jota9 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy ("Policy") describes how jota9 ("jota9", "we", "us", "our") collects, uses, stores, shares, and protects personal information relating to individuals ("you", "your", "Player") who access or use the jota9 platform, including the website at jota9.io, its associated services, mobile-optimised interface, and any other touchpoints operated by jota9.

This Policy applies to all current and former jota9 players, individuals who have registered for an account, individuals who have submitted enquiries to our support team, and visitors to the jota9 website regardless of whether they hold an active account.

By accessing the jota9 platform or creating an account, you acknowledge that you have read and understood this Privacy Policy and that you consent to the data practices described herein. If you do not agree with any part of this Policy, you should not use the jota9 platform.

This Policy should be read alongside jota9's Terms & Conditions and Responsible Gaming Policy, both of which are available on the jota9 website and are incorporated by reference into the overall framework governing your relationship with jota9.

jota9 acts as the data controller in respect of the personal information it collects and processes. As data controller, jota9 determines the purposes and means of processing your personal data. For all data-related enquiries, requests, or complaints, you may contact jota9's data protection team at [email protected].

jota9 operates as an internationally licensed online betting and casino platform. Players from Bangladesh and other eligible jurisdictions interact with the platform in the English language. jota9 is committed to maintaining data processing standards consistent with international best practices for the online gaming industry.

jota9 collects personal data through several channels including account registration, ongoing account use, identity verification, payment processing, customer support interactions, and website analytics. The categories of personal data we collect include:

Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, gender, nationality	Account registration, KYC verification
Contact Data	Email address, mobile phone number, residential address	Account registration, support interactions
Verification Data	National ID, passport copy, utility bill, selfie photograph	KYC verification process
Financial Data	bKash/Nagad mobile number, transaction reference numbers, deposit and withdrawal history	Payment processing
Account Data	Username, account balance, betting history, bonus activity, login timestamps	Platform use
Technical Data	IP address, device type, browser type and version, operating system, session duration	Automated collection via cookies and server logs
Communications Data	Support chat transcripts, email correspondence, feedback submissions	Support interactions
Marketing Preferences	Opt-in/opt-out status for promotional communications	Account settings, consent forms

jota9 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes, or health data, except where limited health-related information is voluntarily shared in the context of a responsible gaming self-exclusion or problem gambling support request.

jota9 uses the personal data we collect for the following clearly defined purposes:

• Account Management: To create, maintain, and administer your jota9 player account, including processing your registration, authenticating your identity at login, and managing account settings.
• Service Delivery: To enable you to place bets, play casino games, receive winnings, and access all features of the jota9 platform.
• Payment Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment channels in Bangladeshi Taka.
• Identity Verification (KYC): To verify your identity and age in compliance with our obligations to prevent underage gambling, fraud, and money laundering.
• Customer Support: To respond to your queries, complaints, account disputes, and technical issues in a timely and effective manner.
• Responsible Gaming: To monitor for signs of problem gambling behaviour and, where appropriate, to contact you about responsible gaming tools such as deposit limits and self-exclusion.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, and other prohibited conduct.
• Legal and Regulatory Compliance: To fulfil our obligations under applicable anti-money-laundering (AML), counter-terrorism financing (CTF), and other applicable international regulations.
• Marketing and Promotions (opt-in only): To send you personalised promotional offers, bonus notifications, and platform updates where you have provided explicit consent to receive such communications.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the jota9 platform, optimise user experience, and develop new features.

jota9 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing that is required to deliver the services described in jota9's Terms & Conditions, including account management, payment processing, and game access.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC verification, AML obligations, and retention of financial records.
• Legitimate Interests: Processing carried out for jota9's legitimate business interests — such as fraud prevention, platform security, and improving our services — where those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — such as the sending of marketing communications. You may withdraw consent at any time without affecting the legality of prior processing.

jota9 does not sell, rent, or trade your personal data. We share your personal data only with trusted third-party service providers and where legally required, as described below:

• Payment Processors: bKash, Nagad, Rocket, Upay, and other integrated payment service providers receive the financial data necessary to process your transactions. These providers operate under their own privacy policies and regulatory obligations.
• Identity Verification Providers: Third-party KYC and identity verification service providers process your identity documents to confirm your eligibility to hold a jota9 account.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited technical data (such as anonymised player session identifiers) to deliver game content. These providers do not receive your personal identity or payment data.
• IT and Security Service Providers: Cloud infrastructure, cybersecurity, and fraud detection providers who process data on our behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Where required by law, court order, or regulatory authority, jota9 may be obligated to disclose personal data to competent authorities. jota9 will only disclose the minimum data necessary to satisfy a valid legal requirement.
• Analytics Providers: Aggregated, anonymised analytics data may be shared with analytics platform providers to support platform improvement. No personally identifiable information is included in analytics data transfers.

All third-party service providers who receive your personal data are required to process it only as directed by jota9, to maintain appropriate security measures, and to delete it when it is no longer required for the specified purpose.

jota9 is an internationally operated platform. Your personal data may be transferred to and processed in countries outside of Bangladesh. Where such transfers occur, jota9 ensures that appropriate safeguards are in place to protect your data to a standard consistent with international data protection best practices.

Safeguards used by jota9 for international data transfers include contractual clauses with recipients requiring them to maintain equivalent data protection standards, and selection of service providers that operate certified secure infrastructure. If you have questions about the specific safeguards applicable to any data transfer, please contact us at [email protected].

jota9 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of 5 years following account closure to satisfy AML and financial record-keeping obligations.
• KYC and Identity Verification Documents: Retained for a minimum of 5 years following the completion of the verification process or account closure, whichever is later.
• Transaction Records: Retained for a minimum of 5 years from the date of the transaction.
• Customer Support Communications: Retained for 3 years from the date of the last interaction.
• Marketing Consent Records: Retained for the duration of the consent period and for 3 years following withdrawal of consent, to demonstrate compliance.
• Technical and Log Data: Retained for up to 12 months from the date of collection, unless longer retention is required for security investigations.

Upon expiry of the applicable retention period, your personal data will be securely deleted or irreversibly anonymised so that it can no longer be associated with your identity.

jota9 uses cookies and similar tracking technologies on the jota9 website to support platform functionality, analyse usage patterns, and deliver a personalised experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the operation of the jota9 platform, including maintaining your login session, storing your account preferences, and enabling secure payment flows. These cookies cannot be disabled without significantly impairing your ability to use the platform.
• Analytical Cookies: Used to collect anonymised data about how players interact with the jota9 website, including pages visited, session duration, and navigation paths. This data is used exclusively to improve platform performance and user experience.
• Functional Cookies: Used to remember your preferences such as language settings, device type, and previously selected game categories to provide a more consistent experience across visits.
• Marketing Cookies (consent-based): Used only where you have provided explicit consent, to deliver personalised promotional content relevant to your interests and activity on the jota9 platform.

You can manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of the jota9 platform.

jota9 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational security measures, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the jota9 platform.
• Encrypted storage of personal and financial data at rest using industry-standard encryption protocols.
• Strict access controls limiting internal access to personal data on a need-to-know basis, with role-based permissions and multi-factor authentication required for all administrative access.
• Regular security audits, vulnerability assessments, and penetration testing conducted by independent security specialists.
• Comprehensive incident response procedures to detect, contain, and notify affected parties of data breaches in a timely manner.
• Employee training on data protection obligations and secure data handling procedures.

While jota9 implements robust security measures, no system can be guaranteed completely immune from security incidents. Players are encouraged to use strong, unique passwords for their jota9 accounts, to enable two-factor authentication, and to report any suspicious activity to [email protected] immediately.

Subject to applicable law and certain exemptions, you hold the following rights in relation to the personal data jota9 processes about you. To exercise any of these rights, please contact us at [email protected]. We will respond to all valid requests within 30 calendar days:

• Right of Access: Request a copy of the personal data we hold about you, together with information about how it is being used.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data held by jota9.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction of Processing: Request that we limit the way we use your data while a dispute regarding its accuracy or lawfulness is being resolved.
• Right to Data Portability: Request that we provide your personal data in a structured, commonly used, machine-readable format, or that we transmit it directly to another data controller where technically feasible.
• Right to Object: Object to the processing of your personal data for direct marketing purposes, or where processing is based on jota9's legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

Please note that exercising certain rights — in particular the right to erasure — may result in the closure of your jota9 account where deletion of the requested data is incompatible with maintaining an active account relationship.

The jota9 platform is strictly intended for adults aged 21 years and above. jota9 does not knowingly collect, process, or store personal data from individuals under the age of 21. If jota9 becomes aware that personal data has been collected from a person under 21 years of age, it will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor in your care has registered with jota9 or provided personal data to jota9, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

jota9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform operations. Where changes are material, jota9 will provide reasonable advance notice to registered players, either by email to the registered account address or by a prominent notice on the jota9 website.

The date at the top of this Policy indicates when it was last revised. Your continued use of the jota9 platform following the effective date of any revision constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or jota9's data processing practices, please contact our data protection team using the details below. All enquiries will be treated with strict confidentiality:

• Email: [email protected] (plain text — not a clickable link; please copy and paste into your email client)
• Live Chat: Available 24 hours a day, 7 days a week via the support widget on the jota9 platform
• Response Commitment: Data subject requests will receive an acknowledgement within 5 business days and a substantive response within 30 calendar days

jota9 is committed to resolving all privacy-related enquiries and complaints promptly and transparently. If you are not satisfied with our response to a complaint, you may have the right to escalate the matter to a relevant supervisory authority in your jurisdiction.