9joy Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") is issued by 9joy ("we", "us", "our"), the operator of the online gaming and sportsbook platform accessible at 9joy.app. It describes how 9joy collects, uses, stores, discloses, and protects personal data relating to visitors and registered players ("you", "your") who interact with any part of the 9joy platform, including but not limited to the website, mobile-optimised interface, game lobby, sportsbook, cashier, live chat, and support channels.

This Policy applies to all personal data processed in connection with the 9joy platform, regardless of how that data was collected — whether through account registration, payment transactions, gameplay activity, support correspondence, or passive data collection technologies such as cookies. By accessing or using 9joy, you acknowledge that you have read and understood this Policy.

We are committed to handling your personal data in a manner that is lawful, fair, and transparent. We collect only the minimum data necessary to provide the services you request, protect the integrity of the platform, and meet our legal and responsible gaming obligations. If you have questions about this Policy at any time, please contact us at [email protected] (plain text — not a clickable link).

2 Data We Collect

9joy collects personal data in several ways: directly from you when you register an account or contact support, automatically as you use the platform, and from third-party identity verification and payment services. The categories of personal data we collect are set out below.

2.1 Data You Provide Directly

• Identity Data: Full legal name, date of birth, gender (optional), and a copy of your National Identity Card (NID) or passport submitted during KYC verification.
• Contact Data: Email address, Bangladesh mobile phone number, and residential address (city, district).
• Account Credentials: Username, hashed and salted password. We never store your password in plain text.
• Financial Data: bKash or Nagad mobile wallet number, bank account details (account holder name, account number, bank name), transaction reference numbers. Full payment PINs are never collected or stored by 9joy.
• Support Correspondence: Messages, complaints, or feedback you send to the 9joy support team via email, live chat, or any other channel.
• Responsible Gaming Preferences: Deposit limits, session time limits, cooling-off period settings, and self-exclusion requests you submit through your account settings.

2.2 Data We Collect Automatically

• Device & Technical Data: IP address, device type, operating system version, browser type and version, screen resolution, and language settings.
• Usage & Behavioural Data: Pages visited, time spent on each page, game titles launched, bet amounts and outcomes, navigation paths, and session duration.
• Log Data: Server-side access logs including timestamps of all login events, deposit and withdrawal requests, game round initiations, and support interactions.
• Cookie & Tracking Data: Session identifiers, preference cookies, and anonymised analytics data. See Section 5 for full details on our cookie practices.

2.3 Data From Third Parties

• Identity Verification Providers: Confirmation of identity document authenticity returned from KYC service providers.
• Payment Processors: Transaction status confirmations (success, failure, pending) and masked payment identifiers returned by bKash, Nagad, Rocket, Upay, and our banking partners.
• Fraud & Risk Services: Device fingerprinting scores, IP reputation data, and velocity check results from third-party fraud prevention tools used to protect the integrity of the 9joy platform.

2.4 Data Categories Summary Table

3 Legal Basis for Processing

9joy processes your personal data on one or more of the following legal grounds, depending on the specific purpose for which the data is used:

• Contractual Necessity: Processing that is necessary to create and administer your 9joy account, process deposits and withdrawals, deliver gaming services, and fulfil our obligations under the Terms & Conditions you accepted at registration.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, identity verification requirements, responsible gaming obligations, and any other legal or regulatory duty applicable to an online gaming platform operating in or serving Bangladesh.
• Legitimate Interests: Processing carried out for the legitimate interests of 9joy in preventing fraud, ensuring platform security, detecting and preventing prohibited conduct, improving the quality and performance of the platform, and conducting internal analytics. We ensure that our legitimate interests are balanced against your privacy rights in each case.
• Consent: Where we rely on consent (for example, for sending optional marketing communications), we will ask for your explicit consent at the time of collection. You may withdraw this consent at any time by contacting [email protected] or by using the unsubscribe mechanism in any marketing message.

4 How We Use Your Data

9joy uses the personal data we collect for the following specific purposes:

Account Management & Service Delivery

• Creating, verifying, and maintaining your 9joy player account.
• Processing deposits and withdrawals through your registered payment methods (bKash, Nagad, Rocket, Upay, and linked bank accounts).
• Authenticating your identity at each login via OTP to your registered Bangladesh mobile number.
• Providing access to sports betting markets (including BPL, Bangladesh Tigers fixtures, T20 World Cup, and IPL), live dealer games, RNG slots, and bingo rooms.
• Communicating transactional information including deposit confirmations, withdrawal status updates, and account security alerts.

Legal Compliance & Responsible Gaming

• Verifying that you meet the minimum age requirement of 18 years before activating your account.
• Conducting ongoing Know Your Customer (KYC) and anti-money laundering (AML) checks as required by applicable regulations.
• Monitoring gameplay patterns to identify signs of problematic gambling behaviour and triggering responsible gaming interventions where appropriate.
• Enforcing self-exclusion, cooling-off periods, and deposit limits set by you or applied by 9joy under its responsible gaming obligations.
• Maintaining records of all financial transactions for the retention periods required by applicable law.

Platform Security & Fraud Prevention

• Detecting and investigating suspected fraud, money laundering, account takeover attempts, and multi-accounting.
• Analysing IP addresses and device fingerprints to identify suspicious access patterns.
• Preserving the integrity of sports betting markets by monitoring for unusual betting patterns that may indicate match-fixing or insider information abuse.

Platform Improvement & Analytics

• Analysing anonymised and aggregated gameplay data to identify the most popular game titles and sports betting markets among Bangladesh players.
• Diagnosing and resolving technical issues, performance bottlenecks, and platform errors.
• Conducting internal A/B testing to improve the user interface, cashier flow, and promotional communications.

Marketing & Promotions (With Consent)

• Sending promotional emails and SMS messages about 9joy offers, seasonal campaigns (Eid, Pohela Boishakh, BPL season), and new game launches — only where you have provided explicit marketing consent.
• Personalising promotional offers based on your gameplay history and stated preferences — only to the extent permitted by your consent settings.
• 9joy will never send marketing communications to accounts that are in a cooling-off period or self-exclusion, regardless of consent status.

5 Cookies & Tracking Technologies

9joy uses cookies and similar technologies to ensure the platform functions correctly, to maintain your login session across pages, and to gather anonymised data about how players use the platform. We do not use advertising cookies, third-party behavioural tracking cookies, or any cookie technology that profiles you for sale to advertisers.

Types of Cookies We Use

Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers (Chrome, Firefox, Safari, Edge, Samsung Internet) allow you to view, block, or delete cookies stored by specific websites. Please note that disabling essential or security cookies will impair your ability to log in and use the 9joy platform. Disabling analytics and preference cookies will not affect core functionality.

9joy does not currently respond to browser "Do Not Track" signals as there is no consistent industry-wide standard for interpreting such signals. We rely instead on our own strict cookie minimisation policy described above.

6 Data Sharing & Disclosure

9joy does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the specific purpose.

Service Providers & Processors

We engage trusted third-party service providers who process personal data on our behalf under strict data processing agreements. These include:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank — to process deposit and withdrawal transactions. These providers receive only the data necessary to execute the specific payment instruction.
• KYC & Identity Verification Providers: Third-party services that verify the authenticity of NID, passport, and other identity documents submitted during account verification.
• Fraud Prevention & Risk Services: Providers of device fingerprinting, IP reputation, and velocity-check tools used to protect the 9joy platform from fraud and money laundering.
• Cloud Infrastructure Providers: Hosting, database, and content delivery network providers who store and serve platform data on secured servers. All infrastructure providers used by 9joy operate under confidentiality obligations.
• Game Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive only the minimum technical data (session token, bet amount, currency) required to operate their games within the 9joy lobby. These providers have their own privacy policies governing their data processing.

Legal Disclosures

9joy may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to: (a) comply with a valid legal obligation or court order; (b) protect the rights, property, or safety of 9joy, its players, or the public; (c) detect, prevent, or report suspected fraud, money laundering, or other criminal activity; or (d) enforce these Terms & Conditions or our Privacy Policy.

Business Transfers

In the event that 9joy undergoes a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred to the acquiring or successor entity as part of that transaction. We will notify affected players via their registered email address before their data is transferred and becomes subject to a different privacy policy.

7 Data Retention

9joy retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The key retention periods that apply to different categories of data are set out below.

When a retention period expires, 9joy securely deletes or anonymises the relevant data. Where data is anonymised (rather than deleted), it can no longer be linked back to you as an individual and is therefore no longer considered personal data under applicable privacy standards.

Where an account is closed at your request, 9joy will process the deletion of your active profile within 90 days of closure. However, transactional and identity records subject to the longer statutory retention periods listed above will be retained for those periods regardless of account closure.

8 Data Security Measures

9joy employs a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include both technical safeguards and organisational controls.

Technical Safeguards

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 9joy platform is encrypted in transit using TLS 1.2 or higher. The padlock icon in your browser confirms this connection is active.
• Encrypted Data at Rest: Sensitive fields including identity documents, financial data, and KYC records are encrypted at the database level using AES-256 encryption.
• Hashed Passwords: Account passwords are hashed using a modern, salted cryptographic algorithm. 9joy never stores passwords in plain text and cannot retrieve your original password.
• OTP Authentication: All login and withdrawal actions require one-time password (OTP) verification sent to your registered Bangladesh mobile number, providing a second factor of authentication.
• Firewalls & Intrusion Detection: The 9joy platform infrastructure is protected by enterprise-grade firewalls, intrusion detection systems (IDS), and continuous security monitoring.
• Regular Security Audits: 9joy conducts periodic vulnerability assessments and penetration tests on its platform infrastructure to identify and remediate security weaknesses proactively.

Organisational Controls

• Access to personal data within 9joy is restricted to employees and contractors who require it to perform their specific job functions (principle of least privilege).
• All staff with access to personal data are subject to confidentiality obligations and undergo regular data protection and security training.
• 9joy maintains a documented incident response plan. In the event of a confirmed data breach affecting your personal data, we will notify affected players and relevant authorities within the timeframes required by applicable law.

9 Your Privacy Rights

As a registered player on 9joy, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected] with a clear description of your request. We will acknowledge your request within 48 hours and respond fully within 5 business days.

• Right of Access: You have the right to request a copy of all personal data that 9joy holds about you, together with information about how it is being used, who it has been shared with, and how long it will be retained.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. This includes updates to your registered mobile number, email address, or residential address.
• Right to Erasure: You may request that 9joy delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (where processing was based solely on consent), or where you object to processing and there are no overriding legitimate grounds. This right is subject to our legal retention obligations — we cannot erase data that we are legally required to retain.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while the accuracy of data is being contested or while an objection to processing is being assessed.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring purposes. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Marketing Consent: Where you have opted in to receive marketing communications, you may withdraw that consent at any time. Withdrawing marketing consent does not affect your account or gaming access in any way.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON).

10 Children's Privacy

If 9joy becomes aware that personal data has been collected from a person under the age of 18, we will immediately suspend the associated account, delete the collected data (subject to any legal retention requirements related to underage access events), and take appropriate steps to prevent recurrence. Age verification is conducted as a standard part of the KYC process for all new registrations and before any withdrawal is processed.

If you are a parent or guardian and believe that your child has registered a 9joy account or provided personal data to 9joy without your knowledge, please contact us immediately at [email protected]. We will prioritise your request and act promptly to address the situation.

11 Policy Updates & Contact

Updates to This Policy

9joy reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or the services we offer. When material changes are made, we will notify registered players via email to their registered address and/or via a prominent in-platform notification. The updated Policy will be published on this page with a revised effective date at the top of the document.

We encourage you to review this Policy periodically. Continued use of the 9joy platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not accept a material change, you should close your account before the updated Policy takes effect.

Contacting Us About Privacy

For any questions, concerns, or requests related to this Privacy Policy or the way 9joy handles your personal data, please contact our Data Protection team using the details below. All privacy-related enquiries are handled with priority and in strict confidence.

Email: [email protected] (plain text — not a clickable link)
Subject Line: "Privacy Request — [Your Registered Username]"
Response Time: Acknowledgement within 48 hours; full response within 5 business days
Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)