Privacy Policy — How joya33 Collects, Uses, and Protects Your Data

joya33 collects personal data through the following channels:

• Registration: When you create a joya33 account, you voluntarily provide your name, date of birth, mobile number, and email address.
• Identity verification: When you submit KYC documents such as a National Identity Card (NID), passport, or utility bill in response to a verification request.
• Deposits and withdrawals: When you use bKash, Nagad, Rocket, or Upay to fund or withdraw from your account, transaction metadata — including the mobile wallet number and transaction reference — is captured.
• Platform use: Automatically collected data including your IP address, device type, operating system, browser version, session duration, pages visited, games played, and bet history is logged during your use of joya33.
• Support interactions: When you contact the joya33 support team by email or live chat, the content of those communications is stored for quality assurance and dispute resolution purposes.
• Cookies and tracking technologies: joya33 uses first-party cookies and similar technologies to maintain session state, remember user preferences, and gather aggregate analytics data. See Section 8 for full cookie details.

joya33 does not collect personal data from minors. If we become aware that a user under the age of 21 has provided personal data, we will immediately close the account and delete all associated data.

joya33 processes your personal data on the following legal grounds:

• Contractual necessity: Processing is required to fulfil our obligations under the Terms & Conditions you agreed to when registering, including account management, payment processing, and game delivery.
• Legal obligation: joya33 is required to conduct KYC and anti-money laundering (AML) checks under internationally recognised compliance frameworks. Retention of certain records is also mandated for a defined period.
• Legitimate interests: joya33 has a legitimate interest in detecting fraud, preventing abuse, securing the platform, and improving its services through analytics — provided these interests do not override your fundamental rights and freedoms.
• Consent: Where joya33 sends you optional marketing communications (e.g., promotional offers, seasonal campaigns for Eid or Pohela Boishakh), we do so only with your prior consent, which you may withdraw at any time from your account settings.

joya33 uses the personal data we collect for the following purposes:

• Creating, verifying, and maintaining your joya33 account.
• Processing deposits and withdrawals in Bangladeshi Taka (৳) via bKash, Nagad, Rocket, and Upay.
• Verifying your age and identity to satisfy the 21+ requirement and KYC obligations.
• Detecting and preventing fraudulent activity, account duplication, bonus abuse, money laundering, and other prohibited conduct.
• Delivering customer support and resolving account or gameplay disputes.
• Monitoring your gaming activity to identify responsible gaming concerns and, where appropriate, applying protective measures such as deposit limits or cooling-off periods.
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional communications, including bonus offers and joya33 event announcements, where you have opted in to receive them.
• Improving the platform through aggregate, anonymised usage analytics.

joya33 does not use automated profiling or algorithmic decision-making in a way that produces legal or similarly significant effects on individual users without human review.

joya33 does not sell your personal data. We share data only in the following limited circumstances:

• Payment processors: Your mobile number and transaction details are shared with bKash, Nagad, Rocket, or Upay only to the extent necessary to process a specific deposit or withdrawal you have initiated.
• Game providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive your session token and game-play data to enable their games to function correctly within the joya33 platform. These providers operate under strict data processing agreements and may not use your data for their own independent purposes.
• Identity verification services: Third-party KYC providers may process identity documents submitted during verification. All such providers are bound by confidentiality and data security obligations.
• Legal and regulatory requirements: joya33 may disclose personal data to law enforcement authorities or regulatory bodies where required by applicable law, a valid court order, or to protect the legal rights of joya33 or third parties.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity. Users will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

All third parties who receive personal data from joya33 are contractually required to treat it with at least the same level of protection described in this Policy and to use it only for the specific purpose for which it was disclosed.

joya33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and compliance obligations. The following general retention periods apply:

• Active accounts: Personal data is retained for the full duration of the account relationship.
• Closed accounts: Following account closure, joya33 retains transaction records, KYC documents, and account history for a minimum of five years to satisfy AML compliance requirements.
• Support communications: Records of support interactions are retained for three years from the date of the interaction.
• Marketing consent records: Records of your opt-in consent for marketing communications are retained for the duration of the marketing relationship plus one year.

When personal data is no longer required and no legal obligation exists to retain it, joya33 will securely delete or anonymise the data in accordance with our internal data destruction procedures.

As a joya33 user, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered mobile number or username for identification purposes.

• Right of access: You may request a copy of the personal data joya33 holds about you. We will respond within 14 days of receiving a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Basic details such as your email address and mobile number can also be updated directly from your account settings.
• Right to erasure: You may request that joya33 permanently delete your account and personal data. Note that we may be required to retain certain records for up to five years under our AML compliance obligations, even following an erasure request.
• Right to restrict processing: In certain circumstances, you may request that we limit the way we process your data while a dispute or objection is being considered.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

joya33 will not discriminate against you for exercising any of these rights. We aim to acknowledge all data rights requests within 48 hours and to resolve them within 14 calendar days.

joya33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and joya33 servers.
• Encryption of sensitive data at rest, including KYC documents and financial records.
• Role-based access controls ensuring that only authorised personnel can access personal data relevant to their specific job function.
• Regular internal security audits and third-party penetration testing of platform infrastructure.
• Multi-factor authentication (MFA) for all internal system access by joya33 staff.
• Automated intrusion detection and anomaly monitoring systems operating 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6).

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights, joya33 will notify affected users without undue delay and take all reasonable steps to contain and remediate the incident.

You also play a role in keeping your data secure. Use a strong, unique password for your joya33 account, do not share your login credentials, and contact [email protected] immediately if you suspect unauthorised access.

joya33 uses cookies and similar technologies (including local storage and session tokens) to operate and improve the platform. The following categories of cookies are used:

• Essential cookies: Required for the platform to function. These maintain your login session, remember your language and currency settings, and enable secure transactions. These cookies cannot be disabled without disrupting the service.
• Analytics cookies: Used to collect aggregate, anonymised data about how users navigate and interact with joya33. This helps us identify areas for improvement. No personally identifiable information is included in analytics data.
• Preference cookies: Store your user preferences such as display settings and notification choices so they are remembered across sessions.
• Security cookies: Used by our fraud detection systems to identify unusual or potentially malicious activity patterns.

joya33 does not use third-party advertising or cross-site tracking cookies. You can manage cookie settings through your browser. Note that disabling essential cookies will prevent you from logging in or using the platform normally.

joya33 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify registered users by email to the address on their account at least 7 days before the changes take effect.

The updated Policy will always be available at joya33.app/privacy-policy with the revised effective date clearly displayed at the top of the document. Your continued use of joya33 after the effective date of any revision constitutes your acceptance of the updated Policy.

If you have questions about any changes to this Policy, or if you wish to review the previous version, please contact us at [email protected].