xbaj Privacy Policy

xbaj ("we", "us", "our") operates the online casino and sports betting platform accessible at https://xbaj.vu (the "Platform"). We are committed to protecting the personal data of every user ("you", "your", "Player") who accesses or registers with the Platform. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure and protection of your personal information in connection with your use of the xbaj Platform. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the data practices described herein.

This Privacy Policy applies to all personal data collected through the xbaj Platform, including data collected via the website, through our customer support channels, and through any transactional activity you conduct on the Platform. This Policy should be read together with our Terms and Conditions, which govern your use of the xbaj Platform. In the event of any conflict between this Privacy Policy and the Terms and Conditions on the subject of data handling, this Privacy Policy shall take precedence.

xbaj collects personal data that you provide directly, data generated by your use of the Platform, and data obtained from third-party sources for verification and fraud-prevention purposes. The categories of data we collect are set out in the table below:

We collect only the data that is necessary for the purposes described in this Policy. We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data or health data, except where such data is incidentally contained in identity documents submitted for KYC verification, in which case it is processed solely for verification purposes and not retained separately.

xbaj uses your personal data only for specific, legitimate purposes. We do not use your data for purposes that are incompatible with those stated at the time the data was collected. The purposes for which we use your data include:

• Account registration and verification — creating and maintaining your xbaj account, verifying your identity and age, and completing KYC checks as required by applicable law.
• Payment processing — processing deposits and withdrawals via bKash, Nagad, Rocket, Upay and linked bank accounts, verifying that payment accounts are registered in your name, and maintaining transaction records.
• Platform operation and personalisation — delivering the gaming services you have requested, personalising your experience (e.g. displaying relevant cricket or slot content), and maintaining your responsible gaming settings.
• Fraud prevention and security — detecting and preventing fraudulent transactions, money laundering, bonus abuse, collusion, account sharing and any other prohibited activity described in our Terms and Conditions.
• Legal and regulatory compliance — complying with applicable anti-money laundering (AML) requirements, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records as required by applicable law.
• Customer support — responding to your queries, complaints and requests submitted to [email protected], and maintaining records of support interactions to improve our service quality.

xbaj does not use your personal data for the purpose of selling advertising space to third parties, building demographic profiles for sale, or any purpose unrelated to the operation of the xbaj Platform and the provision of services to you.

xbaj processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — Processing is necessary to perform our contract with you — i.e., to provide you with the gaming and payment services you have requested by registering an account and using the Platform.
• Legal obligation — Processing is necessary to comply with applicable legal requirements, including KYC identity verification, AML transaction monitoring, and the retention of financial records.
• Legitimate interests — Processing is necessary for the purposes of our legitimate interests, including fraud prevention, platform security, service improvement and responsible gaming monitoring, where those interests are not overridden by your fundamental rights and freedoms.
• Consent — Where we rely on consent as a legal basis — for example, for sending optional promotional communications — you may withdraw your consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

xbaj does not sell, rent or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment providers — bKash, Nagad, Rocket, Upay and partner banks receive only the transaction data necessary to process your deposit or withdrawal. They are independently regulated financial institutions with their own privacy obligations.
• Game providers — Studios such as Pragmatic Play, Evolution Gaming, NetEnt and Spribe receive a session token and game-activity data necessary to operate the game. They do not receive your identity, contact or financial data.
• Regulatory and law enforcement authorities — Where required by applicable law or a valid legal order, xbaj will disclose personal data to relevant authorities. We will inform you of such a disclosure to the extent permitted by law.
• Fraud detection services — xbaj may use third-party identity verification and fraud-detection services to cross-check registration data. These services process data only for verification purposes and are contractually prohibited from retaining or using the data for other purposes.

In all cases where third-party data sharing occurs, xbaj enters into data processing agreements or equivalent contractual protections to ensure that your data is handled in accordance with applicable privacy standards and is used only for the purpose for which it was shared.

All financial transactions on the xbaj Platform are processed in Bangladeshi Taka (BDT). When you make a deposit or request a withdrawal, xbaj collects and processes the payment method identifier (e.g. your bKash or Nagad mobile number, or your bank account number) together with the transaction amount and timestamp. This data is necessary to execute the transaction, to confirm that the payment account is registered in the same name as your xbaj account, and to maintain the transaction records that applicable law requires us to keep.

xbaj does not store full payment card numbers. Where card payments are supported, card data is tokenised and processed exclusively by our payment processor partners. xbaj retains only a non-sensitive token that identifies the payment method for future transaction matching. Financial transaction records are retained for the period required by applicable financial regulation, which is typically a minimum of five years from the date of the transaction.

xbaj uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies — Essential for the Platform to function. These include session cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core Platform functionality.
• Functional cookies — Remember your preferences such as language selection and responsible gaming settings so you do not have to re-enter them on each visit.
• Analytics cookies — Help us understand how players navigate the Platform — which pages are visited most frequently, where users drop off, and how long sessions last. This data is used in aggregate form only and is not linked to your individual account.

You may control cookie settings through your browser preferences. Please note that disabling strictly necessary cookies will prevent certain features of the xbaj Platform from working correctly. xbaj does not use advertising cookies or tracking pixels that serve ads to you across third-party websites.

xbaj retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply: account data and gaming activity records are retained for the duration of your account plus a minimum of five years after account closure; financial transaction records are retained for a minimum of five years from the date of each transaction; KYC verification documents are retained for a minimum of five years from the date of verification; customer support correspondence is retained for three years from the date of the most recent interaction.

When the applicable retention period expires and there is no longer a legal basis to retain your data, xbaj will securely delete or anonymise your personal data in a manner that makes it impossible to re-identify you. Anonymised aggregate data (from which all identifying information has been removed) may be retained indefinitely for statistical and platform improvement purposes.

xbaj implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include: SSL/TLS encryption for all data transmitted between your device and the xbaj Platform; encryption of sensitive data fields at rest in our database; access controls that limit access to personal data to authorised personnel only, on a need-to-know basis; regular security assessments and penetration testing of the Platform; and multi-factor authentication for administrative access to our internal systems.

While xbaj takes every reasonable precaution to safeguard your personal data, no method of electronic transmission or storage is 100% secure. You play an important role in keeping your account secure by choosing a strong, unique password for your xbaj account, not sharing your login credentials with anyone, logging out of your account when using a shared device, and notifying us immediately at [email protected] if you suspect any unauthorised access.

xbaj respects your rights in relation to your personal data. Subject to applicable law and to verification of your identity, you have the following rights:

• Right of access — You have the right to request a copy of the personal data xbaj holds about you, together with information about how it is used and with whom it has been shared.
• Right to rectification — You have the right to request correction of any inaccurate or incomplete personal data xbaj holds about you. If you believe that any data we hold is wrong, please contact [email protected].
• Right to erasure — You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (where consent was the legal basis), or where the data has been unlawfully processed. This right is subject to our legal retention obligations, which may require us to retain certain data for a period after your account is closed.
• Right to restrict processing — In certain circumstances, you have the right to request that xbaj restricts the processing of your personal data — for example, while we investigate a rectification request or a complaint about the accuracy of data we hold.
• Right to data portability — Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive the personal data you provided to xbaj in a structured, commonly used, machine-readable format.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request", including your full name, registered email address and a description of the right you wish to exercise. xbaj will acknowledge your request within five business days and will aim to respond in full within 30 days. Where a request is complex or there are a large number of requests, we may extend this period by a further 30 days, in which case we will inform you of the extension and the reasons for it.

The xbaj Platform is strictly intended for adults aged 21 and above. xbaj does not knowingly collect, use or retain personal data from any individual under the age of 21. If you are under 21, you must not use the xbaj Platform or provide us with any personal information. If xbaj becomes aware that personal data has been collected from a person under the age of 21 without appropriate verification having been completed, we will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that your child may have provided personal data to xbaj, please contact us immediately at [email protected] and we will investigate and act without delay.

xbaj reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where the changes are significant, notify registered users by email or via an in-platform notification prior to the change taking effect. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

Your continued use of the xbaj Platform after any updated version of this Privacy Policy is posted constitutes your acceptance of the revised terms. If you do not agree with any changes to this Privacy Policy, you must stop using the Platform and may request closure of your account by contacting [email protected].

If you have any questions, concerns or complaints about this Privacy Policy or about how xbaj handles your personal data, please contact our support team. We are available every day of the year and aim to respond to all privacy-related queries within five business days.

Email: [email protected] — Please include "Privacy Enquiry" in the subject line of your message, along with your registered username, to help us locate your account and respond efficiently.