by777 Privacy
Policy

The data controller responsible for personal data collected through the by777 Platform is the by777 operating entity, operating the website accessible at by777.bio. References to "by777", "we", "us", or "our" throughout this Privacy Policy refer to this entity in its capacity as data controller.

As data controller, by777 determines the purposes for which and the means by which your personal data is processed. Where by777 engages third-party service providers to process data on its behalf, those providers act as data processors under binding contractual agreements that obligate them to handle your data only as instructed by by777 and in compliance with applicable data protection standards.

by777 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

by777 does not collect or store full payment card numbers, CVV codes, or bank PINs. All payment card processing is handled exclusively by PCI-DSS compliant third-party payment processors.

by777 collects personal data through the following channels:

• Direct Registration: Data you provide when creating your by777 Account, including name, date of birth, email address, and phone number.
• KYC Submission: Identity documents and proof of address submitted through the by777 verification portal during the KYC process.
• Cashier Transactions: Payment details, crypto wallet addresses, and transaction reference numbers recorded when you make deposits or request withdrawals.
• Platform Usage: Betting activity, game session data, and wagering history generated automatically as you use the by777 Platform.
• Device & Browser: Technical data including your IP address, device identifiers, and browser information collected automatically via server logs and cookies when you access by777.bio.
• Support Interactions: Communications data recorded when you contact by777 via live chat or email support.
• Responsible Gaming Tools: Preferences and history data generated when you configure or use deposit limits, self-exclusion, or session time controls within your Account settings.

by777 processes personal data for the following purposes:

1. Account Management: Creating, maintaining, and administering your by777 Account, including processing login sessions and maintaining account preferences.
2. Age & Identity Verification: Conducting KYC checks to confirm that you meet the minimum age requirement of 21 years and to verify your identity in compliance with anti-money laundering obligations.
3. Payment Processing: Facilitating deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Bitcoin, USDT, and Ethereum, and maintaining accurate transaction records.
4. Betting & Gaming Services: Providing sports betting markets (including cricket, PSL, and boxing), live casino tables, and slot games, and settling wagers accurately.
5. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, duplicate accounts, money laundering, and other prohibited conduct on the Platform.
6. Regulatory Compliance: Meeting obligations under applicable anti-money laundering, counter-terrorism financing, and gaming regulations, including record-keeping requirements.
7. Responsible Gaming: Monitoring gambling behaviour to identify potential problem gambling patterns and administering responsible gaming tools including self-exclusion requests.
8. Customer Support: Responding to Account queries, complaints, and dispute escalations submitted through live chat or email.
9. Platform Improvement: Analysing aggregated, anonymised usage data to improve the by777 Platform's features, performance, and user experience.
10. Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive marketing communications. You may opt out at any time via Account settings.

Each processing activity carried out by by777 rests on one of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and by777 — including Account management, payment processing, and bet settlement — is carried out on the basis of contractual necessity.
• Legal Obligation: KYC verification, AML record-keeping, and regulatory reporting are carried out to comply with applicable legal and regulatory obligations binding on by777.
• Legitimate Interests: Fraud detection, security monitoring, platform analytics, and responsible gaming monitoring are carried out on the basis of by777's legitimate interests in operating a secure and compliant platform, where those interests are not overridden by your data protection rights.
• Consent: Marketing communications and the use of non-essential cookies are processed on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

by777 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Personal data is shared only in the following limited circumstances:

• Payment Processors: Financial data is shared with payment service providers (including local bank partners and crypto payment gateways) solely to facilitate deposit and withdrawal transactions.
• KYC Verification Partners: Identity documents and personal data are shared with licensed third-party KYC and AML verification providers to complete the identity verification process.
• Fraud & Risk Management Services: Technical data (including IP addresses and device identifiers) may be shared with fraud prevention platforms to detect and block prohibited activity.
• Game Content Providers: Anonymised or pseudonymised gaming session data may be shared with third-party slot and live casino game providers solely for game performance and RNG certification purposes.
• Regulatory Authorities: by777 will disclose personal data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of by777's business assets, personal data held on the Platform may be transferred to the acquiring entity, subject to equivalent data protection commitments.

by777 is Pakistan's leading crypto-friendly betting platform, supporting deposits and withdrawals via Bitcoin (BTC), USDT (TRC-20 and ERC-20), and Ethereum (ETH). Players choosing crypto payment methods should be aware of the following privacy considerations specific to blockchain-based transactions:

• Blockchain transactions are recorded on a public, immutable ledger. by777 records the wallet addresses used in connection with your Account for AML compliance purposes, but by777 does not publicly disclose your wallet address or link it to your identity in any public forum.
• by777 processes crypto deposits on a non-custodial basis once confirmed on-chain. Network transaction fees and confirmation times are determined by the relevant blockchain protocol and are outside by777's control.
• Wallet addresses submitted to the by777 cashier are stored securely and used exclusively for the purposes of transaction reconciliation, AML screening, and withdrawal processing.
• by777 does not perform on-chain analysis or blockchain surveillance beyond what is required for standard AML and fraud prevention compliance.

by777 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, and accounting obligations. The following retention periods apply as a general guide:

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Self-exclusion records are the sole category of data that by777 retains permanently, to ensure that self-excluded individuals cannot re-register on the Platform.

by777 implements a multi-layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. The following technical and organisational measures are in place:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the by777 Platform is encrypted in transit using industry-standard 256-bit SSL/TLS protocols. A valid SSL certificate is maintained at all times on by777.bio.
• Encrypted Data Storage: Sensitive personal data including passwords (stored as salted hashes), KYC documents, and financial records are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within by777's systems is restricted on a strict need-to-know basis. Staff access privileges are reviewed quarterly and revoked immediately upon termination of employment.
• PCI-DSS Compliance: All payment card data is processed through PCI-DSS Level 1 compliant infrastructure. by777 does not store raw card numbers or CVV codes on its servers.
• Two-Factor Authentication: Players are strongly encouraged to enable two-factor authentication (2FA) on their by777 Accounts. by777 staff accounts with access to personal data require mandatory 2FA.
• Intrusion Detection & Monitoring: by777's infrastructure is monitored 24/7 for anomalous access patterns, brute-force attempts, and other security threats using automated intrusion detection systems.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights, by777 will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data protection obligations.

by777 uses cookies and similar tracking technologies on the by777.bio website. Cookies are small text files stored on your device that help by777 deliver a functional, personalised, and secure platform experience.

You can manage your cookie preferences through your browser settings. Disabling essential cookies will impair Platform functionality. Consent for optional cookies may be withdrawn at any time via the cookie preference centre accessible in the Platform footer.

Subject to applicable data protection law and any overriding legal obligations, you hold the following rights in respect of your personal data held by by777:

• Right of Access: You may request a copy of all personal data by777 holds about you. by777 will respond to verified subject access requests within 30 days.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your Account. Minor corrections (such as address updates) can be made directly through Account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to by777's legal retention obligations — financial and KYC records cannot be erased before the end of their mandatory retention periods.
• Right to Restriction: You may request that by777 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing.
• Right to Data Portability: You may request a copy of personal data you have provided to by777 in a structured, commonly used, machine-readable format (such as CSV), where processing is based on consent or contractual necessity.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. by777 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (such as marketing communications), you may withdraw consent at any time via Account settings or by contacting support. Withdrawal does not affect the lawfulness of prior processing.

The by777 Platform is strictly intended for individuals aged 21 years and above. by777 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process prior to withdrawal processing and may be requested at any point during the Account lifecycle.

If by777 discovers or is notified that personal data has been collected from an individual who is under 21 years of age, by777 will:

• Immediately suspend the relevant Account pending investigation.
• Void any wagers placed and return any real-money deposits to the payment method used, net of any winnings generated (which will be forfeited).
• Permanently delete all personal data collected from the underage individual, subject to any overriding regulatory retention obligations.

by777 serves players primarily in Pakistan and processes the majority of personal data within its secure hosted infrastructure. However, certain third-party service providers engaged by by777 — including KYC verification partners, fraud prevention platforms, and game content providers — may be located in jurisdictions outside Pakistan.

Where personal data is transferred to a third-party service provider located outside Pakistan, by777 ensures that appropriate safeguards are in place to protect the data, including:

• Standard contractual clauses or data processing agreements that bind the recipient to data protection standards equivalent to those applied by by777.
• Transfers only to jurisdictions or recipients that by777 has assessed as providing an adequate level of data protection.
• Restriction of transferred data to the minimum necessary for the specific service being provided.

by777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or by777's data processing practices. Where changes are material, by777 will notify registered Players via email or a prominent notice on the Platform at least 14 days prior to the changes taking effect.

The "Last Updated" date at the top of this Privacy Policy reflects the date on which the most recent version came into effect. Continued use of the by777 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

by777 recommends that you review this Privacy Policy periodically to stay informed of how your personal data is being protected. Archived versions of prior Privacy Policy documents are available upon written request to the by777 privacy team.

For all privacy-related enquiries, data rights requests, or complaints regarding by777's handling of your personal data, please contact the by777 privacy team using the details below. by777 aims to respond to all privacy-related correspondence within 5 business days.