joya2 Privacy Policy — Your Data, Your Rights

1Introduction

This Privacy Policy ("Policy") describes how joya2 ("we", "us", "our", "joya2") collects, processes, stores, and protects personal data obtained from users ("you", "User", "Player") of the joya2 website and all services available through it. This Policy forms part of the joya2 Terms and Conditions and is incorporated therein by reference. By registering an account or using any service on the joya2 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

joya2 takes data privacy seriously. We collect only the data that is necessary to provide our services, comply with our legal obligations, and protect the security of our platform and our users. We do not sell your personal data to third parties. We do not use your data for purposes beyond those described in this Policy without your explicit consent.

2Data We Collect

joya2 collects personal data through multiple channels: information you provide directly when registering, information generated automatically through your use of the platform, and in limited cases, information received from trusted third-party service providers such as payment processors and identity verification services. The categories of data we collect are described below.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly required for identity verification purposes. Where identity documents are submitted for KYC, they are processed securely and retained only for as long as required under our data retention policy.

3How We Use Your Data

joya2 uses personal data collected from users for specific, legitimate purposes directly connected to the delivery of our services. We do not use your data for purposes outside those listed below without obtaining your additional consent.

• To create and manage your joya2 account, verify your identity, and maintain the security and integrity of your account throughout its lifecycle, including processing KYC documentation in compliance with applicable legal requirements.
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other approved payment methods, verify the ownership of payment instruments, detect and prevent fraudulent transactions, and comply with anti-money-laundering obligations.
• To deliver the gaming and betting services you request, personalise your experience on the joya2 platform, recommend relevant games or promotions based on your activity history, and administer promotional offers including bonuses, free spins, and seasonal promotions tied to events such as Eid and BPL.
• To operate our responsible gaming programme, including monitoring gaming activity for signs of problem gambling, enforcing deposit limits and session time controls set by users, processing self-exclusion requests, and contacting users where our responsible gaming monitoring identifies patterns of concern.
• To communicate with you regarding your account, including transaction confirmations, security alerts, password reset notifications, and updates to these Terms or this Policy. We may also contact you with promotional communications where you have consented to receive them — you may withdraw this consent at any time by contacting support.
• To analyse platform usage, improve the joya2 user experience, diagnose technical issues, and conduct internal analytics to guide product development decisions. Analytics data used for this purpose is aggregated and anonymised wherever possible.

4Legal Basis for Processing

joya2 processes personal data only where there is a legitimate legal basis for doing so. The legal bases on which we rely are as follows.

• Contractual necessity: processing required to fulfil our obligations under the Terms and Conditions you accepted when registering your account, including delivering gaming services, processing financial transactions, and maintaining your account.
• Legal obligation: processing required to comply with applicable laws, including anti-money-laundering regulations, KYC requirements, age verification obligations, and any lawful request from a competent regulatory or law enforcement authority.
• Legitimate interests: processing necessary to pursue our legitimate business interests where those interests are not overridden by your rights and interests, including fraud detection and prevention, platform security, responsible gaming monitoring, and internal analytics for service improvement.
• Consent: where we rely on your consent as the legal basis for processing — for example, for marketing communications — you may withdraw that consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing that took place before the withdrawal.

5Sharing Your Data

joya2 does not sell your personal data to any third party under any circumstances. We share personal data only in the limited circumstances described below, and only to the extent necessary for each specific purpose.

• Payment processors and mobile wallet operators (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other approved payment partners): we share transaction data required to process your deposits and withdrawals. These partners are contractually bound to process your data only for the purpose of fulfilling the specific transaction.
• Identity verification and KYC service providers: where we use third-party services to verify your identity documents, those providers are given access only to the specific documents and data required for verification and are contractually restricted from using that data for any other purpose.
• Game content providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming, and others): when you play games supplied by these providers through the joya2 platform, certain technical session data (such as session tokens and game round identifiers) is exchanged with the provider's systems to deliver the game. These providers are not permitted to use this data to identify you or market to you independently.
• Regulatory and law enforcement authorities: joya2 will disclose personal data to competent authorities where required to do so by applicable law, court order, or other legally binding process. We will, where legally permitted, notify you of any such disclosure.

6Cookies & Tracking Technologies

joya2 uses cookies and similar tracking technologies to ensure the platform functions correctly, maintain your login session, remember your preferences, and gather anonymous usage analytics that help us improve the platform. Cookies are small text files placed on your device when you visit the joya2 website. They do not give us access to your device beyond the information stored in the cookie itself.

We use three categories of cookies: essential cookies that are strictly necessary for the platform to function (these cannot be disabled); functional cookies that remember your preferences and session state; and analytics cookies that help us understand aggregate usage patterns on the platform. We do not use advertising or retargeting cookies, and we do not share cookie data with advertising networks.

7Data Retention

joya2 retains personal data only for as long as it is necessary for the purposes described in this Policy, including compliance with applicable legal obligations. The specific retention periods that apply to different categories of data are determined by the nature of the data and the legal or operational requirements that apply to it.

Account data and associated KYC documentation are retained for a minimum of five years from the date of account closure, in compliance with anti-money-laundering regulations. Transaction records are retained for a minimum of five years from the date of each transaction. Gaming activity logs are retained for two years from the date of the relevant session. After the applicable retention period has expired, data is securely deleted or anonymised so that it can no longer be linked to you as an individual.

8Data Security

joya2 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include SSL/TLS encryption for all data transmitted between your device and our servers, encrypted storage of sensitive account data, access controls that restrict internal access to personal data to authorised personnel only, and regular security reviews of our systems and infrastructure.

While joya2 employs industry-standard security practices, no system of data transmission or storage can be guaranteed to be completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, joya2 will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach. You can help protect your account by using a strong, unique password and by notifying us immediately if you suspect any unauthorised access to your account.

9Your Data Rights

As a user of joya2, you have specific rights with respect to your personal data. joya2 is committed to facilitating the exercise of these rights. To exercise any of the rights described below, please contact our support team at [email protected] with your full name and registered mobile number so that we can verify your identity before processing your request.

10Third-Party Services & Links

The joya2 platform integrates with third-party game providers and payment services whose software and systems operate independently of joya2. These third parties have their own privacy policies and data practices. joya2 is not responsible for the data practices of third-party game providers or payment operators. We encourage you to review the privacy policies of any third-party services you interact with through joya2. joya2 does not link to external third-party websites beyond the operational integrations required to deliver games and process payments.

11Minors & Age Verification

joya2 does not knowingly collect personal data from individuals under the age of 21. The joya2 platform is strictly intended for adults aged 21 and above. Age verification is conducted during the registration process and as part of our ongoing KYC obligations. Where joya2 becomes aware that personal data has been collected from a user who is under 21, that account will be closed immediately and all data associated with the underage user will be deleted, subject to any mandatory legal retention obligations.

12Changes to This Policy

joya2 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or changes in the services we offer. When material changes are made, we will update the "Last Updated" date at the top of this page. For significant changes that affect how we use your personal data in a materially different way, joya2 will provide more prominent notice, which may include a notification displayed to you on the platform at the time of your next login.

Your continued use of the joya2 platform following the posting of any amended Privacy Policy constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how we are protecting your personal data. The most current version of this Policy will always be available at joya2.vip/privacy-policy.

13Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the way joya2 handles your personal data, please contact our support team. We are available 24/7 and will respond to all privacy-related enquiries as promptly as possible, and in all cases within the timeframes required by applicable law.