11j Privacy Policy — How We Collect, Use & Protect Your Personal Data

For the purposes of this Privacy Policy, 11j (operating at 11j.onl) is the data controller responsible for the personal data you provide when using the 11j platform. As data controller, 11j determines the purposes and means by which your personal data is processed. If you have any questions about how 11j processes your data, please contact us using the details in Section 14 of this policy.

11j is committed to processing personal data in accordance with applicable data protection law and international privacy standards. Where 11j engages third-party service providers to process personal data on its behalf, those providers act as data processors under written contracts that require them to process data only in accordance with 11j's instructions and to maintain appropriate security measures.

11j collects the following categories of personal data from registered users and platform visitors:

• Full legal name as it appears on your government-issued identification document (e.g., CNIC).
• Date of birth — collected for mandatory age verification purposes (21+ requirement).
• Nationality and country of residence — required for compliance and eligibility screening.
• Government-issued identification documents (CNIC or equivalent) — collected as part of the KYC (Know Your Customer) verification process.

• Pakistani mobile number — used for account communication, two-factor authentication, and security alerts.
• Email address — used for account notifications, promotional communications (where consent is given), and support correspondence.
• Residential address — may be collected as part of enhanced KYC verification for high-value account holders.

• Payment method details — including JazzCash account number, EasyPaisa account number, bank account details (HBL, UBL, Meezan Bank), sufficient to process deposits and withdrawals. Full payment credentials are not stored by 11j — only tokenised references where applicable.
• Transaction history — all deposits, withdrawals, and wager records associated with your 11j account, maintained for accounting, dispute resolution, and AML compliance purposes.
• Source of funds information — may be requested for compliance purposes for accounts transacting above defined thresholds.

• IP address and approximate geolocation derived from IP — used for security monitoring, fraud detection, and jurisdictional compliance.
• Device information — device type, operating system, browser type and version, screen resolution.
• Session data — login timestamps, session durations, pages visited, games played, and bet history within gaming sessions.
• Cookie data and similar tracking technologies — as described in Section 10 of this policy.

• Records of all communications between you and the 11j support team — including chat transcripts, email correspondence, and support ticket records.
• Responses to surveys, feedback forms, and promotional competitions where you choose to participate.

11j collects personal data through the following means:

• Direct collection: Information you provide when creating your 11j account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically during your use of the 11j platform through cookies, server logs, and similar technologies.
• Third-party sources: Identity verification and age confirmation data from KYC service providers; fraud prevention data from industry fraud databases; payment confirmation data from payment processors (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank).

The following table summarises the primary purposes for which 11j processes your personal data and the legal basis relied upon for each processing activity:

11j does not sell, rent, or otherwise transfer your personal data to third parties for their own independent commercial purposes. 11j shares personal data with third parties only in the following circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — to process your deposits and withdrawal requests. These parties receive only the data necessary to complete the transaction and are bound by their own data protection obligations.
• KYC and identity verification providers: Third-party services engaged to verify your identity and age as required by 11j's licensing and regulatory obligations.
• Game software providers: Game providers such as Pragmatic Play, NetEnt, Microgaming, and Playtech may receive limited technical data necessary to operate their games on the 11j platform (e.g., anonymous session identifiers). These providers do not receive identifiable personal data without separate disclosure.
• Fraud prevention and AML databases: 11j participates in industry fraud prevention schemes. Personal data may be shared with these schemes where there are reasonable grounds to suspect fraud, money laundering, or terms abuse.
• Legal and regulatory authorities: Where required by applicable law, court order, regulatory request, or the requirements of 11j's gaming licence, personal data may be disclosed to relevant authorities without prior notice to you.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 11j's business, personal data held by 11j may be transferred to the acquiring entity, subject to equivalent data protection obligations.

As an internationally operating platform, 11j may transfer certain personal data to service providers and processors located outside of Pakistan. Where such transfers occur, 11j ensures that appropriate safeguards are in place — including contractual data protection clauses equivalent to internationally recognised standards — to protect your personal data to a level no less protective than that described in this Privacy Policy.

If you have questions about the specific mechanisms used for international data transfers involving your personal data, please contact 11j using the details in Section 14.

11j retains personal data for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable law or regulatory obligation. The following general retention periods apply:

• Active account data: Retained for the duration of your 11j account plus 5 years following account closure, to comply with AML, tax, and gaming licensing record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years following the date of each transaction, in compliance with applicable financial record-keeping obligations.
• KYC and identity documents: Retained for the duration of account activity plus 5 years post-closure, or as required by the applicable licensing authority.
• Customer support communications: Retained for 2 years following the resolution of the relevant support interaction, except where the communication is part of a formal dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your marketing consent plus 3 years following any opt-out, to demonstrate compliance.
• Self-exclusion records: Retained indefinitely to ensure self-excluded individuals are not inadvertently re-admitted to the platform in violation of their exclusion order.

When data reaches the end of its defined retention period, it is securely deleted or irreversibly anonymised, such that it can no longer be attributed to any individual.

11j implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include — but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your device and 11j servers.
• Encryption of sensitive personal data fields (including payment credentials and identity document data) at rest in 11j databases.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Two-factor authentication (2FA) available and encouraged for all 11j user accounts.
• Automated detection and alerting for unusual login activity, including logins from unrecognised devices or atypical geographic locations.
• Regular third-party security assessments and penetration testing of the 11j platform infrastructure.
• Formal data breach response procedures, including notification protocols for affected users where required by applicable law.

While 11j takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is perfectly secure. You are responsible for maintaining the security of your own account credentials and for promptly reporting any suspected unauthorised access to 11j support.

Subject to applicable law and certain limitations arising from 11j's legal and regulatory obligations, you have the following rights in relation to personal data that 11j holds about you:

• Right of Access: You may request a copy of all personal data that 11j holds about you. 11j will respond to verified access requests within 30 days.
• Right to Rectification: If personal data held by 11j is inaccurate or incomplete, you may request that it be corrected. You can update most account information directly through your 11j account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. This right is subject to 11j's legal retention obligations — data required for AML compliance, gaming licence record-keeping, or ongoing dispute resolution cannot be deleted within applicable mandatory retention periods.
• Right to Restriction of Processing: You may request that 11j restricts its processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a structured, machine-readable copy of your personal data for transfer to another controller where technically feasible.
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to 11j demonstrating compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact 11j support using the contact details in Section 14. 11j will respond to all data rights requests within 30 days of receipt of a verified request. 11j may need to verify your identity before processing a rights request to prevent unauthorised access to another person's data.

The 11j platform uses cookies and similar tracking technologies to enhance the user experience, maintain session state, analyse platform usage, and support security monitoring. The following categories of cookies are used on 11j:

• Strictly Necessary Cookies: Required for the platform to function correctly — including session management, authentication state, and security tokens. These cookies cannot be disabled without impairing platform functionality.
• Functionality Cookies: Remember your preferences and settings to provide a more personalised 11j experience — such as preferred language, last visited game category, and display preferences.
• Analytics Cookies: Used to understand how players use the 11j platform in aggregate — which pages are visited, how long sessions last, where users navigate from — to inform product improvement decisions. Analytics data is processed in anonymised or aggregated form where possible.
• Security Cookies: Used to detect and prevent fraudulent activity, including suspicious login patterns and bot activity.

The 11j platform is strictly for adults aged 21 and above. 11j does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the 11j account registration process, and 11j employs additional verification measures to detect and prevent underage access.

If 11j becomes aware that personal data has been collected from an individual who is under 21 years of age, that data will be deleted immediately and the associated account will be permanently closed. Parents or guardians who believe their child may have registered on 11j should contact 11j support immediately using the details in Section 14.

11j sends marketing communications — including promotional offers, bonus notifications, and platform updates — only to users who have provided explicit opt-in consent during registration or subsequently through their account settings. 11j does not send unsolicited marketing communications.

You can opt out of marketing communications at any time by updating your notification preferences in your 11j account settings or by contacting 11j support. Opt-out requests are processed within 5 business days. Please note that opting out of marketing communications does not affect transactional communications — you will continue to receive account-related notifications (e.g., deposit confirmations, withdrawal status updates, security alerts) that are necessary for the management of your 11j account.

11j reserves the right to update or amend this Privacy Policy at any time. Material changes to the policy — particularly those that affect the manner in which 11j collects, uses, or shares your personal data — will be communicated to registered users via the email address registered on their 11j account prior to the change taking effect, and the updated policy will be published on the 11j platform with a revised effective date.

We encourage you to review this Privacy Policy periodically to stay informed of any updates. Your continued use of the 11j platform following the publication of an updated Privacy Policy constitutes acceptance of the updated terms, except where applicable law requires explicit re-consent.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about how 11j has handled your personal data, please contact the 11j data privacy team using the details below. We aim to respond to all data-related enquiries within 30 days.

If you are not satisfied with how 11j has handled your privacy complaint after going through our internal process, you may escalate your complaint to the relevant data protection authority in your jurisdiction or to the regulatory body overseeing 11j's gaming licence. For responsible gaming concerns, please visit our Responsible Gaming page.