joia9 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how joia9 ("we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "Player") who access or use the joia9 platform at joia9.io, including all associated services, games, promotions, and customer support channels.

joia9 is committed to handling your personal data with care, transparency, and respect. We recognise that your privacy is important, and we have designed our data practices to be proportionate, purposeful, and secure. This Policy is written in plain English to ensure that all players — regardless of their technical or legal background — can clearly understand how their information is handled.

By registering a joia9 account, making a deposit, placing a bet, or otherwise using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please do not use the joia9 platform.

For the purposes of this Privacy Policy, joia9 acts as the data controller in respect of all personal data collected from players who access the platform at joia9.io. As data controller, joia9 determines the purposes and means by which your personal data is processed.

All data-related queries, access requests, correction requests, and deletion requests should be directed to the joia9 data team via email at [email protected]. Please include "Data Privacy Request" in the subject line of your email along with your registered account username to enable us to locate and process your request efficiently.

joia9 is committed to responding to all data-related requests within fourteen (14) business days of receipt. In circumstances where a request is complex or where joia9 receives a high volume of concurrent requests, the response period may be extended by a further fourteen (14) business days, in which case we will notify you of the extension in writing.

joia9 collects the following categories of personal data from players, either directly at the point of registration and use, or automatically through your interaction with the platform:

joia9 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health (other than self-exclusion or responsible gaming flags applied at the player's own request) unless required to do so by applicable law or regulatory obligation.

joia9 collects personal data through the following primary channels:

• Direct collection: Information you provide when completing the joia9 registration form, submitting KYC documentation, making a deposit or withdrawal, contacting customer support, or participating in a promotion or survey.
• Automated collection: Technical and behavioural data collected automatically when you visit joia9.io or use the platform, including via cookies, session tracking technologies, server logs, and device fingerprinting techniques used for security and fraud prevention purposes.
• Third-party sources: Identity verification data received from third-party KYC service providers engaged by joia9 to assist in verifying player identities and ages. Financial data received from payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard) in connection with deposit and withdrawal transactions.
• Game providers: Aggregated or anonymised data from licensed game studio partners (including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe) relating to game outcomes and session data for the purposes of RNG audit compliance and dispute resolution.

joia9 processes personal data for the following specific and legitimate purposes:

• Account creation and management: To register your joia9 account, verify your identity and age (21+), and maintain your account in good standing throughout the duration of your registration.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and any other payment method offered on the platform, and to maintain an accurate record of all financial transactions associated with your account.
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions. This includes IP monitoring, device fingerprinting, and behavioural analysis.
• Responsible gaming compliance: To monitor player activity for signs of problem gambling behaviour, to apply deposit limits and self-exclusion requests, and to fulfil our obligations in relation to responsible gaming as described in our Responsible Gaming Policy.
• Customer support: To respond to your queries, complaints, and requests via live chat and email, and to maintain records of our communications for quality assurance purposes.
• Legal and regulatory compliance: To comply with applicable anti-money laundering obligations, identity verification requirements, and any other legal obligations that apply to our platform operations.
• Service improvement: To analyse aggregated, anonymised behavioural data for the purposes of improving the joia9 platform, optimising game offerings, and enhancing the overall player experience.
• Marketing communications (opt-in only): To send promotional emails, bonus offers, seasonal campaign notifications (including BPL, Eid, Pohela Boishakh, and IPL promotions), and new game announcements to players who have opted in to receive such communications.

joia9 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent.

joia9 processes personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing required to perform the contract between joia9 and the player — including account registration, transaction processing, and the delivery of gaming services — is carried out on the basis that it is necessary for the performance of that contract.
• Legitimate interests: Processing carried out for fraud prevention, platform security, anti-money laundering monitoring, and service improvement is carried out on the basis of joia9's legitimate interest in operating a safe, fair, and commercially viable platform. joia9 has assessed that these legitimate interests are not overridden by the privacy rights of individual players, given the proportionate and targeted nature of the processing.
• Legal obligation: Processing required to comply with applicable legal obligations — including KYC verification, transaction record-keeping, and responding to lawful requests from regulatory or law enforcement authorities — is carried out on the basis of compliance with those obligations.
• Consent: Processing of personal data for optional marketing communications is carried out on the basis of your freely given, specific, informed, and unambiguous consent at the time of registration or subsequently via your account settings. You may withdraw this consent at any time.

joia9 does not sell, rent, or trade your personal data to any third party for their own independent commercial purposes. We share personal data only with the following categories of recipients, and only to the extent strictly necessary to fulfil the purposes described in Section 5 of this Policy:

• KYC and identity verification providers: Third-party services engaged by joia9 to verify player identities and ages as part of our registration and ongoing compliance obligations. These providers are contractually bound to process data solely on joia9's instructions.
• Payment processing partners: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and any other payment processing entity used to facilitate deposits and withdrawals. Data shared with payment partners is limited to the financial transaction data necessary to complete the relevant transaction.
• Game studio and content providers: Licensed game providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive anonymised or pseudonymised session and outcome data for the purposes of RNG compliance, game dispute resolution, and licensing obligations.
• IT infrastructure and hosting providers: Cloud hosting, database management, and cybersecurity service providers who support the technical operation of the joia9 platform. All such providers are engaged under data processing agreements that restrict the use of your data to the performance of services for joia9.
• Legal and regulatory authorities: joia9 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, by a lawful court order, or where joia9 reasonably believes such disclosure is necessary to prevent or investigate fraud, money laundering, or other criminal activity.

joia9 uses cookies and similar tracking technologies on the joia9.io platform to enable core functionality, improve user experience, and support security and fraud prevention operations. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session cookies that maintain your login state, security tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing core platform functionality.
• Functional cookies: Used to remember your preferences (such as language settings and responsible gaming tool configurations) so that you do not need to reconfigure them on each visit.
• Analytics cookies: Used to collect anonymised data about how players navigate and interact with the joia9 platform. This data is used solely to improve the platform's performance and user experience. Analytics data is aggregated and is not linked to individual player identities.
• Security and fraud prevention cookies: Used in conjunction with device fingerprinting and IP analysis to detect and prevent fraudulent activity, multi-accounting, and automated access to the platform.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the joia9 platform. Disabling functional or analytics cookies will not affect your ability to access core platform features but may degrade certain personalisation elements.

joia9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the principal categories of data held by joia9:

• Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in line with standard anti-money laundering record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction records: All deposit and withdrawal records denominated in BDT are retained for a minimum of five (5) years following the date of the transaction.
• Customer support communications: Support chat transcripts and email correspondence are retained for a period of two (2) years from the date of the last communication in a given support thread.
• Technical and behavioural data: Server logs and session data are retained for up to twelve (12) months for security and fraud investigation purposes, after which they are anonymised or deleted.
• Marketing consent records: Records of marketing consent (opt-in and opt-out events) are retained for the duration of your account and for three (3) years following account closure as evidence of compliance.

Upon expiry of the applicable retention period, personal data will be securely deleted from joia9's systems or, where deletion is not technically feasible, anonymised such that the data can no longer be linked to any identifiable individual.

joia9 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our principal security measures include:

• SSL/TLS encryption: All data transmitted between your device and the joia9 platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Connections to joia9.io are enforced over HTTPS at all times.
• Password hashing: Player passwords are stored exclusively in hashed form using a strong, salted hashing algorithm. joia9 staff cannot retrieve your plain-text password — if you forget your password, a secure reset process will be initiated.
• Access controls: Access to personal data within joia9's internal systems is restricted on a need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged and audited.
• Payment data tokenisation: Card payment details are handled by our PCI DSS-compliant payment partners. joia9 does not store full card numbers on its own systems — only tokenised references provided by the payment processor are retained.
• Fraud detection systems: Automated monitoring systems analyse transaction patterns, login behaviours, and device signatures in real time to detect and respond to suspected security incidents.
• Incident response: In the event of a data security breach that poses a risk to the rights and freedoms of affected players, joia9 will notify affected individuals promptly and take all reasonable steps to contain and remediate the incident.

Despite these measures, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their joia9 accounts, to enable any available two-factor authentication features, and to contact [email protected] immediately if they suspect that their account credentials have been compromised.

As a joia9 player whose personal data is processed by us, you have the following rights in relation to your data. To exercise any of these rights, please contact [email protected] with your registered account username and the nature of your request:

• Right of access: You have the right to request a copy of the personal data that joia9 holds about you. We will provide this in a structured, commonly used, and machine-readable format within 14 business days of a verified request.
• Right to rectification: If any personal data held by joia9 about you is inaccurate or incomplete, you have the right to request that it be corrected. Please note that changes to identity data may require re-verification via the KYC process.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there are no overriding legitimate grounds for joia9 to continue. This right is subject to exceptions where retention is required by law.
• Right to restriction: You may request that joia9 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing pending verification of joia9's legitimate grounds.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on joia9's legitimate interests. You also have an unconditional right to object to the use of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right to data portability: For data processed on the basis of contract or consent, you have the right to receive your personal data in a portable format and to have it transferred directly to another controller where technically feasible.

joia9 enforces a strict minimum age requirement of 21 years for all registered players. The joia9 platform is not directed at, and is not intended for use by, any person under the age of 21. joia9 does not knowingly collect personal data from individuals who are under 21 years of age.

If joia9 becomes aware — through age verification processes, reports, or any other means — that a player is under 21 years of age, the following actions will be taken immediately:

• The player's account will be suspended with immediate effect.
• All personal data associated with the account will be reviewed and, subject to any legal retention obligations, will be scheduled for deletion.
• Any real money balance in the account will be returned to the registered payment method; any winnings will be forfeited.
• The account will be permanently closed and the individual will be prohibited from re-registering on the joia9 platform.

If you are a parent or guardian and believe that a minor in your care has registered a joia9 account without your knowledge, please contact us immediately at [email protected] so that we can take the appropriate remedial action.

The joia9 platform may, from time to time, contain references to or integrations with third-party services — such as payment processors, game studio interfaces, or identity verification portals. While joia9 takes reasonable steps to engage only reputable third-party partners, we do not control the privacy practices of third-party websites or services and are not responsible for their privacy policies.

When you interact with a third-party service in connection with your joia9 account — for example, when completing a bKash or Nagad payment transaction — you may be subject to the privacy policy of that third-party provider in addition to this joia9 Privacy Policy. We encourage you to read the privacy notices of any third-party service you interact with.

joia9 does not embed third-party advertising networks, social media tracking pixels, or external analytics platforms on the joia9.io site. Any data collected via the platform's own analytics infrastructure is processed exclusively by joia9 and its contracted service providers as described in this Policy.

joia9 reserves the right to update or amend this Privacy Policy at any time. When material changes are made to the Policy, joia9 will provide reasonable advance notice to registered players via the email address associated with their account and/or by displaying a prominent notice on the joia9.io platform.

The updated Policy will take effect on the date stated at the top of the revised document. Continued use of the joia9 platform after the effective date of the revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the platform and contact [email protected] to request account closure.

All previous versions of this Privacy Policy are archived internally by joia9 and are available upon request. To request a copy of a previous version, please contact [email protected] with the relevant effective date.

If you have any questions, concerns, or requests in relation to this Privacy Policy or joia9's data practices, please contact us using the details below. Our support team is available 24 hours a day, 7 days a week, in Bangladesh Standard Time (BST, UTC+6).

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Data Privacy Request — [Your Username]"
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)
• Response Time: Within 14 business days for formal data requests