xbajay Privacy Policy — How We Handle Your Data

xbajay collects personal information through several channels: directly from you during registration and account use, automatically through your interactions with the Platform, and from third-party service providers such as payment processors and identity verification services. The categories of personal data we collect are described in detail below.

1.1 Registration and Account Data

When you create an xbajay account, we collect the following personal information:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (to verify you are aged 18 or above)
• Residential address, including district and division within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh)
• Email address
• Mobile phone number (as registered with your bKash, Nagad, or Rocket account)
• Username and encrypted password
• Preferred language and currency (BDT)

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer obligations, xbajay may collect:

• A scanned copy or clear photograph of your National Identity Card (NID), passport, or birth certificate
• Proof of address documents (utility bill, bank statement, or official correspondence)
• Proof of payment method ownership (screenshot of mobile financial service account showing your name and number)
• A selfie photograph holding your identity document, if requested by our compliance team

1.3 Financial Transaction Data

When you make deposits or withdrawals, we collect transaction-related data including the payment method used (bKash, Nagad, Rocket, Upay, bank transfer, Visa, Mastercard), transaction amounts in BDT, transaction timestamps, and the reference numbers provided by the payment processor. This data is used for accounting, fraud prevention, and AML compliance.

1.4 Usage and Behavioural Data

As you interact with the xbajay Platform, we automatically collect data about your usage patterns, including:

• Game sessions: which games you played, session duration, wager amounts, and outcomes
• Sports betting activity: markets viewed, bets placed, and settlement outcomes
• Pages and features visited, including timestamps and duration
• Bonus and promotion claims and wagering progress
• Customer support interactions, including chat transcripts and email exchanges

1.5 Technical and Device Data

We also collect technical information about the device and network you use to access xbajay, including your IP address, device type and operating system, browser type and version, screen resolution, and approximate geographic location (derived from IP address). This information helps us detect fraud, prevent unauthorised access, and optimise the Platform's performance across devices commonly used in Bangladesh.

xbajay uses your personal data only for purposes that are directly connected to providing and improving the Platform, fulfilling legal obligations, and communicating with you about your account. We do not use your data for any purpose that is incompatible with the reasons it was originally collected.

Where xbajay relies on your consent as the legal basis for processing — for example, for marketing communications about seasonal promotions tied to events like Eid or Pohela Boishakh — you may withdraw your consent at any time by contacting [email protected] or updating your communication preferences in your account settings. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

xbajay uses cookies and similar tracking technologies (such as pixel tags and local storage) to enhance your experience on the Platform, keep you securely logged in, understand how users navigate the site, and measure the effectiveness of promotions.

Types of cookies we use:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in during your visit. They cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences, such as your preferred language (English), currency (BDT), and game category, so you do not need to re-enter them on each visit.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, time spent, error encounters — to help us improve the user experience.
• Fraud Prevention Cookies: Detect unusual access patterns, multiple account attempts from the same device, and other indicators of fraudulent activity.

xbajay does not use third-party advertising cookies or allow external advertising networks to place tracking cookies on your device through our Platform. You will not be tracked across other websites for ad-targeting purposes.

You can manage or delete cookies through your browser settings. However, disabling strictly necessary cookies may prevent certain features — including account login and game loading — from working correctly. Most mobile browsers used in Bangladesh (Chrome, Samsung Internet, Firefox) provide accessible cookie management options in their settings menu.

xbajay does not sell your personal data to any third party. However, to operate the Platform effectively and meet our legal obligations, we may share your data with the following categories of recipients under strictly controlled conditions:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and our banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) receive the transaction data necessary to process your deposits and withdrawals. These providers are bound by their own privacy obligations and financial regulations.
• Identity Verification Partners: Third-party KYC service providers may process your identity documents to verify your age and identity on xbajay's behalf. These partners are contractually required to handle your data securely and use it only for the specific verification purpose.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited session data (such as a pseudonymised player ID and wager data) in order to operate their games on the Platform. These studios do not receive your full personal profile.
• Fraud and Security Vendors: Specialised anti-fraud and cybersecurity providers may process device and behavioural data to detect and prevent fraud, multi-accounting, and money laundering on the Platform.
• Legal and Regulatory Authorities: xbajay will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by applicable law, court order, or regulatory mandate. Such disclosures are made only to the extent necessary and are documented internally.
• Professional Advisers: Legal counsel, auditors, and accountants may access relevant data in the course of providing professional services to xbajay. These advisers are bound by confidentiality obligations.

All third-party data processors that handle your personal information on xbajay's behalf are required to enter into data processing agreements that obligate them to protect your data to at least the same standard as xbajay itself. We conduct periodic reviews of our third-party partners to ensure ongoing compliance.

xbajay retains your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, including maintaining your active account, processing ongoing transactions, resolving disputes, and complying with legal obligations.

The following retention periods apply as a general framework:

• Active Account Data: Retained for the lifetime of your account plus a minimum of five (5) years after account closure, in accordance with AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years, as required by anti-money laundering and financial compliance frameworks.
• Customer Support Records: Retained for three (3) years after the resolution of the support interaction, or longer if the matter relates to an ongoing dispute or legal proceeding.
• Marketing Data: Retained until you withdraw your consent to marketing communications, after which it is deleted or anonymised within thirty (30) days.
• Technical and Analytics Data: Anonymised or aggregated within twelve (12) months of collection. Raw IP logs are deleted within ninety (90) days unless flagged for fraud investigation.

When personal data is no longer required for any legitimate purpose, xbajay will securely delete or anonymise it in a manner that prevents reconstruction or re-identification. Backups containing personal data are handled under the same retention policies as live data stores.

xbajay takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, disclosure, alteration, or destruction.

Our current security measures include:

• SSL/TLS Encryption: All data transmitted between your device and xbajay's servers is encrypted in transit using industry-standard SSL/TLS protocols. The padlock icon in your browser's address bar confirms this encryption is active.
• Password Hashing: User passwords are never stored in plain text. xbajay uses a strong one-way cryptographic hashing algorithm (such as bcrypt) to store password data, ensuring that even xbajay staff cannot read your password.
• Access Controls: Access to personal data within xbajay's systems is restricted on a strict need-to-know basis. Staff who handle user data are subject to confidentiality agreements and regular data security training.
• Two-Factor Authentication (2FA): xbajay strongly recommends that all users enable 2FA on their accounts. This adds a second verification step — typically an SMS code sent to your registered Bangladeshi mobile number — when logging in from a new device or location.
• Infrastructure Security: xbajay's servers are hosted in secure data centres with physical access controls, fire suppression systems, and redundant power and connectivity. Firewalls and intrusion detection systems monitor for unauthorised access attempts at all times.
• Regular Security Audits: xbajay conducts periodic internal security reviews and works with third-party security specialists to perform vulnerability assessments and penetration testing of the Platform.

While xbajay takes all reasonable precautions to protect your data, no internet-based system can be guaranteed to be 100% secure. You are responsible for keeping your own login credentials confidential. xbajay will never ask you to share your password via email, live chat, or telephone. If you suspect unauthorised access to your account, please contact [email protected] immediately and change your password.

xbajay respects your rights over your personal data. Regardless of where you are located in Bangladesh — whether in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or any other city or district — you are entitled to exercise the following rights with respect to the personal data xbajay holds about you:

To exercise any of the above rights, please contact xbajay's data team at [email protected] with the subject line "Data Rights Request". Include your registered full name, email address, and a brief description of your request. xbajay will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) days, in accordance with applicable data protection timelines. Support operates following Bangladesh Standard Time (BST, UTC+6).

Please note that certain rights — particularly the right to erasure — may be limited where xbajay is required by law to retain specific data. For example, KYC records and financial transaction data must be retained for a minimum period under AML obligations and cannot be deleted upon request during that period.

xbajay reviews and updates this Privacy Policy periodically to reflect changes in applicable data protection laws, our business practices, or the services available on the Platform. When we make material changes to this Policy, we will notify registered users by email and/or by placing a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date at the top of this page always reflects the current version.

Your continued use of the xbajay Platform after a Privacy Policy update constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically to stay informed about how xbajay protects your data. Previous versions of this Policy are available on request.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how xbajay handles your personal information, please contact us using the following details:

• Email: [email protected] (subject: "Privacy Enquiry" or "Data Rights Request")
• Response Time: xbajay aims to respond to all privacy-related enquiries within five (5) business days
• Support Hours: 24/7 English-language support, staffed according to Bangladesh Standard Time (BST, UTC+6), with peak coverage during evening hours

xbajay is committed to resolving privacy concerns fairly and transparently. If you feel that your concern has not been addressed to your satisfaction, you may seek further guidance from a relevant data protection authority or legal adviser in your jurisdiction.