Privacy Policy — How xbajr Protects Your Data

1. Information We Collect

xbajr collects personal information in order to operate the platform, verify user identities, process financial transactions, prevent fraud, and comply with applicable legal obligations. We collect information through three primary channels: information you provide directly to us, information collected automatically through your use of the platform, and information received from trusted third-party partners.

1.1 Information You Provide Directly

When you register an account or interact with xbajr services, you may provide us with the following categories of personal information:

• Identity data: Full legal name, date of birth, nationality, and a copy of a government-issued photo ID (National Identity Card or passport) submitted during KYC verification.
• Contact data: Email address, mobile phone number (including bKash/Nagad registered number), and residential address including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or other).
• Financial data: Mobile banking account references (bKash, Nagad, Rocket, Upay), bank account details where applicable (City Bank, BRAC Bank, Islami Bank, Sonali Bank, Dutch-Bangla Bank), and records of all deposits, withdrawals, and wagers.
• Account credentials: Username, hashed password, and security question responses. Passwords are never stored in plain text.
• Communications data: Records of all support interactions via email or live chat, including message content and timestamps.

1.2 Information Collected Automatically

When you visit and use the xbajr platform, certain technical information is collected automatically through our servers, analytics tools, and cookie technologies:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage data: Pages visited, games played, bet amounts, session duration, click paths, feature interactions, and timestamps of all platform activities.
• Location data: Approximate geographic location derived from your IP address, used solely to verify that access complies with applicable jurisdiction rules. We do not collect precise GPS location data.
• Session data: Login timestamps, session duration, logout events, and concurrent session indicators used for security monitoring.

1.3 Information from Third Parties

xbajr may receive supplementary information about you from trusted third-party sources in the following circumstances:

• Identity verification agencies and KYC service providers who confirm the authenticity of the documents you submit.
• Payment processors including bKash, Nagad, and Rocket, who confirm the status and outcome of financial transactions linked to your account.
• Fraud-prevention and anti-money-laundering (AML) screening services who cross-reference your information against watchlists and sanctions databases.
• Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, who may share game-session logs for dispute resolution purposes.

2. How We Use Your Data

xbajr processes your personal data only for specific, legitimate purposes. The table below outlines the primary purposes for which your data is used and the legal basis for each type of processing.

xbajr does not use your personal data to make fully automated decisions that produce significant legal effects without the possibility of human review. Where automated risk-scoring tools are used (for example in fraud detection), a human compliance officer reviews any action taken against an account as a result.

We do not sell your personal data to third-party marketers or data brokers. Your information is used exclusively to operate the xbajr platform and to fulfil our legal obligations as described in this policy.

3. Data Sharing and Disclosure

xbajr treats your personal data with strict confidentiality. We share your information only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

3.1 Service Providers and Technology Partners

We engage third-party service providers who process data on our behalf under contractual data processing agreements. These partners include cloud hosting providers, database management services, KYC verification platforms, payment processors, fraud-screening systems, and game-platform integrators. All such processors are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than the service they provide to xbajr.

3.2 Legal and Regulatory Disclosure

xbajr may be required to disclose your personal information to law enforcement agencies, financial intelligence units, or other government authorities in Bangladesh or internationally where we are legally compelled to do so. This includes disclosures required in connection with anti-money-laundering (AML) investigations, fraud investigations, court orders, or other binding legal processes. Where permitted by law, we will notify you of such a disclosure request before complying.

3.3 Business Transfers

In the event that xbajr undergoes a merger, acquisition, restructuring, or sale of assets, your personal data held at the time of such a transaction may be transferred to the acquiring entity as part of that transaction. You will be notified by email of any such transfer and of any material changes to this Privacy Policy that result from it, with a minimum of 30 days' notice before the change takes effect.

3.4 No Sale of Personal Data

xbajr does not sell, rent, or trade your personal information to any third party for marketing, advertising, or commercial data-brokering purposes. This prohibition applies regardless of whether the data is individually identifiable or has been aggregated or anonymised.

4. Cookies and Tracking Technologies

xbajr uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, maintain your session security, and analyse how the site is used so that we can improve the experience for all players.

4.1 Types of Cookies We Use

• Strictly necessary cookies: These are essential for the platform to function. They manage your login session, maintain your account security token, and remember your language and currency preferences. These cookies cannot be disabled without breaking core platform functionality.
• Analytical and performance cookies: These cookies collect aggregated, anonymised data about how visitors use the xbajr platform — which pages are most visited, how long sessions last, and where users encounter errors. This information helps us improve the platform for all users.
• Functional cookies: These remember your platform preferences such as your preferred game category, notification settings, and responsible gaming limits, so you do not need to re-enter them on each visit.
• Security cookies: These help detect and prevent fraud, multiple-account creation from the same device, and unauthorised access attempts. They record device fingerprint data and login-attempt patterns.

4.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. However, please be aware that disabling strictly necessary cookies will prevent you from logging in to your xbajr account and using the platform's core features. Instructions for managing cookies are available in your browser's help documentation.

xbajr does not use third-party advertising cookies or cross-site tracking technologies that share your browsing behaviour with external advertising networks.

5. Data Retention

xbajr retains your personal data for only as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to resolve any disputes or enforce our agreements.

The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account relationship with xbajr, plus a minimum of 5 years following account closure to meet anti-money-laundering record-keeping requirements.
• KYC documentation: Identity verification documents (ID scans, address proofs) are retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Transaction records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of 7 years to comply with financial record-keeping standards.
• Support communications: Email and chat support records are retained for 3 years from the date of the last interaction in a support thread.
• Usage and analytics data: Aggregated, anonymised analytics data may be retained indefinitely. Individually identifiable usage logs are deleted within 24 months of collection.

When your data is no longer required for the purposes listed above, xbajr will securely delete or anonymise it in accordance with industry-standard data disposal procedures.

6. Data Security Measures

xbajr takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational safeguards designed to protect your information against unauthorised access, disclosure, alteration, or destruction.

6.1 Technical Safeguards

• SSL/TLS encryption: All data transmitted between your device and the xbajr platform is encrypted using industry-standard TLS 1.2 or higher. Look for the padlock icon in your browser's address bar to confirm your connection is secure.
• Password hashing: Account passwords are stored as salted cryptographic hashes. xbajr staff cannot view your password in plain text under any circumstances.
• Access controls: Access to systems that store personal data is restricted to authorised personnel on a strict need-to-know basis, enforced by role-based access controls and multi-factor authentication.
• Intrusion detection: xbajr's infrastructure is monitored 24/7 by automated intrusion detection systems that flag and respond to anomalous access patterns in real time.
• Database encryption: Sensitive data fields including financial account references and identity document scans are stored in encrypted form within xbajr's database infrastructure.

6.2 Organisational Safeguards

All xbajr staff and contractors with access to personal data are required to complete data protection training and are bound by confidentiality obligations. Internal data handling procedures are reviewed regularly. In the event of a data breach that affects your personal information, xbajr will notify affected users promptly and take immediate steps to contain and remediate the incident.

6.3 Your Role in Security

While xbajr maintains robust platform-side security, your own account security practices are equally important. You should use a strong, unique password for your xbajr account, never share your login credentials, and contact our support team immediately at [email protected] if you suspect any unauthorised access to your account.

7. Your Privacy Rights

As a user of the xbajr platform, you have a number of rights in relation to the personal data we hold about you. xbajr is committed to honouring these rights promptly and transparently. Requests may be submitted to our support team at [email protected].

Please note that some of these rights are subject to limitations. For example, we cannot erase data that we are required by law to retain for AML or financial record-keeping purposes. Where we are unable to fulfil a request in full, we will explain the reason clearly in writing.

8. Contact and Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about how xbajr handles your personal data, please contact our support team using the details below.

All privacy-related requests and enquiries should be submitted in writing to:

xbajr Data Privacy Team
Email: [email protected]
Please include "Privacy Request" in the subject line of your email.

We aim to respond to all privacy requests within 30 calendar days of receipt. For complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

xbajr reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. The most current version of this policy will always be available at xbajr.com/privacy-policy. Material changes will be communicated to registered users by email with a minimum of 14 days' notice before taking effect.