Privacy Policy —
How bajj Protects Your Data

This Privacy Policy ("Policy") is issued by bajj ("bajj", "we", "us", "our") and applies to all personal data collected through the bajj online betting and casino platform available at bajj.bio, including all associated pages, features, mobile-optimised views, and communication channels (collectively, the "Platform"). This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

bajj is committed to handling your personal data with transparency, integrity, and care. We collect only what is necessary, retain it only for as long as required, and never sell it to third parties for advertising or marketing purposes. This Policy is written in plain English to ensure every player in Bangladesh can understand exactly how their data is handled.

bajj operates as an online sports betting and casino entertainment platform serving players across Bangladesh. In the course of providing our services — which include cricket betting, live casino, slot games, crash titles, and fishing games — we necessarily collect and process certain categories of personal data about our registered players. This is an unavoidable feature of any regulated online platform that handles real-money transactions, verifies player identities, and maintains the integrity of its gaming environment.

Our approach to privacy is built on six core principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. We apply these principles to every stage of data processing, from the moment you first visit the Platform to the point at which your data is securely deleted following the expiry of applicable retention periods.

This Policy is structured to give you a complete picture of your data journey with bajj. We describe the categories of data we collect, the sources from which we collect them, the specific purposes for which we use them, the parties with whom we share them, how long we keep them, and the rights you can exercise at any time to control your own information.

bajj collects personal data across several distinct categories, each serving a clearly defined operational or compliance purpose. The following table summarises the categories of data we collect and provides examples of the specific data points within each category:

bajj collects your personal data through three primary channels: directly from you, automatically through your use of the Platform, and from trusted third parties involved in delivering our services.

Data you provide directly:

• When you register a bajj account by completing the sign-up form, including your name, date of birth, contact details, and preferred payment method.
• When you complete KYC identity verification by uploading your National ID card, passport, or other government-issued document as requested by our compliance team.
• When you make a deposit or withdrawal request and provide payment details such as your bKash wallet number or bank account information.
• When you contact our support team via live chat, email, or WhatsApp — the content of those communications is stored for quality assurance and dispute resolution purposes.
• When you participate in surveys, feedback forms, or promotional activities on the Platform.

Data collected automatically:

• Technical and usage data is collected automatically every time you interact with the Platform through cookies, server logs, and similar tracking technologies (see Section 7 for full cookie details).
• Device fingerprinting data is collected to detect multi-accounting and prevent fraud.
• In-play betting behaviour and gaming session data are logged automatically each time you engage with a game or market.

Data received from third parties:

• Payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and others) share transaction confirmation data with bajj to facilitate deposit and withdrawal reconciliation.
• Identity verification service providers may share the results of document authentication checks performed on your behalf during the KYC process.
• Fraud detection and AML screening partners may flag accounts or transactions based on data patterns observed across their wider networks.
• Game providers such as Evolution Gaming, Pragmatic Play, Spribe, and NetEnt share game round outcomes and session metadata to support dispute resolution and responsible gaming oversight.

bajj uses your personal data only for clearly defined and legitimate purposes. We do not use your data for purposes that are incompatible with those originally disclosed to you at the time of collection. The following list covers all purposes for which we currently process player data:

• Account creation and management: Creating your bajj player account, authenticating your identity at login, managing your account preferences and settings, and maintaining your account history.
• Age and identity verification: Confirming that you are 21 years of age or older and that your identity documents are genuine. This is a mandatory requirement before any withdrawal is processed.
• Payment processing: Facilitating deposits via bKash, Nagad, Rocket, Upay, and bank transfer, as well as processing withdrawal requests to your verified payment method.
• Fraud and security monitoring: Detecting and preventing unauthorised access, multi-accounting, bonus abuse, money laundering, and other forms of fraudulent or prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: Monitoring your gaming activity to identify potential signs of problem gambling and, where necessary, reaching out to offer support, apply protective limits, or enforce self-exclusion as requested.
• Customer support: Responding to your enquiries, resolving disputes, investigating complaints, and providing general assistance via live chat, email, and WhatsApp.
• Legal and regulatory compliance: Fulfilling our obligations under applicable anti-money laundering (AML) and know-your-customer (KYC) requirements, retaining records as required by law, and cooperating with lawful requests from competent authorities.
• Platform improvement: Analysing aggregated and anonymised usage data to understand how players navigate the Platform, identify areas for improvement, and prioritise feature development.
• Marketing communications: Sending you promotional offers, bonus notifications, and event-based communications (such as BPL season promotions or Eid special offers) where you have expressly opted in to receive such communications. You may withdraw this consent at any time.

For each purpose for which bajj processes your personal data, we rely on one or more of the following legal bases:

• Contractual necessity: Processing your identity, contact, financial, and betting data is necessary to perform the contract between you and bajj — specifically, to provide you with access to betting markets, process your transactions, and deliver the gaming services you have signed up for. Without this data, we cannot provide the service.
• Legal obligation: Collecting and retaining identity documents, transaction records, and AML screening data is required to comply with applicable anti-money laundering and counter-terrorism financing obligations. bajj must retain this data regardless of your preferences.
• Legitimate interests: We process technical data, device fingerprints, and behavioural analytics to protect the Platform from fraud, maintain its security, and improve the service quality for all players. These interests do not override your fundamental privacy rights.
• Consent: Where we send you optional marketing communications, recommend personalised promotions based on your activity, or use non-essential cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

bajj does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the following strictly limited and necessary circumstances:

• Payment service providers: We share the minimum data necessary with bKash, Nagad, Rocket, Upay, BRAC Bank, Dutch-Bangla Bank, City Bank, Islami Bank, Sonali Bank, and international card networks (Visa, Mastercard) to process your deposits and withdrawals. These providers act as independent data controllers and are subject to their own privacy policies.
• Identity verification providers: Third-party KYC and document authentication services may receive copies of your identity documents for the sole purpose of verifying their authenticity. These providers are contractually bound to process the data only for this purpose and to apply appropriate security measures.
• Game software providers: Game providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi receive limited session and round data necessary to deliver their games within the bajj Platform environment. They do not receive your full identity or financial profile.
• Fraud detection and security partners: bajj works with specialist security and fraud prevention services that process device and behavioural data to identify suspicious patterns. These partners are bound by strict data processing agreements.
• IT infrastructure and hosting providers: Our Platform is hosted on secure cloud infrastructure. Server administrators may have access to system logs which could contain technical data, but access is strictly controlled and limited to authorised personnel.
• Legal and regulatory authorities: bajj will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, court order, or legal process. We will notify affected players of such disclosures where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of bajj's assets, your data may be transferred to the successor entity as part of the transaction. You will be notified of any such transfer in advance and afforded the opportunity to exercise your data rights.

bajj uses cookies and similar tracking technologies to operate the Platform effectively, ensure security, and improve the player experience. A cookie is a small text file placed on your device when you visit the Platform. The following categories of cookies are used:

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will impair the functionality of the Platform, including your ability to log in and place bets. Optional cookies (functional and analytics) can be declined without affecting core service availability.

bajj retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

• Active account data: Retained for the full duration of your account registration plus a period of 5 years following permanent account closure, to satisfy AML and financial record-keeping obligations.
• Identity and KYC documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later, in accordance with anti-money laundering requirements.
• Transaction records: All deposit and withdrawal records are retained for 7 years from the date of each transaction to comply with financial reporting obligations.
• Betting and gaming history: Retained for 5 years from the date of each transaction or game round for the purposes of dispute resolution, responsible gaming monitoring, and regulatory audit.
• Support communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, unless the communication is relevant to an ongoing dispute or investigation.
• Marketing preferences: Records of your marketing consent and opt-out preferences are retained for the full duration of your account plus 3 years after closure as evidence of lawful processing.
• Technical and usage logs: Server logs and session data are retained for a rolling period of 12 months and then automatically deleted unless flagged for security investigation.

At the end of applicable retention periods, data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

bajj implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes the following controls:

• Transport encryption: All data transmitted between your device and bajj's servers is encrypted using TLS 1.3, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Data-at-rest encryption: Sensitive data stored in bajj's databases — including identity documents, financial records, and KYC data — is encrypted at rest using AES-256 encryption.
• Password security: Player passwords are never stored in plain text. They are processed through a bcrypt hashing algorithm with a unique salt per password, rendering stored password data useless even in the event of a database breach.
• Access controls: Access to player data within bajj's internal systems is governed by strict role-based access controls (RBAC). Only authorised personnel with a defined operational need may access personal data, and all access events are logged.
• Intrusion detection: bajj's infrastructure is monitored 24 hours a day by automated intrusion detection and anomaly alerting systems. Security incidents trigger immediate escalation to our technical response team.
• Penetration testing: bajj engages independent security specialists to conduct regular penetration tests and vulnerability assessments of the Platform. Identified vulnerabilities are remediated according to a prioritised patching schedule.
• Vendor security standards: All third-party providers who process bajj player data on our behalf are subject to a vendor security assessment and are contractually required to maintain security standards consistent with industry best practice.

As a registered bajj player, you have the following rights with respect to your personal data. These rights are subject to applicable legal limitations and may not apply in every circumstance — for example, where retention is required by law.

• Right of access: You may request a copy of all personal data bajj holds about you. We will provide this in a structured, commonly used, and machine-readable format within 30 days of a valid request.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update most account details directly within your player dashboard.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing. This right is subject to our obligations to retain certain records under AML and financial regulations.
• Right to restriction: You may request that bajj restrict the processing of your data — for example, while a dispute regarding its accuracy is being investigated — rather than deleting it entirely.
• Right to data portability: You may request that we provide your personal data in a portable format so that it can be transferred to another service provider, where technically feasible and where processing is based on your consent or contractual necessity.
• Right to object: You may object at any time to the processing of your data for direct marketing purposes, including profiling related to direct marketing. You may also object to processing based on legitimate interests, subject to our ability to demonstrate compelling grounds.
• Right to withdraw consent: Where processing is based on your consent (such as optional marketing communications or functional cookies), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place before the withdrawal.

bajj is strictly an adult platform. The minimum age requirement to register an account and use any paid service on the Platform is 21 years. bajj does not knowingly collect, solicit, or process personal data from any individual under the age of 21.

If bajj becomes aware, through account verification or any other means, that a registered player is under 21 years of age, the account will be immediately suspended, all pending bets and transactions will be voided, any deposited funds will be returned to the originating payment method, and all personal data associated with the minor's account will be securely deleted from our systems.

Parents and guardians who believe a minor may have accessed the Platform using falsified identity documents are encouraged to contact us immediately at [email protected] so that we can take swift action to close the account and remove associated data.

The bajj Platform may from time to time contain references to third-party game providers, payment processors, or service partners. While bajj takes care to work only with reputable partners, we do not control the privacy practices of any third-party websites or services, and this Privacy Policy does not apply to them.

When you interact directly with a third-party payment provider such as bKash or Nagad — for example, by confirming a transaction through their own application — you are subject to that provider's privacy policy and terms of service. bajj encourages you to review the privacy policies of any third-party service you use in connection with your bajj account.

Game content delivered by providers such as Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, and Ezugi is rendered within the bajj Platform environment. These providers receive only the minimum session data necessary to deliver game functionality and are bound by strict data processing agreements that prohibit any secondary use of player data.

bajj reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the features and services offered on the Platform. All updates will be published on this page with a revised effective date prominently displayed at the top of the document.

For material changes — those that significantly affect how we collect, use, or share your personal data — bajj will provide advance notice to registered players via email to the address on file, or via a prominent notice on the Platform, at least 14 days before the changes take effect. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

We recommend that you review this Privacy Policy periodically to stay informed about how bajj is protecting your information. The version number and effective date displayed at the top of this page indicate the currency of the document you are reading.

If you have any questions, concerns, or requests relating to this Privacy Policy or to bajj's handling of your personal data, please contact our data team through any of the following channels. All privacy-related correspondence is handled by dedicated staff and will receive a response within 30 days.

• Email: [email protected] — use the subject line "Privacy Rights Request" for data rights queries and "Privacy Concern" for general privacy questions.
• WhatsApp: +880 1700 000000 — available during Bangladesh Standard Time (BST, UTC+6) business hours for non-sensitive privacy queries.
• Live Chat: Available 24/7 on the Platform — for general account and privacy questions. For formal data rights requests, email is recommended to create a documented record.

bajj is committed to resolving all privacy concerns fairly and promptly. If you are not satisfied with our response to a privacy rights request or complaint, you have the right to escalate the matter to the appropriate data protection authority in your jurisdiction.