xbaj Privacy Policy

1 Introduction

xbaj is an online betting and casino platform designed exclusively for the Bangladesh market. We are committed to handling your personal data with the highest standards of care, transparency, and security. This Privacy Policy sets out in full detail what personal information xbaj collects from you, the purposes for which it is processed, who it may be shared with, how long it is retained, and the rights you have in connection with your personal data.

This policy applies to all users of the xbaj platform, including visitors who browse without registering, registered account holders, and players who access xbaj via any device including mobile phones, tablets, and desktop computers. It covers all services offered on the xbaj platform including cricket betting, live casino, slots, virtual sports, water polo betting, and all associated account and payment functions.

xbaj operates in compliance with internationally recognised data protection principles including purpose limitation, data minimisation, storage limitation, integrity and confidentiality, and accountability. We collect only what we need, use it only for stated purposes, and protect it with appropriate technical and organisational measures throughout its lifecycle.

2 Personal Data We Collect

xbaj collects several categories of personal data from its users. The specific data collected depends on the nature of your interaction with the platform — for example, more detailed information is collected from registered players than from casual visitors. The categories of personal data we collect include:

Category	Examples	When Collected
Identity Data	Full name, date of birth, National ID number, photograph	Registration & KYC verification
Contact Data	Mobile phone number, email address, residential address (city/district)	Registration
Account Data	Username, hashed password, account preferences, session history	Registration & ongoing use
Financial Data	Mobile banking account number (bKash, Nagad, Rocket, Upay), transaction amounts, transaction timestamps	Deposits & withdrawals
Gaming Activity Data	Bets placed, game sessions, win/loss history, bonus usage, responsible gaming tool activity	Platform use
Technical Data	IP address, device type, operating system, browser type, cookie identifiers	All site visits
Communications Data	Support chat logs, emails sent to support, complaint records	When you contact support

xbaj does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, or data concerning health or sexual orientation, except where a player voluntarily discloses such information in a support communication, in which case it is used solely to respond to the specific query.

3 How We Collect Your Data

xbaj collects personal data through the following channels:

• Direct submission: Information you provide voluntarily during account registration, identity verification, deposit and withdrawal requests, or when contacting our support team.
• Automated collection: Technical data such as IP addresses, device identifiers, and session logs are collected automatically when you access the xbaj platform, using standard web server logs and analytics tools.
• Cookies and similar technologies: xbaj uses cookies and local storage to maintain session state, remember preferences, and analyse platform usage. See Section 7 for full details.
• Payment providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, we receive transaction confirmation data from your payment provider — typically a transaction reference, amount, timestamp, and masked account identifier.
• Identity verification partners: Where required, xbaj may use trusted third-party identity verification services to validate National ID documents or confirm your date of birth. These services return a verified or not-verified status; xbaj does not store raw document images beyond the verification process.

4 Purpose of Processing Your Data

xbaj processes your personal data only for specific, documented purposes. We do not use your data for purposes beyond those listed below without first seeking your consent or establishing another valid legal basis:

• Account creation and management: To register your account, verify your identity and age (21+ requirement), maintain your account settings, and provide access to all xbaj platform features.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, to reconcile transaction records, and to investigate any disputed transactions.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorised account access, and any other activity that violates our Terms & Conditions or applicable law.
• Regulatory compliance: To comply with applicable anti-money-laundering (AML) obligations, know-your-customer (KYC) requirements, and any data disclosure requests made by lawfully authorised authorities.
• Responsible gaming: To monitor gaming patterns and identify players who may exhibit signs of problem gambling behaviour, and to administer self-exclusion requests, deposit limits, and cooling-off periods.
• Customer support: To respond to your queries, complaints, and requests submitted via email or live chat.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the xbaj platform's functionality, performance, and user experience.
• Marketing communications: To send you promotional offers, bonus alerts, and news about xbaj — but only if you have opted in to receiving such communications. You may opt out at any time.

5 Legal Basis for Processing

xbaj relies on the following legal bases when processing your personal data:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accept at registration — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, KYC identity verification requirements, and lawful authority requests.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics — where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given clear, affirmative consent. You may withdraw consent at any time without affecting any other aspect of your account.

6 Data Sharing & Disclosure

xbaj does not sell, rent, or trade your personal data. We share your personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and affiliated banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) receive transaction data necessary to process your deposits and withdrawals.
• Identity verification providers: Trusted KYC partners receive your identity document data solely for the purpose of confirming your eligibility to hold an xbaj account. These providers are contractually bound to process your data only for this purpose.
• Game studio providers: Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Ezugi, Spribe, and other certified game studios may receive your anonymised session identifiers to deliver and log game rounds. They do not receive your name, contact details, or financial data.
• Technology and hosting providers: Cloud infrastructure and software service providers who host and maintain the xbaj platform may process your data as data processors under strict contractual data protection obligations.
• Legal and regulatory authorities: xbaj will disclose personal data to government bodies, financial intelligence units, or law enforcement agencies in Bangladesh or internationally where required by law, court order, or where disclosure is necessary to prevent fraud or serious harm.
• Business transfers: In the event of a merger, acquisition, or sale of xbaj's business assets, your personal data may be transferred to the acquiring entity. You will be notified in advance if such a transfer affects your data and your rights.

7 Cookies & Tracking Technologies

xbaj uses cookies and similar tracking technologies (including local storage and session identifiers) to operate the platform effectively. Cookies are small text files stored on your device when you visit xbaj. They allow us to recognise your browser, maintain your login session, remember your preferences, and gather aggregated analytics data.

The categories of cookies used on the xbaj platform are:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled as the platform cannot operate without them.
• Functional cookies: Used to remember your preferences, such as language settings and display options, so you do not need to reconfigure them on each visit.
• Analytics cookies: Used to collect anonymised data about how users interact with the xbaj platform — such as pages visited, time spent, and features used — to help us improve the platform. No personal identity data is included in analytics reports.
• Marketing cookies: Used to deliver relevant promotional content and to measure the effectiveness of marketing campaigns. These cookies are only set with your consent.

You may manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing certain platform features. xbaj does not use third-party advertising networks that track your behaviour across other unrelated websites.

8 Data Retention

xbaj retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Our standard retention periods are as follows:

• Active account data: Retained for the full duration of your account's active status on the xbaj platform.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the relevant transaction, in compliance with financial record-keeping obligations.
• Identity verification documents: Retained for a minimum of five (5) years following account closure, as required for AML compliance purposes.
• Support communications: Retained for three (3) years from the date of the last communication in a given ticket or thread, unless a longer period is required for an ongoing dispute or regulatory matter.
• Closed account data: Where an account is closed by the player or by xbaj, non-financial personal data is retained for two (2) years for fraud prevention and responsible gaming monitoring purposes, after which it is securely deleted or anonymised.
• Marketing opt-in records: Retained for as long as you remain opted in, plus one (1) year after opt-out to provide evidence of your consent history.

When retention periods expire, personal data is securely deleted using industry-standard data sanitisation methods or permanently anonymised so that it can no longer be associated with any identifiable individual.

9 Data Security

xbaj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes the following measures:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the xbaj servers, ensuring that your personal and financial data cannot be intercepted in transit.
• Encrypted storage of sensitive data fields including passwords (stored as salted cryptographic hashes, never in plain text), payment account identifiers, and identity documents.
• Role-based access controls ensuring that only authorised xbaj personnel with a legitimate operational need can access personal data, and only to the extent required for their role.
• Regular security audits and penetration testing of the xbaj platform infrastructure, carried out by qualified security professionals.
• Automated fraud detection systems that monitor account activity in real time for patterns indicative of unauthorised access, credential stuffing, or account takeover attempts.
• Secure data centres with physical access controls, 24/7 monitoring, and redundant backup systems to protect against data loss.

While xbaj takes all reasonable and appropriate security measures, no system connected to the internet can guarantee absolute security. You also have a role to play in keeping your account secure — please use a strong, unique password for your xbaj account and never share your login credentials with anyone. If you suspect your account has been compromised, contact us immediately at [email protected].

10 Your Data Rights

As a user of the xbaj platform, you have the following rights in relation to your personal data. These rights may be exercised at any time by contacting our support team at [email protected]:

• Right of access: You have the right to request a copy of all personal data xbaj holds about you, together with information about how it is used and who it has been shared with.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update some account details directly in your account settings.
• Right to erasure ("right to be forgotten"): You may request that xbaj delete your personal data in circumstances where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that this right is subject to xbaj's obligation to retain certain data for the periods specified in Section 8.
• Right to restriction of processing: You may request that xbaj temporarily halt the processing of your personal data — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where xbaj relies on legitimate interests as the legal basis. You also have an unconditional right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (such as for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

xbaj will respond to all data rights requests within a reasonable timeframe and no later than 30 days from receipt of your request. Where a request is complex or involves a large volume of data, we may extend this period by up to an additional 30 days and will notify you accordingly. xbaj will not charge a fee for responding to data rights requests unless they are manifestly unfounded or excessive.

11 Children & Minors

The xbaj platform is strictly intended for adults aged 21 years and above. xbaj does not knowingly collect personal data from any individual under the age of 21. Registration is prohibited for minors, and we employ mandatory age verification checks to enforce this requirement.

xbaj does not direct any marketing, advertising, or promotional content toward persons under 21 years of age. If xbaj becomes aware that personal data has been collected from an individual who is under 21, we will immediately suspend the relevant account, delete the associated data, and refund any deposited funds in accordance with our Terms & Conditions.

If you believe a minor has accessed the xbaj platform using your account or device, please contact our support team at [email protected] immediately. We take underage gambling concerns very seriously and will act promptly to address any such report. For further guidance, please review our Responsible Gaming page.

12 Marketing Communications

xbaj may send you promotional communications — including bonus offers, deposit match alerts, seasonal promotions, and platform news — by email or mobile notification, but only if you have expressly opted in to receiving such communications during registration or at a later point in your account settings.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email from xbaj.
• Updating your communication preferences in your account settings.
• Contacting our support team at [email protected] and requesting removal from our marketing list.

Opting out of marketing communications will not affect the delivery of transactional messages that are necessary for the operation of your account — such as payment confirmations, security alerts, and responses to support queries. These service communications are sent regardless of your marketing preferences because they are required for the performance of our contract with you.

13 Third-Party Links

The xbaj platform may reference the names of third-party services, including payment providers (bKash, Nagad, Rocket, Upay) and game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe). xbaj does not include clickable links to external third-party websites on the platform.

Where you independently navigate to any third-party website or service — for example, to access your bKash or Nagad account to process a deposit — that third party's own privacy policy governs how your data is handled on their platform. xbaj has no control over and accepts no responsibility for the privacy practices, content, or security of any third-party website or service.

14 Updates to This Policy

xbaj reserves the right to update or revise this Privacy Policy at any time. When changes are made, the updated version will be published on this page with a revised "Last Updated" date. We encourage you to review this page periodically to stay informed of how xbaj protects your personal data.

For material changes that significantly affect your privacy rights or how your data is used, xbaj will make reasonable efforts to notify registered players in advance via email or an in-platform notification. Your continued use of the xbaj platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated terms, where such acceptance is permitted by applicable law.

If any provision of this Privacy Policy is found to be unenforceable under applicable law, the remaining provisions will continue in full force and effect.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xbaj handles your personal data, please contact our Data Protection team using the details below. We will endeavour to respond to all privacy-related enquiries within 5 business days.

• Email: [email protected]
• Support hours: 24/7 · Bangladesh Standard Time (UTC+6)
• Subject line for data requests: "Privacy Request – [Your Username]"

Please include your registered account username and a clear description of your request in all privacy-related correspondence. For security purposes, xbaj may need to verify your identity before actioning any data rights request, to ensure that we do not disclose or delete data belonging to a third party.