moja7 Privacy Policy — How We Handle Your Data

moja7 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We collect only the data we genuinely need to operate the Platform, process your transactions, verify your identity, and keep your account secure.

We do not sell your personal data to third parties. We do not share your data with advertisers or data brokers. Your data is used solely for the purposes described in this Privacy Policy, and it is protected using SSL encryption and industry-standard security practices.

When you register a moja7 account, use the Platform, or contact our support team, we may collect the following categories of personal information:

• Registration data: your mobile phone number, date of birth, username, and account password (stored in hashed form — never in plain text).
• Identity verification data: where KYC verification is required, we may collect a copy of a national identity document (NID), passport, or other government-issued document, along with a selfie or proof-of-life image for verification purposes.
• Financial data: records of your deposit and withdrawal transactions, including mobile wallet numbers used (e.g. bKash, Nagad, Rocket numbers), transaction reference IDs, amounts, and timestamps. We do not store full wallet PINs or passwords.
• Gaming activity data: records of games played, bets placed, amounts wagered, results, session durations, and bonus usage history. This data is used to operate the Platform, calculate balances, resolve disputes, and detect problem gambling patterns.
• Device and technical data: your device type, operating system, browser version, IP address, and approximate geolocation (country and city level only — we do not track precise GPS location). This data is used for security monitoring, fraud detection, and Platform performance improvement.
• Support communications: records of any messages, live chat transcripts, or other communications between you and the moja7 support team. These records are retained to ensure quality of service and to assist in resolving future disputes.

We do not collect sensitive personal data beyond what is required for identity verification. We do not request or store biometric data, health information, religious affiliation, or political views.

moja7 uses the personal data collected for the following specific purposes. We process your data only for purposes that are compatible with the reason it was originally collected:

• Account creation and management: to register your account, authenticate your identity at login, send OTP verification codes, and maintain your account settings and preferences.
• Transaction processing: to process your deposits and withdrawals via bKash, Nagad, and Rocket, maintain accurate account balances, and generate transaction records for your review.
• Identity verification and fraud prevention: to verify your age (you must be 21 or above) and identity, to comply with applicable KYC requirements, and to detect and prevent fraudulent activity, money laundering, and account abuse.
• Customer support: to respond to your queries, resolve disputes, process complaints, and maintain a record of support interactions for quality assurance.
• Responsible gaming monitoring: to track gaming activity and identify patterns that may indicate problem gambling, to apply and enforce responsible gaming tools (such as deposit limits and self-exclusion) at your request, and to fulfil our duty of care obligations to players.
• Platform security and technical operation: to monitor for unauthorised access attempts, investigate security incidents, maintain system integrity, and improve Platform performance.
• Legal and regulatory compliance: to meet record-keeping obligations, respond to lawful requests from courts or regulatory authorities, and fulfil any other legal obligations applicable to the operation of the Platform.

moja7 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing that is necessary to deliver the services you have registered for, including account management, game access, and payment processing.
• Legitimate interests: processing carried out to protect the security of the Platform, prevent fraud and money laundering, maintain service quality, and fulfil our responsible gaming obligations — provided these interests are not overridden by your rights.
• Legal obligation: processing required to comply with applicable laws, court orders, or regulatory requirements, including KYC verification and transaction record-keeping.
• Consent: where we seek your explicit consent before processing, for example if we wish to send you optional promotional communications. You may withdraw this consent at any time by contacting our support team.

moja7 does not sell your personal data. We share personal data with third parties only where strictly necessary and only in the following circumstances:

• Game technology providers: licensed game studios such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi may receive limited session data necessary to deliver their games within the Platform. These providers are contractually bound to handle data in accordance with applicable data protection standards and may not use it for any other purpose.
• Payment processors: mobile financial service providers (bKash, Nagad, Rocket) receive the transaction data necessary to process your deposits and withdrawals. moja7 does not have access to your mobile wallet PIN or account password.
• Law enforcement and regulatory authorities: where required to do so by applicable law, court order, or other binding legal process, moja7 may disclose personal data to law enforcement agencies, regulatory bodies, or other government authorities.
• Fraud prevention and security services: trusted third-party security and fraud prevention services may receive limited data (such as IP addresses and device fingerprints) to identify and block fraudulent activity. These providers do not receive full account profiles.

All third-party service providers who handle your personal data on behalf of moja7 are required to implement appropriate technical and organisational security measures and are contractually prohibited from using your data for their own purposes.

When you make a deposit or withdrawal using bKash, Nagad, or Rocket, you are interacting directly with your mobile financial service provider through their own interface. moja7 receives only a transaction confirmation, reference ID, amount, and the mobile number associated with the transaction. moja7 does not see, store, or process your mobile wallet PIN, password, or OTP at any point.

Transaction records are retained as part of your account history for the duration described in the Data Retention section of this Policy. You may request a summary of your transaction history at any time by contacting the moja7 support team.

moja7 uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, and monitor for security threats. The cookies used by moja7 fall into the following categories:

• Strictly necessary cookies: required for the Platform to function. These cookies maintain your login session, remember your language preference, and enable core Platform features. They cannot be disabled without preventing the Platform from working correctly.
• Security cookies: used to detect and prevent fraudulent activity, identify suspicious login patterns, and protect your account from unauthorised access attempts. These cookies are essential to Platform security.
• Performance and analytics cookies: used to understand how players interact with the Platform, identify technical issues, and improve overall Platform performance. Data collected by these cookies is aggregated and does not identify individual players.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies may impair your ability to use the Platform. moja7 does not use advertising cookies or place cookies on behalf of third-party advertisers.

moja7 retains your personal data for as long as your account remains active and for a reasonable period thereafter to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically: account registration data and identity verification documents are retained for the lifetime of the account plus a minimum of five years following account closure; transaction records are retained for a minimum of five years; support communications are retained for two years from the date of the relevant interaction.

When retention is no longer necessary, personal data is securely deleted or anonymised. Where full deletion is not immediately practicable (for example, where data exists in backup archives), moja7 will ensure that the data is isolated from further active processing until deletion is completed.

moja7 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include SSL encryption for all data transmitted between your device and our servers, hashed storage of account passwords, access controls that restrict internal staff access to personal data on a strict need-to-know basis, regular security audits and vulnerability assessments, and automated monitoring for suspicious access patterns.

Despite these measures, no system connected to the internet is entirely immune to security risks. moja7 will notify affected players without undue delay in the event of a data breach that poses a risk to their personal data, and will take prompt remedial action to contain and address the breach.

As a moja7 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact the moja7 support team. We will respond to all valid requests within a reasonable timeframe:

The moja7 Platform is strictly for adults aged 21 years and above. moja7 does not knowingly collect personal data from anyone under the age of 21. If we become aware that personal data has been submitted by a person under 21, we will delete that data promptly and close the associated account. If you are a parent or guardian and believe that your child has created a moja7 account or submitted personal data to the Platform, please contact our support team immediately at [email protected] so that we can take appropriate action.

moja7 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the features of the Platform. When a material change is made, we will post the updated Policy on this page with a revised effective date and, where practicable, notify registered players via a message to their registered mobile number.

We encourage you to review this Privacy Policy periodically to stay informed about how moja7 protects your data. Your continued use of the Platform following any update to this Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way moja7 handles your personal data, please contact our support team. We are available 24 hours a day, 7 days a week via live chat on the Platform and are committed to responding to all privacy-related enquiries promptly and thoroughly.

Email: [email protected]