jl18 Privacy Policy

jl18 ("jl18", "we", "us", "our") operates the online gaming platform accessible at jl18.lat (the "Platform"). This Privacy Policy describes how jl18 collects, uses, stores, discloses, and protects the personal data of individuals ("you", "your", "Player") who register for or use the Platform.

jl18 is committed to responsible data management. Our privacy practices are aligned with internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR) framework, adapted to the context of an international gaming operator serving Pakistani players.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. Together, these documents govern your relationship with jl18.

We periodically review and update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or regulatory guidance. The version number and effective date displayed in the metadata bar above indicate the currently operative version. We encourage you to review this page regularly.

For the purposes of applicable data protection law, jl18 is the data controller in respect of the personal data collected from Platform users. As data controller, jl18 determines the purposes for which and the means by which your personal data is processed.

All data controller responsibilities — including responding to data subject requests, maintaining records of processing activities, and implementing appropriate technical and organisational security measures — are fulfilled by jl18's designated data protection team.

If you have any questions about how jl18 processes your personal data, or wish to exercise any of the rights described in Section 10 of this Privacy Policy, please contact us at the details provided in Section 14.

jl18 collects personal data across several categories, depending on the nature of your interaction with the Platform. The following table provides a structured overview of the categories of personal data we collect and their primary collection points:

jl18 collects your personal data through the following channels and mechanisms:

4.1 Direct Collection

You directly provide personal data to jl18 when you register for an account, complete KYC verification, make a deposit or withdrawal, contact our support team, set responsible gaming limits, or participate in promotions. Data provided directly by you forms the primary basis of your jl18 player profile.

4.2 Automated Collection

When you access and use the Platform, jl18 automatically collects technical and usage data via server logs, cookies, web beacons, and similar tracking technologies. This includes your IP address, device identifiers, browser configuration, session duration, and navigation patterns within the Platform. See Section 9 for our full Cookies policy.

4.3 Third-Party Sources

jl18 may receive personal data about you from the following third-party sources:

• Payment Providers: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank may share transaction confirmation data with jl18 as part of the payment processing workflow;
• Identity Verification Services: Third-party KYC and AML screening providers may return identity verification results, sanctions screening outcomes, and politically exposed person (PEP) flags;
• Fraud Prevention Agencies: jl18 may receive fraud risk signals and device fingerprint data from third-party fraud prevention partners;
• Analytics Providers: Aggregated audience insights from analytics platforms used to understand Platform usage patterns.

jl18 processes your personal data for specific, explicit, and legitimate purposes. For each processing activity, jl18 identifies an appropriate legal basis. The primary purposes and their legal bases are set out below:

Where jl18 relies on legitimate interests as its legal basis, we have conducted a legitimate interests assessment to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests — see Section 10.

jl18 does not sell your personal data to third parties. We may share your personal data with carefully selected third-party service providers and partners only to the extent necessary and always subject to appropriate data protection safeguards.

6.1 Categories of Recipients

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank — for the processing of deposits, withdrawals, and refunds in PKR;
• KYC & AML Providers: Identity verification and sanctions screening services that assist jl18 in meeting its regulatory obligations;
• Game Content Providers: Third-party casino game studios and sports data providers whose content is integrated into the Platform. These providers may receive anonymised session data for game integrity purposes;
• IT & Hosting Providers: Cloud infrastructure and data centre providers who host the Platform and player data under strict data processing agreements;
• Customer Support Platforms: Helpdesk software providers used to manage support tickets and communications;
• Analytics Providers: Web analytics services used to understand Platform performance, provided only with aggregated or pseudonymised data;
• Regulatory Authorities: jl18 may be required to disclose personal data to gaming regulators, financial intelligence units, tax authorities, or law enforcement agencies in compliance with legal obligations.

6.2 Data Processing Agreements

All third-party service providers who process personal data on jl18's behalf are required to enter into a formal Data Processing Agreement (DPA) with jl18. These agreements impose binding obligations on processors regarding data security, confidentiality, and compliance with applicable data protection law.

jl18 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or permanently anonymised such that it can no longer be attributed to an identifiable individual. Where anonymisation is not technically feasible, data will be securely destroyed in accordance with recognised data destruction standards.

jl18 takes the security of your personal data seriously and has implemented comprehensive technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure.

8.1 Technical Safeguards

• Encryption in Transit: All data transmitted between your browser or device and the jl18 Platform is protected by 256-bit SSL/TLS encryption;
• Encryption at Rest: Sensitive personal data stored in jl18 databases — including KYC documents and financial data — is encrypted at rest using AES-256 encryption;
• Access Controls: Access to personal data is restricted to authorised jl18 personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA);
• Intrusion Detection: jl18 operates automated intrusion detection and prevention systems (IDS/IPS) across its infrastructure;
• Regular Security Audits: The Platform undergoes periodic penetration testing and vulnerability assessments conducted by independent security professionals.

8.2 Organisational Safeguards

• All jl18 employees and contractors with access to personal data are subject to confidentiality obligations and undergo data protection training;
• jl18 maintains a formal incident response plan. In the event of a data breach that poses a risk to your rights and freedoms, jl18 will notify affected individuals in accordance with applicable notification obligations;
• Third-party processors are vetted for security compliance before engagement and are subject to periodic review.

jl18 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, understand how the Platform is used, detect fraud, and — where you have provided consent — deliver relevant content.

9.1 Cookie Categories

9.2 Managing Cookies

You can manage your cookie preferences through the cookie consent banner presented on your first visit to the Platform, or at any time via the cookie settings panel accessible from the Platform footer. You may also control cookies through your browser settings; however, disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging in.

Please note that jl18 does not use cookies to collect personal data for sale to third parties or for cross-site behavioural advertising on external websites.

As a data subject, you hold the following rights in respect of your personal data held by jl18. jl18 is committed to honouring these rights promptly and without unnecessary obstacles.

10.1 Right of Access

You have the right to request a copy of the personal data jl18 holds about you, along with supplementary information about how that data is processed. We will provide this information within 30 calendar days of a verified request, free of charge for the first request in any 12-month period.

10.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data held by jl18. You may update most account information directly through your account settings. For identity and KYC data corrections, please contact our support team.

10.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. Please note that this right is subject to our legal retention obligations — we cannot delete data we are legally required to retain (e.g., AML and transaction records).

10.4 Right to Restriction

You have the right to request that jl18 restricts the processing of your personal data in certain circumstances, such as while the accuracy of data is contested or while an objection to legitimate interests processing is being assessed.

10.5 Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

10.6 Right to Object

You have the right to object to processing of your personal data where jl18 relies on legitimate interests as its legal basis. jl18 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. You may also object at any time to your personal data being used for direct marketing purposes.

10.7 Rights Related to Automated Decision-Making

jl18 may use automated systems in certain contexts, such as fraud detection, KYC screening, and responsible gaming interventions. Where a fully automated decision produces a significant legal or similarly significant effect on you, you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

jl18 employs age verification procedures at the point of registration to prevent underage access. All accounts where age cannot be confirmed are placed in a restricted state pending documentary proof. Where jl18 discovers that personal data has been collected from an individual under the age of 21, that data will be deleted promptly and the account permanently closed.

Parents and guardians who are concerned about underage access to online gaming platforms are encouraged to use parental control software and to visit our Responsible Gaming page for further guidance and resources.

As an internationally licensed gaming operator, jl18 may transfer personal data to, and store it in, countries outside Pakistan. Some of these countries may not have data protection laws equivalent to those applicable in your jurisdiction.

Where jl18 transfers personal data internationally, it does so subject to appropriate safeguards, which may include:

• Transfers to countries recognised as providing an adequate level of data protection;
• Standard Contractual Clauses (SCCs) or equivalent contractual protections approved under applicable data protection frameworks;
• Binding Corporate Rules where transfers occur within a group of companies;
• Specific derogations applicable to the performance of a contract or the establishment, exercise, or defence of legal claims.

You may request information about the specific safeguards in place for any particular international transfer by contacting jl18 at the details set out in Section 14.

jl18 reserves the right to update or revise this Privacy Policy at any time. Where material changes are made — for example, changes that affect how we use your personal data or changes to your rights — we will notify you by email to your registered account address and/or by posting a prominent notice on the Platform at least seven (7) calendar days before the changes take effect.

For minor or non-material changes (such as corrections of typographical errors or clarifications that do not affect data processing), we may update this page without prior notice, but we will always update the version number and effective date in the metadata bar at the top of this page.

Your continued use of the jl18 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not accept the revised policy, you must stop using the Platform and contact us to close your account.

If you have any questions, concerns, or complaints regarding this Privacy Policy or jl18's data processing practices, or if you wish to exercise any of your data subject rights, please contact us using the details below:

If you are not satisfied with jl18's response to your privacy enquiry or data subject request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.