Privacy Policy

This Privacy Policy ("Policy") describes how xbajee ("the Platform", "we", "us", "our"), operating at xbajee.bar, collects, uses, stores, and protects the personal data of users ("Player", "User", "you") who access or use our online casino and sports betting services.

By registering an account on xbajee or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, both of which are available on this website. If you have questions about how we handle your data, please contact us at [email protected].

All times and date references in this Policy are in Bangladesh Standard Time (BST, UTC+6).

xbajee is the data controller responsible for the personal data collected through this Platform. As data controller, we determine the purposes for which your personal data is processed and the means by which that processing is carried out.

For all data protection enquiries, subject access requests, or complaints relating to the handling of your personal data, please contact us in writing at:

Email: [email protected]
Subject line: Data Protection Enquiry

We aim to acknowledge all data protection enquiries within 5 business days and to provide a substantive response within 30 calendar days of receipt.

We collect personal data from you in the following categories, depending on how you interact with the Platform:

xbajee collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing identity verification, making deposits or withdrawals, contacting our support team, or responding to surveys and promotions.
• Automated technologies: Technical and usage data collected automatically via cookies, web beacons, server logs, and similar tracking technologies when you access and navigate the Platform.
• Third-party payment providers: Financial transaction data received from payment processors including bKash, Nagad, Rocket, and Upay when you initiate a deposit or withdrawal.
• Identity verification partners: Data received from third-party identity verification services we engage to confirm your identity and age as part of our know-your-customer (KYC) obligations.
• Fraud prevention services: Risk signals and fraud indicators shared by third-party fraud detection providers to help us maintain a safe and secure platform for all players.

We process your personal data only where we have a lawful basis for doing so. The purposes for which we use your data, and the corresponding legal basis for each, are set out below:

• Account registration and management: To create and maintain your player account, verify your identity and age (21+), and provide you with access to our services. Legal basis: performance of a contract.
• Payment processing: To process deposits and withdrawals in BDT (৳) via your chosen payment method (bKash, Nagad, Rocket, Upay, bank transfer). Legal basis: performance of a contract.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, and other illegal activity on the Platform. Legal basis: legitimate interests and legal obligation.
• Regulatory compliance: To fulfil our obligations under applicable law, including anti-money laundering (AML) requirements and age verification obligations. Legal basis: legal obligation.
• Customer support: To respond to your enquiries, resolve complaints, and provide assistance with account issues. Legal basis: performance of a contract and legitimate interests.
• Responsible gaming: To monitor gaming behaviour, identify indicators of problem gambling, and enforce player-requested limits, cooling-off periods, or self-exclusions. Legal basis: legitimate interests and legal obligation.
• Platform improvement: To analyse usage patterns and technical data in order to improve the performance, design, and content of the xbajee platform. Legal basis: legitimate interests.
• Marketing communications: To send you promotional offers, bonus announcements, and seasonal campaign updates (e.g., Eid, BPL, IPL) where you have given your consent to receive such communications. Legal basis: consent. You may withdraw consent at any time by contacting [email protected].

We will not use your personal data for any purpose that is incompatible with the purposes described above without first obtaining your consent or establishing a separate lawful basis.

xbajee uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit a website. They allow us to recognise your device, maintain your session, and understand how you interact with the Platform.

We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in during your visit and security cookies that help prevent fraudulent use of your account. These cannot be disabled.
• Performance cookies: Collect anonymised data about how players use the Platform — which pages are visited most, how long sessions last, and where errors occur. This data helps us improve the overall user experience.
• Functionality cookies: Remember your preferences such as language settings and display options so that you do not need to reset them on each visit.
• Analytics cookies: Used to compile aggregate statistical reports about Platform traffic and usage. Data collected through analytics cookies does not identify individual users.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform. Detailed browser-specific instructions for managing cookies are available through your browser's help documentation.

xbajee does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection agreements:

• Payment service providers: bKash, Nagad, Rocket, Upay, and banking partners including Dutch-Bangla Bank, City Bank, and BRAC Bank, to the extent required to process your financial transactions.
• Identity verification and KYC providers: Third-party services that assist us in verifying the identity and age of players as required by our operating procedures.
• Game providers: Our licensed game content partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive session and technical data necessary to deliver their games within our Platform.
• Fraud prevention and security providers: Specialist services that help us identify and prevent fraudulent activity, money laundering, and other security threats.
• Legal and regulatory authorities: Law enforcement agencies, courts, or regulatory bodies where we are required by law to disclose your information, or where disclosure is necessary to protect the rights, property, or safety of xbajee, our players, or the public.
• Professional advisors: Lawyers, auditors, and other professional advisors engaged by xbajee in the ordinary course of business, subject to strict confidentiality obligations.

Any third party with whom we share your data is required to process it only for the specific purposes agreed with xbajee and in accordance with applicable data protection principles.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention practices are as follows:

• Account data: Retained for the duration of your registered account and for a minimum of 5 years following account closure, in line with standard financial record-keeping obligations.
• Transaction records: Financial transaction data, including deposit and withdrawal records in BDT (৳), is retained for a minimum of 7 years to comply with anti-money laundering regulations.
• Identity verification documents: Copies of government-issued identification are retained for the duration of your account and for a minimum period following closure as required by applicable KYC obligations.
• Support communications: Records of customer support interactions are retained for up to 3 years from the date of the last interaction.
• Marketing data: Where you have consented to receive marketing communications, your marketing preferences are retained until you withdraw consent. Following withdrawal of consent, we retain a suppression record to ensure we do not contact you again.
• Technical and usage data: Server logs and anonymised analytics data are typically retained for up to 12 months, after which they are aggregated or deleted.

When personal data is no longer required, we will delete or anonymise it in a secure manner. Where immediate deletion is not technically feasible, we will isolate the data from further processing until deletion is possible.

xbajee takes the security of your personal data seriously. We implement a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and our servers.
• Encrypted storage of sensitive personal and financial data at rest on our secure servers.
• Access controls that restrict access to personal data to authorised personnel only, on a strictly need-to-know basis.
• Regular security assessments and vulnerability testing of our Platform infrastructure.
• Staff training on data protection obligations and secure data handling practices.
• Incident response procedures to detect, investigate, and respond to data security incidents promptly.

While we take all reasonable steps to protect your personal data, no method of electronic transmission or storage is entirely secure. We cannot guarantee absolute security, and you acknowledge this inherent risk when using any online platform. If you suspect that your account has been compromised, please contact us immediately at [email protected].

Subject to applicable law, you have the following rights with respect to your personal data held by xbajee:

• Right of access: You may request a copy of the personal data we hold about you at any time.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances, for example while we investigate a dispute about its accuracy.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data where we rely on legitimate interests as our legal basis, or where data is used for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will verify your identity before processing any request and will respond within 30 calendar days. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension.

Please note that certain rights may be limited where we are required to retain data to comply with legal obligations or to defend legal claims.

The xbajee Platform is strictly intended for adults aged 21 and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Our registration process includes age verification steps designed to prevent minors from creating accounts.

If you are a parent or guardian and believe that a minor under your care has provided us with personal data or has registered an account on xbajee, please contact us immediately at [email protected]. We will investigate and, where confirmed, take immediate steps to delete all associated personal data and close the account.

We encourage parents and guardians to make use of parental control software and device-level content filters to prevent minors from accessing gambling websites. Additional guidance is available on our Responsible Gaming page.

xbajee operates primarily within the Bangladesh market and processes the majority of player data within servers serving this region. In some cases, the operation of our Platform may involve the transfer of personal data to service providers or partners located outside Bangladesh.

Where such transfers occur, we take steps to ensure that your personal data continues to be protected to a standard consistent with this Policy. These steps may include entering into data transfer agreements with receiving parties that incorporate appropriate data protection clauses, or relying on other lawful transfer mechanisms as available.

If you would like further information about the safeguards we apply to international data transfers, please contact us at [email protected].

xbajee reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page.
• Notify registered players via their registered email address or mobile number where the change is significant.
• Where required by applicable law, seek fresh consent from players before processing their data under the revised terms.

Your continued use of the xbajee Platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms. We strongly encourage you to review this page periodically to stay informed about how we protect your data.

If you do not accept the changes to this Policy, you should discontinue use of the Platform and contact us at [email protected] to close your account and arrange for any eligible balance to be returned.

If you have any questions, concerns, or complaints about the way xbajee handles your personal data, we encourage you to contact us in the first instance so that we can address the matter promptly:

Email: [email protected]
Subject line: Privacy Enquiry or Data Complaint

We take all privacy complaints seriously and will acknowledge your submission within 5 business days. We aim to resolve all privacy-related complaints within 30 calendar days. Where an investigation requires additional time, we will keep you informed of progress.

If you are not satisfied with the outcome of our internal complaint process, you may have the right to refer the matter to the relevant supervisory authority under applicable data protection law.