bbajee Privacy Policy

§ 01 Introduction

bbajee ("we", "us", "our") operates the online casino and sports betting platform accessible at bbajee.biz. This Privacy Policy describes the categories of personal data we collect from players based in Bangladesh, the purposes for which that data is processed, the parties with whom it may be shared, and the rights available to you as a data subject.

This Privacy Policy forms part of the overall agreement between you and bbajee, alongside the Terms & Conditions and the Responsible Gaming Policy. By creating an account or continuing to use the platform, you confirm that you have read and understood this Privacy Policy and consent to the data practices described herein.

We may update this Privacy Policy from time to time. The effective date at the top of this document reflects the most recent revision. Where changes are material, we will notify registered players via a notice displayed upon next login.

§ 02 Data We Collect

bbajee collects personal data through several channels: directly from you when you register an account or complete KYC verification; automatically through your use of the platform; and in limited circumstances from third-party service providers involved in payment processing or identity verification.

2.1 Registration Data

When you create a bbajee account, we collect the following information:

• Full legal name as it appears on your government-issued identification
• Date of birth (for age verification — players must be 18 years or older)
• Residential address, including district, division, and postcode
• Mobile phone number registered in Bangladesh
• Email address (if provided)
• Preferred currency (Bangladeshi Taka, BDT)

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and to confirm player eligibility, bbajee may request the following documents at account opening or at any subsequent point:

• National Identity Card (NID) or passport copy
• Proof of residential address (utility bill, bank statement, dated within 90 days)
• Selfie or live photograph for facial verification
• Proof of payment method ownership (screenshot of bKash, Nagad, or Rocket account showing name and number)

2.3 Financial Transaction Data

We record all deposit and withdrawal transactions, including the payment method used (bKash, Nagad, Rocket, Upay, bank transfer, Visa, Mastercard), transaction timestamps, amounts in BDT, and transaction reference numbers assigned by the payment provider. We do not store full card numbers or mobile banking PINs.

2.4 Usage & Behavioural Data

As you use the platform, we automatically collect information about your activity, including:

• Games played, bet amounts, win/loss outcomes, and session durations
• Pages visited, navigation paths, and feature interactions
• Device type, operating system, browser type, and version
• IP address and approximate geolocation (used for security and fraud detection)
• Login timestamps and session activity logs

2.5 Communications Data

If you contact bbajee support via live chat or email, we retain records of those communications, including the content of messages, timestamps, and any attachments provided. These records are used to resolve disputes, improve service quality, and maintain a history of interactions for account management purposes.

Data Category	Examples	Collection Method
Registration Data	Name, DOB, address, mobile number	Provided by player at sign-up
KYC Documents	NID, passport, selfie, address proof	Uploaded by player on request
Financial Data	Transaction amounts, payment method, timestamps	Generated during deposit / withdrawal
Usage Data	Games played, bets placed, session logs	Automatically collected via platform
Device & Technical Data	IP address, browser type, OS	Automatically collected
Communications	Live chat logs, email threads	Recorded when player contacts support

§ 03 How We Use Your Data

bbajee processes personal data strictly for defined purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected without first obtaining your consent.

• Account management: Creating, maintaining, and administering your player account, including processing login requests and managing account settings.
• Age and identity verification: Confirming that you are 18 years of age or older and that your identity matches the information provided at registration, in compliance with responsible gaming obligations.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank channels, and maintaining accurate transaction records in BDT.
• Fraud prevention and security: Detecting and preventing unauthorised account access, money laundering, bonus abuse, multi-accounting, and other prohibited activities described in the Terms & Conditions.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling behaviour and applying protective account measures where appropriate, including deposit limits and session controls.
• Customer support: Responding to account queries, resolving disputes, and maintaining support interaction records for quality assurance.
• Legal and regulatory compliance: Meeting anti-money laundering (AML) obligations, responding to lawful requests from competent authorities, and maintaining records as required by applicable law.
• Platform improvement: Analysing anonymised, aggregated usage data to improve game selection, user interface, loading performance, and the overall player experience.
• Promotional communications: Sending bonus offers, tournament notifications, and seasonal promotions to players who have opted in to receive marketing communications. This is always consent-based and can be withdrawn at any time.

§ 04 Legal Basis for Processing

bbajee processes your personal data under the following legal bases, as applicable to each processing activity:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions — including account creation, payment processing, and customer support — is carried out on the basis that it is necessary to fulfil the contract between you and bbajee.
• Legal obligation: Processing necessary to comply with applicable laws and regulations, including anti-money laundering requirements, record-keeping obligations, and lawful data disclosure requests from competent authorities.
• Legitimate interests: Processing carried out for fraud detection, platform security, responsible gaming monitoring, and service improvement, where bbajee's legitimate interests do not override your fundamental privacy rights.
• Consent: Processing for optional purposes — specifically, the sending of promotional and marketing communications — is carried out solely on the basis of your freely given, specific, and withdrawable consent.

§ 05 Data Sharing & Third Parties

bbajee does not sell, rent, or trade your personal data. We share personal information only with the categories of third parties listed below, and only to the extent necessary for the stated purpose:

5.1 Payment Service Providers

To process deposits and withdrawals, bbajee shares transaction data with payment processors including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. These providers operate under their own privacy and data security frameworks and are contractually bound to use your data only for payment processing purposes.

5.2 KYC and Identity Verification Providers

Identity documents submitted for KYC verification are processed by authorised third-party verification service providers. These partners are contractually prohibited from using your documents for any purpose other than identity and age verification on bbajee's behalf.

5.3 Game Content Providers

Licensed game suppliers (including but not limited to Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive anonymised or pseudonymised gameplay data — such as game session identifiers and bet amounts — for the purposes of game functionality, fairness auditing, and RTP reporting. These providers do not receive your name, contact details, or payment information.

5.4 Law Enforcement and Regulatory Authorities

bbajee will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by applicable law, valid legal process, or where we have a good-faith belief that disclosure is necessary to prevent, detect, or investigate illegal activity, including money laundering or fraud.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of bbajee's business assets, personal data held by the platform may be transferred to the successor entity. Affected players will be notified via their registered contact details prior to any such transfer, and the successor entity will be bound by a data processing agreement consistent with this Privacy Policy.

§ 06 Cookies & Tracking Technologies

bbajee uses cookies and similar technologies (local storage, session tokens, pixel tags) on the platform to enable core functionality, maintain login sessions, personalise the player experience, and analyse platform usage.

6.1 Essential Cookies

These cookies are strictly necessary for the platform to function. They maintain your login session, remember your language and currency preferences, and enable the deposit and withdrawal processes. Essential cookies cannot be disabled without preventing the platform from operating correctly.

6.2 Analytics Cookies

bbajee uses anonymised analytics data to understand how players navigate the platform, which games are most popular, and where technical issues occur. Analytics data is aggregated and does not identify individual players. These cookies can be disabled through your browser settings.

6.3 Functional Cookies

Functional cookies remember your preferences — such as preferred deposit method, notification settings, and table game configurations — to provide a more personalised experience on subsequent visits. Disabling these cookies will not prevent you from using the platform but may result in your preferences not being saved between sessions.

You may manage or delete cookies through your browser's settings at any time. Please note that blocking all cookies may impair platform functionality, particularly login persistence and payment session handling.

§ 07 Data Security

bbajee implements a layered security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your device and the bbajee platform is encrypted using industry-standard TLS 1.3 protocols.
• Password hashing: Account passwords are stored using bcrypt or equivalent one-way hashing algorithms. No bbajee employee or system can retrieve your password in plain text.
• Access controls: Access to personal data is restricted to authorised personnel who require it to perform their job functions. Access is governed by role-based permissions and logged for audit purposes.
• Two-factor authentication (2FA): Players are encouraged to enable 2FA on their accounts via OTP codes sent to their registered mobile number. 2FA adds an additional layer of protection against unauthorised login attempts.
• Regular security assessments: The platform undergoes periodic technical security reviews to identify and remediate vulnerabilities in line with current best practices.
• Incident response: In the event of a data security incident that poses a risk to player rights, bbajee will notify affected players as promptly as practicable and take immediate steps to contain and remediate the breach.

While bbajee employs robust security measures, no online system can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own account credentials and should never share their password or OTP codes with any other person.

§ 08 Data Retention

bbajee retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or for the period required by applicable legal obligations — whichever is longer. The following retention periods apply:

Data Type	Retention Period	Basis
Active account data	Duration of account activity	Contractual necessity
Closed account data	5 years from account closure	AML legal obligation
KYC documents	5 years from submission	AML / regulatory compliance
Financial transaction records	5 years from transaction date	Legal obligation
Support interaction logs	3 years from last interaction	Legitimate interests (dispute resolution)
Marketing consent records	Until consent is withdrawn + 1 year	Consent accountability
Anonymised analytics data	Up to 36 months (rolling)	Legitimate interests (platform improvement)

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify individual players.

§ 09 Your Data Rights

As a registered player, you have the following rights in relation to the personal data bbajee holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 5 business days of receiving a verifiable request.

• Right of access: You may request a copy of all personal data bbajee holds about you, along with information about how it is used and with whom it is shared.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request that it be corrected. Some corrections may require supporting documentation.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent. Note that erasure requests may be declined where retention is required by law (e.g., AML obligations).
• Right to restrict processing: You may request that bbajee suspend processing of your data in certain circumstances — for example, while a rectification request is under review.
• Right to data portability: You may request a structured, machine-readable copy of the personal data you have directly provided to bbajee, where processing is based on consent or contractual necessity.
• Right to withdraw consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time through your account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object: You may object to processing carried out on the basis of bbajee's legitimate interests. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

§ 10 Children's Privacy

The bbajee platform is strictly intended for adults aged 18 years and above. bbajee does not knowingly collect personal data from individuals under the age of 18. Age verification is performed during the account registration process and may be supplemented by KYC document checks at any time.

If bbajee becomes aware that a player account has been created by or is being used by an individual under the age of 18, the account will be immediately suspended, all pending bets will be voided, and any deposited funds will be returned to the originating payment method after verification of the payment account holder's identity. The matter may also be referred to relevant authorities where appropriate.

If you believe that a minor may have accessed or registered on the bbajee platform, please notify us immediately at [email protected] so that we can investigate and take appropriate action without delay.

§ 11 Third-Party Links

The bbajee platform may contain links to third-party websites or services, including payment provider portals (bKash, Nagad, Rocket), game provider information pages, and regulatory reference sites. Once you leave the bbajee platform by following such a link, this Privacy Policy no longer applies. bbajee is not responsible for the privacy practices, content, or data handling of third-party websites.

We recommend that you review the privacy policy of any third-party site before providing personal information on that site. The presence of a link on the bbajee platform does not constitute an endorsement of the linked site's privacy practices.

§ 12 Updates to This Policy

bbajee reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the services we offer. The effective date at the top of this page is updated each time a change is made.

Where a change is material — meaning it significantly affects how we collect, use, or share personal data — we will provide advance notice to registered players via a prominent notification displayed upon next login, and where practicable, via the mobile number or email address registered to the account. Non-material clarifications (such as improved wording or formatting) may be made without individual notification.

Your continued use of the bbajee platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should cease using the platform and request account closure.

§ 13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bbajee handles your personal data, please contact us through the following channels:

• Email: [email protected]  —  please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate
• Live Chat: Available 24 hours a day, 7 days a week, directly on the bbajee platform
• Response time: We aim to respond to all privacy-related enquiries within 5 business days, Bangladesh Standard Time (BST, UTC+6)