kbaji Privacy Policy — How We Handle Your Personal Data

About This Policy

This Privacy Policy ("Policy") describes the practices of kbaji ("kbaji", "we", "us", or "our") regarding the collection, use, storage, protection, and disclosure of personal data obtained from individuals ("you", "user", or "player") who access or use the kbaji platform at kbaji.io and any associated services, mobile applications, or communication channels operated by kbaji.

kbaji is an online betting and casino platform serving players in Bangladesh and internationally. We are committed to handling your personal data with the utmost care, transparency, and respect for your privacy. This Policy has been prepared in alignment with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, integrity, and confidentiality.

By registering an account on kbaji, accessing our platform as a visitor, or otherwise interacting with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any aspect of this Policy, you should discontinue your use of the kbaji platform immediately.

Data We Collect

kbaji collects only the personal data that is necessary for the lawful and efficient operation of its platform. The categories of personal data we may collect are set out below.

2.1 Identity and Contact Data

When you register an account on kbaji, we collect information that identifies you as an individual, including your full legal name, date of birth, gender, nationality, residential address (including city, district, and postal code), mobile phone number, and email address. This data is used to create and manage your account and to verify your identity during the KYC process.

2.2 Financial Data

In connection with processing deposits and withdrawals, kbaji collects financial information including your bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details (including account number and bank name where applicable), and Visa or Mastercard card details where card payments are used. We do not store full card numbers on our own servers — card data is handled directly by our certified payment processing partners.

2.3 Identity Verification Documents

During the KYC verification process, kbaji collects copies of government-issued identification documents such as your National ID card, passport, or driving licence. We may also collect proof of address documents (such as utility bills or bank statements issued within the last three months) and, where required by our AML obligations, documentation confirming the source of funds used to make deposits on the platform.

2.4 Transactional Data

kbaji automatically records all financial and gaming transactions associated with your account. This includes deposit amounts and timestamps, withdrawal requests and outcomes, bet placements (including event, market, stake, odds, and outcome), game session data (including game title, provider, session duration, and result), bonus credits and wagering progress, and account balance history.

2.5 Technical and Device Data

When you access the kbaji platform, our systems automatically collect certain technical data about your device and connection, including your Internet Protocol (IP) address, device type and model, operating system and version, browser type and version, screen resolution, time zone setting, and referring URL. This data is used for security monitoring, fraud prevention, and platform optimisation purposes.

2.6 Usage and Behavioural Data

kbaji collects data about how you interact with the platform, including pages and features accessed, navigation paths, session durations, search queries entered on the platform, links clicked, promotional materials interacted with, and in-app notification responses. This data helps us improve the platform experience and tailor content and offers to your interests.

2.7 Communications Data

When you contact kbaji's customer support team by email or live chat, or when you respond to surveys, promotional communications, or feedback requests, we retain records of those communications, including the content of messages and the dates and times of correspondence. This data is used to manage your support requests and to maintain a history of your account interactions.

How We Collect Data

kbaji collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide voluntarily when registering an account, completing KYC verification, making deposits or withdrawal requests, filling in profile settings, contacting customer support, or responding to surveys and promotions.
• Automated collection: Technical and behavioural data collected automatically by our platform systems, web servers, and analytics tools as you navigate and use the kbaji website and services.
• Cookies and similar technologies: Data gathered via browser cookies, local storage objects, pixel tags, and similar tracking technologies placed on your device when you visit the kbaji platform. See Section 7 for full details of our cookie practices.
• Third-party payment providers: Transaction confirmation and account verification data shared with kbaji by payment partners such as bKash, Nagad, Rocket, Upay, and bank transfer processors when you initiate a financial transaction.
• Identity verification services: Data returned to kbaji by third-party KYC and identity verification service providers used to confirm the authenticity of documents submitted during the verification process.
• Fraud and AML screening services: Risk signal data provided by third-party anti-fraud and anti-money-laundering screening platforms used by kbaji to evaluate the risk profile of account activity.
• Game providers: Session and outcome data passed to kbaji by integrated game providers such as Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe in connection with your game activity on the platform.

Why We Use Your Data

kbaji uses the personal data it collects for specific, defined purposes. We do not use your data for any purpose that is incompatible with the purposes stated at the time of collection. The primary purposes for which kbaji processes personal data are as follows:

• Account creation and management: To register your account, maintain your account profile, and provide you with access to kbaji's full range of betting and gaming services.
• Identity verification and KYC compliance: To verify that you meet the minimum age requirement of 21 years, to confirm your identity, and to fulfil our obligations under applicable anti-money-laundering and know-your-customer regulatory requirements.
• Payment processing: To process your deposit and withdrawal transactions accurately and securely via your chosen payment method, including bKash, Nagad, Rocket, Upay, and bank transfers.
• Service delivery: To make available our sports betting markets (including BPL, IPL, T20 World Cup, and international cricket), casino games, slot games, crash games, and live dealer tables — and to settle bets and game outcomes correctly.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent account activity, unauthorised access, money laundering, bonus abuse, collusion, and other prohibited conduct as defined in our Terms & Conditions.
• Customer support: To respond to your enquiries, manage support tickets, and resolve disputes relating to your account, transactions, or gaming activity.
• Responsible gaming: To monitor your account for indicators of problematic gambling behaviour, to apply deposit limits, session limits, cooling-off periods, or self-exclusion measures at your request, and to provide responsible gaming guidance where appropriate.
• Legal and regulatory compliance: To comply with applicable legal obligations including AML reporting requirements, law enforcement requests, and data retention mandates.
• Marketing and promotions: To send you information about kbaji promotions, seasonal offers (such as those related to Eid, Pohela Boishakh, or BPL season), and platform updates — where you have provided consent to receive such communications. You may opt out of marketing communications at any time.
• Platform analytics and improvement: To analyse how users interact with the kbaji platform in order to improve the user experience, optimise performance, and develop new features and product offerings.

Legal Bases for Processing

kbaji processes your personal data only where a valid legal basis exists for doing so under internationally recognised data protection standards. The legal bases on which kbaji relies are:

5.1 Contractual Necessity

Processing is necessary for the performance of the contract between you and kbaji — specifically, to create and operate your account, process your transactions, settle your bets, and provide you with access to the full range of kbaji services. Without this processing, kbaji would be unable to provide the services you have registered to use.

5.2 Legal Obligation

Processing is necessary for kbaji to comply with applicable legal obligations, including KYC identity verification requirements, anti-money-laundering obligations, and any mandatory data retention periods imposed by applicable law or our operating licence conditions.

5.3 Legitimate Interests

Processing is necessary for the purposes of kbaji's legitimate business interests, including the detection and prevention of fraud, the security of our platform and user accounts, the analysis of platform usage for the purpose of service improvement, and the management of legal claims and disputes — where these interests are not overridden by your privacy rights.

5.4 Consent

For certain categories of processing — in particular, the sending of marketing communications and the use of non-essential cookies — kbaji relies on your explicit consent as the legal basis. Where your consent is the basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Sharing Your Data

kbaji does not sell your personal data to third parties. We do not share your personal data with external organisations for their own marketing purposes. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose.

6.1 Payment Service Providers

To process your deposits and withdrawals, kbaji shares the minimum necessary financial and identity data with the relevant payment service providers — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and Visa/Mastercard processing networks. These providers are contractually bound to use your data only for the purpose of processing the specific transaction.

6.2 KYC and Identity Verification Providers

To fulfil its KYC obligations, kbaji shares copies of identity documents and associated personal data with certified third-party identity verification service providers. These providers verify the authenticity of the documents submitted and return a verification result to kbaji. They are prohibited from using or retaining your data for any other purpose.

6.3 Game Providers

To enable your access to games supplied by Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, Spribe, and other certified game providers, kbaji shares a limited player session token and account identifier with the relevant provider at the time of game launch. Full identity data is not shared with game providers under normal circumstances.

6.4 Regulatory and Law Enforcement Authorities

kbaji may be required to disclose personal data to regulatory bodies, law enforcement agencies, financial intelligence units, or other government authorities where required by applicable law, court order, or regulatory directive. kbaji will comply with all legally valid requests for data disclosure and will, where permitted by law, notify the affected user of any such disclosure.

6.5 Fraud Prevention and AML Screening Services

kbaji shares transaction and account data with third-party anti-fraud and anti-money-laundering screening services that help kbaji identify and prevent suspicious activity on the platform. These services process data on kbaji's behalf under strict data processing agreements.

6.6 Corporate Transactions

In the event that kbaji undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to data processing practices that results from it.

Cookies & Tracking Technologies

kbaji uses cookies and similar technologies (including local storage objects and pixel tags) on its platform to support the delivery of core functionality, improve the user experience, and — with your consent — to analyse usage patterns and deliver relevant promotional content.

7.1 Types of Cookies Used

7.2 Managing Cookie Preferences

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may affect the functionality of the kbaji platform and could prevent you from accessing certain features, including your account login. Disabling analytics or marketing cookies will not prevent you from using the platform.

To withdraw consent for analytics or marketing cookies, you may update your preferences through the kbaji platform settings dashboard, or by contacting our support team at [email protected].

Data Retention

kbaji retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods applied to different categories of data are summarised below.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual. Where data has been anonymised in this manner, the resulting anonymised dataset is no longer subject to the terms of this Privacy Policy.

Data Security

kbaji takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the kbaji platform, ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Encryption at rest for sensitive data fields stored in kbaji's databases, including identity document images, financial account details, and KYC records.
• Access controls that restrict internal access to personal data to only those kbaji employees and contractors who require it to perform their authorised functions. All access is governed by a principle of least privilege and is subject to regular audit.
• Multi-factor authentication for all kbaji internal system access, preventing unauthorised use of employee credentials to access personal data.
• Intrusion detection and monitoring systems that continuously monitor the kbaji infrastructure for anomalous activity, attempted breaches, and unauthorised access attempts.
• Regular security assessments including penetration testing and vulnerability scanning of the kbaji platform and supporting infrastructure.
• Staff data protection training to ensure that all personnel handling personal data understand their obligations and apply data protection principles consistently.

In the event of a personal data breach that poses a risk to your rights and freedoms, kbaji will take prompt remedial action and will notify affected users as soon as reasonably practicable. kbaji will also report material data breaches to relevant authorities as required under applicable law.

International Data Transfers

kbaji is an international offshore platform and its infrastructure, data processing systems, and certain third-party service providers may be located in countries other than Bangladesh. As a result, your personal data may be transferred to, stored in, and processed in jurisdictions outside of Bangladesh.

Wherever personal data is transferred internationally, kbaji takes all reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy. Such safeguards may include contractual data protection clauses incorporated into agreements with third-party processors, or reliance on the recipient jurisdiction's adequacy determination under applicable international data protection frameworks.

By using the kbaji platform and providing your personal data, you acknowledge that your data may be transferred and processed internationally in the manner described above. If you have questions about the specific safeguards applied to international transfers involving your data, please contact [email protected].

Your Rights

Subject to applicable law and the limitations inherent in operating a regulated gambling platform, kbaji recognises the following rights of individuals with respect to their personal data:

11.1 Right of Access

You have the right to request a copy of the personal data that kbaji holds about you, along with information about how that data is being used. Access requests will be responded to within 30 days of receipt, subject to identity verification.

11.2 Right to Rectification

You have the right to request correction of any personal data that kbaji holds about you that is inaccurate or incomplete. Where the data in question is used to verify your identity for KYC purposes, corrected data may need to be re-verified before it is applied to your account.

11.3 Right to Erasure

You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis for processing applies. Please note that kbaji is subject to mandatory data retention obligations (see Section 8) that will override erasure requests in many cases, particularly for financial and KYC records.

11.4 Right to Restriction of Processing

You have the right to request that kbaji restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing based on legitimate interests.

11.5 Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to kbaji in a structured, commonly used, machine-readable format, and to request that kbaji transmit that data directly to another controller where technically feasible.

11.6 Right to Object

You have the right to object to the processing of your personal data where kbaji relies on legitimate interests as the legal basis for processing. You also have an absolute right to object to the use of your data for direct marketing purposes at any time, with no need to justify your objection.

11.7 Rights Related to Automated Decision-Making

kbaji may use automated systems to make certain decisions in relation to your account — for example, automated fraud detection flags or AML risk scoring. Where such automated decision-making produces a legally significant or similarly significant effect on you, you have the right to request human review of the decision, to express your point of view, and to contest the outcome.

Children's Privacy

The kbaji platform is strictly intended for adults aged 21 years and above. kbaji does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register an account on kbaji or use any of its services, and you must not submit any personal data to kbaji through any channel.

If kbaji becomes aware that personal data has been collected from an individual under the age of 21, it will take immediate steps to delete that data and close the associated account. If you have reason to believe that a person under the age of 21 has submitted personal data to kbaji, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

Third-Party Links

The kbaji platform may contain references to third-party services — for example, payment processors such as bKash, Nagad, and Rocket, or game providers such as Evolution Gaming, Pragmatic Play, and Spribe. While kbaji takes care to work only with reputable partners, we do not control the privacy practices of third-party services and are not responsible for their data handling. Each third-party service operates under its own privacy policy, and we encourage you to review those policies before submitting personal data to any third-party service.

kbaji does not host third-party advertising banners or affiliate tracking pixels on its platform that would result in your browsing data being shared with external advertising networks. Any integrations with third-party services are limited to those strictly necessary for the operation of the kbaji platform and are subject to data processing agreements as described in Section 6.

Changes to This Policy

kbaji reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the Policy, we will update the "Effective Date" and "Last Updated" indicators at the top of this page, and we will notify registered users via email or via a notice displayed on the platform at the time of login.

Your continued use of the kbaji platform following notification of any changes to this Policy constitutes your acceptance of those changes. If you do not agree with the revised Policy, you should close your account and discontinue your use of the platform. We encourage you to review this Privacy Policy periodically to stay informed of how kbaji is protecting your personal data.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which kbaji processes your personal data, please contact our support team using the details below. kbaji is committed to responding to all privacy-related enquiries promptly and transparently.

When submitting a privacy enquiry or a data rights request by email, please include your registered account username and the email address associated with your kbaji account to help us locate your records and verify your identity efficiently. Do not include your password or full payment account numbers in any correspondence.