Privacy Policy — How j2w Handles Your Personal Data

Data We Collect

j2w collects personal data only to the extent necessary to provide you with a safe, functional, and compliant online gaming experience. We do not collect data speculatively. The categories of personal data we collect are described in the table below.

Data You Provide Directly

The majority of personal data j2w holds is provided directly by you at registration, during identity verification, or through your ongoing use of the platform. You are responsible for ensuring that any data you provide is accurate, complete, and up to date. Inaccurate data may delay withdrawals, trigger account verification holds, or result in account suspension as described in our Terms & Conditions.

Data Collected Automatically

Certain technical and behavioural data is collected automatically whenever you interact with the j2w platform. This includes your IP address (used for geolocation, fraud detection, and security monitoring), device identifiers, browser fingerprint data, session start and end times, and in-page click and scroll behaviour used to improve platform usability. This data is collected via first-party server logs and, where applicable, session analytics tools operating under strict data processing agreements with j2w.

Data from Third Parties

In limited circumstances, j2w may receive supplementary personal data about you from trusted third-party sources. These include identity verification bureaus used to confirm your NID or passport during the KYC process, payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard) who confirm transaction status and account ownership, and fraud prevention services that flag known patterns of abusive behaviour. Data received from third parties is only retained where it is directly relevant to operating your account or meeting a legal obligation.

How We Use Your Data

j2w uses personal data for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the purposes described below. The primary purposes for which j2w processes your personal data are as follows:

Account Management and Service Delivery

Your identity, contact, and financial data are used to create and maintain your j2w account, process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, verify your age and identity in compliance with our 18+ policy, deliver the games and betting markets you access on the platform, and provide English-language customer support via live chat and email from 09:00 to 22:00 BST (UTC+6) daily.

Security, Fraud Prevention, and Compliance

j2w uses technical and activity data to detect and prevent unauthorised account access, identify patterns consistent with fraud, money laundering, duplicate account registration, or bonus abuse, enforce the single-account rule and age restriction requirements, and comply with any applicable anti-money-laundering (AML) and counter-terrorism-financing (CTF) obligations. Where suspicious activity is detected, j2w may share relevant data with law enforcement authorities in Bangladesh without prior notice to the account holder where legally required or permitted.

Responsible Gaming Monitoring

j2w actively monitors account activity data to identify patterns that may indicate harmful gambling behaviour, including rapid increases in deposit frequency, large losses relative to historical deposit levels, and unusual session durations. This monitoring is carried out in the interest of player welfare and forms part of j2w's responsible gaming commitment. See the Responsible Gaming page for full details of the tools and support available to j2w players in Bangladesh.

Platform Improvement and Analytics

Anonymised and aggregated behavioural data (from which individual users cannot be identified) is used by j2w to understand how the platform is used, identify technical issues, prioritise feature development, and optimise page performance for users connecting from cities across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

Marketing Communications (Consent-Based Only)

With your explicit consent at registration (or subsequently via account settings), j2w may send you promotional emails and SMS messages about new games, upcoming cricket and BPL tournament betting markets, seasonal promotions around Eid, Pohela Boishakh, and Victory Day, and exclusive j2w bonus offers. Marketing communications will always include a clear, one-click unsubscribe mechanism. j2w does not send unsolicited marketing communications to users who have not opted in.

Legal Basis for Processing

j2w processes your personal data on one or more of the following legal grounds, depending on the specific processing activity involved:

• Contractual necessity: Processing your identity, contact, and financial data to create and operate your j2w account and process your transactions is necessary to fulfil the contract between you and j2w as established by the Terms & Conditions.
• Legal obligation: Age verification, identity verification (KYC), and transaction monitoring are carried out to meet obligations under applicable laws and regulations governing online gaming and financial services in Bangladesh.
• Legitimate interests: Security monitoring, fraud detection, platform analytics, and responsible gaming monitoring are carried out on the basis of j2w's legitimate interests in maintaining a safe, fair, and legally compliant platform — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Marketing communications and the use of non-essential cookies are processed only where you have given explicit, freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing & Third Parties

j2w does not sell your personal data. We share your data with third parties only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

Payment Processors

To process deposits and withdrawals, j2w shares your account reference and transaction details with your chosen payment provider — bKash, Nagad, Rocket, Upay, Visa, or Mastercard. Each of these providers operates under its own privacy policy and is independently responsible for data it collects through its own interfaces. j2w does not store full card numbers or mobile banking PINs.

Game Providers

j2w's game library is supplied by third-party studios including Evolution Gaming, Pragmatic Play, Pragmatic Play Live, Ezugi, NetEnt, Microgaming, and Spribe. When you launch a game, a session token (a pseudonymous identifier that does not include your name or contact details) is passed to the relevant game provider's server to initialise the game session and record the game outcome. Game providers do not receive your full profile data.

Identity Verification Partners

During KYC verification, j2w may share your submitted identity documents (NID, passport) with a trusted third-party verification bureau to confirm authenticity. These bureaus operate under strict data processing agreements with j2w and are prohibited from using your data for any purpose beyond the verification check.

Legal and Regulatory Authorities

j2w may disclose your personal data to law enforcement agencies, courts, or regulatory authorities in Bangladesh or other applicable jurisdictions where we are legally required or permitted to do so — for example, in response to a court order, a law enforcement request, or a regulatory investigation. j2w will not notify you of such disclosure where prohibited from doing so by law.

Business Transfers

In the event that j2w or a substantial part of its assets are acquired by or merged with another entity, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any material change in data controller via the email address registered on your account prior to any such transfer taking effect, and the successor entity will be required to honour the commitments made in this Privacy Policy.

Cookies & Tracking Technologies

j2w uses cookies and similar first-party tracking technologies to deliver a functional, personalised, and secure experience on the platform. We do not use third-party advertising cookies or cross-site tracking pixels.

Strictly necessary cookies cannot be disabled as they are essential for the platform to function. For functional and analytics cookies, you may manage your preferences via the cookie settings panel accessible from your j2w account dashboard. Please note that disabling functional cookies may affect the usability of certain platform features.

No Third-Party Ad Networks

j2w does not integrate with Google Ads, Meta Pixel, or any other third-party advertising network's tracking technology. The j2w platform does not serve behavioural advertising to users based on off-site browsing activity, and no cross-site user profiles are created from your j2w session data.

Data Retention & Deletion

j2w retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or to comply with applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account being active on the j2w platform.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction in compliance with applicable financial record-keeping requirements.
• KYC / identity verification documents: Retained for a minimum of 5 years from account closure or the completion of the verification process, whichever is later.
• Customer support communications: Retained for 3 years from the date of the communication, or longer where the communication relates to an unresolved dispute or legal matter.
• Marketing consent records: Retained for as long as the consent remains active and for 2 years after consent is withdrawn, to demonstrate compliance.
• Analytics data (anonymised): Retained indefinitely in anonymised, aggregated form from which no individual can be identified.

Upon account closure and expiry of all applicable retention periods, j2w will securely delete or irreversibly anonymise your personal data. You may request confirmation that your data has been deleted by contacting support@j2w.app after the applicable retention period has elapsed.

Your Privacy Rights

As a j2w player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the j2w support team at support@j2w.app with the subject line "Privacy Rights Request" and specify clearly which right you wish to exercise. j2w will acknowledge your request within one business day and respond in full within five business days.

Right of Access

You have the right to request a copy of all personal data j2w holds about you. Upon a verified access request, j2w will provide a structured, machine-readable summary of your account data, transaction history, game activity records, and support communications.

Right to Rectification

If any personal data j2w holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain data elements (such as your email address) directly via your account settings dashboard. For data that cannot be self-corrected (such as your registered legal name), submit a rectification request to support@j2w.app along with supporting documentation.

Right to Erasure

You may request deletion of your personal data. j2w will honour erasure requests subject to overriding legal retention obligations (see Data Retention above). Where j2w cannot fully erase data due to a legal obligation, we will inform you of what data has been retained and on what legal basis.

Right to Restrict Processing

You may request that j2w restricts the processing of your personal data in specific circumstances — for example, while a dispute over data accuracy is being resolved. During a restriction period, j2w may store your data but will not actively process it for any purpose other than the legal obligation that requires its retention.

Right to Data Portability

Where j2w processes your data on the basis of consent or contractual necessity, you have the right to receive that data in a structured, commonly used, machine-readable format (such as JSON or CSV) suitable for transfer to another service provider of your choice.

Right to Object

You have the right to object to j2w's processing of your personal data where that processing is based on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes at any time — j2w will action marketing opt-out requests within 48 hours.

Data Security Measures

j2w employs a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include but are not limited to the following:

• 256-bit SSL/TLS encryption on all data in transit between your device and j2w servers
• AES-256 encryption for personal data stored in j2w databases
• Bcrypt password hashing — passwords are never stored in plain text or recoverable form
• SMS OTP two-factor authentication available for all account login and withdrawal actions
• Role-based access controls ensuring j2w staff can only access personal data relevant to their specific operational function
• Regular third-party penetration testing of the j2w platform infrastructure
• Automated intrusion detection and real-time security monitoring of server infrastructure
• Formal incident response procedures in place for security breaches, with player notification protocols meeting applicable standards

Security Breach Notification

In the unlikely event of a security breach that affects your personal data, j2w will notify affected account holders via their registered email address and/or SMS as soon as practicable after the breach has been confirmed and contained. The notification will describe the nature of the breach, the categories of data affected, the steps j2w has taken to address it, and any recommended actions for you as an account holder. j2w will also report the breach to the relevant authorities where required by law.

Your Role in Security

While j2w implements robust technical security measures, the security of your account also depends on actions you take. j2w strongly recommends that you use a unique, strong password for your j2w account (at least 8 characters including uppercase, numerals, and special characters), enable SMS OTP two-factor authentication, never share your password or OTP codes with anyone — including anyone claiming to be a j2w staff member (j2w will never ask for your password), and log out of your account when using shared or public devices. If you suspect your account has been compromised, contact j2w support immediately via live chat or at support@j2w.app.