joya7 Privacy Policy — How We Collect, Use, and Protect Your Data

1 Overview

joya7 ("joya7", "we", "us", "our") operates the online casino and sports betting platform accessible at joya7.io (the "Platform"). This Privacy Policy describes how joya7 collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "User", "Player") who visit or use the Platform.

We take our obligations regarding personal data seriously. The joya7 platform is designed for players in Bangladesh, and we process personal data in a manner consistent with fair-play, responsible gaming, and data-security best practices. All personal data we hold is treated with strict confidentiality and is processed only for the specific, legitimate purposes described in this document.

This Privacy Policy should be read alongside joya7's Terms & Conditions, which are incorporated by reference. In the event of a conflict between this Privacy Policy and any other document, this Privacy Policy shall prevail on matters relating to personal data.

2 Personal Data We Collect

joya7 collects personal data in two broad categories: data you provide directly, and data we collect automatically through your use of the Platform. The specific categories are as follows:

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number, and residential address in Bangladesh.
• Identity verification (KYC) documents: National Identity Card (NID) number, passport copy, or driving licence, as required for account verification and withdrawal processing.
• Payment data: bKash wallet number, Nagad wallet number, Rocket wallet number, Upay number, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or Sonali Bank account details, and Visa/Mastercard details (last four digits and billing name only — full card numbers are not stored by joya7).
• Communications data: Messages and correspondence you send to joya7 support at [email protected], including support ticket history and complaint records.
• Responsible gaming preferences: Self-exclusion elections, deposit limits, cooling-off requests, and session time preferences set by you in your account settings.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, bet amounts and outcomes, session duration, click patterns, and navigation paths within the Platform.
• Transaction data: Deposit amounts, withdrawal requests, bonus claims, wagering activity, and payment processing timestamps. All amounts are recorded in Bangladeshi Taka (BDT, ৳).
• Cookie and tracking data: As described in Section 6 of this Privacy Policy.
• Location data: Country and city-level geolocation data derived from your IP address, used to verify that you are accessing the Platform from Bangladesh.

3 How We Collect Your Data

joya7 collects personal data through the following channels:

• Account registration: When you create a joya7 account, you provide your name, date of birth, contact details, and payment method information.
• KYC verification: When you are prompted to complete identity verification, you submit documents directly through the Platform's secure upload facility.
• Deposits and withdrawals: Payment method details are captured at the time you initiate a deposit or request a withdrawal.
• Gameplay activity: Every game session, bet placement, and casino interaction generates usage data that is automatically logged by our Platform systems.
• Customer support: When you contact us at [email protected], we collect and store the content of your communications together with your account reference.
• Cookies and similar technologies: As described in Section 6, our Platform uses cookies and web analytics tools to collect technical and usage data automatically when you browse or play.
• Third-party game providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may share session-level technical data with joya7 for the purpose of dispute resolution and game integrity verification.

4 How and Why We Use Your Data

joya7 processes your personal data only for specific, lawful purposes. We do not process personal data in a manner incompatible with the purposes listed below:

• Account management: Creating, maintaining, verifying, and closing your joya7 account; enforcing the single-account policy; and communicating account-related notifications to you.
• Identity and age verification: Confirming that you are 21 years of age or older and that you are the rightful owner of the payment methods associated with your account. This is a legal and responsible-gaming obligation.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladeshi banks, and reconciling transaction records.
• Fraud prevention and security: Detecting and preventing duplicate accounts, bonus abuse, money laundering, unauthorised access, and other fraudulent or abusive activity on the Platform.
• Platform operation and improvement: Analysing usage patterns to improve game selection, page performance, payment flow, and overall user experience on the Platform.
• Responsible gaming compliance: Monitoring gameplay activity to identify potential problem-gambling indicators; enforcing deposit limits, cooling-off periods, and self-exclusion elections; and providing mandated responsible gaming disclosures.
• Customer support: Investigating and resolving queries, complaints, and disputes submitted to the joya7 support team.
• Legal and regulatory compliance: Meeting anti-money laundering (AML), Know Your Customer (KYC), and other legal obligations applicable to the Platform's operations.
• Marketing communications (with consent): Where you have opted in to receiving promotional communications, sending you information about joya7 bonuses, promotions, and new game releases. You may withdraw consent at any time by contacting [email protected].

5 How We Share Your Data

joya7 does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. Your data is shared only in the following limited circumstances and with the following categories of recipient:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive the minimum data necessary to process your payment transactions. These processors are contractually bound to handle your data securely and only for the purpose of completing the transaction.
• Game providers: Licensed studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive your session identifier and bet data to deliver game content and to support dispute resolution. Game providers do not receive your full identity or payment data.
• Identity verification partners: Third-party KYC providers may process your identity document data to verify your identity on behalf of joya7. These partners are contractually prohibited from using your data for any purpose other than identity verification for joya7.
• Platform infrastructure providers: Cloud hosting and data-centre providers who store and process Platform data on joya7's behalf, under strict data processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or lawful regulatory request, joya7 may disclose personal data to competent authorities. joya7 will notify you of any such disclosure unless legally prohibited from doing so.
• Professional advisers: Lawyers, auditors, and accountants acting in an advisory capacity, where strictly necessary and subject to professional confidentiality obligations.

6 Cookies and Tracking Technologies

joya7 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. The types of cookies used by joya7 are as follows:

6.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They enable core features such as user authentication, session management, and security token validation. These cookies cannot be disabled, as doing so would prevent the Platform from operating correctly.

6.2 Analytical and Performance Cookies

These cookies collect anonymised data about how players use the Platform — such as which pages are visited most frequently, how long sessions last, and where errors occur. This information helps joya7 improve Platform performance and user experience. The data collected by these cookies does not identify you personally.

6.3 Functional Cookies

These cookies remember your preferences and personalisation settings on the Platform, such as your preferred game categories, display settings, and account notification preferences. They improve the quality of your experience without affecting Platform security.

6.4 Managing Cookies

You may control or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform and may prevent some features from working as expected. Strictly necessary cookies cannot be disabled through browser settings without breaking core Platform functionality.

7 Data Retention

joya7 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, and to comply with our legal obligations. The general retention principles applied by joya7 are as follows:

• Account data: Retained for the duration of your active account relationship with joya7, and for a minimum of five (5) years following account closure, to meet AML/KYC record-keeping obligations.
• Transaction records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of five (5) years from the date of the transaction.
• KYC documents: Identity verification documents are retained for a minimum of five (5) years from the date of submission or account closure, whichever is later.
• Support communications: Customer support correspondence is retained for three (3) years from the date of the last message in the exchange.
• Self-exclusion records: Records of self-exclusion elections are retained for a minimum of seven (7) years to prevent re-registration during the exclusion period and to demonstrate compliance with responsible gaming obligations.
• Technical/log data: Server logs and technical data are retained for up to twelve (12) months and then automatically deleted or anonymised.

When personal data is no longer required for its retention purpose, joya7 will securely delete or anonymise it in a manner that prevents reconstruction of the original data.

8 Security Measures

joya7 takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the joya7 Platform is encrypted using 256-bit SSL/TLS protocols. This applies to all account pages, payment flows, and support communications.
• Encrypted data storage: Sensitive personal data — including identity document data, payment references, and account credentials — is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within joya7 is restricted on a strict need-to-know basis. Internal staff access is controlled through role-based access policies, and all access events are logged and audited.
• Two-factor authentication: Account login on joya7 is protected by OTP (one-time password) verification sent to your registered Bangladeshi mobile number, adding an additional layer of security beyond your password.
• Regular security assessments: joya7 conducts periodic internal security reviews to assess and address potential vulnerabilities in the Platform's infrastructure and data-handling processes.
• Incident response: In the event of a confirmed personal data breach that poses a risk to your rights, joya7 will notify affected users promptly and take all reasonable steps to contain and remediate the breach.

9 Your Rights Over Your Personal Data

As a joya7 player, you hold a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact joya7 at [email protected], referencing your registered account email and the specific right you wish to exercise. joya7 will respond to all data rights requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data joya7 holds about you, together with information about how it is being processed.
• Right to rectification: If any personal data held by joya7 is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account information directly through your account settings.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to joya7's legal obligations to retain certain data (see Section 7). Note that legal retention requirements may mean that not all data can be erased immediately upon request.
• Right to restrict processing: You may request that joya7 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to data portability: Where technically feasible and legally applicable, you may request a structured, machine-readable copy of the personal data you have provided to joya7, for the purpose of transferring it to another service provider.
• Right to withdraw consent: Where joya7 processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.
• Right to object: You may object to joya7 processing your personal data where that processing is based on legitimate interests, if you believe your interests, rights, or freedoms override those interests. joya7 will assess each objection on a case-by-case basis.

10 Protection of Minors

The joya7 platform is strictly restricted to individuals who are 21 years of age or older. joya7 does not knowingly collect, store, or process personal data relating to individuals under the age of 21.

As part of the account registration and KYC process, joya7 verifies the age of all players. Where joya7 has reason to believe that a user is under 21 years of age, the account will be immediately suspended pending verification, and any funds held in the account will be handled in accordance with responsible gaming obligations.

If a parent or guardian believes that a minor has submitted personal data to joya7, they should contact us immediately at [email protected]. joya7 will take prompt action to identify and delete any data associated with a minor's account, and to refund any deposits where this is legally required.

11 International Data Transfers

joya7's primary operations are focused on the Bangladesh market, and the majority of data processing takes place on infrastructure located in or serving the Asia-Pacific region. However, some of our third-party service providers — including game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may process certain technical session data on servers located outside Bangladesh.

Where personal data is transferred outside Bangladesh, joya7 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Bangladesh. These safeguards include contractual data processing agreements with each third-party processor that impose data security and confidentiality obligations consistent with this Privacy Policy.

By using the joya7 platform, you acknowledge that your personal data may be processed by third-party game providers in jurisdictions outside Bangladesh for the limited purposes of game delivery and dispute resolution, subject to the safeguards described above.

12 Changes to This Privacy Policy

joya7 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When a material change is made to this Privacy Policy, joya7 will notify registered players by email or via a prominent notice on the Platform at least 7 days before the change takes effect.

The effective date at the top of this document will be updated each time the Privacy Policy is revised. The most current version of this Privacy Policy is always available at joya7.io/privacy-policy. We encourage you to review this page periodically. Your continued use of joya7 following the publication of a revised Privacy Policy constitutes your acknowledgement of the changes.

13 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way joya7 handles your personal data, please contact our support team. All data-related enquiries are handled by a dedicated team member and will be responded to within 30 days.

Support email: [email protected]

When contacting us about a data rights request, please include your registered account email address, your full name as registered on joya7, and a clear description of your request or concern. This information helps us locate your records and respond accurately.

joya7 operates 24 hours a day, 7 days a week on Bangladesh Standard Time (BST, UTC+6). Our support team aims to acknowledge all incoming data-related requests within 24 hours of receipt and to provide a substantive response within 30 calendar days.