y27s Privacy Policy

y27s operates an online sports betting and casino gaming platform available at y27s.io, serving players across Bangladesh. As part of operating this platform, y27s necessarily collects and processes certain personal information about the players who use our services.

This Privacy Policy sets out in clear, formal terms the categories of personal data y27s collects, the lawful bases on which we process that data, the purposes for which it is used, how long it is retained, with whom it may be shared, and the rights available to you as the data subject.

This policy should be read alongside the y27s Terms & Conditions and the Responsible Gaming Policy, which together form the complete contractual and compliance framework governing your relationship with y27s. Where any conflict arises between this Privacy Policy and the Terms & Conditions, the Terms & Conditions shall prevail except in matters that are exclusively governed by data protection obligations, where this policy shall take precedence.

For the purposes of this Privacy Policy, y27s acts as the data controller in respect of the personal information collected through y27s.io and its associated services. As data controller, y27s is responsible for determining the purposes and means by which your personal data is processed.

All data-related enquiries, access requests, correction requests, and complaints should be directed to the y27s Data Protection contact point. Contact details are provided in Section 15 of this policy. y27s commits to acknowledging all formal data-related requests within five (5) business days of receipt and resolving them within thirty (30) calendar days, or within any shorter period required by applicable law.

y27s collects personal data across several categories, depending on the nature of your interaction with the platform. The following table summarises the main categories of data collected:

y27s does not collect sensitive personal data such as religious beliefs, political opinions, racial or ethnic origin, or health data except where directly relevant to a responsible gaming assessment or legal obligation, and only with your explicit consent in those circumstances.

y27s collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing identity verification (KYC), making a deposit or withdrawal request, contacting support, or filling in any form on the platform.
• Automated technical collection: Data collected automatically when you access y27s.io, including IP addresses, device identifiers, browser fingerprints, and session activity logs gathered via server logs, cookies, and similar tracking technologies.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, and Upay when you initiate a financial transaction. y27s receives confirmation of payment completion but does not store your full mobile wallet credentials.
• Game and betting providers: Session and outcome data passed from third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, which is necessary for account crediting, dispute resolution, and game history records.
• Anti-fraud and compliance services: Risk signals and verification data from third-party identity and fraud detection providers used to protect the integrity of the platform and comply with anti-money laundering obligations.

y27s processes personal data only where a lawful basis exists for doing so. The following table sets out the primary purposes of processing and the corresponding legal basis in each case:

Where processing is based on your consent — particularly for marketing communications and personalised promotions — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent can be effected via your account settings or by contacting support at [email protected].

y27s does not sell, rent, or trade your personal data to any third party. We share personal data only in the following limited and defined circumstances:

• Payment processors (bKash, Nagad, Rocket, Upay): Transactional data is shared with your chosen payment provider solely to execute deposit and withdrawal instructions. These providers operate under their own privacy policies and are independently responsible for data they hold in their own systems.
• Game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi): Session identifiers and betting data are shared with game providers to deliver game content, record outcomes, and support dispute resolution. These providers act as data processors under agreements with y27s.
• Identity verification and KYC providers: Where document verification is required, your identity documents and photograph may be processed by a third-party KYC platform operating under a data processing agreement with y27s. All such processors are bound by strict data handling obligations.
• Fraud detection and anti-money laundering services: Risk signals, device fingerprints, and transaction patterns may be shared with fraud prevention partners to detect suspicious activity and protect the integrity of the platform.
• Legal and regulatory authorities: y27s may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, legal process, or to protect the rights, property, or safety of y27s, its players, or the public.
• Business continuity: In the event of a merger, acquisition, or sale of all or part of y27s's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections and notification to affected players where required.

y27s uses cookies and similar tracking technologies to operate the platform, maintain session continuity, prevent fraud, analyse usage patterns, and personalise your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, preferred game view, and responsible gaming tool settings across sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate y27s.io, which pages are most visited, and where technical errors occur. This data is used solely to improve platform performance.
• Fraud Prevention Cookies: Device fingerprinting identifiers used to detect unauthorised account access, multiple-account creation, and automated bot activity.

y27s does not use third-party advertising cookies or retargeting pixels to serve y27s advertisements on external websites. You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use core platform features.

y27s implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key security measures in place include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and y27s servers.
• Salted password hashing using industry-standard cryptographic algorithms. Passwords are never stored or transmitted in plain text.
• SMS OTP two-factor authentication available for all accounts and strongly recommended for all registered players.
• Access controls limiting internal access to personal data to authorised y27s personnel on a strict need-to-know basis, with activity logging for audit purposes.
• Regular security assessments including vulnerability scanning and penetration testing of platform infrastructure.
• Incident response procedures designed to contain, investigate, and remediate any data security incident, with notification to affected players within 72 hours of a confirmed breach where required.

y27s retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or for as long as required to meet legal, regulatory, and compliance obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual. Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes without restriction.

As a data subject, you hold the following rights with respect to personal data that y27s holds about you. These rights may be exercised by contacting [email protected] with the subject line "Data Rights Request" and providing sufficient information to verify your identity:

• Right of Access: You may request a copy of the personal data y27s holds about you, along with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data held by y27s be corrected or completed without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where you have objected to processing and no overriding legitimate grounds exist. This right is subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that y27s restrict processing of your data in certain circumstances, such as while the accuracy of data is being contested or a legitimate interest objection is being assessed.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing based on legitimate interests, including profiling, unless y27s can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

y27s will respond to all rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further two months, in which case y27s will notify you of the extension and the reason within the initial thirty-day period.

y27s may send you promotional communications, including bonus offers, tournament announcements, seasonal promotions (such as those tied to BPL, IPL, T20 World Cup, Eid, or Pohela Boishakh), and other marketing messages, where you have provided explicit consent to receive such communications at the time of registration or through your account settings.

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences within your y27s account, or by contacting support at [email protected]. Upon receipt of a valid opt-out request, y27s will cease sending marketing messages within five (5) business days. Please note that withdrawing marketing consent does not affect your receipt of essential service communications such as transaction confirmations, security alerts, or account notifications, which are sent on the basis of contractual necessity rather than consent.

y27s does not conduct cold marketing outreach to individuals who have not registered an account. We do not purchase marketing lists or send unsolicited promotional messages to non-players.

The y27s platform may contain references to third-party services such as game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and payment platforms (bKash, Nagad, Rocket, Upay). Where links to or integrations with third-party services exist, those services operate under their own independent privacy policies and data practices.

y27s is not responsible for the privacy practices, security standards, or content of third-party services. We recommend that you review the privacy policy of any third-party service you interact with directly. The inclusion of any third-party service provider within the y27s platform does not constitute an endorsement of their privacy practices beyond the scope of the data processing agreements in place between y27s and those providers.

The y27s platform is strictly intended for adults aged 21 years and above. y27s does not knowingly collect, process, or retain personal data from individuals under the age of 21. The platform's registration process includes an age declaration and y27s conducts identity verification to enforce this requirement.

If y27s becomes aware that personal data has been collected from an individual who is under 21 years of age, that account will be closed immediately, all associated data will be deleted as soon as practicable, and any deposits received will be handled in accordance with applicable legal requirements. If you are a parent or guardian and believe that a minor has registered an account on y27s, please contact us immediately at [email protected].

y27s reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data practices, the services we offer, applicable legal requirements, or feedback from players. The "Effective Date" displayed at the top of this document indicates when the current version was last updated.

Where changes are material — meaning they affect your rights, the categories of data collected, or the purposes for which your data is used — y27s will notify registered players via the platform notification system or by email to your registered address at least seven (7) days before the changes take effect.

For non-material changes such as typographical corrections or clarifications that do not alter the substance of the policy, y27s may update the document without advance notice. Your continued use of y27s following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not accept the revised policy, you must cease using y27s and may request account closure by contacting support.

For all privacy-related enquiries, data rights requests, marketing opt-out requests, or complaints regarding y27s's data practices, please use the contact details below. All contact information is provided as plain text — addresses are not clickable links.

• Data Rights & Privacy Email: [email protected] (subject line: "Privacy / Data Rights Request")
• General Support Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the platform
• WhatsApp Support: Available 8 AM to 12 AM Bangladesh Standard Time (BST, UTC+6)

When submitting a data rights request, please include your registered mobile number and account username so that our team can verify your identity and locate the relevant records efficiently. y27s will acknowledge all formal privacy requests within five (5) business days and aim to resolve them fully within thirty (30) calendar days.