and improve service quality through gameplay analytics.
• Consent: Processing of data for optional marketing communications and cookies beyond functional necessity, where you have provided clear, affirmative consent.

5Data Sharing

by777 does not sell, rent or trade your personal data to any third party for their own marketing or commercial use. by777 shares personal data only in the following limited circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank and other payment partners receive only the transaction data necessary to process deposits and withdrawals.
• Game Providers: Third-party game studios, including EVO Live, receive a player session token and bet data necessary to operate the game. They do not receive full registration or financial account details.
• Identity Verification Partners: Where a third-party KYC service is used to verify CNIC documents, that service receives only the identity documents necessary to complete verification.
• Regulatory and Law Enforcement Authorities: by777 will disclose personal data to competent authorities where required by applicable law, court order, or regulatory directive, and only to the extent required by that legal obligation.

6Cookies & Tracking Technologies

by777 uses cookies and similar tracking technologies to operate the platform, maintain login sessions, remember your preferences, detect fraudulent activity and analyse usage patterns. Cookies used on by777 fall into the following categories:

• Essential Cookies: Required for the platform to function. These include session authentication cookies and security tokens. They cannot be disabled without preventing login.
• Functional Cookies: Remember your language or display preferences between sessions.
• Analytics Cookies: Collect aggregated, anonymised data on how players navigate the platform, helping us identify and fix areas of friction in the user experience.
• Marketing Cookies: Used only where you have opted in to marketing communications. These track whether you have opened a promotional email or clicked through to the platform from a notification.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing your by777 account, but may affect the functionality of certain platform features.

7Data Retention

by777 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and the by777 licensing framework. As a general principle:

• Active account data is retained for the lifetime of the account and for a minimum of five years following account closure, to satisfy AML and regulatory record-keeping requirements.
• KYC identity documents are retained for a minimum of five years from the date of verification, in line with standard anti-money laundering practice.
• Financial transaction records are retained for a minimum of five years from the date of each transaction.
• Support communications are retained for up to three years from the date of the last interaction, unless a dispute remains unresolved.
• Marketing consent records are retained indefinitely until consent is withdrawn, at which point the record of withdrawal is kept for a minimum of two years.

8Security Measures

by777 implements a layered security framework to protect your personal data against unauthorised access, disclosure, alteration or destruction. Technical and organisational measures in place include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the by777 platform.
• Encrypted storage of all sensitive account and financial data on access-controlled servers.
• Two-factor authentication available on all by777 accounts, and enabled by default for new registrations.
• Automated anomaly detection on login and financial transactions, flagging unusual activity for manual security review.
• Strict internal access controls limiting staff access to personal data to those with a specific operational need.
• Regular third-party security audits of the platform infrastructure and data handling practices.

While by777 takes every reasonable precaution to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for keeping your account password and two-factor authentication credentials confidential and for logging out of your account after each session, particularly on shared devices.

9Your Data Rights

As a by777 player, you hold the following rights in relation to your personal data, which you may exercise at any time by contacting by777 support:

• Right of Access: You may request a copy of all personal data held about you by by777 at any time.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held on your account.
• Right to Erasure: You may request deletion of your personal data, subject to by777's legal obligations to retain certain records under AML and regulatory frameworks.
• Right to Restriction: You may request that by777 limit the processing of your data in certain circumstances, such as during the resolution of an accuracy dispute.
• Right to Object: You may object to processing based on legitimate interest, and you may withdraw consent for marketing communications at any time.
• Right to Data Portability: You may request a structured, machine-readable copy of your personal data for transfer to another service where technically feasible.

by777 will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days with written notification to you. All requests must be submitted via the support email address with sufficient identity verification to confirm the request is made by the account holder.

10Children & Minors

by777 does not knowingly collect personal data from any individual under the age of 21. The platform is intended exclusively for verified adults. If by777 becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended, all associated funds will be held pending investigation, and the personal data of the minor will be deleted once the investigation is concluded. Parents or guardians who believe a minor has accessed by777 should contact support immediately using the email address in Section 13.

11International Data Transfers

by777 may transfer personal data to service providers and infrastructure partners operating outside of Pakistan, including to data centres and cloud infrastructure providers located in jurisdictions with established data protection frameworks. Where personal data is transferred internationally, by777 ensures that appropriate safeguards are in place, including data processing agreements with receiving parties that impose data protection standards consistent with those applied within the by777 platform. Players will not be directly affected by the location of data processing and all rights described in Section 9 apply regardless of where data is physically stored.

12Changes to This Policy

by777 reserves the right to update this Privacy Policy at any time to reflect changes in data practices, platform features, or applicable legal requirements. When material changes are made, by777 will notify registered players through an on-site notice or via the contact details associated with your account prior to the changes taking effect. The date at the top of this Policy will always reflect the most recent revision. Continued use of by777 following notification of a revised Privacy Policy constitutes acceptance of the updated terms.