Privacy Policy — 11jj

1 Introduction

This Privacy Policy ("Policy") describes how 11jj (the "Platform", "we", "us" or "our"), accessible at https://11jj.cam, collects, uses, stores, shares and protects the personal data of users ("you" or "your") who access or interact with our online casino and sports betting services.

11jj is an English-language platform designed for Pakistani players. We are committed to handling your personal data responsibly, lawfully and transparently. This Policy applies to all personal data we process in connection with your use of the Platform, including data provided during registration, KYC verification, payment transactions, customer-support interactions and general browsing activity on the site.

By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy.

2 Definitions

In this Policy, unless the context otherwise requires:

3 Personal Data We Collect

We collect the following categories of Personal Data, which vary depending on how you interact with the Platform:

3.1 Account & Registration Data

• Full legal name, date of birth and gender;
• Email address and account password (stored in hashed form);
• Country of residence and, where provided, city (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar);
• Preferred language and communication preferences.

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (e.g., CNIC, passport, driving licence);
• Proof of address documentation;
• Source-of-funds documentation where required under AML procedures;
• Facial verification images where applicable.

3.3 Financial & Payment Data

• Deposit and withdrawal transaction records (amounts in PKR, method references, timestamps);
• Payment method identifiers (e.g., last four digits of a card, wallet account reference) — payment method references such as Easypaisa, JazzCash, Raast and bank transfer records are collected only as applicable transaction metadata. These providers do not endorse gambling or this Platform;
• Account balance history and wagering activity.

3.4 Technical & Usage Data

• IP address, device type, browser type and operating system;
• Session timestamps, pages visited and features used;
• Geolocation data (country/region level, derived from IP address);
• Cookie and tracking data as described in Section 10.

3.5 Communication Data

• Live chat transcripts and email correspondence with our support team;
• Complaint and dispute records;
• Responsible-gambling self-assessment responses and limit-setting history.

4 How We Collect Personal Data

We collect Personal Data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make deposits or withdrawals, contact support or engage with responsible-gambling tools;
• Automatically — through cookies, server logs and analytics tools when you navigate the Platform, including device fingerprinting data used for fraud prevention;
• From third-party service providers — identity-verification agencies, payment processors and fraud-detection services may supply us with data necessary to verify your identity or protect the integrity of the Platform;
• From publicly available sources — where necessary for AML/KYC compliance purposes, including sanctions screening databases.

5 Data Processing Purposes

We process your Personal Data for the specific purposes set out in the table below. Where a purpose changes materially, we will update this Policy and notify you as appropriate.

6 Legal Basis for Processing

We rely on the following lawful bases for Processing your Personal Data:

• Contract Performance: Processing necessary to provide the services you have requested — including account management, transaction processing and customer support;
• Legal Obligation: Processing required to comply with applicable anti-money laundering, know-your-customer and responsible-gambling regulatory requirements under our international operating licence;
• Legitimate Interests: Processing that is in our legitimate business interest and does not unreasonably override your privacy rights — including fraud detection, Platform security, abuse prevention and internal analytics. We conduct a balancing test before relying on this basis;
• Consent: Where we have obtained your explicit, freely given, informed and withdrawable consent — such as for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not process Personal Data for automated decision-making that produces significant legal effects on you without a human review mechanism.

7 Sharing & Disclosure of Personal Data

11jj does not sell, rent or trade your Personal Data to third parties for their own marketing purposes. We may share your data in the following limited circumstances:

• Service Providers (Data Processors): Identity-verification agencies, payment processors, fraud-detection providers, cloud infrastructure providers and customer-support platform operators that process data on our behalf under written data-processing agreements and solely on our instructions;
• Game and Technology Providers: Game studios and odds-feed providers may receive pseudonymised session or wagering data necessary to deliver game functionality and calculate outcomes. These providers are contractually prohibited from using your data for independent purposes;
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, regulatory directive or to protect the rights and safety of 11jj, its staff or users;
• AML/KYC Compliance Bodies: Sanctions screening, politically exposed person (PEP) checks and adverse media screening conducted through licensed compliance data providers;
• Business Transfers: In the event of a merger, acquisition or sale of all or part of our business, Personal Data may be transferred to the acquiring entity subject to equivalent privacy protections.

8 Data Retention

We retain Personal Data only for as long as is necessary for the stated processing purpose or as required by applicable regulatory obligations. The following indicative retention schedule applies:

At the end of the applicable retention period, Personal Data will be securely deleted or anonymised in accordance with our internal data-disposal procedures.

9 Your Rights

Subject to applicable law and certain conditions or exceptions, you may exercise the following rights in relation to your Personal Data held by 11jj:

To exercise any of the above rights, contact us at [email protected] (plain text — not a clickable link) with a clear description of your request. We may need to verify your identity before processing the request. We will respond within 30 days, or notify you if additional time is required under applicable law.

10 Cookies & Tracking Technologies

11jj uses cookies and similar technologies to operate the Platform, remember your preferences, prevent fraud and understand how users interact with our content. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens and load-balancing. These cannot be disabled without affecting core Platform functionality;
• Functional Cookies: Remember your preferences such as language, display settings and responsible-gambling limit configurations;
• Analytics Cookies: Collect anonymised or pseudonymised data about how users navigate the Platform, used solely to improve the user experience. We do not share raw analytics data with advertising networks;
• Fraud-Prevention Cookies: Used by our security systems to detect suspicious access patterns and protect accounts from unauthorised access.

11 Security Measures

11jj implements a range of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. These include, without limitation:

• HTTPS/TLS encryption for all data in transit between your device and our servers;
• Encryption at rest for sensitive data fields, including identity documents and payment references;
• Access controls and role-based permissions ensuring that only authorised staff can access Personal Data on a documented need-to-know basis;
• Regular security audits and vulnerability assessments of Platform infrastructure;
• Incident response procedures for detecting, containing and notifying of data breaches within applicable regulatory timeframes.

No security system is entirely impenetrable. While we take all reasonable measures to protect your data, we cannot guarantee absolute security. You should use a strong, unique password for your Account and enable two-factor authentication where available. Notify us immediately at [email protected] if you suspect any unauthorised access to your Account.

12 Minors & Age Gating

The 11jj Platform is strictly for adults aged 18 years and over, or the higher minimum age required by the operator or applicable licence jurisdiction. We do not knowingly collect Personal Data from individuals below the applicable minimum age.

Age verification is conducted as part of the KYC process. Where we discover that Personal Data has been provided by an underage individual, we will promptly delete that data and close the associated Account. Any winnings generated during an Account operated by an underage user will not be paid out.

If you have reason to believe that a minor has registered an Account on 11jj using false information, please contact us immediately at [email protected] (plain text — not a link).

13 International Data Transfers

11jj operates under an international licensing framework and may store or process Personal Data on servers located outside your country of residence, including outside Pakistan. Where Personal Data is transferred to countries that may not provide the same level of data protection as your home jurisdiction, we take appropriate safeguards to ensure that your data remains protected, including:

• Entering into data-processing agreements with third-party processors that incorporate appropriate contractual protections;
• Applying technical and organisational security measures equivalent to those described in Section 11;
• Conducting due-diligence assessments of third-party processors before engagement.

By using the Platform and providing us with your Personal Data, you acknowledge that your data may be processed in jurisdictions outside Pakistan.

14 Third-Party Links & Services

The 11jj Platform may contain references to or integrations with third-party game studios, odds-feed providers and payment processors in the course of delivering gaming and betting services. This Policy applies only to Personal Data processed by 11jj in its capacity as Data Controller.

Where third-party service providers act as Data Processors on our behalf, they are bound by data-processing agreements and may only process your data on our documented instructions. They may not use your data for their own independent purposes.

The Platform does not contain links to external third-party websites outside the 11jj domain. If you independently navigate to external sites, this Policy does not apply to those sites and we are not responsible for their privacy practices.

15 Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated to registered users via email or in-Platform notification where practicable. The updated Policy will be published on this page with a revised Effective Date at the top.

Your continued use of the Platform after the revised Policy is published constitutes your acceptance of the changes. If you do not agree with any change, you should cease using the Platform and request Account closure. Historical versions of this Policy are available on request from [email protected].

16 Contact & Complaints

For any queries, requests or complaints relating to this Privacy Policy or the processing of your Personal Data by 11jj, please contact us through the following channels. Note that email addresses below are displayed as plain text and are not clickable links.

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate your complaint to the relevant supervisory or regulatory authority in the jurisdiction under which we operate. Contact us for further information about applicable escalation routes.