9joya Privacy Policy

This Privacy Policy ("Policy") describes how 9joya ("we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "player") who access or use the 9joya online gaming and sports betting platform, including the website at 9joya.io, any associated mobile interface, and all related services (collectively, the "Platform").

9joya is committed to handling your personal data with transparency, integrity, and respect. We recognise that privacy is a fundamental right, and we are dedicated to ensuring that every player who chooses to use our Platform can do so with full confidence that their information is handled responsibly.

This Policy applies to all users of the Platform, including visitors who browse without registering, registered account holders, and any person who contacts our support team. It should be read alongside the Terms & Conditions and the Responsible Gaming policy, both of which are incorporated by reference into the overall agreement between you and 9joya.

By accessing or using the 9joya Platform, or by submitting any personal data to us, you acknowledge that you have read and understood this Policy and agree to the collection and use of your information as described herein. If you do not agree to this Policy, please discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, 9joya acts as the data controller — meaning we are responsible for determining the purposes and means by which your personal data is processed. All requests relating to your personal data, including access, correction, deletion, or portability requests, should be directed to us using the contact details provided in Section 15 of this Policy.

Where we engage third-party service providers to process data on our behalf (for example, payment processors or identity verification services), those parties act as data processors and are contractually bound to process data only according to our documented instructions and in accordance with applicable data protection standards.

We collect the following categories of personal data:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation. If you voluntarily disclose such information in a support communication, we will handle it with heightened care and will not use it for any secondary purpose.

9joya collects personal data through the following channels:

• Direct registration: Information you provide when creating your 9joya account, including your name, date of birth, phone number, and email address.
• Account activity: Data generated when you log in, place bets, play casino games, make deposits or withdrawal requests, and interact with Platform features.
• Identity verification submissions: Documents you upload when completing the KYC process, either at registration or when prompted by our compliance team.
• Support interactions: Information you share when contacting us via email at [email protected] or through any in-platform messaging interface.
• Payment processors: Confirmation and reference data returned by bKash, Nagad, Rocket, Upay, and USDT network providers when transactions are processed.
• Automated technologies: Cookies, server logs, and device fingerprinting technologies that operate when you access the Platform. See Section 10 for full details on cookies.
• Third-party verification services: Where identity and age verification is conducted by a specialist third-party KYC provider, we receive a confirmed verification result and relevant reference data.

9joya processes your personal data on the following legal grounds, depending on the specific activity:

• Performance of a contract: Processing necessary to provide the services described in our Terms & Conditions — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) requirements, know-your-customer (KYC) regulations, and age verification obligations.
• Legitimate interests: Processing necessary for fraud prevention, security monitoring, platform performance analysis, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.
• Consent: Where we send you optional marketing communications or promotional offers, we do so only where you have explicitly opted in. You may withdraw your consent at any time by contacting support.

9joya uses personal data collected from players across Bangladesh for the following purposes:

• Account creation and management: To open and maintain your player account, verify your eligibility (including the 21+ age requirement), and authenticate your identity each time you log in.
• Payment processing: To process deposits and withdrawals through bKash, Nagad, Rocket, Upay, and USDT; to match payment channels; and to apply the minimum deposit threshold of ৳200.
• Fraud and AML prevention: To detect, investigate, and prevent fraudulent transactions, money laundering, unauthorised account access, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling behaviour, and to apply self-imposed limits or exclusions that you have requested.
• Customer support: To respond to your queries, process complaints, and resolve disputes in accordance with our published dispute resolution procedure.
• Platform improvement: To analyse anonymised usage data and improve the performance, stability, and user experience of the 9joya Platform.
• Legal compliance: To retain records as required by applicable law and to respond to lawful requests from competent authorities.
• Marketing (consent-based only): To send you information about promotions, bonuses, and events at 9joya — including seasonal offers tied to BPL, IPL, T20 World Cup, Eid, Pohela Boishakh, and other events relevant to Bangladeshi players — only where you have provided explicit consent.

9joya does not sell, rent, or trade your personal data to any third party for commercial gain. We share your data only to the extent necessary to deliver our services, comply with legal obligations, or protect the security of the Platform. The categories of recipients with whom we may share data are:

• Payment service providers: bKash, Nagad, Rocket, Upay, and cryptocurrency network operators receive transaction data required to process your payments. Each provider operates under its own privacy terms in addition to the contractual obligations they hold with us.
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive an anonymised session token to authenticate game access. They do not receive your personal identity data.
• Identity verification services: Specialist KYC providers receive the documents you submit for age and identity verification. These providers are contractually prohibited from retaining or using your documents beyond the immediate verification purpose.
• IT and hosting service providers: Cloud infrastructure and server providers who host the Platform receive access to data solely to perform hosting and maintenance functions under strict data processing agreements.
• Legal and regulatory authorities: We may disclose personal data to competent authorities, law enforcement bodies, or courts where we are legally required or compelled to do so by a valid order.
• Professional advisers: Lawyers, auditors, and compliance consultants who require access to data for the purpose of providing professional services to 9joya, always subject to confidentiality obligations.

In all cases of data sharing with third-party processors, 9joya executes a data processing agreement that requires the recipient to: (a) process data only for the stated purpose; (b) maintain appropriate security measures; (c) not disclose data to further sub-processors without our authorisation; and (d) delete or return data at the end of the processing engagement.

Some of the third-party service providers with whom 9joya works operate servers or personnel located outside Bangladesh. Where personal data is transferred to entities in other countries, we take appropriate steps to ensure that the transfer is lawful and that your data continues to receive an adequate level of protection.

Safeguards we apply to international transfers include: executing standard contractual clauses with the receiving entity; conducting transfer impact assessments where required; and ensuring receiving entities hold appropriate security certifications. Where a service provider operates in a country that has been recognised as providing an adequate level of data protection, no additional safeguards beyond the data processing agreement are required.

If you would like further information about the specific safeguards applied to any particular international transfer of your data, please contact us at [email protected].

9joya retains personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal retention obligations, and to resolve any disputes or enforce our agreements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account and for a minimum of five (5) years after account closure, in line with AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• KYC verification documents: Retained for five (5) years from the date of verification or account closure, whichever is later, then securely deleted.
• Support communications: Retained for three (3) years from the date of the communication, then deleted unless ongoing legal proceedings require longer retention.
• Technical and usage data: Retained in anonymised or aggregated form for platform analytics purposes. Personally identifiable technical data is retained for no longer than twelve (12) months.
• Marketing consent records: Retained for as long as you hold an active account or until you withdraw consent, whichever comes first. Proof of consent is retained for six (6) months after withdrawal as an audit record.

When data is no longer required, it is securely deleted from our systems using industry-standard data erasure methods. Physical documents, if any, are destroyed by certified shredding. Backup copies are purged within thirty (30) days of the primary deletion cycle.

9joya uses cookies and similar technologies (local storage, session tokens) to operate the Platform securely and improve your experience. A cookie is a small text file stored on your device by your browser when you visit a website. The cookies used by 9joya fall into the following categories:

9joya does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. We do not participate in cross-site behavioural advertising networks. Your browsing activity on 9joya is not shared with ad exchanges or data brokers.

You can control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Most browsers provide a cookie management interface in their settings or preferences menu — consult your browser's help documentation for guidance specific to your browser version.

9joya implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption: All data transmitted between your device and our servers is encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 or higher). You can verify the secure connection by checking for the padlock icon in your browser's address bar when visiting 9joya.io.
• Encryption at rest: Personal data stored on our servers — including KYC documents and payment records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to 9joya employees and contractors who have a genuine operational need. All staff with data access undergo security training and are bound by confidentiality obligations.
• Multi-factor authentication (MFA): Administrative access to our core systems requires multi-factor authentication. We also strongly encourage players to enable any available account security features on the Platform.
• Regular security assessments: We conduct periodic vulnerability assessments and penetration tests to identify and remediate potential weaknesses in the Platform's security posture.
• Incident response: In the event of a data security incident that is likely to result in a risk to your rights and freedoms, 9joya will notify affected players without undue delay and will take immediate remedial action to contain the incident.
• Secure deletion: Data that has reached the end of its retention period is purged using certified erasure methods that prevent recovery.

While 9joya takes all reasonable steps to protect your data, no internet transmission or electronic storage system is completely immune to risk. You play an important role in protecting your own account by using a strong, unique password, never sharing your login credentials with others, and logging out of your account when using shared or public devices. If you suspect that your account has been compromised, contact support at [email protected] immediately.

As a player and data subject, you have the following rights in relation to the personal data 9joya holds about you. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" along with your registered username and a description of your request. We will respond within thirty (30) days.

• Right of access: You have the right to request a copy of the personal data 9joya holds about you, together with information about how it is being used. We will provide this in a clear, readable format free of charge for the first request in any twelve-month period.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay. Some corrections — particularly to identity data — may require you to submit supporting documentation.
• Right to erasure ("right to be forgotten"): You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Please note that this right is subject to legal retention obligations described in Section 9.
• Right to restriction of processing: You may ask us to temporarily restrict how we use your data — for example, while a correction request is under review, or while you contest the basis on which we are processing your data.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You have the right to object to processing based on our legitimate interests at any time. Where your objection relates to direct marketing communications, we will cease processing immediately upon receipt of your objection.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing emails), you may withdraw that consent at any time by contacting support. Withdrawal of consent does not affect the lawfulness of any processing that occurred prior to the withdrawal.

The 9joya Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. The Platform employs age verification checks at registration and at the KYC stage to confirm that every player meets the minimum age requirement.

If 9joya becomes aware that personal data has been collected from a person under the age of 21 — whether through a misrepresentation at registration or through any other means — we will take immediate steps to:

• Suspend and permanently close the account in question.
• Void any bets placed and reverse any remaining balance to the payment method on record.
• Delete all personal data associated with the account as expeditiously as possible, subject only to any mandatory retention obligations under applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account with 9joya, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

9joya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes to this Policy, we will notify registered players by email at least seven (7) days before the changes take effect, except where immediate changes are required for legal or security reasons.

The most current version of this Privacy Policy will always be published on this page at 9joya.io/privacy-policy, with the "Last Updated" date revised accordingly. We encourage you to review this page periodically to stay informed about how we protect your data.

Your continued use of the Platform after any amendment to this Policy constitutes your acknowledgement of the revised terms. If you do not accept the amended Policy, you should discontinue use of the Platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise your data rights, want to report a suspected data security incident, or have any concern about how 9joya handles your personal information, please reach out to our dedicated support team. All privacy-related enquiries are handled with strict confidentiality.

• Support Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Rights Request" or "Privacy Enquiry"
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)
• Response Time: Acknowledgement within 24 hours; full response within 30 days
• Regions Served: Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all of Bangladesh