Privacy Policy — How xbaje Protects Your Data

1Introduction

This Privacy Policy ("Policy") describes how xbaje ("we", "us", "our") collects, uses, stores, shares, and protects the personal data of players and visitors who access the xbaje platform at https://xbaje.bar ("the Platform"). This Policy applies to all users of the Platform, including registered players, prospective players who browse the Platform without registering, and any person who contacts xbaje via any communication channel.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to the terms of this Policy, you must cease using the Platform. This Policy is incorporated by reference into xbaje's Terms and Conditions, which govern your overall relationship with the Platform.

2Information We Collect

xbaje collects personal data from you in several ways: directly when you provide it during registration or account use, automatically when you interact with the Platform, and from third-party service providers involved in delivering the Platform's services. The categories of personal data we may collect include:

• Identity data: your full name, date of birth, gender, and a copy of government-issued identification documents (such as a National Identity Card) when required for KYC verification.
• Contact data: your registered Bangladesh mobile number, and optionally an email address if provided during registration. This data is used for account security, OTP delivery, and communications.
• Financial data: records of all deposit and withdrawal transactions processed through your xbaje account, including transaction amounts, timestamps, payment method identifiers (e.g. your bKash or Nagad mobile wallet number), and transaction status.
• Gaming and activity data: your complete betting and gaming history, including games played, bet amounts, outcomes, session duration, login timestamps, and any bonus or promotion activity associated with your account.
• Device and technical data: your IP address, device type, operating system, browser type and version, mobile network, screen resolution, and unique device identifiers. This data is collected automatically when you access the Platform and is used for security, fraud prevention, and service optimisation.
• Communications data: records of any written communications you have with xbaje customer support via live chat, email, or any other channel, including the content of those communications and any attachments you submit.

Where xbaje collects personal data from third-party sources — for example, identity verification providers used to assist with KYC checks, or payment processors used to confirm the status of a transaction — such data is handled in accordance with this Policy and only used for the purpose for which it was obtained.

3How We Use Your Information

xbaje uses the personal data collected about you for the following purposes. We process your data only where we have a valid legal basis for doing so and only to the extent necessary for the stated purpose:

• Account creation and management: to register your player account, verify your identity, process your transactions, maintain your account balance, and provide you with access to the Platform's games and features.
• Security and fraud prevention: to detect and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct. This includes monitoring login patterns, transaction patterns, and gaming behaviour for anomalies that may indicate a security risk.
• Responsible gaming compliance: to monitor gaming activity for indicators of problem gambling, to apply and enforce deposit limits, time-out periods, and self-exclusion measures, and to fulfil our obligations under applicable responsible gaming requirements.
• Customer support: to respond to your enquiries, complaints, and requests, to resolve account issues, and to maintain records of our communications with you for quality assurance and dispute resolution purposes.
• Platform improvement and analytics: to understand how players use the Platform, identify popular features, diagnose technical issues, and improve the overall performance and user experience of the Platform. Where analytics data is used, it is aggregated and anonymised wherever possible.
• Marketing communications: where you have provided consent or where we have a legitimate interest, to send you promotional offers, bonus notifications, game launch announcements, and other marketing communications relevant to your use of the Platform. You may opt out of marketing communications at any time.

4Legal Basis for Processing Your Data

xbaje processes personal data only where a valid legal basis exists for doing so. The primary legal bases on which xbaje relies to process player data are:

• Contractual necessity: processing required to perform our obligations under the Terms and Conditions, including account registration, transaction processing, game delivery, and customer support.
• Legal obligation: processing required to comply with applicable anti-money laundering (AML) requirements, know-your-customer (KYC) obligations, age verification requirements, and any other applicable legal or regulatory requirement.
• Legitimate interests: processing undertaken to protect the security and integrity of the Platform and its players, to prevent and detect fraud, to improve Platform performance, and to maintain accurate records for dispute resolution. We process data under this basis only where our interests are not overridden by your data protection rights.
• Consent: processing of your personal data for marketing communications, where we rely on your explicit consent. You may withdraw your consent to marketing at any time by contacting customer support or updating your account communication preferences.

5Sharing Your Information with Third Parties

xbaje does not sell your personal data to any third party. We share personal data with third parties only where necessary and only for defined purposes. The categories of third parties with whom we may share your data are:

• Payment processors and mobile financial service providers: bKash, Nagad, Rocket, Upay, and any other payment method integrated with the Platform. These providers receive only the transaction data necessary to process your deposit or withdrawal and are bound by their own data protection obligations.
• Identity verification and KYC providers: third-party services used to assist with identity document verification, age verification, and sanctions screening. These providers process only the identity data required to complete the verification check and do not retain your data for their own purposes.
• Game technology providers: software studios and game platform providers (such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi) whose games are made available through the Platform. These providers may receive anonymised or pseudonymised session data for the purpose of game delivery and RNG audit trails.
• Law enforcement and regulatory authorities: where required or permitted by applicable law, we may disclose personal data to law enforcement agencies, courts, or regulators. This includes disclosures required in connection with the investigation of fraud, money laundering, or other criminal activity, or where required by a valid court order or official legal process.

All third-party service providers who process personal data on behalf of xbaje are contractually required to handle that data securely, use it only for the purposes for which it was shared, and not to disclose it to any further third party without xbaje's prior written authorisation.

6Payment Data and Financial Information

All financial transaction data processed through xbaje is handled with the highest level of security. Deposit and withdrawal transactions made via bKash, Nagad, Rocket, or Upay are processed through encrypted, secure API connections. xbaje does not store your full mobile wallet PIN or any full card number on its servers. Payment data is retained only for as long as required to fulfil our transaction record-keeping obligations and to resolve any disputes that may arise in connection with a transaction.

All deposits and withdrawals on xbaje are denominated in Bangladeshi Taka (BDT). Transaction records maintained by xbaje will show amounts in BDT. Where a player's payment service provider applies currency conversion or service charges, those charges are the responsibility of the payment provider and are not reflected in the transaction records held by xbaje.

7Cookies and Tracking Technologies

xbaje uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. xbaje uses the following categories of cookies:

• Essential cookies: strictly necessary for the Platform to function. These include session cookies that keep you logged in during a gaming session, security cookies that protect against cross-site request forgery, and cookies that remember your language preference. Essential cookies cannot be disabled without breaking core Platform functionality.
• Analytical cookies: used to collect anonymised data about how players use the Platform, including which pages are visited most frequently, session durations, and navigation paths. This data helps xbaje identify areas for improvement and optimise the player experience.
• Functional cookies: used to remember your preferences and personalise your experience on the Platform, such as remembering your preferred game category, display settings, or responsible gaming settings you have applied to your account.
• Security and anti-fraud cookies: used to identify and flag unusual activity patterns that may indicate a security threat, multiple-account usage, or an attempt to manipulate the Platform. These cookies are essential to maintaining the integrity of the gaming environment.

You can manage or delete cookies through your browser settings at any time. Note that disabling all cookies may prevent certain features of the Platform from working correctly. For mobile users accessing xbaje on Android or iOS, cookie settings can be managed through your mobile browser's privacy settings.

8Data Retention

xbaje retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal and regulatory requirements. The following general retention periods apply: account data and identity verification records are retained for the duration of your account's active period and for a minimum of five (5) years following account closure, in order to satisfy applicable AML and KYC record-keeping obligations. Transaction records are retained for a minimum of five (5) years from the date of the transaction. Communications records are retained for up to three (3) years from the date of the communication.

When personal data is no longer required, xbaje will securely delete or anonymise it in accordance with our data destruction procedures. Where anonymisation is not technically feasible, xbaje will restrict further processing of the data and ensure it is held securely until deletion is possible.

9Your Data Protection Rights

As a player using the xbaje platform, you hold the following rights in respect of the personal data we hold about you. To exercise any of these rights, please contact xbaje customer support. We will respond to all valid data rights requests within 30 days:

• Right of access: you may request a copy of all personal data xbaje holds about you, including information on how that data is used, with whom it has been shared, and how long it will be retained.
• Right to rectification: you may request that xbaje correct any inaccurate or incomplete personal data held about you. Where the correction relates to data that has been shared with a third party, xbaje will notify that third party of the correction where reasonably practicable.
• Right to erasure: in certain circumstances, you may request that xbaje delete the personal data it holds about you. This right is subject to any overriding legal obligation to retain that data (for example, AML record-keeping requirements), which may mean that not all data can be erased on request.
• Right to restrict processing: you may request that xbaje restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing and a determination is pending.
• Right to data portability: where xbaje processes your personal data on the basis of your consent or in connection with a contract with you, you may request that xbaje provide you with a copy of that data in a structured, commonly used, machine-readable format.
• Right to object: you have the right to object to xbaje's processing of your personal data where that processing is based on legitimate interests. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

To submit any data rights request, contact xbaje customer support via live chat on the Platform or by email at [email protected]. Please include your registered mobile number and a description of your request. xbaje may require identity verification before processing a data rights request to ensure that personal data is disclosed only to the correct individual.

10Security Measures

xbaje implements a range of technical and organisational security measures designed to protect the personal data of its players against unauthorised access, disclosure, alteration, loss, or destruction. These measures include: 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform; encrypted storage of sensitive account data at rest; role-based access controls that restrict access to personal data to only those members of xbaje staff who require it to perform their job functions; regular security assessments and vulnerability testing of Platform infrastructure; and multi-factor authentication requirements for player account access.

While xbaje takes all reasonable steps to protect your personal data, no security system is completely impenetrable, and xbaje cannot guarantee the absolute security of data transmitted over the internet. If you believe your account security has been compromised, you should contact xbaje customer support immediately and change your account password. xbaje will notify you without undue delay if we become aware of a data breach that is likely to result in a high risk to your rights and freedoms.

11Children's Privacy and Age Verification

The xbaje platform is strictly intended for adults aged 21 years and above. xbaje does not knowingly collect personal data from any person under the age of 21. Age verification checks are applied during the account registration process and may be repeated at any point during the account's active period. Any account found to belong to a person under the age of 21 will be immediately closed, all funds will be forfeited, and the personal data of the underage user will be deleted in accordance with applicable data protection requirements, subject to any retention obligations.

12Marketing Communications

Where you have consented to receive marketing communications from xbaje, we may contact you via SMS to your registered Bangladesh mobile number, or via email if you have provided an email address, to share information about bonuses, promotions, new game launches, and platform updates. You may withdraw your consent to receive marketing communications at any time by contacting xbaje customer support via live chat or by emailing [email protected] and stating that you wish to opt out of marketing. Once we receive your opt-out request, we will update your preferences within 5 business days.

Please note that opting out of marketing communications does not affect xbaje's right to send you service communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, security alerts, and account status updates. These operational messages are not marketing and cannot be opted out of while your account remains active.

13Changes to This Privacy Policy

xbaje may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legal requirements, or the services offered on the Platform. Where a material change is made to this Policy, xbaje will endeavour to notify registered players via the Platform or by notification to the player's registered contact details prior to the change taking effect. The date of the most recent revision to this Policy is displayed at the top of this page.

Your continued use of the Platform after any revised Policy has taken effect constitutes your acceptance of the updated terms. We recommend that you review this Policy periodically to stay informed about how xbaje collects and uses your personal data. If you have any concern about a change made to this Policy, please contact xbaje customer support before continuing to use the Platform.

14Contact Us and Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how xbaje handles your personal data, please contact our customer support team. Our support team is available 24 hours a day, 7 days a week via live chat on the Platform. You may also submit written data rights requests by email to [email protected] — please include your registered Bangladesh mobile number and a clear description of your request to help us process it efficiently.

xbaje is committed to resolving all privacy-related enquiries promptly and fairly. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter through available legal channels in your jurisdiction. xbaje will cooperate fully with any lawful regulatory investigation arising from a data protection complaint.