Privacy Policy — How puji9 Protects Your Personal Data

This Privacy Policy ("Policy") describes how puji9 ("puji9", "we", "us", or "our") collects, uses, discloses, and safeguards the personal data of individuals ("you" or "the user") who access or use the puji9 website located at puji9.io and all associated services, features, and content (collectively, the "Platform").

This Policy applies to all users of the Platform, including registered account holders, visitors who browse without registering, and any person whose personal data is processed by puji9 in connection with the Platform's operation. It should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, you should discontinue use of the Platform immediately. Questions about this Policy may be directed to our Data Protection contact at [email protected].

puji9 acts as the data controller in respect of personal data processed through the Platform. As data controller, puji9 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently in accordance with applicable data protection principles.

For all privacy-related enquiries, data subject rights requests, or complaints, you may contact us at:

• Email: [email protected]
• Subject line: Privacy / Data Protection Enquiry
• Response time: We aim to acknowledge all privacy requests within 72 hours and resolve them within 30 days.

puji9 collects the minimum personal data required to operate the Platform legally and securely. The categories of personal data we may collect are described in the table below:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or detailed health data, except where health information is voluntarily provided in the context of a responsible gaming self-exclusion or problem gambling support request.

puji9 collects personal data through the following means:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion;
• Automated technologies: Technical and usage data collected automatically when you visit the Platform, via cookies, server logs, and similar tracking technologies (see Section 10 on Cookies);
• Payment processors: Transaction confirmation data received from payment service providers including bKash, Nagad, Rocket, Upay, and Visa/Mastercard processing partners when you make a deposit or withdrawal;
• Identity verification providers: Verification results and risk scores received from third-party KYC and anti-money laundering (AML) service providers when we process your identity documents;
• Fraud prevention services: Device fingerprinting and behavioural data provided by fraud detection partners to protect the integrity of the Platform and all players;
• Publicly available sources: In limited circumstances, we may supplement your data with publicly available information such as company registries or court records for AML compliance purposes.

puji9 processes personal data for the following specific purposes. We only use your data for the purpose for which it was collected, and we will not process it in a manner incompatible with those purposes without notifying you and, where required, obtaining your consent.

• Account management: Creating, maintaining, and securing your puji9 account, including authentication and password reset processes;
• Identity and age verification: Confirming that you are at least 21 years of age and that your identity matches the details provided at registration, as required for responsible gaming compliance;
• Payment processing: Processing deposits and withdrawals via your chosen payment method, reconciling transactions, and maintaining accurate financial records;
• Anti-money laundering (AML) and fraud prevention: Monitoring transactions and account activity for signs of money laundering, fraud, collusion, or other prohibited conduct as required by applicable regulations;
• Platform operation and improvement: Ensuring the technical performance, security, and reliability of the Platform; analysing usage patterns to improve user experience and product features;
• Customer support: Responding to your enquiries, resolving disputes, and providing assistance with account issues;
• Responsible gaming: Monitoring gambling behaviour for signs of problem gambling, applying account restrictions requested by you, and fulfilling self-exclusion obligations;
• Regulatory compliance: Meeting obligations under applicable laws, cooperating with lawful requests from competent authorities, and maintaining records as required;
• Communications: Sending you transactional messages (deposit confirmations, withdrawal notifications, security alerts) and, where you have opted in, promotional communications about puji9 offers and updates.

Every instance of personal data processing by puji9 is grounded in one or more of the following lawful bases:

• Contract performance: Processing necessary to fulfil our obligations to you under the Terms & Conditions, including account management, payment processing, and game result settlement;
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, age verification requirements, and regulatory reporting duties;
• Legitimate interests: Processing carried out for our legitimate business interests, such as fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily used for optional marketing communications. You may withdraw consent at any time by contacting us at [email protected].

puji9 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card processing partners, solely to process your transactions;
• Identity and KYC verification providers: Third-party services that assist with age verification, document authentication, and AML screening;
• Fraud prevention and security providers: Services that help us detect and prevent fraud, bot activity, and account abuse;
• IT infrastructure and hosting providers: Cloud hosting and data centre partners who store Platform data under strict confidentiality and security obligations;
• Customer support platforms: Software tools used to manage and respond to support tickets and live chat sessions;
• Legal and regulatory authorities: Where we are required by law, court order, or regulatory directive to disclose personal data to a competent authority, we will comply and, where legally permitted, notify you of such disclosure;
• Professional advisers: Solicitors, auditors, and other professional advisers bound by confidentiality obligations, in connection with legal proceedings or business compliance activities.

All third parties who process personal data on puji9's behalf are required to do so only on our documented instructions, and to maintain appropriate technical and organisational security measures. We do not permit third-party service providers to use your personal data for their own independent purposes.

puji9 retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following retention periods apply as general guidelines:

When the applicable retention period expires and no other legal basis requires continued storage, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

puji9 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the puji9 Platform;
• Encryption at rest for sensitive personal data and financial records stored on our servers;
• Role-based access controls that restrict employee access to personal data strictly to those with a documented business need;
• Two-factor authentication (2FA) available to all users and mandatory for staff with access to personal data systems;
• Regular penetration testing and security audits carried out by qualified independent security professionals;
• Intrusion detection and monitoring systems that operate continuously to identify and respond to suspicious activity;
• Data breach response procedures that include detection, containment, assessment, notification to affected users, and regulatory reporting where required.

While puji9 takes all reasonable precautions to protect your data, no digital system can be entirely immune to security threats. You also play a role in keeping your account secure by choosing a strong, unique password, enabling 2FA, and not sharing your credentials with anyone.

The puji9 Platform uses cookies and similar technologies to operate essential Platform functions and to analyse how users interact with the service. A cookie is a small text file placed on your device when you visit a website. puji9 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens, and load balancing cookies. They cannot be disabled without breaking core Platform functionality;
• Functional cookies: Remember your preferences such as language settings, previously selected payment methods, and game display preferences to improve your experience;
• Analytics cookies: Collect aggregated, anonymised data about how users navigate the Platform — such as which pages are visited most frequently and where errors occur — so we can improve performance and usability. These cookies do not identify you personally;
• Fraud prevention and security cookies: Used to detect automated bots, identify suspicious login patterns, and protect accounts from unauthorised access.

puji9 does not use third-party advertising or retargeting cookies. We do not allow advertising networks to place tracking cookies on the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair or prevent access to the Platform. Please consult your browser's help documentation for guidance on cookie management.

Subject to applicable law, you have the following rights in relation to your personal data held by puji9. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request".

• Right of access: You may request a copy of the personal data puji9 holds about you, together with information about how and why it is being processed;
• Right to rectification: You may request correction of any personal data we hold about you that is inaccurate or incomplete;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our retention obligations under applicable law (see Section 8);
• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances, for example while a dispute about accuracy is being resolved;
• Right to data portability: Where processing is based on consent or contract performance and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format;
• Right to object: You may object to processing of your personal data carried out on the basis of legitimate interests. We will assess whether our legitimate interests are overridden by your rights and freedoms and respond accordingly;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal;
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces significant legal or similarly significant effects on you, except where necessary for contract performance or with your explicit consent.

We will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it. We may need to verify your identity before processing a data rights request.

The puji9 Platform is strictly restricted to individuals aged 21 years or older. We do not knowingly collect or process personal data from persons under the age of 21. Age verification is a mandatory step during the account registration and KYC process specifically to prevent minors from accessing the Platform.

If puji9 discovers or is notified that an account has been created by, or that personal data has been collected from, a person under the age of 21, we will immediately suspend the account, delete the associated personal data to the extent permitted by applicable law, and return any balance to the payment source where identity can be verified to a parent or guardian.

If you are a parent or guardian and believe your child may have accessed or registered on the puji9 Platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". We treat such reports with the highest priority.

puji9 primarily stores and processes personal data within data centres located in regions that provide appropriate levels of data protection. In certain circumstances — for example, when using globally distributed cloud services or international KYC providers — your personal data may be transferred to and processed in countries outside Bangladesh.

Where such international transfers take place, puji9 ensures that appropriate safeguards are in place to protect your personal data, including:

• Transfers to service providers located in countries with recognised adequate levels of data protection;
• Standard contractual clauses or equivalent contractual safeguards incorporated into agreements with service providers;
• Binding corporate rules or equivalent frameworks where applicable.

You may request further information about the safeguards applied to international transfers of your personal data by contacting us at [email protected].

puji9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, we will publish the revised Policy on the Platform with an updated effective date and, where practically possible, notify registered account holders by email.

We encourage you to review this Policy periodically to stay informed about how puji9 protects your personal data. Your continued use of the Platform following the publication of an updated Policy constitutes your acknowledgment of the changes. If you disagree with any updated provisions, you should cease using the Platform and may close your account by contacting our support team.

If you have questions, concerns, or complaints about the way puji9 handles your personal data, or if you wish to exercise any of your data rights described in Section 11, please contact our Data Protection team:

We take all privacy complaints seriously and will investigate every report promptly and impartially. If you are not satisfied with our response to your complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. puji9 will cooperate fully with any such authority in the resolution of complaints.

For matters specifically relating to responsible gaming, self-exclusion, or problem gambling, please visit our dedicated Responsible Gaming page, where you will find guidance on available tools and support resources.