Privacy Policy – How jitaw Collects, Uses, and Protects Your Personal Data

1. Information We Collect

jitaw collects personal data that is necessary to provide a safe, compliant, and high-quality online betting and casino experience for players in Bangladesh. We collect data in three main ways: information you provide directly to us, information collected automatically when you use the Platform, and information obtained from third parties as part of our verification processes.

1.1 Information You Provide Directly

When you register for a jitaw account, deposit funds, request a withdrawal, contact support, or interact with any part of the Platform, you may provide us with the following categories of personal data:

1.2 Information Collected Automatically

When you access the jitaw Platform, our servers and analytics tools automatically record certain technical data. This includes:

• IP address and approximate geographic location (country, city)
• Device type, operating system, and browser version
• Pages visited, features used, time spent on each page, and click patterns
• Session start and end times in Bangladesh Standard Time (BST, UTC+6)
• Betting and gaming activity logs (game rounds played, stakes placed, outcomes)
• Cookies, local storage identifiers, and device fingerprint data (see Section 4)
• Referral source (how you arrived at jitaw.org)

1.3 Information from Third Parties

jitaw may receive personal data about you from the following external sources in the course of verifying your identity and processing transactions:

• Payment Processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard.
• Identity Verification Partners: Document authentication results from our KYC service providers.
• Fraud Prevention Services: Risk scores, device reputation data, and IP reputation intelligence from third-party fraud detection providers.
• Sanctions & PEP Screening: Results from politically exposed person (PEP) and sanctions list screening as required by anti-money laundering obligations.

2. How We Use Your Data

jitaw processes personal data only for clearly defined, legitimate purposes. We do not use your data for any purpose incompatible with the reasons for which it was originally collected. The table below sets out every purpose for which we use your personal data and the corresponding legal basis for that processing.

Marketing Communications. If you have opted in to receive promotional emails or SMS notifications from jitaw, we will send you information about bonuses, seasonal promotions (such as Eid, Pohela Boishakh, or IPL season offers), and VIP Club updates. You may withdraw your consent and opt out at any time by contacting [email protected] or following the unsubscribe instructions in any marketing email. Opting out of marketing communications does not affect your receipt of transactional account notifications, which are required for the operation of your account.

3. Legal Basis for Processing

jitaw processes your personal data only where a lawful basis exists for doing so. Depending on the specific processing activity, we rely on one or more of the following legal bases:

• Contract Performance: Processing is necessary to perform the contract between you and jitaw — that is, to provide you with a functioning player account, accept your deposits, settle your bets, and pay out your winnings. Without this processing, we cannot deliver the service you have signed up for.
• Legal Obligation: jitaw is subject to obligations under anti-money laundering (AML) law, counter-terrorism financing (CTF) regulations, and responsible gaming requirements. These obligations require us to collect identity documents, screen against sanctions lists, and retain transaction records for defined periods regardless of your preferences.
• Legitimate Interests: jitaw processes some data where we have a legitimate business interest in doing so, provided that interest is not overridden by your fundamental rights. This includes fraud prevention, platform security, network integrity monitoring, and general business analytics. Where we rely on legitimate interests, you have the right to object to such processing (see Section 7).
• Consent: Where processing is not required by contract or law, and where jitaw does not have an overriding legitimate interest, we will ask for your specific, informed, and freely given consent before processing. Marketing communications are the primary example. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

4. Cookies & Tracking Technologies

jitaw uses cookies and similar tracking technologies (local storage, session tokens, device fingerprinting) to operate the Platform reliably, keep you logged in securely, and understand how players use the site so we can continue improving it. This section explains what types of cookies we use and how you can manage them.

Types of Cookies Used by jitaw

Managing Your Cookie Preferences. Most web browsers allow you to control the cookies stored on your device through the browser's settings menu. You can typically choose to block all third-party cookies, delete existing cookies, or be notified before a cookie is set. Please note that disabling functional or analytics cookies will not prevent you from using the Platform, but may limit certain convenience features.

jitaw does not use advertising or retargeting cookies that track your activity across other websites to serve you personalised advertisements on external platforms. Our analytics implementation uses anonymised, aggregated data that cannot be used to personally identify you.

5. Data Sharing & Third Parties

jitaw does not sell, lease, or trade your personal data to third parties for their own commercial purposes. We share data only where necessary to deliver the Platform's services, fulfil legal obligations, or protect the security of the Platform and its players. The categories of third parties with whom jitaw may share your data are described below.

• Payment Service Providers: To process your deposits and withdrawals, we share the minimum necessary financial and identity data with your chosen payment provider — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, or Mastercard. These providers act as independent data controllers for the transaction data they handle and are governed by their own privacy policies.
• KYC and Identity Verification Partners: Third-party identity verification services receive copies of your identity documents to perform document authentication and liveness checks as part of our KYC process. These providers are contractually bound to process your data only for the purposes we specify and to maintain industry-standard data security.
• Fraud Detection and Security Services: Anonymised device data, IP addresses, and transaction patterns may be shared with specialist fraud detection partners to identify suspicious activity, multiple account usage, and bonus abuse patterns.
• Game and Software Providers: Certain game studios and platform providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive anonymised session data necessary to operate their games within the jitaw Platform. These providers do not receive your name, contact details, or payment data.
• Legal and Regulatory Authorities: jitaw may disclose personal data to law enforcement agencies, financial intelligence units, courts, or regulatory bodies where required by applicable law or a valid legal order. We do not notify players of such disclosures where doing so would be unlawful or would undermine an ongoing investigation.
• Business Transfers: In the event that jitaw undergoes a merger, acquisition, restructuring, or sale of all or part of its business, your personal data may be transferred to the acquirer as part of that transaction. We will notify affected players of any such transfer and of any material changes to this Privacy Policy that result from it.

All third-party service providers who process personal data on jitaw's behalf are required to enter into a data processing agreement (DPA) with us. These agreements require the provider to process data only on jitaw's documented instructions, to maintain appropriate technical and organisational security measures, and to delete or return data upon termination of the service relationship.

6. Data Retention

jitaw retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The retention periods below reflect both the operational needs of the Platform and the legal requirements associated with operating an online gaming and financial services platform in Bangladesh.

After the applicable retention period has elapsed, jitaw will securely delete or irreversibly anonymise your personal data. Where data is anonymised rather than deleted, the resulting dataset cannot be used to identify you and therefore falls outside the scope of this Privacy Policy.

If you request deletion of your personal data (see Section 7 — Your Rights), jitaw will honour that request where no legal obligation requires us to retain the data. Where a retention obligation does apply, we will inform you of the specific legal basis and the earliest date on which the data can be deleted.

7. Your Rights

As a jitaw player, you have rights in relation to the personal data we hold about you. jitaw is committed to honouring these rights promptly and without unnecessary barriers. To exercise any of the rights described below, please contact us at [email protected]. All requests will be acknowledged within 5 business days and resolved within 30 business days, unless the complexity of the request requires an extension (in which case we will notify you).

• Right of Access: You have the right to request a copy of all personal data that jitaw holds about you, together with information about how it is used and with whom it is shared. This is sometimes called a Subject Access Request (SAR). jitaw will provide this information in a structured, commonly used electronic format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For account data such as your name, date of birth, or contact details, you may also be able to update some fields directly through your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request that jitaw delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where you object to processing based on legitimate interests and there is no overriding legitimate ground. jitaw will comply except where a legal retention obligation requires us to keep the data.
• Right to Restriction of Processing: You may ask jitaw to restrict processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved, or where you have objected to processing and we are assessing whether our legitimate interests override your rights.
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another data controller.
• Right to Object: You have the right to object to processing based on legitimate interests at any time. You also have an unconditional right to object to the use of your personal data for direct marketing purposes. Upon receipt of a marketing objection, jitaw will cease all marketing communications within 5 business days.
• Rights Related to Automated Decision-Making: jitaw uses automated systems to detect fraud and bonus abuse. Where an automated decision has a significant legal or similarly significant effect on you (such as account suspension), you have the right to request human review of that decision by contacting [email protected].

8. Data Security

jitaw takes the security of your personal data seriously and implements a combination of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure. The following security measures are in place across the jitaw Platform:

• Encryption in Transit: All data transmitted between your device and jitaw's servers is encrypted using 256-bit TLS/SSL protocols. This applies to every page on jitaw.org, including account login, deposit flows, and withdrawal requests.
• Encryption at Rest: Sensitive data stored in jitaw's databases — including identity documents and payment references — is encrypted at rest using industry-standard encryption algorithms.
• Password Security: Account passwords are never stored in plain text. jitaw uses a strong one-way cryptographic hashing algorithm with per-user salting to store password credentials.
• Two-Factor Authentication (2FA): jitaw offers 2FA via SMS OTP to all players. We strongly recommend enabling 2FA to add an additional layer of security to your account beyond your password alone.
• Access Controls: Access to personal data within jitaw's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of access required to perform their role. All internal access is logged and regularly audited.
• Infrastructure Security: jitaw's Platform is hosted on servers with physical and network security controls including firewalls, intrusion detection systems, and DDoS mitigation services. Regular vulnerability assessments and penetration tests are conducted to identify and address potential weaknesses.
• Fraud Monitoring: Automated systems continuously monitor for suspicious login attempts, unusual betting patterns, and anomalous financial transactions. Accounts exhibiting suspicious behaviour may be temporarily suspended pending investigation to protect both the player and the integrity of the Platform.
• Staff Training: All jitaw staff who handle personal data receive mandatory data protection and security awareness training. Confidentiality obligations are embedded in all employment and contractor agreements.

Data Breach Response. Despite best efforts, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, jitaw will take immediate steps to contain the breach, assess its scope, and notify affected players without undue delay. We will provide clear information about what data was affected, what steps you should take to protect yourself, and what measures jitaw has implemented in response.

9. Contact & Data Protection Officer

jitaw has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. If you have any questions, concerns, or complaints about how jitaw handles your personal data, you are encouraged to contact us in the first instance using the details below.

All privacy-related enquiries, Subject Access Requests, data rights exercises, and breach reports should be directed to:

Changes to This Privacy Policy. jitaw reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or the way we operate the Platform. When we make material changes, we will notify registered players by email and display a prominent notice on the Platform for at least 30 days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the jitaw Platform following the notification of changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the revised terms, you should close your account before the changes take effect by contacting [email protected].

This Privacy Policy was last reviewed and updated on 1 January 2026. It supersedes all prior versions.