Data Protection & Privacy
Privacy Policy — xbajaee
Your privacy is not an afterthought at xbajaee — it is a core commitment. This Privacy Policy explains in plain English exactly what personal data we collect, why we collect it, how it is stored and protected, and what rights you hold over your information. Reading this document helps you make informed decisions about your account.
End-to-End Encryption
All data transmitted between your device and xbajaee is protected by TLS 1.3 encryption. Your personal details, payment information, and account credentials are never sent over unencrypted connections.
No Third-Party Data Sales
xbajaee does not sell, rent, or trade your personal data to any third party for marketing purposes. Your information is used solely to operate your account, process payments, and improve your experience on the platform.
Identity Verification Only
KYC documents such as your National ID or passport are collected exclusively for age verification and fraud prevention. These documents are stored in encrypted form and are never used for any purpose beyond compliance and account security.
Transparent Cookie Use
We use cookies to keep you logged in, remember your preferences, and analyse platform performance. We do not use cookies to build advertising profiles or track your activity on other websites outside xbajaee.
Secure Data Storage
Your personal data is stored on access-controlled, encrypted servers. Only authorised xbajaee personnel with a legitimate operational need may access player records, and all such access is logged and audited.
Your Rights, Respected
You have the right to access, correct, and request deletion of your personal data held by xbajaee. Submit a data request at any time by contacting support@xbajaee and we will respond within 10 business days.
Section 1
Data We Collect
xbajaee collects personal data through several points of interaction: when you register an account, when you deposit or withdraw funds, when you contact our support team, and automatically when you use the platform. The categories of personal data we collect are described below.
| Category | Specific Data Points | How Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, National ID (NID) number or passport number | Registration form and KYC document submission |
| Contact Data | Email address, mobile phone number, residential address (city, district, country) | Registration form and account profile updates |
| Financial Data | Payment method identifiers (e.g., bKash wallet number, Nagad number, masked card number), transaction history, deposit and withdrawal amounts in BDT or INR | Cashier / payment processing flow |
| Verification Documents | Scanned or photographed copies of NID, passport, driving licence, and proof of payment method ownership | KYC verification portal |
| Technical Data | IP address, device type, browser type and version, operating system, screen resolution, time zone (BST UTC+6 by default) | Automatically collected via server logs and cookies |
| Usage Data | Pages visited, games played, bet amounts, session duration, click patterns, in-platform search queries | Automatically collected via analytics and session tracking |
| Communications Data | Support chat transcripts, email correspondence, dispute records | Live chat system and email support channels |
xbajaee does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is inherent in a photo ID submitted for KYC purposes. Where a photo ID is submitted, only the identity fields (name, date of birth, ID number) are recorded; the image file is stored encrypted and accessed only by authorised compliance personnel.
Data Collected from Minors
xbajaee does not knowingly collect personal data from any person under the age of 18. Our registration process includes an age declaration step, and KYC verification confirms age before any withdrawal is processed. If we discover that a person under 18 has submitted personal data to xbajaee, we will immediately delete that data, close the account, and refund any deposits made by that individual. If you believe a minor has registered an account, please contact support@xbajaee immediately.
Voluntary Data
Some data is provided entirely at your discretion — for example, if you choose to submit a support query, write a review, or participate in a survey or promotion. This voluntary data is used only in connection with the purpose for which it was submitted and is not linked to your betting or financial history without your explicit consent.
Section 2
How We Use Your Data
xbajaee uses your personal data for specific, documented purposes. We do not use your data in ways that are incompatible with the purpose for which it was collected without first notifying you and, where required, obtaining your consent.
Account Operations
Your identity and contact data are used to create and maintain your account, authenticate your login sessions, process deposits and withdrawals, and communicate essential account-related information such as password reset instructions, KYC status updates, and transaction confirmations. This processing is necessary for the performance of the contract between you and xbajaee.
Compliance and Legal Obligations
xbajaee processes identity documents and financial records to fulfil obligations related to age verification, anti-money laundering (AML) screening, and Know Your Customer (KYC) regulations. We may also process and retain data to respond to lawful requests from regulatory authorities, law enforcement agencies, or courts of competent jurisdiction. This processing is based on legal obligation and cannot be opted out of by individual players.
Fraud Prevention and Security
Technical data including IP addresses, device identifiers, and login patterns are analysed to detect and prevent fraudulent activity, unauthorised account access, bonus abuse, and money laundering. Automated risk-scoring tools may flag accounts for manual review based on this analysis. Where fraud is confirmed, relevant data may be shared with payment providers and relevant authorities.
Platform Improvement and Analytics
Aggregated, anonymised usage data is used to improve the platform's performance, game selection, user interface, and overall user experience. This analysis does not identify individual players and does not involve selling data to third parties. For example, we may observe that a majority of Bangladeshi players access xbajaee on mobile devices between 8 pm and 11 pm BST, and use this insight to optimise our mobile experience for those hours.
Marketing Communications
If you have opted in to marketing communications during registration or through your account settings, xbajaee may send you promotional emails about new games, bonuses, seasonal offers (such as BPL or Eid promotions), and platform updates. You may withdraw your consent to marketing communications at any time by clicking the "Unsubscribe" link in any marketing email or by contacting support@xbajaee. Withdrawal of marketing consent does not affect the receipt of essential transactional communications related to your account.
Responsible Gaming Monitoring
xbajaee uses betting pattern data and session duration data to identify players who may be exhibiting signs of problem gambling behaviour, in line with our responsible gaming commitments. If such patterns are detected, our team may reach out proactively or apply temporary account restrictions. This processing is carried out in your legitimate interest and in fulfilment of our responsible gaming obligations.
Legal Bases for Processing
xbajaee relies on the following legal bases when processing your personal data:
- Contract performance — account creation, transaction processing
- Legal obligation — KYC, AML, age verification, regulatory reporting
- Legitimate interests — fraud prevention, security, responsible gaming
- Consent — marketing communications, optional analytics cookies
You can review and update your communication preferences at any time from within your account settings after logging in to xbajaee. For data processing based on legitimate interests, you may raise an objection by contacting support@xbajaee, and we will assess your request within 10 business days.
xbajaee does not use your personal data to make fully automated decisions that produce legal or similarly significant effects without human review. Any automated risk-scoring outcome that results in account restriction is subject to manual review by a compliance team member upon your request.
Section 3
Data Sharing and Third Parties
xbajaee does not sell your personal data. We share personal data with third parties only where it is strictly necessary to operate the platform, comply with legal obligations, or protect the security of the platform and its users. All third-party recipients of personal data are bound by data processing agreements that restrict the use of that data to the specified purpose.
Payment Processors
To process your deposits and withdrawals, xbajaee shares your financial data (wallet numbers, transaction amounts, and identity confirmation) with our payment processing partners including bKash, Nagad, Rocket, Upay, and the card networks operated by Visa and Mastercard. These providers operate under their own privacy policies and are independently regulated. xbajaee is not responsible for the data practices of payment processors once data is transmitted to them for the purpose of executing a transaction you have authorised.
Game Providers
Third-party game providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive a session token and anonymised player identifier to authenticate your game session. These providers do not receive your full name, contact details, or financial data. Game round results and bet amounts may be logged by the provider for RNG certification and dispute resolution purposes.
Regulatory and Law Enforcement Authorities
xbajaee will disclose personal data to regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law, by court order, or where we believe in good faith that disclosure is necessary to prevent fraud, money laundering, terrorist financing, or harm to another person. We will notify you of such disclosure where we are legally permitted to do so.
Analytics and Technology Providers
xbajaee may use third-party analytics and infrastructure providers to support platform performance monitoring, error logging, and security scanning. These providers process technical and usage data only in aggregated or pseudonymised form. They are contractually prohibited from using this data for any independent purpose.
Business Transfers
If xbajaee undergoes a business restructuring, merger, acquisition, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified by email at your registered address before your data is subject to a different privacy policy as a result of such a transfer. You will have the right to close your account and request data deletion before the transfer takes effect if you do not accept the incoming policy.
Important: xbajaee will never share your data with advertising networks, social media platforms, or data brokers for the purpose of targeting you with advertisements on third-party websites or applications. If you ever receive a communication claiming to be from xbajaee that asks you to confirm personal details on an external website, treat it as a phishing attempt and report it to support@xbajaee immediately.
Section 5
Data Retention and Storage
Retention Periods
xbajaee retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as standard:
- Active account data (identity, contact, financial): Retained for the duration of the account's active status, plus a minimum of 5 years after account closure, for AML and legal compliance purposes.
- KYC documents (NID, passport scans): Retained for a minimum of 5 years from the date of submission or account closure, whichever is later.
- Transaction records: Retained for a minimum of 5 years in line with standard financial record-keeping requirements.
- Support communications: Retained for 3 years from the date of the communication, unless the communication relates to an unresolved dispute or legal proceeding, in which case it is retained until resolution plus 1 year.
- Analytics and usage data: Aggregated and anonymised after 13 months; raw session logs deleted after 90 days.
- Marketing consent records: Retained for the duration of your account plus 3 years to demonstrate compliance with consent requirements.
Data Storage Location
Your personal data is stored on servers located in secure data centres. xbajaee applies the same data protection standards regardless of where data is stored. Where data is processed by a third-party service provider located outside of Bangladesh, we ensure that appropriate contractual safeguards are in place to maintain equivalent data protection standards.
Account Deletion and Data Erasure
When you request account closure, xbajaee will initiate the closure process within 5 business days. Personal data that is no longer required for the purposes described in this policy will be deleted or irreversibly anonymised. Data that must be retained for legal, regulatory, or compliance reasons will be held in a restricted archive accessible only to compliance personnel, and will not be used for any other purpose.
If you submit a formal erasure request under your data rights (see Section 6 below), we will assess whether the data in question is subject to a mandatory retention obligation. Where no such obligation applies, the data will be permanently deleted within 30 days of the confirmed request. Where a retention obligation does apply, we will inform you of the specific legal basis and the earliest date on which deletion can take place.
Backups
Encrypted backups of platform data — including player account data — are maintained for disaster recovery purposes. Backup copies are subject to the same data protection standards as live data. Backup retention is limited to a maximum of 90 days, after which backup files are securely overwritten. Erasure requests will be applied to live data immediately; backup copies will be overwritten at the next scheduled backup rotation cycle.
If you close your xbajaee account and later wish to confirm what data we hold about you, you may submit a Subject Access Request at any time within the retention period by emailing support@xbajaee with the subject line "Subject Access Request". We will respond with a full account data summary within 10 business days.
Section 6
Your Privacy Rights
xbajaee respects your rights over your personal data. The following rights are available to all registered players and visitors who have submitted personal data to the platform. To exercise any of these rights, contact support@xbajaee with the subject line indicating the specific right you wish to exercise. We will respond within 10 business days of receiving a valid, verifiable request.
Request a copy of all personal data xbajaee holds about you, including account details, KYC records, transaction history, and communications data.
Request correction of any inaccurate or incomplete personal data held in your account. Some corrections (e.g., legal name changes) may require supporting documentation.
Request deletion of your personal data where it is no longer necessary for the purpose collected or where you withdraw consent, subject to mandatory legal retention obligations.
Request that we pause processing of your data in certain circumstances — for example, while you contest the accuracy of the data or the legitimacy of our processing basis.
Request a structured, machine-readable copy of the personal data you provided to xbajaee, which you may transfer to another service provider of your choosing.
Object to data processing based on legitimate interests, including profiling for responsible gaming monitoring. We will assess each objection individually and respond with our decision.
Where processing is based on your consent (e.g., marketing emails, optional analytics), withdraw that consent at any time without affecting the lawfulness of prior processing.
If you are unsatisfied with how xbajaee handles your personal data or a rights request, you may escalate your complaint to the relevant data protection authority in your jurisdiction.
To protect your privacy and prevent unauthorised access to another person's data, we require identity verification before processing any data rights request. You will be asked to confirm your registered email address and, for high-sensitivity requests (such as full data export or deletion), to complete a brief KYC re-verification step. This is for your protection and is not intended to discourage you from exercising your rights.
Section 7
Data Security Measures
xbajaee takes the security of your personal data seriously and maintains a layered security architecture designed to prevent unauthorised access, disclosure, alteration, or destruction of player data. The following measures are in place at all times.
Transport Layer Security
All communications between your device and xbajaee are encrypted using TLS 1.3, the current industry standard for secure data transmission. Older, vulnerable protocols (TLS 1.0, TLS 1.1, and SSL) are disabled. Our SSL certificate is renewed and monitored continuously. You can verify the secure connection by checking for the padlock symbol in your browser's address bar when visiting xbajaee.
Data Encryption at Rest
Sensitive personal data — including KYC documents, payment details, and password hashes — is encrypted at rest using AES-256 encryption. Passwords are never stored in plaintext; they are hashed using a one-way cryptographic function with a unique salt per account. Even in the unlikely event of a data breach, individual passwords cannot be recovered from the stored hashes.
Access Controls
Access to player data within xbajaee's internal systems is governed by strict role-based access controls. Staff members may only access the minimum data required for their specific operational role. All internal access to player records is logged with a timestamp and user identifier. Access logs are reviewed regularly by our security team and retained for a minimum of 12 months.
Security Monitoring
xbajaee operates continuous automated security monitoring to detect unusual login patterns, brute-force attempts, SQL injection attempts, and other forms of attack. Suspicious activity triggers automated alerts and, where appropriate, temporary account lockdowns pending investigation. Our security team performs regular vulnerability assessments and penetration testing to identify and remediate potential weaknesses before they can be exploited.
Data Breach Response
In the event of a confirmed personal data breach that poses a risk to the rights and freedoms of players, xbajaee will notify affected players by email to their registered address as promptly as possible and no later than 72 hours after becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
Your Account Security Responsibilities
While xbajaee takes extensive measures to protect your data on our end, you play an important role in keeping your account secure:
- Use a strong, unique password for your xbajaee account that you do not use on any other platform.
- Never share your login credentials, OTP codes, or account PIN with anyone — including people claiming to be xbajaee staff.
- Log out of your account when using a shared or public device.
- Enable two-factor authentication (2FA) if available in your account settings.
- Report any suspicious activity on your account to support@xbajaee immediately.
xbajaee will never ask you for your password, full card number, or OTP via email, live chat, or telephone. If you receive such a request, it is fraudulent. Disconnect immediately and report it to support@xbajaee.
Fair Play Certification
All game outcomes on xbajaee are determined by certified Random Number Generators (RNGs) supplied by our third-party game providers. RNG integrity is independently audited on an ongoing basis. Your game result data is logged securely and can be reviewed in your account transaction history at any time.
Section 8
Changes to This Privacy Policy
xbajaee reviews and updates this Privacy Policy periodically to reflect changes in our data practices, the services we offer, or applicable legal requirements. The effective date at the top of this page indicates when the current version came into force.
How We Notify You of Changes
When we make material changes to this Privacy Policy — such as introducing a new category of data collection, changing a data sharing arrangement, or altering a retention period — we will notify registered players by email to the address on file at least 7 days before the changes take effect. A prominent notice will also be displayed on the xbajaee platform during that notice period. Minor changes, such as typographic corrections or clarifications that do not affect the substance of the policy, may be made without advance notice.
Your Continued Use
Your continued use of xbajaee after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any material change to this Privacy Policy, you have the right to close your account and request deletion of your personal data (subject to mandatory retention obligations) before the revised policy takes effect. To do so, contact support@xbajaee prior to the effective date stated in the change notification.
Policy Archive
Previous versions of the xbajaee Privacy Policy are retained in an internal archive. If you need to review a prior version of this policy — for example, to understand the terms that applied during a specific period of your account history — you may request a copy by emailing support@xbajaee with the subject line "Privacy Policy Archive Request" and specifying the approximate date range you are interested in.
Contact and Data Controller
xbajaee is the data controller for personal data collected through this platform. For all privacy-related enquiries, data rights requests, or complaints, contact our Data Protection team at support@xbajaee. Our English-speaking privacy team is available 24/7 and will acknowledge all formal written requests within 2 business days, with a substantive response provided within 10 business days.
All privacy correspondence should be directed to support@xbajaee. Please include your registered email address and a brief description of your query or request in your message. For Subject Access Requests and erasure requests, please include "SAR" or "Erasure Request" in the subject line to ensure your message is routed to the correct team without delay.
Questions About Your Privacy? We Have Answers
Our 24/7 support team is ready to help with any data rights requests, account queries, or privacy concerns. Explore our FAQ for quick answers, or log in to manage your preferences directly.