ej33 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how ej33 ("ej33", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you access or use the ej33 website at ej33.io and all associated services, features, games, and promotional communications (collectively, the "Platform").

ej33 is committed to protecting your privacy and handling your personal data with transparency, integrity, and respect. This Policy applies to all users of the ej33 Platform, including registered players, visitors who browse without registering, and individuals who contact our support team.

By creating an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with how ej33 handles your personal data as described here, you must discontinue use of the Platform.

This Policy should be read alongside ej33's Terms & Conditions and Responsible Gaming Policy, which together govern your relationship with the Platform.

2 Data Controller

For the purposes of this Policy, ej33 acts as the data controller in respect of personal data collected through the Platform. As data controller, ej33 determines the purposes and means by which personal data is processed.

ej33 operates as an offshore gaming platform. It is not registered with, affiliated with, or subject to the oversight of any Bangladeshi government authority or data protection regulator. Players accessing the Platform from Bangladesh do so in acknowledgment of this offshore status.

For all data-related queries, requests, and complaints, players may contact ej33 directly via our 24/7 live chat or by emailing [email protected]. Email contact details are provided as plain text and are not clickable links.

3 Data We Collect

ej33 collects personal data that you provide directly, data generated by your use of the Platform, and in limited cases, data obtained from third parties such as payment providers and identity verification services.

Data you provide directly:

• Registration data: Username, mobile number or email address, password (stored in hashed form — never in plain text), date of birth, and country of residence.
• Identity verification data: Full legal name, national ID card (NID) number, passport number, driver's licence number, photograph, and proof of address documents. This data is collected when required for KYC verification.
• Payment data: bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details, and transaction reference IDs. ej33 does not store full payment credentials — only the minimum required for transaction matching and fraud detection.
• Support communications: Any information you provide when contacting the support team via live chat or email, including the content of messages, complaint details, and dispute records.
• Responsible gaming preferences: Deposit limits, loss limits, session time reminders, self-exclusion requests, and cooling-off period settings.

Data generated automatically:

• Technical data: IP address, device identifier, browser type and version, operating system, screen resolution, and connection type.
• Usage data: Pages visited, games accessed, bets placed, bet amounts, session start and end times, features interacted with, and navigation paths through the Platform.
• Cookie data: Data stored in cookies and similar tracking technologies as described in Section 8 of this Policy.

4 How We Collect Data

ej33 collects personal data through the following mechanisms:

• Direct input: When you complete the registration form, submit identity documents, update your account profile, place bets, make deposits, request withdrawals, or contact support, you are providing data directly to ej33.
• Automated collection: The ej33 Platform automatically collects technical and usage data through server logs, session tracking, and cookies (see Section 8) whenever you access the Platform, whether or not you are logged in.
• Payment providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or other supported payment methods, the respective payment provider shares transaction confirmation data with ej33 for the purpose of crediting or debiting your account balance.
• Identity verification services: Where ej33 uses third-party KYC service providers to verify identity documents, those providers may return verification results — such as a pass/fail status and document authenticity score — to ej33. ej33 does not receive or store raw biometric data from these services.
• Fraud detection and security systems: ej33's fraud prevention systems may cross-reference data points from your session (IP address, device fingerprint, behavioural patterns) against known fraud indicators. No sensitive personal data is transmitted to external fraud databases for this purpose.

5 How We Use Your Data

ej33 uses your personal data exclusively for the following purposes:

• Account creation and management: To create and maintain your player account, authenticate your identity on login, and manage your account settings and preferences.
• Age and identity verification: To confirm that you are at least 21 years of age and that your identity is genuine, in compliance with our responsible gaming obligations and offshore platform requirements.
• Payment processing: To process deposits and withdrawals via supported payment methods including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank.
• Platform delivery: To provide access to games, betting markets, live casino, and all other features available on the ej33 Platform.
• Fraud prevention and security: To detect and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and unauthorised account access.
• Responsible gaming: To monitor gameplay patterns for signs of problem gambling behaviour, enforce player-set limits and self-exclusion requests, and proactively reach out to players who may be at risk.
• Customer support: To respond to your queries, resolve disputes, process complaints, and deliver the 24/7 support service ej33 is committed to providing.
• Legal compliance: To fulfil obligations under applicable offshore gaming regulations, anti-money laundering (AML) requirements, and data retention laws.
• Marketing communications: Where you have opted in, to send promotional offers, bonus notifications, and event-based communications (e.g., BPL season promotions, Eid bonuses, Pohela Boishakh offers). You may withdraw marketing consent at any time via your account settings or by contacting support.
• Platform improvement: To analyse usage patterns, identify technical issues, test new features, and continuously improve the performance and usability of the ej33 Platform.

ej33 does not use your personal data for automated decision-making that produces significant legal or similarly significant effects without human oversight, except where explicitly required by fraud prevention systems and subject to your right to request human review.

6 Legal Bases for Processing

ej33 processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our contractual obligations to you as a player — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations — including KYC/AML compliance, age verification, and record-keeping obligations.
• Legitimate interests: Processing carried out in ej33's legitimate business interests — including fraud detection, platform security, usage analytics, and service improvement — provided that these interests do not override your fundamental privacy rights.
• Consent: Processing for purposes that require your explicit opt-in consent — specifically, sending marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

7 Data Sharing & Disclosure

ej33 does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared only in the following limited and controlled circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and SureCash receive the minimum data necessary to process transactions (such as account numbers and transaction amounts). These providers are subject to their own privacy obligations.
• Identity verification providers: Third-party KYC service providers may receive copies of identity documents for the purpose of verification. These providers are contractually required to process data solely for the stated verification purpose and to delete documents following completion of the verification process.
• Game content providers: Third-party game studios — including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, and NetEnt — may receive your Player ID and game session data necessary to deliver their game content. These studios do not receive your full personal profile or payment data.
• IT infrastructure and hosting providers: ej33 uses trusted cloud infrastructure and hosting providers to operate the Platform. These providers process data on ej33's behalf under data processing agreements and are prohibited from using your data for their own purposes.
• Legal and regulatory authorities: ej33 will disclose personal data to law enforcement agencies, financial intelligence units, or other government authorities where required by law, court order, or where ej33 has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other serious crimes.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ej33's business, player data may be transferred to the acquiring entity. You will be notified of any such transfer via the Platform or your registered contact details in advance.

In all cases where data is shared with third parties, ej33 applies contractual safeguards to ensure that recipient parties process personal data only for the specified purpose, maintain appropriate security standards, and comply with applicable data protection principles.

8 Cookies & Tracking Technologies

ej33 uses cookies and similar tracking technologies to operate the Platform, improve performance, and — where you have consented — deliver personalised content and relevant promotions.

Types of cookies used by ej33:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without rendering the Platform unusable.
• Functional cookies: Remember your preferences such as language settings, game display options, and notification preferences to provide a consistent experience across sessions.
• Analytics cookies: Collect aggregated, anonymised data about how players navigate and use the Platform. This data helps ej33 identify technical issues and prioritise improvements. ej33 uses first-party analytics and does not share raw analytics data with advertising networks.
• Security cookies: Used by ej33's fraud detection systems to identify suspicious behaviour patterns and protect your account from unauthorised access. These are strictly necessary and cannot be disabled.

You may control non-essential cookies through your browser settings. Please note that disabling certain functional cookies may affect your ability to use some features of the Platform. A cookie preference panel is available in your account settings.

ej33 does not use third-party advertising cookies or permit advertising networks to place tracking cookies on the Platform. ej33 does not participate in cross-site behavioural advertising.

9 Data Retention

ej33 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulations. The following retention periods apply as a general guide:

• Account data: Retained for the duration of your account's active status, plus a minimum of 5 years following account closure to satisfy AML and record-keeping obligations.
• Financial transaction records: Retained for a minimum of 7 years from the date of transaction to comply with financial record-keeping requirements.
• KYC and identity documents: Retained for the duration of the account relationship plus 5 years post-closure. Physical or digital copies of documents are securely deleted at the end of the retention period.
• Support correspondence: Retained for 3 years from the date of the most recent interaction to support dispute resolution and service quality auditing.
• Marketing preference data: Retained until you withdraw consent. Following withdrawal, your details are suppressed (not deleted) to ensure we honour your opt-out preference and do not inadvertently re-contact you.
• Technical and usage logs: Retained for 12 months in active systems and up to 3 years in secure archive storage for security investigation purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised aggregate data may be retained indefinitely for statistical analysis.

10 Data Security

ej33 takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, and destruction.

• Encryption in transit: All data transmitted between your browser or app and the ej33 servers is encrypted using 256-bit SSL/TLS protocols. Look for the padlock icon in your browser address bar to confirm the secure connection.
• Encryption at rest: Sensitive data stored in ej33's databases — including identity documents, financial records, and hashed passwords — is encrypted using AES-256 encryption.
• Access controls: Access to personal data within ej33's systems is restricted to authorised personnel on a strict need-to-know basis. All staff with data access undergo background checks and receive mandatory data protection training.
• Two-factor authentication: ej33 offers two-factor authentication (2FA) for player accounts and enforces it for all internal administrative access to systems containing personal data.
• Penetration testing: ej33 conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities in the Platform.
• Incident response: ej33 maintains a documented data breach response plan. In the event of a breach affecting your personal data, affected players will be notified without undue delay with details of the nature of the breach, the data affected, and the steps taken in response.

While ej33 employs robust security measures, no system can guarantee absolute security. You are responsible for keeping your login credentials confidential and for ensuring that the device you use to access the Platform is secured with appropriate protection such as a lock screen and up-to-date antivirus software.

11 International Data Transfers

ej33 operates as an offshore platform with infrastructure hosted in data centres outside Bangladesh. As a result, your personal data may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in Bangladesh.

Where such international transfers occur, ej33 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual protections: Data processing agreements with hosting providers, KYC vendors, and game studios that include standard contractual clauses requiring the recipient to maintain data protection standards equivalent to those described in this Policy.
• Security requirements: All international recipients of ej33 player data are required to implement technical security measures — including encryption at rest and in transit — that meet or exceed the standards described in Section 10 of this Policy.
• Minimisation: Only the minimum data necessary for the relevant purpose is transferred internationally. Full player profiles are not shared with overseas third parties unless required for KYC, fraud investigation, or legal compliance.

By using the ej33 Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

12 Your Rights

As an ej33 player, you have the following rights in relation to your personal data. These rights are described in summary form in the "Your Data Rights at a Glance" section above and are set out in full here:

• Right of access (Subject Access Request): You may request a copy of all personal data ej33 holds about you, the purposes for which it is being processed, the categories of data held, and the recipients to whom it has been disclosed. ej33 will respond to Subject Access Requests within 30 days of receipt.
• Right of rectification: You may request correction of any inaccurate or incomplete personal data. Where data is held in multiple systems, ej33 will apply corrections across all relevant records. Corrections are typically completed within 5 working days.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where: (a) the data is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and ej33 has no overriding legitimate grounds; or (d) the data has been unlawfully processed. Erasure requests will be assessed against ej33's legal retention obligations before being actioned.
• Right to restrict processing: You may request that ej33 limits its processing of your personal data in certain circumstances, such as while a rectification request is under review or while an objection is being assessed.
• Right to data portability: You may request an export of your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV). This right applies to data you have provided to ej33 directly and that is processed by automated means.
• Right to object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on ej33's legitimate interests, in which case ej33 will assess whether its interests override your rights and freedoms.
• Rights related to automated decision-making: You have the right to request human review of any automated decision that produces a significant effect on you, such as an automated account suspension triggered by fraud detection systems.

To exercise any of the above rights, contact the ej33 support team via 24/7 live chat or email at [email protected]. Please include your registered username and clearly state the right you wish to exercise. ej33 will acknowledge your request within 48 hours and respond in full within 30 days. For complex or high-volume requests, the response period may be extended to 60 days with prior written notification.

ej33 will not charge a fee for reasonable data rights requests. Where requests are manifestly unfounded or excessive, ej33 reserves the right to charge a reasonable administrative fee or refuse to act on the request, with written reasons provided.

13 Children & Minors

The ej33 Platform is strictly intended for adults aged 21 years or older. ej33 does not knowingly collect personal data from individuals under the age of 21. The Platform employs age verification measures at registration to confirm that applicants meet the minimum age requirement.

If ej33 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted immediately and the associated account will be permanently closed. Any funds deposited by an underage player will be refunded to the originating payment method following identity confirmation.

Parents and guardians who believe a minor may have accessed or registered on the ej33 Platform are urged to contact the support team immediately at [email protected] so that appropriate action can be taken without delay.

ej33 also recommends that households with minors use parental control software to restrict access to online gambling platforms. Tools such as GamBlock, Betfilter, and Cyberpatrol are available for this purpose and can be installed on shared devices.

14 Third-Party Links

The ej33 Platform does not contain outbound links to third-party websites for commercial or advertising purposes. However, game content delivered by third-party providers such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi is embedded within the Platform and subject to those providers' own data practices in respect of game session data.

ej33 is not responsible for the privacy practices of third-party game studios. Players who wish to understand how game providers handle session data should consult the respective provider's privacy documentation. ej33 does not share your full personal profile with game providers — only the minimum data required to deliver game sessions (typically a session token and Player ID).

15 Changes to This Privacy Policy

ej33 reserves the right to update or amend this Privacy Policy at any time. Changes may be necessary to reflect updates in our data practices, changes in applicable regulations, or improvements to the Platform.

When material changes are made to this Policy — meaning changes that affect your rights or how your data is used — ej33 will notify you by:

• Posting a prominent notice on the ej33 Platform homepage and your account dashboard for a minimum of 14 days before the changes take effect.
• Sending a notification to your registered email address or mobile number where you have provided these details and have not opted out of platform communications.
• Updating the "Last updated" date at the top of this Policy document.

Minor changes that do not affect your rights — such as grammatical corrections, clarifications of existing practices, or updated contact details — may be made without prior notice, though the "Last updated" date will always reflect the most recent revision.

Your continued use of the ej33 Platform following the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must close your account and cease using the Platform before the effective date.

16 Contact & Complaints

ej33 takes all privacy concerns seriously. If you have a question about this Privacy Policy, wish to exercise a data right, or believe that ej33 has handled your personal data in a manner inconsistent with this Policy, please contact us through one of the following channels:

• Live chat: Available 24/7 directly through the ej33 Platform. This is the fastest way to reach the support team for data-related queries.
• Email: [email protected] — for formal data rights requests, please include "Privacy Request" in the subject line and your registered username in the message body.

ej33 aims to resolve all privacy-related complaints within 30 days of receipt. If you are not satisfied with our response, you may escalate your complaint through the dispute resolution mechanism outlined in the ej33 Terms & Conditions.

As ej33 is an offshore platform not regulated by a Bangladeshi authority, there is no local data protection supervisory authority with jurisdiction over ej33's data processing activities. Players are responsible for understanding the implications of using an offshore platform as described in the Terms & Conditions.