xbaaje Privacy Policy

xbaaje operates as the data controller for all personal information collected through the xbaaje platform at https://xbaaje.net. As data controller, xbaaje determines the purposes and means by which your personal data is processed, and assumes full responsibility for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all data-related enquiries, subject access requests, deletion requests, or complaints regarding the handling of your personal information, you may contact our dedicated Data Protection team using the details below:

This Privacy Policy governs all data collected from players located in or accessing the Platform from Bangladesh. xbaaje is an internationally operated platform and applies data protection standards consistent with internationally recognised best practices, including principles drawn from the General Data Protection Regulation (GDPR) framework, applied as good practice for the benefit of all users regardless of jurisdiction.

xbaaje collects personal data from you through several channels: directly when you register and use your Account, automatically when you interact with the Platform, and in limited cases from third-party sources such as payment processors and KYC verification providers. The categories of personal data we collect are detailed below.

Registration & Account Data

When you create an xbaaje Account, we collect the following information you provide directly:

• Full legal name;
• Date of birth (used to verify you are 18 years of age or older);
• Residential address (including division, district, and thana for players in Bangladesh);
• Email address;
• Mobile number (used for account verification and, where opted in, promotional messaging);
• Username and encrypted password;
• Preferred currency (Bangladeshi Taka / BDT).

Identity Verification (KYC) Data

To comply with our age verification and anti-money laundering obligations, we may collect:

• Copies of government-issued identity documents (National ID card, passport, or driving licence);
• Proof of address documents (utility bills, bank statements dated within three months);
• Proof of payment method ownership (screenshots of bKash, Nagad, Rocket, or Upay account details);
• Selfie or facial verification image where required by our KYC provider.

Transaction & Financial Data

• Deposit and withdrawal amounts, dates, and payment methods used;
• Transaction reference numbers from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard;
• Account balance history and bonus credit records;
• Wagering history, win/loss records, and game session data.

Technical & Device Data

When you access the Platform, our servers automatically record:

• IP address and approximate geolocation (city/region level);
• Device type, operating system, and browser version;
• Session start and end times, pages visited, and features used;
• Referral URL (the address of the webpage from which you arrived at xbaaje);
• Cookie identifiers and local storage data (see Section 6 — Cookies).

Communications Data

We retain records of communications you send us, including live chat transcripts, emails sent to [email protected], and any complaints or feedback submitted through the Platform. These records are retained to ensure continuity of support and for dispute resolution purposes.

Data We Do Not Collect

xbaaje processes your personal data only where a valid lawful basis exists for doing so. The primary bases on which we rely are set out in the table below.

xbaaje uses the personal data we collect for clearly defined, specific purposes. We do not use your data for automated decision-making that produces significant legal effects without human review, and we do not sell your personal data to third parties for their own marketing purposes under any circumstances.

Account Management & Service Delivery

• Creating, maintaining, and securing your xbaaje Account;
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and card networks;
• Crediting bonuses and managing wagering requirement balances;
• Delivering game content and live casino streams from our third-party providers;
• Providing customer support via live chat and email.

Compliance & Fraud Prevention

• Verifying your age and identity in accordance with our KYC obligations;
• Monitoring transactions for money laundering, fraud, or suspicious activity;
• Detecting and preventing the use of bots, scripts, or automated tools;
• Identifying and blocking players from Prohibited Jurisdictions;
• Maintaining audit records as required by applicable regulations.

Responsible Gaming

• Monitoring betting patterns that may indicate problem gambling behaviour;
• Applying deposit limits, session limits, or cooling-off periods requested by players;
• Processing self-exclusion requests and enforcing exclusion periods;
• Sending responsible gaming communications where behavioural indicators suggest a player may be at risk.

Platform Improvement & Analytics

• Analysing aggregated and anonymised usage data to improve Platform performance;
• Testing new game integrations, promotional mechanics, and payment flows;
• Conducting internal research to better serve the Bangladesh player community;
• Diagnosing and resolving technical errors reported by players or detected by our systems.

Marketing Communications (Consent-Based Only)

With your explicit consent, we may use your email address or mobile number to inform you of promotions, bonus offers, new game launches, and seasonal campaigns. You may opt out of marketing communications at any time without affecting your ability to use the Platform. To withdraw marketing consent, contact [email protected] or use the unsubscribe link in any marketing email.

In the course of delivering our Services, xbaaje works with a number of trusted third-party service providers. Each provider is contractually bound to process your data only as instructed by xbaaje and for no other purpose. The categories of third parties with whom your data may be shared are:

xbaaje does not transfer your personal data to advertising networks, data brokers, social media platforms, or any other third party for marketing, profiling, or re-targeting purposes. If you receive unsolicited communications purporting to be from xbaaje, please contact [email protected] immediately as this may indicate a phishing attempt.

xbaaje uses cookies and similar technologies (including local storage and session tokens) to ensure the Platform functions correctly and to improve your experience. This section explains what each category of cookie does and how you can manage your preferences.

Third-Party Cookies

Game content delivered by providers such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi may set their own session cookies within the game iframe. These cookies are governed by the respective provider's privacy policy and are limited to facilitating the game session. xbaaje does not use third-party advertising cookies or re-targeting pixels.

Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional cookies may impair your Platform experience. Instructions for managing cookies in popular browsers are available through the Help section of Chrome, Firefox, Safari, and Edge. Disabling strictly necessary or security cookies will prevent you from logging in to your xbaaje Account.

xbaaje retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods applicable to key data categories are outlined below.

At the end of each applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where deletion is not immediately technically feasible (for example, in backup systems), data is isolated from active processing and scheduled for deletion at the next routine backup cycle.

xbaaje respects your rights over your personal data. As a player on our Platform, you are entitled to exercise the following rights at any time by contacting our support team at [email protected]. We will respond to all valid requests within 30 days of receipt. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason.

xbaaje employs a layered, defence-in-depth approach to data security. We implement technical, organisational, and procedural measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include the following:

Technical Controls

• TLS 1.3 Encryption in Transit: All data exchanged between your browser or device and xbaaje servers is encrypted using Transport Layer Security version 1.3, the current industry standard.
• AES-256 Encryption at Rest: Sensitive personal data including identity documents and payment records is stored using AES-256 encryption on secured servers.
• Secure Password Hashing: Account passwords are never stored in plain text. We use a modern adaptive hashing algorithm (bcrypt) with a unique salt per account, ensuring that even in the highly unlikely event of a breach, raw passwords cannot be recovered.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their xbaaje Account for an additional layer of login security.
• Firewall & Intrusion Detection: The Platform is protected by enterprise-grade firewalls and continuously monitored intrusion detection systems that alert our security team to anomalous traffic patterns in real time.
• Regular Penetration Testing: Our infrastructure undergoes periodic independent security assessments to identify and remediate vulnerabilities before they can be exploited.

Organisational Controls

• Access to personal data is restricted to authorised xbaaje staff on a strict need-to-know basis using role-based access controls;
• All staff with access to personal data are trained in data protection responsibilities and are bound by confidentiality obligations;
• Third-party service providers are required to sign Data Processing Agreements confirming they will protect your data to an equivalent standard;
• Internal data handling procedures are reviewed and updated regularly in line with evolving best practices.

Data Breach Response

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, xbaaje will take immediate steps to contain the breach, assess its scope, and notify affected players without undue delay. We maintain an internal incident response plan for this purpose and will communicate clearly about what data was involved, what we have done to address the breach, and what steps you can take to protect yourself.

xbaaje reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, new service features, or improvements to our security and operational procedures. We are committed to keeping you informed of any material changes in a clear and timely manner.

When we make material changes to this Privacy Policy, we will notify you by one or more of the following methods:

• Displaying a prominent notice on the xbaaje Platform homepage or Account dashboard;
• Sending a notification to the email address registered on your Account;
• Updating the "Last Updated" date displayed at the top of this page.

The updated Privacy Policy will take effect immediately upon publication at https://xbaaje.net/privacy-policy unless a later effective date is specified. Your continued use of the Platform after a revised Policy has been published constitutes your acceptance of the updated terms. If you do not agree with the changes, you should stop using the Platform and may request Account closure in accordance with our Terms & Conditions.

We recommend reviewing this Privacy Policy periodically so you remain informed about how xbaaje protects your data. The version currently published at https://xbaaje.net/privacy-policy is always the authoritative, governing version.

For any questions, concerns, or requests regarding this Privacy Policy or the way xbaaje handles your personal data, please contact our support team. We are available 24/7 via live chat on the Platform, and by email at [email protected] with an average response time of 2–5 minutes.