2jbat Privacy Policy

Data Controller Identity

1.1 The data controller responsible for your personal information processed in connection with the 2jbat Platform and Services is 2jbat, the internationally licensed online gaming platform operating at 2jbat.bio ("2jbat," "we," "us," or "our").

1.2 As data controller, 2jbat determines the purposes and means of processing your personal data. Where processing is carried out on our behalf by third-party processors — such as KYC verification providers or payment processors including JazzCash and EasyPaisa — we ensure that appropriate data processing agreements are in place and that those processors comply with equivalent data protection standards.

1.3 For all privacy-related enquiries, requests, or complaints, you may contact our Data Protection contact as detailed in Section 14 of this Policy. We aim to respond to all privacy enquiries within 10 business days.

Personal Data We Collect

2.1 2jbat collects personal data through three primary channels: information you provide directly to us, information generated by your use of the Platform, and information provided to us by authorised third parties.

2.2 Sensitive Personal Data. CNIC documentation and selfie photographs used for KYC verification constitute sensitive identity documentation. This data is processed under strict access controls, is encrypted at rest, and is retained only for the period required by our licensing and anti-money-laundering obligations. 2jbat does not process special categories of personal data (e.g., health, biometric, or religious data) as part of its standard gaming operations.

Legal Bases for Processing

3.1 2jbat processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to fulfil the contract between you and 2jbat — including account creation, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with our obligations under our international gaming licence, anti-money-laundering regulations, identity verification requirements, and responsible gaming mandates.
• Legitimate Interests: Processing carried out for 2jbat's legitimate business interests where those interests are not overridden by your privacy rights — including fraud detection, security monitoring, platform improvement, and responsible gaming risk assessment.
• Consent: Processing carried out on the basis of your freely given, specific, informed, and unambiguous consent — primarily for marketing communications. You may withdraw consent at any time as described in Section 12.

3.2 Where 2jbat relies on legitimate interests as a legal basis, we conduct a balancing test to confirm that our interests do not override your fundamental rights. The outcomes of these assessments are documented and available on request through our data protection contact.

How 2jbat Uses Your Personal Data

4.1 2jbat uses your personal data for the following purposes, each of which is linked to an identified legal basis:

• Account Registration and Management — Creating and maintaining your 2jbat account, verifying your identity, enabling login, managing account settings and preferences. (Contractual necessity.)
• Identity Verification (KYC) — Verifying that you are who you say you are and that you meet eligibility requirements (including the 21+ age restriction). (Legal obligation.)
• Payment Processing — Processing PKR deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa, and Mastercard; processing withdrawal requests to your verified payment methods. (Contractual necessity.)
• Gaming and Betting Services — Delivering casino games, sports betting markets (including PSL cricket, international cricket, UFC, and other sports), live dealer tables, slots, and all other gaming services. (Contractual necessity.)
• Fraud Prevention and AML Compliance — Monitoring transactions and account activity for patterns indicative of fraud, money laundering, or other financial crime; reporting suspicious activity to relevant authorities as required by law. (Legal obligation and legitimate interests.)
• Responsible Gaming Monitoring — Monitoring gaming patterns to identify indicators of problem gambling; delivering responsible gaming tool functionality; enforcing self-exclusion and limit settings. (Legal obligation and legitimate interests.)
• Customer Support — Responding to your queries, complaints, and requests; maintaining records of communications for quality assurance and dispute resolution. (Contractual necessity and legitimate interests.)
• Platform Security and Integrity — Detecting and preventing unauthorised account access, abuse of bonus systems, multi-accounting, and other violations of 2jbat's Terms & Conditions. (Legitimate interests.)
• Marketing Communications — Sending promotional offers, bonus notifications, PSL betting promotions, new game announcements, and other marketing communications where you have provided consent. (Consent.)
• Platform Improvement — Analysing aggregated usage data (anonymised where possible) to improve the 2jbat Platform, its features, and the player experience. (Legitimate interests.)

Sharing Your Personal Data

5.1 2jbat does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Full stop. We share your data only in the following circumstances:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Visa/Mastercard acquiring banks — to process deposits and withdrawals. These parties act as independent data controllers for their own processing of payment transaction data.
• KYC and Identity Verification Providers: Third-party identity verification services used to verify CNIC documentation, confirm date of birth, and conduct age and identity checks required by our licence. These parties act as data processors under contract with 2jbat.
• Gaming Software Providers: Third-party game studios and live casino operators who provide games available on the 2jbat Platform. Necessary session data is shared to facilitate game delivery. These parties operate under data processing agreements.
• Licensing and Regulatory Authorities: Our international gaming licensing authority and any other regulatory body with legal authority to request player data in connection with licensing compliance, audits, or investigations. Disclosure is made only to the extent legally required.
• Law Enforcement and Legal Authorities: Where required by law, court order, or regulatory requirement, 2jbat may disclose personal data to law enforcement or governmental authorities. We will notify you of such disclosures where legally permitted to do so.
• Fraud Prevention and AML Services: Specialised fraud prevention and anti-money-laundering monitoring services that assist 2jbat in fulfilling its compliance obligations.

International Data Transfers

6.1 As an internationally licensed gaming platform, some processing of your personal data may take place on servers or by service providers located outside Pakistan. Where such international transfers occur, 2jbat ensures appropriate safeguards are in place to protect your data to the standard described in this Policy.

6.2 Appropriate safeguards for international transfers include contractual data transfer agreements incorporating equivalent data protection obligations, and transfer impact assessments conducted by our data protection team to evaluate the legal environment of the destination jurisdiction.

6.3 Where technically feasible, 2jbat prioritises data storage and processing arrangements that minimise international data transfers. Player financial data and KYC documentation are stored on servers that are subject to enhanced access controls regardless of their physical location.

Security Measures

7.1 2jbat implements a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. Our security measures include:

• Data in Transit: All communications between your device and 2jbat servers are encrypted using TLS 1.2 or higher (256-bit encryption). This applies to all Platform pages, including the login page, cashier, and account settings.
• Data at Rest: Sensitive personal data and financial records stored on 2jbat servers are encrypted using AES-256 encryption. Encryption keys are managed separately from the encrypted data.
• Access Controls: Access to personal data within 2jbat's internal systems is restricted on a need-to-know basis. Staff access is authenticated using multi-factor authentication, logged, and subject to regular review.
• Network Security: 2jbat's infrastructure is protected by enterprise-grade firewalls, intrusion detection and prevention systems, and regular penetration testing conducted by independent security firms.
• Application Security: The 2jbat Platform undergoes regular security assessments to identify and remediate vulnerabilities. Security patches are applied on a priority basis following our security response procedures.
• Incident Response: 2jbat maintains a documented data breach response procedure. In the event of a data breach that creates a risk to your rights and freedoms, we will notify affected players within 72 hours of becoming aware of the breach where required by applicable law.

7.2 While 2jbat takes all reasonable steps to protect your personal data, no security system is completely impenetrable. You are responsible for maintaining the security of your own 2jbat account credentials. Do not share your password with anyone — 2jbat staff will never ask for your password.

Data Retention Periods

8.1 2jbat retains personal data for no longer than is necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations. The following retention periods apply:

8.2 At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

Your Privacy Rights

9.1 2jbat respects your privacy rights and commits to facilitating their exercise. The following rights are available to you:

9.2 To exercise any of the rights listed above, contact 2jbat's data protection contact as described in Section 14. We will acknowledge your request within 5 business days and provide a substantive response within 30 days. Where requests are complex or numerous, the response period may be extended by a further 30 days with notice to you.

Cookies & Tracking Technologies

10.1 The 2jbat Platform uses cookies and similar tracking technologies to enable core functionality, improve the player experience, and fulfil certain compliance obligations. A cookie is a small text file stored on your device when you visit the Platform.

10.2 2jbat uses the following categories of cookies:

10.3 You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair the functionality of the 2jbat Platform and may prevent you from accessing your account.

Children and Minors

11.1 Age verification through CNIC documentation is a mandatory step in the 2jbat account registration process precisely to prevent underage access. The 21+ age restriction is a non-negotiable condition of our international gaming licence and is enforced through technical controls, documentary verification, and ongoing monitoring.

11.2 If you believe a minor is operating a 2jbat account, please contact our support team immediately at [email protected]. We take such reports extremely seriously and will act on them immediately.

Marketing Communications

12.1 2jbat may send you marketing communications — including promotional offers, bonus notifications, PSL cricket betting specials, new game announcements, and VIP programme updates — by email and/or SMS to your registered Pakistani mobile number where you have provided explicit consent to receive such communications.

12.2 Withdrawing Marketing Consent. You may withdraw your consent to marketing communications at any time by: (i) clicking the unsubscribe link included in every marketing email; (ii) replying STOP to any marketing SMS; or (iii) updating your notification preferences within your 2jbat account settings under Communication Preferences. Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before withdrawal, and does not affect your receipt of service communications (such as account security alerts, transaction confirmations, and responsible gaming notifications) which are sent on the basis of contractual necessity.

12.3 2jbat does not share your contact details with third-party marketers. If you receive marketing communications purportedly from 2jbat that you did not consent to, please contact us immediately as this may indicate a phishing attempt.

Changes to This Privacy Policy

13.1 2jbat may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or updates to our Platform and Services. The effective date at the top of this Policy indicates when it was last updated.

13.2 Where a change is material — meaning it significantly affects how we process your personal data or the rights available to you — we will notify you by email to your registered address and/or by a prominent notice on the 2jbat Platform at least 14 days before the change takes effect. Continued use of the Platform following the effective date of the updated Policy constitutes acceptance of the revised terms.

13.3 Previous versions of this Privacy Policy are available on request from our data protection contact. The current version is always published at 2jbat.bio/privacy-policy.

Contact & Complaints

14.1 For all privacy-related enquiries, requests to exercise your data subject rights, or complaints relating to this Policy or 2jbat's data processing practices, please contact us using the details below:

14.2 If you are not satisfied with 2jbat's response to your privacy complaint, you have the right to escalate your complaint to the supervisory authority responsible for data protection oversight in the jurisdiction of our gaming licence. Details of the relevant authority are available from our compliance team on request.