ijj Casino — Privacy Policy
How We Handle Your Data

In this Privacy Policy, the following terms carry the meanings assigned below unless the context requires otherwise:

ijj, operating at the domain ijj.bio, is the Data Controller responsible for the Personal Data of all Players who access or register on the platform. As Data Controller, ijj determines the purposes for which Personal Data is collected and the means by which it is processed.

All data protection queries, subject access requests, correction requests, erasure requests, and privacy complaints should be directed to ijj's designated data contact using the email address set out in Clause 15 of this Policy. ijj will acknowledge receipt of all formal written requests within two (2) business days and provide a substantive response within thirty (30) calendar days of acknowledgement.

ijj collects Personal Data across three primary touchpoints: account registration, ongoing platform use, and payment processing. The specific categories of data collected at each stage are set out in the table below:

3.1 Data Not Collected

ijj does not collect full payment card numbers at any stage — payment card processing is handled exclusively by certified third-party payment gateways that are PCI DSS compliant. ijj receives only tokenised references and transaction confirmation codes from card processors, not the underlying card data.

3.2 Sensitive Personal Data

ijj does not request or retain sensitive personal data categories such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond the minimum liveness verification data required for KYC compliance. Liveness check images are processed solely for identity verification purposes and are not retained for any secondary use.

ijj processes Player Personal Data for the following specific purposes. Each purpose is associated with the legal basis under which that processing activity is carried out, as detailed further in Clause 5:

• Account Creation and Management: Establishing and maintaining your ijj account, authenticating login sessions, managing your PKR wallet, and communicating account-related information;
• Age and Identity Verification (KYC): Confirming that all players are 21 years of age or older and verifying identity to comply with anti-money laundering obligations;
• Payment Processing: Executing deposit and withdrawal transactions via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other supported Pakistani payment methods;
• Platform Delivery: Providing access to casino games, sports betting markets, live dealer tables, Andar Bahar, Kalaka Bingo, and all other platform features;
• Fraud Detection and Security: Identifying suspicious account activity, detecting prohibited behaviour such as multi-accounting and bonus abuse, and protecting the integrity of the platform;
• Responsible Gaming Compliance: Monitoring gaming activity against self-imposed deposit limits and session controls, applying self-exclusion where requested, and identifying patterns that may indicate problem gambling behaviour for appropriate intervention;
• Customer Support: Responding to queries, resolving disputes, and maintaining records of support interactions for quality and compliance purposes;
• Legal and Regulatory Compliance: Fulfilling obligations under applicable anti-money laundering, counter-terrorism financing, and gaming licensing frameworks;
• Marketing Communications (where consented): Sending promotional offers, bonus notifications, and news about new games or features to players who have opted in to marketing communications.

Each processing activity carried out by ijj rests on one of the following legal bases:

ijj shares Player Personal Data only with the categories of third parties listed below, and only to the extent necessary for the specific purpose described. ijj does not sell Player data to any third party.

6.1 Payment Processors

Transaction data including account references, transaction amounts in PKR, and Player identity confirmation is shared with licensed Pakistani payment service providers — specifically JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — to execute deposit and withdrawal instructions. Each provider processes this data in accordance with its own privacy policy and applicable Pakistani financial regulation.

6.2 KYC and Identity Verification Services

Identity document images and personal details required for age verification and KYC compliance are shared with certified identity verification service providers. These providers are contractually bound to process data solely for the verification purpose and to apply equivalent data protection standards to those maintained by ijj.

6.3 Game Content Providers

Session identifiers and anonymised technical data are shared with licensed game content providers — including live dealer studio operators — to facilitate game delivery, maintain game integrity records, and resolve disputes relating to game outcomes. Full identity data is not shared with game providers.

6.4 Regulatory and Law Enforcement Authorities

ijj will disclose Personal Data to competent regulatory or law enforcement authorities where required to do so by applicable law, court order, or regulatory direction. Where legally permissible, ijj will notify the affected Player of any such disclosure.

6.5 Professional Advisers

ijj may share Personal Data with legal advisers, auditors, and accountants on a need-to-know basis and subject to binding professional confidentiality obligations where such disclosure is necessary to obtain professional advice or services.

As a platform operating under an international gaming framework, certain Personal Data processed by ijj may be transferred to or accessed by systems or personnel located outside Pakistan. Where such transfers occur, ijj applies the following safeguards:

• Data processing agreements with all third-party recipients that require equivalent data protection standards to those applied by ijj;
• Use of certified KYC and payment processing providers that operate under recognised international data protection and financial compliance frameworks;
• Restriction of access to Personal Data by international parties to the minimum data necessary for the specific processing purpose;
• Encryption of data in transit via TLS 256-bit protocols for all cross-border data communications.

Payment data relating to JazzCash and EasyPaisa transactions is processed within Pakistan through the respective licensed payment networks and is not transferred internationally by ijj.

ijj retains Personal Data for no longer than is necessary for the purpose for which it was collected, subject to mandatory minimum retention periods imposed by applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to any identifiable individual. Anonymised aggregated data may be retained indefinitely for statistical and platform improvement purposes.

The ijj platform uses cookies and similar tracking technologies to deliver core platform functionality, maintain session state, analyse usage patterns, and where consented to, personalise the player experience. The categories of cookies used by ijj are set out below:

9.1 Essential Cookies

Essential cookies are strictly necessary for the ijj platform to function. They maintain your authenticated session, remember your PKR wallet state between page loads, and preserve your security tokens for OTP verification. Essential cookies cannot be disabled without rendering the platform inoperable. No consent is required for essential cookies as they serve no purpose beyond delivering the service you have requested.

9.2 Analytics Cookies

With your consent, ijj uses analytics cookies to collect aggregated, anonymised data about how Players navigate the platform — including which game categories are most visited, where Players exit the registration flow, and how the mobile interface performs across different Pakistani device types. This data is used exclusively to improve the platform experience. Analytics data is not linked to individual Player identities.

9.3 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, game lobby filter settings, and notification configuration — so you do not need to reconfigure them on every visit. These cookies are optional and can be declined without affecting core platform functionality.

9.4 Managing Cookie Preferences

You may adjust your cookie consent preferences at any time through the Cookie Preferences panel accessible from the footer of every ijj platform page. You may also manage cookies through your browser settings, though disabling essential cookies at the browser level will prevent you from using the ijj platform. Withdrawing consent from non-essential cookies does not affect the lawfulness of processing that occurred prior to withdrawal.

As an ijj player, you hold the following rights in respect of your Personal Data. To exercise any of these rights, submit a written request to the contact details in Clause 15. ijj will respond within thirty (30) calendar days:

• Right of Access: You may request a copy of all Personal Data held by ijj about you, including the categories of data, the purposes of processing, any third parties with whom it has been shared, and the applicable retention period;
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data held by ijj. Where the data in question has been shared with third-party processors, ijj will notify them of the correction;
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the original collection purpose, where you have withdrawn consent (for consent-based processing), or where processing was unlawful. This right is subject to mandatory retention obligations under applicable financial and gaming regulation;
• Right to Restriction: You may request that ijj restricts processing of your Personal Data while a rectification request is being resolved or while a complaint is under review;
• Right to Object: You may object at any time to processing carried out on the basis of legitimate interests, including the use of your data for platform analytics. You may also withdraw marketing consent at any time without providing a reason;
• Right to Data Portability: For data processed on the basis of contract or consent, you may request a machine-readable copy of your Personal Data for transfer to another service provider.

Parents or guardians who believe that a minor has registered on the ijj platform should contact ijj support immediately using the contact details in Clause 15. ijj will treat such reports with urgency and will close the relevant account pending investigation within 24 hours of receipt of a credible report.

ijj implements a layered set of technical and organisational security measures to protect Player Personal Data against unauthorised access, accidental loss, destruction, or alteration. The principal measures in place include:

• Encryption in Transit: All data exchanged between your device and the ijj platform is protected by TLS 256-bit encryption. No Personal Data is transmitted in plaintext at any point;
• Encryption at Rest: Stored Personal Data — including identity records, financial transaction data, and KYC documents — is encrypted at rest using industry-standard symmetric encryption algorithms;
• Access Controls: Access to Player Personal Data within ijj's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of access required to perform their job functions, and all access events are logged and subject to periodic audit;
• Two-Factor Authentication: All internal ijj staff accounts that can access Player data are protected by mandatory two-factor authentication. Player accounts on the platform also support optional 2FA, the activation of which is strongly recommended;
• Intrusion Detection: The ijj platform infrastructure is monitored continuously for anomalous access patterns, brute-force attempts, and other indicators of unauthorised access;
• Penetration Testing: ijj engages independent security specialists to conduct periodic penetration testing of platform infrastructure and to assess the effectiveness of implemented security controls;
• Data Breach Response: ijj maintains a documented data breach response procedure. In the event of a breach that poses a risk to Player rights, ijj will notify affected Players without undue delay and will take immediate remedial action to contain and mitigate the breach.

The ijj platform may display references to or integrations with third-party licensed game content providers, payment gateways, and customer support tooling. These third parties operate their own privacy policies independent of this document. ijj is not responsible for the privacy practices of third-party service providers beyond the contractual data protection obligations imposed on them by ijj through data processing agreements.

ijj does not embed third-party advertising networks, social media tracking pixels, or affiliate tracking cookies on the platform that would allow third parties to build independent profiles of Player behaviour for commercial targeting purposes. Any analytics tools used by ijj operate under ijj's control and in accordance with this Privacy Policy.

Game content providers — including live dealer studio operators — receive session-level technical data necessary to deliver game content and maintain game integrity records. They do not receive full Player identity data and are contractually prohibited from using any data received from ijj for purposes beyond game delivery and regulatory record-keeping.

ijj reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform functionality, or data processing practices. Where amendments are material — meaning they significantly affect how Player Personal Data is collected, used, or shared — ijj will provide advance notice of not less than seven (7) days via the email address registered to each Player's account before the amended Policy takes effect.

Non-material amendments — such as clarifications of existing language, corrections of typographical errors, or updates to contact details — may be made without advance notice. The current version of this Privacy Policy will always be accessible at ijj.bio/privacy-policy and will display the effective date of the current version prominently at the top of the document.

Continued use of the ijj platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the amended Policy, you should cease using the platform and may request account closure and data deletion in accordance with Clause 10 of this Policy.

All privacy-related queries, subject access requests, correction requests, erasure requests, and formal complaints should be directed to the ijj data protection contact using the details below. Please use the subject line "DATA PRIVACY REQUEST" or "PRIVACY COMPLAINT" to ensure your message is routed to the appropriate team:

• Email: [email protected]
• Response Time: Acknowledgement within 2 business days; substantive response within 30 calendar days;
• Support Hours: 09:00–02:00 Pakistan Standard Time, seven days a week;
• Live Chat: Available on-site during support hours for general account queries.

When submitting a subject access request or erasure request, please include your registered email address and, where possible, your account username to allow ijj to locate your records without delay. ijj may need to verify your identity before processing certain types of data requests to ensure that Personal Data is not disclosed to or deleted at the request of an unauthorised party.