bd baj Privacy Policy — Your Data, Protected

bd baj collects personal data from players in three principal ways: information you provide directly during account registration and verification, information generated automatically as you use the platform, and information received from third-party service providers such as payment processors. The following categories describe the data we collect in each case.

Information you provide directly:

• Registration data: Full legal name, date of birth, email address, mobile phone number, and residential address (including city, district, and country — e.g., Dhaka, Chittagong, Sylhet).
• Identity verification (KYC) documents: Copies of government-issued photo identification (National ID card, passport), proof of address (utility bill, bank statement), and proof of payment method ownership where requested.
• Payment information: Mobile banking account references (bKash, Nagad, Rocket, Upay), bank account details for DBBL or other local bank transfers, and card details for Visa/Mastercard transactions. Full card numbers are handled exclusively by our PCI-DSS-compliant payment partners — bd baj does not store raw card numbers on its own servers.
• Communications: The content of support tickets, live chat transcripts, and email correspondence you send to bd baj, including the email address and phone number used to contact us.
• Responsible gaming declarations: Self-exclusion requests, deposit limit preferences, cool-off period activations, and any problem gambling disclosures you voluntarily submit.

Information collected automatically:

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, betting history (stakes, outcomes, session duration), navigation paths, and feature interactions within the platform.
• Cookie and tracking data: See Section 4 (Cookies & Tracking) for full details of the cookies bd baj uses and how you can manage them.
• Geolocation: Approximate geographic location derived from your IP address, used to apply jurisdiction-specific access controls. bd baj does not request access to your device's precise GPS location.

Information from third parties:

• Transaction confirmation data from bKash, Nagad, Rocket, Upay, and banking partners, used to verify deposit and withdrawal events.
• Identity verification results from third-party KYC service providers, where bd baj uses such providers to assist with document verification.
• Fraud and risk signals from payment processors and fraud prevention services, used to protect players and the platform from financial crime.

bd baj processes your personal data only for the specific, lawful purposes described in this section. We do not use your data for any purpose that is incompatible with the reason for which it was originally collected. The primary purposes for which we process personal data are as follows:

• Account management: Creating and maintaining your player account, authenticating your identity at login, and enabling access to the full range of bd baj services.
• Identity verification and compliance: Conducting age verification checks (18+ requirement), KYC verification, and fulfilling anti-money laundering (AML) obligations, including transaction monitoring and suspicious activity reporting.
• Payment processing: Processing deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, and bank transfer channels. Verifying payment method ownership and preventing payment fraud.
• Game delivery and fairness: Delivering casino games and sports betting markets, recording game outcomes and betting history for dispute resolution, and maintaining the integrity of game results.
• Customer support: Responding to support requests, investigating account disputes, and maintaining records of communications for quality assurance purposes.
• Platform improvement: Analysing anonymised usage data and aggregated player behaviour to improve platform performance, game selection, and user experience.
• Security and fraud prevention: Detecting and preventing unauthorised account access, bonus abuse, multi-accounting, money laundering, and other prohibited conduct described in the bd baj Terms & Conditions.
• Responsible gaming: Monitoring account activity for indicators of problem gambling behaviour, applying player-requested deposit limits and self-exclusion restrictions, and fulfilling responsible gaming obligations.
• Promotional communications: Sending promotional offers, bonus notifications, and seasonal promotions (e.g., BPL cricket season, Eid, Pohela Boishakh) to players who have not opted out of marketing communications. You may opt out at any time via your account notification settings.

Where bd baj relies on your consent as the legal basis for processing (for example, marketing emails), you have the right to withdraw that consent at any time without affecting the legality of processing carried out prior to withdrawal.

bd baj does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

Service partners and processors: bd baj engages third-party service providers to help operate the platform. These providers act as data processors on our behalf and are contractually prohibited from using your data for any purpose other than providing the specific service. Categories of service partners include:

• Payment processors and mobile banking gateways (bKash, Nagad, Rocket, Upay, DBBL, Visa, Mastercard) — for deposit and withdrawal processing.
• KYC and identity verification service providers — for age and identity document verification.
• Fraud detection and AML screening services — for transaction monitoring and suspicious activity detection.
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) — for delivering game content. These providers may receive session identifiers and game event data required to run the game, but do not receive your full personal profile.
• Cloud infrastructure and hosting providers — for data storage, platform availability, and content delivery.
• Customer support platform providers — for managing support ticket workflows.

Legal and regulatory disclosure: bd baj may disclose personal data to law enforcement agencies, regulatory bodies, or other government authorities where we are legally required to do so — for example, in response to a court order, a lawful request from a financial intelligence unit, or an anti-money laundering investigation. We will not disclose data beyond what is required by the specific legal demand.

Business transfers: In the event that bd baj undergoes a merger, acquisition, or sale of substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via the email address registered on your account prior to the transfer taking effect.

Aggregate and anonymised data: bd baj may share aggregated, fully anonymised statistical data (for example, total number of active players by region, most popular game categories) with business partners or for publication in marketing materials. This data cannot be used to identify you individually.

bd baj uses cookies and similar tracking technologies (such as local storage objects and session tokens) to keep the platform functioning correctly, to remember your preferences, and to understand how players interact with the site. This section explains the types of cookies we use and how you can manage them.

Essential cookies: These cookies are strictly necessary for the platform to operate. They maintain your login session, remember your language and currency preferences, enforce security controls, and ensure game sessions function without interruption. Essential cookies cannot be disabled without breaking core platform functionality.

Analytics cookies: bd baj uses anonymised analytics data to understand aggregate player behaviour — for example, which game categories are most visited, average session durations, and common navigation paths. This data is used solely to improve the platform and is not linked to your individual account profile.

Functional cookies: These cookies remember your platform preferences — such as recently played games, your preferred deposit method, and notification settings — so you do not have to re-enter them on every visit.

Cookie duration:

• Session cookies expire when you close your browser and are not stored on your device beyond that session.
• Persistent cookies remain on your device for a defined period (typically 30–365 days depending on the cookie's purpose) and are used to remember your preferences across visits.

Managing cookies: You can control and delete cookies through your browser settings. Most browsers allow you to block all cookies, block third-party cookies only, or delete existing cookies. Note that disabling essential cookies will prevent you from logging in and using core platform features. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

bd baj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. While no system can guarantee absolute security, bd baj applies industry-standard safeguards appropriate to the sensitivity of the data we hold.

• TLS/SSL encryption: All data transmitted between your device and bd baj servers is encrypted using TLS 1.2 or higher. Look for the padlock icon in your browser's address bar when using bd baj.
• Password hashing: Account passwords are never stored in plain text. They are stored as salted cryptographic hashes using current best-practice algorithms. bd baj staff cannot view your password.
• Access controls: Access to personal data is restricted to bd baj staff who require it to perform their job function. Access rights are reviewed regularly and revoked promptly when no longer required.
• Payment data isolation: Full payment card numbers and mobile banking credentials are handled exclusively by PCI-DSS-compliant payment partners. bd baj retains only masked payment references (e.g., last four digits of a card, or a partial bKash number).
• Infrastructure security: bd baj systems are hosted in secure data centres with physical access controls, intrusion detection systems, and regular security audits.
• Incident response: In the event of a personal data breach that poses a risk to your rights, bd baj will notify affected players via their registered email address as promptly as practicable.

You also have a role in keeping your account secure. Use a strong, unique password for your bd baj account, enable two-factor authentication where available, and never share your login credentials with anyone — including individuals claiming to be bd baj staff, who will never ask for your password.

bd baj retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, to meet our legal and regulatory obligations, or to resolve active disputes. The following retention guidelines apply:

• Active account data: Personal data associated with an active player account is retained for the lifetime of the account plus a minimum post-closure period required by applicable AML and financial record-keeping obligations (typically five to seven years after account closure).
• Identity verification documents: KYC documents are retained for the period required by applicable AML regulations following account closure. Copies are stored securely and access is restricted to compliance personnel.
• Transaction records: Deposit and withdrawal transaction records, including bKash, Nagad, and Rocket transaction references, are retained for the minimum period required by financial record-keeping obligations.
• Support communications: The content of support tickets and live chat transcripts is retained for up to three years following the resolution of the relevant query, or longer where the communication relates to an ongoing dispute or regulatory matter.
• Marketing consent records: Records of your marketing consent or opt-out status are retained for the duration of your account and for a reasonable period following account closure, to demonstrate compliance with consent obligations.
• Analytics data: Anonymised and aggregated analytics data that cannot be linked to an individual player may be retained indefinitely for platform improvement purposes.

When personal data is no longer required and no legal retention obligation applies, bd baj deletes or anonymises it using secure data destruction methods. You may request early deletion of your data in certain circumstances — see Section 7 (Your Rights) for details.

bd baj respects your rights as a data subject. The following rights are available to you in relation to the personal data bd baj holds about you. To exercise any of these rights, please contact bd baj at [email protected] with a clear description of your request. We will respond within a reasonable timeframe and at no charge to you.

• Right of access: You may request a copy of the personal data bd baj holds about you, including information about how it is used and with whom it is shared.
• Right to rectification: You may request that inaccurate or incomplete personal data held by bd baj be corrected or updated. You can also update most account details directly in your account profile settings.
• Right to erasure: In certain circumstances — for example, where your data is no longer necessary for the purpose for which it was collected — you may request that bd baj delete your personal data. This right is subject to exceptions where retention is required by law, such as AML record-keeping obligations.
• Right to restriction of processing: You may ask bd baj to restrict the processing of your personal data in certain circumstances, for example while the accuracy of your data is being disputed.
• Right to object: You may object to bd baj's processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though bd baj may be able to demonstrate overriding grounds that justify continued processing.
• Right to data portability: You may request a copy of the personal data you provided to bd baj in a structured, commonly used, machine-readable format (for example, CSV).
• Right to withdraw consent: Where bd baj relies on your consent as the legal basis for processing (such as marketing emails), you may withdraw your consent at any time via your account notification settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

bd baj will verify your identity before processing any data rights request to protect against unauthorised access to another person's data. We may ask you to confirm details matching your registered account before fulfilling a request.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bd baj handles your personal data, please contact the bd baj privacy team at:

Email: [email protected]
Response time: bd baj aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within five business days (Bangladesh Standard Time, UTC+6).

Policy updates. bd baj reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered players via the email address on their account prior to the changes taking effect. The updated policy will also be published on this page with a revised effective date at the top of the document.

Your continued use of the bd baj platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a revised policy, you should discontinue use of the platform and may request account closure by contacting support.

For responsible gaming enquiries — including self-exclusion requests, deposit limit changes, or concerns about your own gambling behaviour — please visit the Responsible Gaming page or contact support directly. 18+ only.