2jay Privacy Policy – How We Handle Your Data

1. Introduction

This Privacy Policy ("Policy") is issued by 2jay ("2jay," "we," "us," "our") and applies to all personal data collected through the 2jay website and platform at 2jay.org, including all products and services offered to Pakistani players — casino games, sports betting, live dealer tables, and associated account and payment services.

2jay is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy sets out what data we collect, the purposes and legal bases for processing, how data is shared, how long it is retained, and the rights available to you as a data subject.

By registering a 2jay account or using any 2jay service, you acknowledge that you have read and understood this Policy. If you do not agree with how 2jay processes personal data as described in this Policy, you should not create or use a 2jay account.

2. Data Controller

2jay is the data controller responsible for personal data collected through the platform. As data controller, 2jay determines the purposes and means of processing personal data related to the provision of online casino, sports betting, and account services to players.

Questions or requests relating to personal data should be directed to the 2jay Data Privacy team via the contact details provided in Section 15 of this Policy.

3. Data We Collect

3.1 Data Provided by You

When you register a 2jay account, we collect the following information that you provide directly:

• Full legal name as it appears on your identity document
• Date of birth (used for age verification — you must be 18+)
• Email address and/or Pakistani mobile telephone number
• Residential address
• CNIC number or passport number (for KYC identity verification)
• Copies of identity documents submitted during KYC verification
• Payment method details (JazzCash account number, Easypaisa account, bank account details, as applicable)
• Communications you send to 2jay support

3.2 Data Collected Automatically

When you use the 2jay platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Pages visited, time spent, and navigation paths within the platform
• Game session data — games played, stakes placed, outcomes, session duration
• Login timestamps and session activity logs
• Cookie identifiers and similar tracking technologies (see Section 8)

3.3 Data from Third Parties

2jay may receive personal data about you from third-party sources in limited circumstances, including:

• Identity verification providers who assist with KYC document authentication
• Payment processors who confirm transaction status and sender identity
• Fraud detection and risk management service providers
• Responsible gaming databases where you have previously registered a self-exclusion

4. How We Use Your Data

2jay uses personal data for the following purposes:

• Account creation and management: Registering your 2jay account, maintaining your profile, and providing access to platform features.
• Age and identity verification: Confirming that you are 18 or older and that the identity details you provide are accurate and genuine.
• Transaction processing: Facilitating PKR deposits and withdrawals via JazzCash, Easypaisa, bank transfer, and other supported payment methods.
• Platform personalisation: Displaying relevant promotions, game recommendations, and content based on your activity history and preferences.
• Customer support: Responding to your enquiries, complaints, and support requests.
• Security and fraud prevention: Detecting and preventing unauthorised access, fraudulent transactions, money laundering, and other prohibited conduct.
• Responsible gaming: Monitoring account activity for indicators of problem gambling and administering deposit limits, cooling-off periods, and self-exclusion measures.
• Legal and regulatory compliance: Meeting obligations imposed by applicable laws, regulations, and licensing conditions, including AML/CTF requirements.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to you — subject to your communication preferences. You may opt out at any time.
• Platform improvement: Analysing aggregated usage data to improve the design, performance, and content of the 2jay platform.

5. Legal Basis for Processing

2jay processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to deliver the services you have contracted for by registering a 2jay account, including account management, game access, and payment processing.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC and AML obligations.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming risk management, where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent for specific processing activities — such as marketing communications — you may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sharing Your Data

2jay does not sell, rent, or otherwise transfer your personal data to third-party marketers or data brokers. We share personal data with third parties only in the following limited circumstances:

• Service providers: Companies acting as data processors on our behalf — including KYC verification providers, payment processors, IT infrastructure providers, and customer support platforms — who process data solely on 2jay's instructions under binding contractual obligations.
• Game content providers: Third-party casino game studios may receive session-level data necessary to deliver their games and verify outcomes. Personal identifying data is not shared with game studios beyond what is technically necessary.
• Responsible gaming organisations: Where you have registered a self-exclusion, we may share your registration details with industry self-exclusion databases to give effect to that exclusion across participating platforms.
• Law enforcement and regulatory authorities: Where required by law, court order, or regulatory directive, 2jay will disclose personal data to competent authorities. 2jay will notify you of such disclosure where legally permissible.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the 2jay business, personal data held by 2jay may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections.

7. Payment Data

All financial transactions on 2jay — including PKR deposits via JazzCash and Easypaisa, bank transfers from HBL, UBL, Meezan Bank, Bank Alfalah, and other supported methods — are processed through PCI DSS-compliant payment processing infrastructure.

2jay does not store full payment card numbers. Debit and credit card transactions are tokenised, meaning that only a secure token reference — not the actual card number — is retained for recurring transaction matching. Mobile wallet account numbers (JazzCash, Easypaisa) are retained for the purpose of matching withdrawals to the correct outbound account, as required under our anti-money-laundering obligations.

Payment data is shared only with the payment processor directly involved in executing the relevant transaction. Payment processors operate under binding contractual data protection obligations and are prohibited from using your payment data for any purpose other than executing and reporting on the specific transaction.

8. Cookies & Tracking Technologies

2jay uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small data files stored on your device that enable the platform to recognise your browser session, maintain your login state, and remember your preferences.

8.1 Types of Cookies Used

• Essential cookies: Required for the platform to function. These include session authentication cookies and security tokens. You cannot opt out of essential cookies without ceasing to use the platform.
• Analytics cookies: Used to collect aggregated data about how users navigate the platform, which pages are visited most frequently, and where users encounter errors. This data is used to improve platform design and performance.
• Preference cookies: Store your platform settings such as language preference and notification choices across sessions.
• Marketing cookies: Used to track your engagement with 2jay promotions and tailor marketing communications to your interests. You may opt out of marketing cookies via your account communication preferences.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies may affect the functionality of certain platform features.

9. Data Retention

2jay retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable laws or regulations. Specific retention guidelines include:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in compliance with applicable AML and financial record-keeping obligations.
• KYC documentation is retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Customer support communications are retained for a period of three (3) years from the date of the last communication in each support thread.
• Game session logs are retained for a minimum of two (2) years and may be retained longer where required for dispute resolution or regulatory purposes.
• Marketing data is retained until you withdraw consent or until it is no longer reasonably necessary for marketing purposes, whichever is earlier.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

10. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data held by 2jay:

• Right of access: Request a copy of the personal data 2jay holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding retention obligations.
• Right to restrict processing: Request that 2jay limit the processing of your data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, machine-readable format and have it transferred to another controller where technically feasible.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time without affecting prior processing.

To exercise any of the above rights, submit a written request to [email protected]. 2jay will respond within thirty (30) days. Complex requests may take up to ninety (90) days, in which case we will notify you of the extended timeline and the reasons for it.

11. Children's Privacy

The 2jay platform is strictly prohibited to individuals under the age of 18. 2jay does not knowingly collect personal data from persons under 18. If 2jay becomes aware that it has inadvertently collected personal data from a person under 18, that data will be deleted immediately and the associated account will be closed.

If you believe that a person under 18 has created a 2jay account or submitted personal data to 2jay, please contact us immediately at [email protected] so that we can take appropriate action.

12. Data Security

2jay implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the 2jay platform
• Encryption at rest for sensitive personal data stored on 2jay servers
• Role-based access controls restricting employee access to personal data on a need-to-know basis
• Regular penetration testing and vulnerability assessments
• Multi-factor authentication for internal administrative systems
• Security incident response procedures and breach notification protocols

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own account credentials. 2jay strongly recommends enabling two-factor authentication on your 2jay account to provide an additional layer of protection.

13. International Data Transfers

2jay may transfer personal data to service providers located outside Pakistan in connection with the delivery of platform services — for example, to cloud infrastructure providers or KYC verification platforms. Where such transfers occur, 2jay ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to the protections described in this Policy.

Safeguards for international transfers may include standard contractual clauses, binding corporate rules, or reliance on adequacy determinations applicable to the recipient jurisdiction.

14. Changes to This Privacy Policy

2jay reserves the right to update this Privacy Policy at any time. When material changes are made, 2jay will notify registered account holders by email to the address associated with their account at least fourteen (14) days before the changes take effect, except where a shorter notice period is required by law or is necessary to address an urgent security or regulatory concern.

The "last updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed of how 2jay processes your personal data. Your continued use of the platform after the effective date of any revision constitutes your acceptance of the updated Policy.

15. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or to the personal data 2jay holds about you, please contact the 2jay Data Privacy team using the details below. All enquiries will be acknowledged within five (5) business days.

You also have the right to lodge a complaint with a competent data protection authority in your jurisdiction if you believe your personal data has been processed in violation of applicable data protection law.