12jat Privacy Policy

1.1 12jat is an online casino and sports betting platform designed and operated exclusively for the Bangladesh market. We are committed to protecting the privacy of all users who interact with our platform, whether as registered players or as visitors browsing the site without an account.

1.2 This Policy applies to all personal data we collect through the 12jat website at 12jat.io, through our customer support channels, and through any other means by which you interact with 12jat as a business. It covers data collected digitally and, where applicable, through offline interactions such as email correspondence.

1.3 This Policy should be read alongside the 12jat Terms and Conditions and Responsible Gaming Policy. Together, these documents form the complete framework governing your relationship with 12jat. In the event of any inconsistency between this Policy and those documents on matters of data protection, this Policy shall take precedence.

1.4 We review and update this Policy periodically to reflect changes in our data practices, applicable law, or operational structure. The most current version will always be available at 12jat.io/privacy-policy with the date of the most recent revision displayed prominently.

2.1 For the purposes of this Policy, 12jat acts as the data controller in respect of all personal data collected from players and visitors through the 12jat platform. As data controller, 12jat determines the purposes for which and the means by which personal data is processed.

2.2 All data-related enquiries, access requests, correction requests, and deletion requests should be directed to our designated data protection contact at [email protected]. We aim to respond to all data-related requests within 30 calendar days of receipt.

3.1 12jat collects the following categories of personal data from players and platform users:

3.2 We do not collect or process any special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless you voluntarily provide such information in the context of a responsible gaming self-exclusion request, in which case it is used solely to process and enforce that request.

4.1 12jat collects personal data through the following primary channels:

• Direct submission: Data you provide when registering an account, completing KYC, making a deposit, contacting customer support, or responding to a survey or promotion.
• Automated technical collection: Data collected automatically when you visit 12jat.io, including IP address, device identifiers, browser fingerprint, and session activity logs gathered via cookies and server logs.
• Payment processor data: Transaction confirmation data passed to us by bKash, Nagad, Rocket, Upay, Visa, Mastercard, and our banking partners when you make a deposit or withdrawal.
• Third-party game studios: Aggregated gameplay data from our game studio partners (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, PG Soft) relating to games played on their platforms embedded within 12jat.
• Identity verification services: Confirmation data returned from third-party identity verification providers used as part of our KYC process.

4.2 You are not legally obligated to provide personal data to 12jat; however, certain data (particularly identity and contact data) is a prerequisite for creating a verified account and accessing real-money gaming features. Failure to provide required data will prevent account registration or the processing of financial transactions.

5.1 12jat processes your personal data only for specific, documented purposes. The principal purposes and the corresponding legal basis for each are set out below:

• Account creation and management: Processing is necessary for the performance of the contract between you and 12jat.
• Identity and age verification (KYC): Processing is required to comply with applicable legal and regulatory obligations, including anti-money-laundering requirements and age verification standards. 12jat enforces a strict 21+ age restriction on all real-money products.
• Payment processing and fraud prevention: Processing is necessary for the performance of the contract and to protect the legitimate interests of 12jat and its players against financial fraud and unauthorised account access.
• Customer support and dispute resolution: Processing is necessary for the performance of the contract and to fulfil our legitimate interest in resolving player disputes fairly and efficiently.
• Responsible gaming monitoring: Processing is necessary to fulfil our legal and ethical obligation to monitor for signs of problem gambling and to intervene appropriately, including enforcing self-exclusion requests.
• Platform improvement and analytics: Processing is based on our legitimate interest in understanding how the platform is used and improving the player experience, provided those interests are not overridden by your data protection rights.
• Marketing communications (where consented): Processing is based on your explicit opt-in consent. You may withdraw consent at any time as described in Section 13 of this Policy.

6.1 12jat does not sell, rent, or lease your personal data to any third party for commercial or marketing purposes. Data is shared with third parties only to the extent necessary to deliver the services described in this Policy or to comply with applicable legal obligations.

6.2 The categories of third parties with whom 12jat may share your personal data are as follows:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank, and BRAC Bank — for the purpose of processing deposits and withdrawals.
• Game studio partners: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, PG Soft, and Spribe — limited to the data required to deliver game functionality and verify eligible play.
• Identity verification providers: Third-party KYC and age verification services engaged to confirm player identity and age during account registration.
• IT and infrastructure providers: Hosting, database, and cybersecurity service providers operating under binding contractual obligations to protect your data and use it only on 12jat's documented instructions.
• Legal and regulatory authorities: Where 12jat is compelled by applicable law, court order, or regulatory directive to disclose player data to a government body, law enforcement agency, or financial intelligence unit. In such cases, 12jat will disclose only the minimum data required and will notify the affected player where legally permitted to do so.

6.3 All third-party service providers engaged by 12jat are required to maintain data security standards consistent with this Policy. We do not permit third-party service providers to use your data for their own independent purposes.

7.1 12jat uses cookies, web beacons, and similar tracking technologies to operate and improve the platform. The cookies used by 12jat fall into the following categories:

• Strictly necessary cookies: Required for core platform functionality, including session management, login authentication, and fraud prevention. These cookies cannot be disabled without impairing your ability to use the platform.
• Performance and analytics cookies: Used to collect anonymised or aggregated data on how visitors use the platform, including which pages are visited most frequently and where technical errors occur. This data helps us improve the platform experience.
• Functional cookies: Used to remember your preferences, such as preferred language, session settings, and display options. These cookies improve your experience but are not essential to core platform operation.

7.2 12jat does not use cookies to serve third-party advertising or to track your browsing activity on external websites.

7.3 You can control and manage cookies through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may affect the functionality of the 12jat platform, including your ability to maintain a logged-in session.

8.1 12jat implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your device and 12jat servers.
• Encrypted storage of passwords using industry-standard hashing algorithms. 12jat employees cannot view your password in plain text.
• Access controls that restrict internal access to personal data on a strict need-to-know basis.
• Regular security audits and penetration testing of the 12jat platform and infrastructure.
• Secure disposal procedures for physical documents and electronic storage media containing personal data.
• Multi-factor authentication options for player accounts to reduce the risk of unauthorised access.

8.2 While 12jat takes all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, 12jat will notify affected players without undue delay once the breach has been identified and contained.

8.3 You are responsible for maintaining the confidentiality of your 12jat account credentials. 12jat will never ask for your password via email, live chat, or any other communication channel. If you believe your account has been compromised, contact us immediately at [email protected].

9.1 12jat retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to any longer retention periods required by applicable law. The following retention periods apply:

• Active account data: Retained for the full duration of the account's existence plus a minimum of five years following account closure.
• KYC and identity documents: Retained for a minimum of five years following account closure to satisfy anti-money-laundering and financial record-keeping obligations.
• Transaction records: Retained for a minimum of five years following the date of the transaction.
• Customer support communications: Retained for a minimum of two years following the resolution of the relevant support query or dispute.
• Marketing preferences and consent records: Retained for as long as you remain a registered player and for a period of two years following account closure as evidence of consent management.

9.2 When your personal data is no longer required for any of the purposes described in this Policy, 12jat will securely delete or anonymise it in accordance with our internal data disposal procedures.

10.1 As a data subject, you hold the following rights in respect of the personal data that 12jat holds about you:

• Right of Access: You may request a copy of the personal data 12jat holds about you at any time. We will provide this information in a structured, commonly used format within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Please note that correcting identity data will require re-verification of your KYC documents.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where the data is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. This right is subject to our legal obligations to retain certain records for minimum statutory periods.
• Right to Restriction of Processing: You may request that 12jat restrict the processing of your data in certain circumstances, for example while a rectification request is under review.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you may request that we provide your data in a machine-readable format for transfer to another controller.
• Right to Object: You have the right to object to processing carried out on the basis of 12jat's legitimate interests. We will comply unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

11.1 The 12jat platform is strictly for adults aged 21 years and above. 12jat does not knowingly collect personal data from any individual under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account, void any winnings, and delete the data as quickly as practicable.

11.2 We strongly encourage parents and guardians in Bangladesh to use parental control software and filtering tools to prevent minors from accessing online gambling platforms. If you believe that a minor has registered on 12jat or provided personal data to us, please notify us immediately at [email protected].

12.1 Some of the third-party service providers engaged by 12jat — including certain game studio partners and technology infrastructure providers — may process personal data outside Bangladesh. Where such transfers occur, 12jat takes appropriate steps to ensure that an adequate level of data protection is maintained.

12.2 These steps include requiring all international data recipients to enter into binding data processing agreements that impose data protection obligations consistent with this Policy, and selecting providers that operate under recognised data protection standards.

12.3 By using the 12jat platform, you acknowledge and consent to the transfer of your personal data to our service providers as described in this section, for the purposes outlined in this Policy.

13.1 With your consent, 12jat may send you marketing communications by email or in-platform notification relating to promotions, bonuses, new games, cricket betting markets, and seasonal events relevant to Bangladesh (such as BPL season offers, Eid promotions, and Pohela Boishakh specials).

13.2 You may opt in to marketing communications at the time of account registration or at any later date through your account settings. You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by 12jat.
• Updating your communication preferences in the Account Settings section of your 12jat account.
• Contacting our support team at [email protected] and requesting removal from all marketing lists.

13.3 Withdrawal of marketing consent will not affect your ability to receive transactional and service-related communications from 12jat, such as deposit confirmations, withdrawal notifications, security alerts, and support responses. These service communications are necessary for the operation of your account and cannot be opted out of while your account remains active.

13.4 12jat does not use your personal data to display targeted advertising on third-party websites or social media platforms.

14.1 12jat reserves the right to update this Privacy Policy at any time. When material changes are made, we will update the "Last Updated" date displayed at the top of this page and, where reasonably practicable, notify registered players via email or in-platform notification.

14.2 It is your responsibility to review this Policy periodically to stay informed of any changes. Continued use of the 12 jat platform following the publication of an updated Policy constitutes your acceptance of the revised terms.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 12jat processes your personal data, please contact our data protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Response time: We aim to respond to all data-related enquiries within 30 calendar days of receipt.
• Language: Our support team operates in English and is available 24 hours a day, 7 days a week.

15.2 If you are not satisfied with our response to a data-related enquiry, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.