joa99 Privacy Policy

Definitions

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "joa99", "We", "Us", "Our" — the operator of the joa99 platform at joa99.io, responsible for decisions about how personal data is collected and used.
• "You", "Member", "Player" — any individual who visits, registers on, or interacts with the joa99 platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including name, phone number, email address, payment details, device identifiers, and IP address.
• "Processing" — any operation performed on personal data, including collection, storage, use, transmission, and deletion.
• "Third Party" — any entity other than joa99 and the Member, including payment processors, KYC providers, and fraud-detection services.
• "KYC" — Know Your Customer verification, the identity-checking process required before withdrawals are processed.
• "Cookie" — a small text file placed on your device by the joa99 platform to enable certain features and collect analytical data.

Data We Collect

joa99 collects personal data through three primary channels: information you provide directly, information generated automatically by your use of the platform, and information received from trusted third-party sources.

How We Use Your Data

Every use of your personal data at joa99 is tied to a specific operational or legal purpose. We do not use your data for any purpose beyond those listed below without first obtaining your separate consent:

• Account creation and management: To register your account, verify your identity, maintain your profile, and administer your account balance and transaction history.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to reconcile financial records.
• KYC and fraud prevention: To verify that you meet the 21+ age requirement, confirm your identity matches your payment method, and detect and prevent fraudulent or suspicious activity on your account.
• Service delivery: To allow you to place bets on cricket (BPL, IPL, T20 World Cup, Bangladesh Tigers), volleyball, and other sports markets, and to access casino and slot game content.
• Bonus and promotion administration: To calculate and credit your daily bonus, track wagering requirement progress, and manage promotional eligibility.
• Responsible gaming monitoring: To identify patterns of play that may indicate problem gambling behaviour and to apply any self-imposed limits or restrictions you have requested.
• Customer support: To respond to your queries, complaints, and requests, and to maintain a record of our communications for quality assurance purposes.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the joa99 platform, fix technical issues, and enhance the Member experience.
• Legal compliance: To meet our obligations under applicable anti-money laundering, counter-terrorism financing, and data protection laws.

Legal Basis for Processing

joa99 relies on the following legal bases to process your personal data:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary to fulfil our contract with you — specifically, to operate your joa99 account and process your transactions.
• Legal obligation: KYC verification, anti-money laundering checks, and the retention of certain financial records are required by applicable law, irrespective of your consent.
• Legitimate interests: We process technical data and usage data on the basis of our legitimate interests in operating a secure, fraud-free platform and improving our service — provided those interests are not overridden by your rights.
• Consent: Where we use your data for direct marketing communications (such as promotional emails or SMS notifications about new bonuses), we rely on your separately given consent, which you may withdraw at any time.

You may withdraw consent for marketing communications at any time by contacting [email protected] or using the unsubscribe option in any marketing message. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Data Sharing

joa99 does not sell your personal data. We share your data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy policy and applicable financial regulations.
• KYC and identity verification providers: We share identity data with licensed third-party KYC providers for the purpose of verifying your identity and age. These providers are contractually prohibited from using your data for any other purpose.
• Fraud and security services: Technical data and transaction data may be shared with fraud-detection platforms to identify and prevent abuse, money laundering, and account takeover attacks.
• IT and hosting infrastructure providers: Our platform is hosted on secure servers. Infrastructure providers have access to data only as necessary for technical maintenance and are bound by strict confidentiality obligations.
• Legal and regulatory authorities: We will disclose personal data to law enforcement, regulatory bodies, or courts when required to do so by law or valid legal process, or to protect the safety and security of our platform and Members.

Cookies & Tracking Technologies

joa99 uses cookies and similar tracking technologies to operate essential platform functions, remember your preferences, and collect anonymised analytics data. The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in and security cookies that prevent cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences such as your preferred language setting and display options. Disabling these cookies may reduce your platform experience.
• Analytical cookies: Collect anonymised data about how Members use the platform — which pages are visited, how long sessions last, and where navigation errors occur. This data is used solely to improve the joa99 platform and is not tied to your identity.
• Security and fraud-prevention cookies: Help us detect unusual login behaviour, identify bots and automated scripts, and flag accounts that may have been compromised.

You may manage cookie preferences through your browser settings. Note that disabling all cookies except strictly necessary ones may affect your ability to use certain joa99 features. joa99 does not use third-party advertising cookies or retargeting pixels.

Data Retention

joa99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five years after account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and betting records: Retained for a minimum of five years following the date of the transaction, as required for financial auditing and regulatory compliance purposes.
• KYC documentation: Retained for five years after the date of verification, or longer if required by a regulatory authority or legal process.
• Support communications: Retained for three years from the date of the most recent interaction, to allow review in the event of a dispute or complaint.
• Analytical and usage data: Retained in anonymised, aggregated form indefinitely for platform improvement purposes. Anonymised data cannot be used to re-identify any individual Member.
• Marketing consent records: Retained for the duration of your consent and for two years after withdrawal, to demonstrate compliance with consent requirements.

When data reaches the end of its retention period, it is securely deleted or anonymised. We conduct periodic data audits to ensure retention practices remain consistent with this policy.

Data Security

joa99 implements a layered security architecture to protect your personal data against unauthorised access, loss, alteration, and disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers.
• Encrypted storage of all sensitive personal data and financial records within our database infrastructure.
• Role-based access controls that restrict internal access to personal data to staff with a genuine operational need.
• Regular security audits and vulnerability assessments conducted by qualified security professionals.
• Multi-factor authentication requirements for all joa99 administrative systems.
• Continuous server monitoring for anomalous activity, with automated alerts and incident response procedures in place.

In the event of a data security incident that poses a material risk to your rights, joa99 will notify affected Members as promptly as practicable and take all reasonable steps to contain and remediate the incident. No security system is infallible; however, joa99 is committed to maintaining industry-standard protections at all times.

Your Rights

As a joa99 Member, you hold the following rights over your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" and we will respond within 30 days:

• Right of access: You may request a copy of all personal data joa99 holds about you, together with information about how it is being used.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For minor details such as address or contact number, you can update these directly through your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we cannot delete data we are legally required to retain, such as anti-money laundering records.
• Right to restriction: You may request that we restrict the processing of your data — for example, while a rectification request is being investigated — rather than deleting it.
• Right to data portability: You may request a copy of the personal data you have provided to joa99 in a structured, machine-readable format, where technically feasible.
• Right to object: You may object at any time to the processing of your data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to joa99 demonstrating a compelling legitimate ground.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Children's Privacy

The joa99 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process personal data belonging to individuals under the age of 21. If you are under 21, you must not register an account or use any part of the joa99 platform.

If joa99 becomes aware that personal data has been collected from a person under the age of 21 — whether through account registration, KYC checks, or any other means — that account will be immediately suspended, all associated data will be securely deleted in accordance with our data retention procedures, and any funds held in the account will be managed in accordance with our Terms & Conditions.

Parents or guardians who believe that a minor in their care has registered a joa99 account are encouraged to contact us immediately at [email protected] so that we can take swift action.

Third-Party Links

The joa99 platform does not contain links to third-party websites for commercial or advertising purposes. However, in the course of processing your payments, you may be redirected to the secure portals of our payment partners — bKash, Nagad, Rocket, and Upay — to authenticate transactions. These portals are operated by their respective providers and are governed by those providers' own privacy policies.

joa99 has no control over the data practices of third-party payment portals and accepts no responsibility for the privacy or security practices of those external services. We recommend reviewing the privacy policy of any third-party service before providing your credentials or personal data through their interface.

Policy Updates

joa99 reviews this Privacy Policy at least annually and whenever our data practices change in a material way. When we make significant updates — such as introducing a new category of data collection, engaging a new class of third-party processor, or changing retention periods — we will notify registered Members by email and by displaying a prominent notice on the platform at least seven days before the changes take effect.

The most current version of this Privacy Policy is always available at joa99.io/privacy-policy. The "Effective" date shown in the page header reflects the version currently in force. Minor updates — such as typographical corrections, clarifications that do not change the substance of the policy, or contact detail updates — may be made without prior notice.

Your continued use of the joa99 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any change, you should close your account before the revision takes effect and contact [email protected] to exercise your data rights.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how joa99 has handled your personal data, please contact our Data Support team using the details below. All privacy-related communications should be directed to the email address below and clearly marked with the nature of the request in the subject line.

• Email: [email protected] — subject line: "Privacy Request" or "Data Rights Request"
• Response Time: Within 30 calendar days of receiving a valid, verifiable request
• Verification: To protect your data, we may ask you to verify your identity before fulfilling a data rights request
• No Charge: Data rights requests are handled free of charge in all standard cases
• Availability: Our support team is available 24 hours a day, 7 days a week, including Eid and public holidays