yay9 Privacy Policy — How We Protect Your Data

1. Introduction

This Privacy Policy (the "Policy") describes how yay9 (the "Company", "we", "us", or "our"), the operator of the online betting and casino platform at yay9.io (the "Platform"), collects, uses, stores, shares, and protects the personal data of individuals who visit or use the Platform (each a "User", "Player", or "you").

This Policy applies to all personal data processed in connection with your use of the Platform, including data provided during account registration, identity verification, deposits and withdrawals, customer support interactions, and your general navigation of the yay9 website.

This Policy should be read alongside the yay9 Terms & Conditions and the Responsible Gaming Policy, both of which are published on the Platform and are incorporated herein by reference.

2. Data Controller

For the purposes of data protection law, yay9 is the data controller in respect of the personal information collected through the Platform. As data controller, yay9 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions about this Policy or wish to exercise any of your data rights, you may contact our designated data protection point of contact at [email protected]. We will respond to all privacy-related enquiries within 30 days of receipt.

3. Data We Collect

yay9 collects personal data through several channels. The categories of personal data we collect, and the circumstances in which we collect them, are set out in the table below.

We do not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information, except where it is voluntarily disclosed by a User in the context of a responsible gaming self-exclusion or support request, in which case such data is processed solely for the purpose for which it was provided.

4. How We Use Your Data

yay9 uses the personal data we collect strictly for the following defined purposes:

• Account Management: To create, maintain, verify, and administer your yay9 Player Account, including processing your registration and responding to account-related enquiries.
• Identity & Age Verification (KYC): To confirm that you are at least 21 years of age and are who you say you are, in accordance with our legal obligations and our Terms & Conditions.
• Payment Processing: To facilitate deposits via bKash, Nagad, Rocket, Upay, and other accepted payment methods, and to process withdrawal requests to your verified payment accounts, all denominated in Bangladesh Taka (BDT).
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, collusive behaviour, and other prohibited activities that may harm you, other players, or yay9.
• Platform Improvement: To analyse usage patterns, diagnose technical problems, test new features, and improve the overall quality and reliability of the yay9 Platform.
• Responsible Gaming: To monitor gambling behaviour patterns that may indicate problem gambling and to enforce deposit limits, cool-off periods, or self-exclusion measures that you or we have applied to your account.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance.
• Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory authorities, and defend or assert legal claims.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided explicit consent or where we have a legitimate interest and you have not opted out. See Section 12 for your opt-out options.

5. Legal Basis for Processing

yay9 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform our contract with you (the Terms & Conditions) — including account management, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations and age verification requirements.
• Legitimate Interests: Processing carried out in pursuit of yay9's legitimate business interests, including fraud prevention, Platform security, and product improvement, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, informed, and specific consent — principally for the sending of marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Third Parties

yay9 does not sell your personal data. We share personal data only with the following categories of trusted third-party service providers, and only to the extent necessary for them to perform their services:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — for the purpose of processing deposits and withdrawals in BDT.
• KYC & Identity Verification Providers: Third-party identity verification services that assist with age verification and document authentication.
• Game Software Providers: Certified casino and sports data providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) who supply game content to the Platform. These providers may receive anonymised session data for game integrity purposes.
• IT & Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity providers that support the technical operation of the Platform.
• Legal & Compliance Advisors: Professional advisors (lawyers, auditors) who are bound by confidentiality obligations.
• Law Enforcement & Regulatory Authorities: Where yay9 is required by law or court order to disclose personal data, we will do so in compliance with applicable legal obligations.

7. Cookies & Tracking Technologies

The yay9 Platform uses cookies and similar tracking technologies to enhance your experience, maintain your session, and gather analytical data about Platform usage. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how visitors use the Platform — which pages are visited most, where errors occur, and how users navigate between sections. This data helps us improve the Platform experience.
• Functional Cookies: Used to remember your preferences — such as your preferred language or display settings — so that you do not need to reconfigure them on each visit.
• Marketing & Targeting Cookies: Used to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. These cookies are only placed where you have given consent.

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform. Your cookie preferences can also be updated via the cookie preferences panel accessible on the Platform.

8. Data Security

yay9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data fields (including payment references and identity document data) at rest using industry-standard encryption algorithms.
• One-way cryptographic hashing of all account passwords — yay9 staff cannot view your plaintext password under any circumstances.
• Role-based access controls ensuring that only authorised personnel can access personal data, on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Automated monitoring systems that detect and alert on unusual data access patterns or potential breaches in real time.
• Physical security controls at data centre facilities, including access logging and surveillance.

9. Data Retention

yay9 retains personal data for no longer than is necessary to fulfil the purposes described in this Policy, taking into account applicable legal, regulatory, and operational requirements. Our general retention periods are as follows:

• Active Account Data: Retained for the full duration that your account remains open and active on the Platform.
• Closed Account Data: Following account closure, personal data (including transaction records and KYC documents) is retained for a minimum of five (5) years to satisfy anti-money laundering record-keeping obligations and to enable resolution of any disputes that may arise.
• Marketing Data: Retained until you withdraw your consent or opt out of marketing communications, at which point marketing preferences are updated within 10 business days.
• Technical & Usage Logs: Anonymised or aggregated after 12 months; raw logs are retained for up to 24 months for security and fraud investigation purposes.
• Support Correspondence: Retained for 36 months from the date of the last communication to allow for follow-up and quality assurance purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

10. Your Rights

You have the following rights in relation to the personal data that yay9 holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data we hold about you and to receive information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request deletion of your personal data where there is no longer a legitimate purpose for us to retain it, subject to our legal retention obligations.
• Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where it is based on our legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to all data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension within the initial 30-day period.

11. Children's Privacy

The yay9 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If yay9 becomes aware that personal data has been submitted by a person under 21, that account will be immediately suspended, all associated personal data will be deleted, and any funds deposited will be handled in accordance with our underage gambling policy as set out in our Terms & Conditions.

Parents and guardians who believe that a minor in their care has registered an account on yay9 should contact us immediately at [email protected] so that we can take appropriate action without delay.

12. Marketing Communications

Where you have provided consent or where we have a legitimate interest in doing so, yay9 may contact you with promotional information about bonuses, new games, cricket betting markets (including BPL, IPL, and T20 tournaments), seasonal offers (such as Eid promotions or Pohela Boishakh specials), and other Platform updates.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in the Account settings panel.
• Clicking the "Unsubscribe" link in any marketing email we send you.
• Contacting our support team at [email protected] with the subject line "Marketing Opt-Out".

Please allow up to 10 business days for your opt-out request to take full effect across all communication channels. Opting out of marketing communications will not affect transactional communications related to your account, such as deposit confirmations, withdrawal notifications, KYC requests, or security alerts.

13. International Data Transfers

The yay9 Platform primarily serves players in Bangladesh. However, some of our trusted third-party service providers — including cloud infrastructure providers and game software suppliers — may process personal data on servers located outside Bangladesh. Where such international data transfers occur, yay9 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Such safeguards include contractual data protection clauses in our agreements with all international service providers, requiring them to process data only for the purposes specified and to maintain security standards consistent with this Policy.

14. Policy Amendments

yay9 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made, we will provide advance notice via email to your registered address or via a prominent notice on the Platform, at least 14 days before the changes take effect.

The date at the top of this Policy reflects the date it was last updated. We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by yay9, please contact us through the following channel:

• Email: [email protected] — Please use the subject line "Privacy Enquiry" for all data protection matters.
• Response time: We aim to acknowledge all privacy-related correspondence within 48 hours (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.
• Support availability: Our support team is available 24 hours a day, 7 days a week, including Eid and all public holidays in Bangladesh.