Your Privacy Matters to joa9 — Here Is Exactly How We Protect It

1. Introduction

1.1 joa9 ("we", "us", "our") is committed to protecting the personal data of every individual who interacts with the joa9 Platform. This Policy explains, in clear and precise terms, what personal data we collect from Players and visitors, the purposes for which that data is processed, the legal grounds on which processing is based, and the rights available to you in relation to your personal data.

1.2 joa9 operates as an online betting and casino platform serving the Bangladesh market. As part of delivering our services — including cricket betting, live casino, slots, and payment processing — we necessarily collect and process personal data. We process this data responsibly, proportionately, and only to the extent required to deliver a safe, compliant, and high-quality gaming experience.

1.3 This Policy should be read alongside the joa9 Terms & Conditions, which govern your contractual relationship with joa9. Where this Policy addresses data protection matters that overlap with the Terms & Conditions, this Policy shall take precedence for data protection purposes.

1.4 We may update this Policy from time to time. The current version is always available at joa9.ws/privacy-policy. The "Last updated" date at the top of this document reflects the date of the most recent revision. Material changes will be communicated to registered Players via on-Platform notification or email to the registered address.

2. Data Controller

2.1 For the purposes of applicable data protection law, the data controller responsible for your personal data is joa9, the operator of the Platform accessible at joa9.ws. All data protection enquiries, subject access requests, and consent withdrawal requests should be directed to our dedicated data protection contact at [email protected] with the subject line "Data Protection Request — [Your Username]".

2.2 joa9 operates under an internationally recognised gaming licence framework. Our data processing obligations are shaped both by the conditions of that licence and by internationally accepted data protection standards, including principles equivalent to those established under the General Data Protection Regulation (GDPR) as a reference framework for best practice.

3. Data We Collect

3.1 We collect personal data through several channels: data you provide directly during registration and KYC, data generated automatically through your use of the Platform, and data we receive from third-party service providers such as payment processors and identity verification partners. The categories of personal data we collect are described in the table below.

Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, nationality, NID / passport number, photograph	Registration form; KYC document upload
Contact Data	Mobile phone number, email address, residential address (district, division)	Registration form; Account settings
Financial Data	bKash / Nagad / Rocket wallet number, bank account details, transaction history, deposit and withdrawal amounts in BDT	Payment processing; Cashier section
Account & Activity Data	Username, login timestamps, betting history, game session data, bonus usage records, balance history	Platform activity logs
Technical Data	IP address, device type, operating system, browser type and version, screen resolution, time zone (BST / UTC+6)	Automated collection via server logs and cookies
Communication Data	Support chat transcripts, email correspondence, complaint records, feedback submissions	Live chat; email to [email protected]
Responsible Gaming Data	Deposit limit settings, self-exclusion status, cooling-off period records, session time alerts	Account settings; responsible gaming tool usage

3.2 We do not collect or store full payment card numbers. Where card payments are processed (Visa, Mastercard), card data is handled exclusively by our PCI-DSS compliant payment gateway partners and is never transmitted to or stored on joa9 servers.

3.3 We do not collect special categories of personal data (such as health data, biometric data, or political opinions) except where a Player voluntarily discloses health-related information in the context of a responsible gaming or self-exclusion request, in which case such data is processed solely for that purpose and retained only for as long as the relevant responsible gaming measure remains active.

4. How We Use Your Data

4.1 joa9 processes your personal data for the following specific purposes:

• Account Registration and Management: To create, maintain, and administer your joa9 Account, verify your identity, enforce the one-Account-per-person rule, and communicate with you regarding Account status.
• KYC and Age Verification: To verify that you are 21 years of age or older in compliance with our responsible gaming obligations and to satisfy anti-money-laundering (AML) requirements applicable to our licence framework.
• Payment Processing: To process deposits and withdrawals via supported Bangladesh payment methods including bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank, and to maintain an auditable record of all financial transactions on your Account.
• Service Delivery: To provide access to the full range of Platform features including cricket betting (BPL, IPL, T20 World Cup, Bangladesh Tigers matches), live casino games (Evolution Gaming, Ezugi), slot titles (Pragmatic Play, NetEnt, Microgaming, Spribe), and promotional offers.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, match-fixing, and other prohibited conduct as defined in the joa9 Terms & Conditions.
• Responsible Gaming: To monitor Account activity for behavioural indicators of problem gambling, to administer self-exclusion and deposit limit tools, and to fulfil our duty of care to Players who may be at risk.
• Customer Support: To respond to your enquiries, resolve complaints, and maintain records of communication for quality assurance and dispute resolution purposes.
• Legal Compliance: To comply with applicable legal obligations, including record-keeping requirements under our gaming licence and obligations arising from any lawful request from a competent authority.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, game selection, payment flows, and user experience. This analysis does not identify individual Players.
• Marketing Communications: To send you personalised promotional offers, bonus notifications, and game recommendations where you have provided explicit consent or where such communications fall within the scope of legitimate interest and you have not opted out.

5. Legal Basis for Processing

5.1 joa9 processes your personal data on one or more of the following legal grounds depending on the specific purpose:

• Contractual Necessity: Processing required to fulfil our obligations to you under the joa9 Terms & Conditions — including Account management, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC, AML obligations, and record-keeping mandates under our gaming licence.
• Legitimate Interests: Processing carried out for purposes of fraud prevention, Platform security, responsible gaming monitoring, and internal analytics, where our legitimate interest in maintaining a safe and compliant platform is not overridden by your rights and interests.
• Consent: Processing for direct marketing communications and optional personalisation features, where you have provided clear and freely given consent. You may withdraw consent at any time by contacting [email protected] or using the opt-out mechanism provided in any marketing communication.

6. Cookies & Tracking Technologies

6.1 The joa9 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, to maintain session security, and to analyse usage patterns. Cookies are small text files stored on your device by your web browser.

6.2 The categories of cookies used on the joa9 Platform are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in, security tokens, and cookies that manage your betting cart. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and responsible gaming tool configurations. Disabling these cookies may affect your experience but will not prevent access to the Platform.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players navigate the Platform — which pages are visited most, where sessions typically end, and which game categories are most popular. This data helps us improve the Platform. No individual Player is identified through analytics data.
• Security Cookies: Used to detect and prevent fraudulent login attempts, unusual Account activity, and potential bot traffic. These cookies are strictly necessary for Account security.

6.3 You may configure your browser to block or delete cookies at any time. However, disabling strictly necessary cookies will impair your ability to log in and use the Platform. joa9 does not use third-party advertising cookies or cross-site tracking technologies.

7. Data Sharing & Disclosure

7.1 joa9 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Processors: We share financial transaction data with payment processing partners (including but not limited to mobile wallet operators such as bKash and Nagad, and card payment gateways) solely to the extent necessary to process your deposit or withdrawal. All payment partners are contractually bound to process your data only for the stated purpose and in accordance with applicable data protection standards.
• Identity Verification Partners: We may share your identity and document data with accredited KYC verification service providers to complete the verification of your Account. These partners are engaged under strict data processing agreements and are permitted to use your data only for identity verification.
• Game Providers: When you access a game provided by a third-party studio (e.g., Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi), a game session token and pseudonymous Player identifier are shared with that provider to enable game delivery and maintain game session integrity. No directly identifying personal data (such as your name or phone number) is shared with game providers beyond what is technically necessary.
• Legal and Regulatory Disclosure: We may disclose personal data to competent authorities, law enforcement bodies, or regulatory agencies where required to do so by applicable law, court order, or under the conditions of our gaming licence. We will notify you of any such disclosure where we are legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or corporate restructuring involving joa9, your personal data may be transferred to the successor entity. You will be notified of any such transfer and of any changes to this Policy that result from it before the transfer takes effect.

7.2 All third parties with whom joa9 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only in accordance with our documented instructions and applicable data protection requirements.

8. Data Retention

8.1 joa9 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licence obligations. The table below summarises our standard retention periods by data category:

Data Category	Retention Period	Basis
Identity & KYC documents	5 years from Account closure	AML / licence obligation
Financial transaction records	5 years from transaction date	AML / legal obligation
Account & betting activity logs	3 years from Account closure	Dispute resolution / licence obligation
Support communications	2 years from closure of support ticket	Quality assurance / dispute resolution
Self-exclusion records	Duration of exclusion + 5 years	Responsible gaming / legal obligation
Marketing consent records	Until consent is withdrawn + 1 year	Proof of consent
Technical / server logs	12 months from generation	Security monitoring

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual. Where anonymisation is not technically feasible within our system architecture, data is deleted in its entirety.

9. Data Security

9.1 joa9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the joa9 Platform is encrypted in transit using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive personal data stored on our servers — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within joa9's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication (2FA) on their Accounts. joa9 system access for internal staff handling personal data requires mandatory multi-factor authentication.
• Penetration Testing: The joa9 Platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: joa9 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights, we will notify affected Players without undue delay and in accordance with applicable notification obligations.

9.2 While joa9 employs robust security measures, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your Account credentials and for ensuring that your device and internet connection are adequately secured. If you suspect unauthorised access to your Account, contact [email protected] immediately.

10. Your Data Protection Rights

10.1 joa9 respects your rights in relation to your personal data. Subject to applicable law and the conditions of our gaming licence, you have the following rights:

10.2 To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]" and specify which right(s) you wish to exercise. joa9 will respond to all data rights requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days and will notify you of the extension within the initial 30-day window.

10.3 joa9 will not charge a fee for processing data rights requests unless a request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply. You will be notified before any fee is charged.

10.4 Please note that certain rights — particularly erasure and portability — may be limited where retention is required by applicable legal obligation, including our AML and gaming licence record-keeping requirements described in Section 8.

11. Children's Privacy and the 21+ Rule

11.1 The joa9 Platform is strictly intended for adults aged 21 years and above. joa9 does not knowingly collect personal data from any individual under the age of 21. All Account registrations are subject to mandatory KYC age verification requiring submission of a valid Bangladesh National ID (NID) or passport before full Platform access is granted.

11.2 If joa9 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated Account, void any transactions, return any deposited balance to the originating payment method, and permanently delete all personal data associated with that Account from our systems.

11.3 If you are a parent or guardian and believe that a minor in your care has registered on the joa9 Platform, please contact us immediately at [email protected] with the subject line "Underage Account Report". We treat all such reports as high priority and will investigate and resolve them within 24 hours.

12. Third-Party Links and Embedded Content

12.1 The joa9 Platform may contain references to game providers and payment partners whose services are integrated into the Platform. When you access a game provided by a third-party studio or initiate a transaction through a third-party payment gateway, you are also subject to that provider's privacy policy and data processing practices.

12.2 joa9 is not responsible for the privacy practices, content, or security of any third-party services accessed via the Platform. We strongly encourage you to review the privacy policies of any third-party service providers whose services you use in connection with your joa9 Account.

12.3 joa9 does not embed third-party advertising networks, social media widgets, or cross-site tracking pixels on the Platform. Our commitment to your privacy means we actively minimise third-party data exposure to only what is technically necessary for game delivery and payment processing.

13. International Data Transfers

13.1 In providing game content and payment processing services to Players in Bangladesh, joa9 works with game studios and payment technology providers that may be headquartered or operate servers in jurisdictions outside Bangladesh. Where your personal data is transferred to such jurisdictions, joa9 ensures that appropriate safeguards are in place to protect your data to an equivalent standard as required under applicable data protection principles.

13.2 Safeguards for international transfers include contractual data processing agreements with all third-party processors, requiring them to implement security measures equivalent to those described in Section 9 of this Policy and to process your data only for the purposes specified by joa9.

13.3 Your financial data processed through Bangladeshi mobile wallet providers (bKash, Nagad, Rocket, Upay) and domestic bank channels remains within the Bangladesh financial system and is processed in accordance with Bangladesh Bank guidelines and those providers' own privacy frameworks.

14. Changes to This Privacy Policy

14.1 joa9 reserves the right to update, amend, or replace this Privacy Policy at any time. When we make material changes — including changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered Players via a prominent on-Platform notification and/or an email to the registered address at least 7 days before the change takes effect.

14.2 Minor, non-material updates (such as clarifications of existing practices, formatting corrections, or updates to contact details) may be made without prior notice. The "Last updated" date at the top of this page will always reflect the date of the most recent change of any kind.

14.3 Your continued use of the joa9 Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must notify joa9 before the effective date and request Account closure in accordance with Section 12 of the Terms & Conditions. Your verified real-money balance will be returned to your registered payment method upon closure.

15. Contact Us

15.1 All data protection enquiries, subject access requests, consent withdrawal notices, and privacy-related complaints should be addressed in writing to the joa9 data protection contact. Our support team operates 24 hours a day, 7 days a week, including all Bangladeshi public holidays, with a target first response time of under 5 minutes during BST peak hours (18:00–01:00 BST).

15.2 Data protection contact: [email protected] — please use the subject line format "Data Protection Request — [Your Username]" to ensure your message is routed directly to the appropriate team.

15.3 For formal data rights complaints that we have been unable to resolve to your satisfaction after following our internal complaints procedure (outlined in Section 17 of the Terms & Conditions), you retain the right to escalate your complaint to a competent supervisory authority in accordance with applicable data protection law.