Privacy Policy — ja9 Online Casino

ja9 ("we", "us", "our", or "the Platform") is the online casino and sports betting platform accessible at ja9.lat. We are committed to protecting the privacy and personal data of every individual who accesses or uses our platform, including visitors who browse without registering and registered players who actively use our services.

This Privacy Policy sets out in plain, precise terms what personal data we collect about you, the purposes for which that data is processed, the lawful basis on which we rely to process it, how long we retain it, who we may share it with, and the rights you hold as a data subject. This Policy applies to all services operated under the ja9.lat domain.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement between you and ja9. By using the platform, you confirm that you have read and understood this Privacy Policy in its entirety.

For the purposes of applicable data protection law, ja9 acts as the data controller in respect of the personal data of its registered players and website visitors. As data controller, ja9 determines the purposes and means by which personal data is processed and is responsible for ensuring that processing activities are carried out lawfully, fairly, and transparently.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a concern about our data practices, please contact our Data Protection team using the contact details provided in Section 14 of this Policy.

ja9 collects personal data across several categories. The specific data points collected in each category depend on the nature of your interaction with the platform:

ja9 collects personal data through the following channels and mechanisms:

• Direct provision by you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or use any interactive feature of the platform, you directly provide us with personal data.
• Automated technical collection: When you access the platform, our servers automatically record technical data such as your IP address, device identifiers, browser characteristics, and session data. This data is collected through server logs and similar technical mechanisms.
• Cookies and similar technologies: ja9 uses cookies and similar browser-based tracking technologies to maintain your session, recognise returning visitors, analyse platform usage patterns, and prevent fraud. Full details are set out in Section 10 of this Policy.
• Third-party identity verification providers: During KYC verification, ja9 may use third-party identity verification services. These providers process your identity documents and biometric data on our behalf under strict data-processing agreements.
• Payment processors: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, or USDT TRC-20, the relevant payment provider shares transaction confirmation data with ja9 to allow us to credit or debit your Account balance accurately.
• Game providers: Third-party game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may share game session data and RNG outcomes with ja9 for the purposes of account settlement and dispute resolution.

ja9 processes personal data only where a valid lawful basis exists. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing your Account data, financial data, and transaction data is necessary to fulfil the contract between you and ja9 — specifically, to operate your Account, process deposits and withdrawals, and deliver the gaming services you have requested.
• Legal obligation: ja9 is subject to legal and regulatory obligations that require us to collect and retain certain data, including KYC identity verification, anti-money-laundering (AML) checks, and the maintenance of transaction records. Processing for these purposes is mandatory and cannot be opted out of.
• Legitimate interests: ja9 processes certain categories of technical and usage data on the basis of our legitimate interests in operating a secure, fraud-free platform; improving service quality; preventing multi-accounting; and ensuring responsible gaming compliance. We have conducted a legitimate interests assessment to confirm that these interests are not overridden by your rights and freedoms.
• Consent: Where processing activities are not covered by the above bases — for example, the use of non-essential analytical cookies — we will seek your consent prior to commencing such processing. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

ja9 uses the personal data we collect for the following specific purposes:

• Account management: Creating, maintaining, and administering your player Account, including processing login requests, managing your balance, and maintaining your preferences and responsible gaming settings.
• Identity verification (KYC/AML): Verifying your identity, age, and eligibility to use the platform in accordance with our legal and regulatory obligations, including anti-money-laundering requirements.
• Payment processing: Processing deposit and withdrawal requests accurately and promptly, reconciling transaction records, and investigating discrepancies or disputes relating to financial transactions.
• Customer support: Responding to your support queries, resolving complaints, and maintaining a record of your support interactions for quality assurance and dispute resolution purposes.
• Fraud and security: Detecting, investigating, and preventing fraud, money laundering, multi-accounting, bonus abuse, and any other form of Prohibited Conduct as defined in our Terms & Conditions. This includes monitoring for unusual betting patterns and suspicious transaction activity.
• Platform improvement: Analysing aggregated, anonymised usage data to improve the platform's design, game library, payment options, and overall user experience for players in Bangladesh and the wider regional market.
• Responsible gaming compliance: Monitoring gaming behaviour to identify potential indicators of problem gambling, managing self-exclusion requests, enforcing deposit limits and cooling-off periods, and sending responsible gaming communications where appropriate.
• Legal compliance: Retaining records as required by applicable law, responding to lawful requests from regulatory or law enforcement authorities, and defending ja9's legal position in the event of a dispute or legal proceedings.
• Service communications: Sending you essential transactional communications such as deposit confirmations, withdrawal status updates, KYC request notifications, and account security alerts. These communications are not marketing and cannot be opted out of while your Account is active.
• Promotional communications: Where you have opted in to receive marketing communications, sending you information about bonuses, promotions, new games, and special events relevant to the Bangladesh market (including seasonal promotions for Eid, Pohela Boishakh, and major cricket tournaments such as BPL and T20 World Cup). You may opt out of marketing communications at any time via your Account settings.

ja9 does not sell your personal data. We share personal data with third parties only in the following limited and controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, and USDT network infrastructure providers receive only the data necessary to process your specific transaction (for example, your mobile number for bKash, or your wallet address for USDT). These providers act as independent data controllers for their own services under their own privacy policies.
• KYC and identity verification providers: Third-party identity verification services receive your identity documents and, where required, biometric data, solely for the purpose of verifying your identity on ja9's behalf. These providers are engaged under binding data-processing agreements that restrict their use of your data to the agreed verification purpose.
• Game providers: Game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) receive a session token and minimum necessary data to authenticate and deliver game content to your device. Game providers do not receive your full identity or financial data.
• IT and hosting infrastructure: ja9's platform is hosted on secure cloud infrastructure. Our hosting providers have access to server-level data as a necessary function of delivering the hosting service and are bound by strict confidentiality and data security obligations.
• Legal and regulatory authorities: ja9 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a court order, or a legally binding regulatory request. We will notify you of any such disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ja9's business, personal data held by ja9 may be transferred to the acquiring entity as part of that transaction. Affected players will be notified prior to the transfer and the acquiring entity will be required to honour this Privacy Policy.

ja9 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations, whichever is the longer. Our principal retention periods are as follows:

• Account data (active accounts): Retained for the duration of your Account's active status plus a minimum of 5 years following Account closure, to satisfy financial record-keeping and AML obligations.
• Identity and KYC documents: Retained for a minimum of 5 years from the date of verification or from the date of Account closure, whichever is later. This period reflects standard AML and due-diligence record-keeping requirements.
• Transaction records: Deposit, withdrawal, bet, and win/loss records are retained for a minimum of 5 years from the date of the transaction.
• Customer support communications: Retained for 2 years from the date of the most recent interaction in a given support thread, or until any related dispute is fully resolved, whichever is later.
• Technical and log data: Server logs and IP access records are retained for up to 12 months from the date of collection, after which they are deleted or irreversibly anonymised.
• Responsible gaming records: Self-exclusion records, deposit limit histories, and cooling-off period logs are retained for the duration of the relevant restriction plus 5 years, to prevent circumvention of self-exclusion arrangements.
• Inactive accounts: Where an Account has been inactive for 12 consecutive months with no login, deposit, or betting activity, ja9 may close the Account and initiate a data-minimisation review. Core identity and financial records required by law are retained; non-essential usage data may be deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual.

As a data subject, you hold the following rights in respect of your personal data held by ja9. These rights may be subject to certain conditions and limitations under applicable law, but ja9 will always consider requests carefully and respond within a reasonable timeframe:

To exercise any of the above rights, please contact ja9's Data Protection team via the support channel available after logging in to your Account, or in writing to the email address published in Section 14 of this Policy. We will acknowledge your request within 3 business days and respond substantively within 30 calendar days. Where a request is particularly complex or numerous, this period may be extended by a further 30 days; we will notify you if an extension is required.

ja9 uses cookies and similar client-side tracking technologies to deliver and improve the platform. The categories of cookies we use are as follows:

• Strictly necessary cookies: These cookies are essential to the operation of the platform and cannot be disabled. They maintain your login session, store your language preferences, and enable core security features including CSRF protection and fraud detection flags. No consent is required for strictly necessary cookies.
• Functional cookies: These cookies remember your preferences — such as your preferred payment method display or your last visited game category — to provide a more personalised experience. These are set only with your consent.
• Analytical cookies: ja9 uses anonymised analytics data to understand how players navigate the platform — which pages are most visited, where players drop off, and how game categories perform. This data is aggregated and cannot be used to identify individuals. Analytical cookies are set only with your consent.
• Security and fraud-prevention cookies: These cookies are used by our fraud-detection systems to identify unusual patterns of behaviour that may indicate account takeover, multi-accounting, or bot activity. These are strictly necessary for platform security and cannot be disabled.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning correctly and may result in your inability to access your Account. Disabling optional cookies will not affect core platform functionality.

ja9 implements a layered technical and organisational security framework to protect your personal data against unauthorised access, loss, destruction, or disclosure. Our security measures include:

• TLS 1.3 encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records.
• Bcrypt hashing with salting for all stored account passwords — ja9 never stores passwords in plain text.
• Role-based access controls ensuring that only authorised personnel with a specific operational need can access personal data.
• Comprehensive audit logging of all access events involving personal data, reviewed regularly by our security team.
• Two-factor authentication (2FA) required for all administrative system access.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Documented data breach response procedures, including notification to affected players within 72 hours of becoming aware of a breach that poses a high risk to their rights and freedoms.

While ja9 takes all reasonable technical precautions, no platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying us immediately if you suspect unauthorised access to your Account.

Where ja9 becomes aware that personal data has been collected from a person under the age of 18, all such data will be deleted immediately and the associated Account will be permanently closed. If you believe that a minor may have registered on the platform, please contact our support team immediately via the live chat channel so that we can investigate and act without delay.

Parents and guardians who are concerned about a minor's access to online gambling platforms are encouraged to use parental control software and internet filtering tools to restrict access to gambling websites. Our Responsible Gaming page contains additional guidance on protecting vulnerable individuals.

ja9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. The updated Policy will be published at ja9.lat/privacy-policy with a revised effective date displayed prominently at the top of the document.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will notify registered players by email or via an in-platform notification at least 14 days before the changes take effect. Your continued use of the platform after the revised Policy takes effect constitutes your acknowledgement of the updated terms.

We recommend that you review this Privacy Policy periodically to stay informed about how ja9 protects your data. The version history below records all material revisions:

• Version 2026.1 — 1 January 2026: Initial published version for ja9.lat. Covers all data categories, processing purposes, retention periods, and player rights as described in this document.

If you have any questions, concerns, or requests relating to this Privacy Policy or to ja9's handling of your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live chat: Available 24/7 via the support widget within your logged-in Account area, staffed by agents operating on Bangladesh Standard Time (BST, UTC+6).
• Written subject line: Please use the subject line "Privacy Request — [Your Username]" when contacting us about a data subject rights request so that our team can prioritise and route your query correctly.

We aim to acknowledge all privacy-related enquiries within 3 business days and to provide a substantive response within 30 calendar days of receipt. If your request is particularly complex, we may extend this period by a further 30 days and will inform you accordingly.