badbaji Privacy Policy

badbaji collects personal data through several channels: directly from you when you register or contact us, automatically as you use the platform, and in some cases from trusted third-party service providers. We only collect information that is genuinely necessary for the purposes described in this Privacy Policy.

1.1 Information You Provide Directly

When you create a badbaji account, use our services, or contact our support team, you voluntarily provide us with information such as:

• Registration details: your full legal name, date of birth, Bangladeshi mobile number, and any other fields required during account creation.
• Identity verification documents: copies of your National Identity Card (NID), passport, or birth certificate submitted as part of our Know Your Customer (KYC) process.
• Payment information: your bKash, Nagad, Rocket, or Upay mobile wallet number, or bank account details for BRAC Bank, City Bank, Dutch-Bangla Bank, Islami Bank, or Sonali Bank — as relevant to the payment method you choose. We do not store full card numbers for Visa or Mastercard transactions; these are tokenised by our payment processor.
• Support communications: the content of any messages, complaints, or enquiries you submit to our customer support team via live chat or email.
• Responsible gaming self-declarations: any deposit limits, time-out requests, or self-exclusion elections you make within your account settings.

1.2 Information Collected Automatically

When you access badbaji, our servers and analytics systems automatically record certain technical data:

• Device and browser data: device type, operating system, browser version, screen resolution, and language preference.
• Network data: IP address, approximate geographic location derived from IP, and internet service provider (ISP) identifier.
• Usage data: pages visited, time spent on each page, game sessions initiated, bets placed, deposit and withdrawal events, and navigation paths through the platform.
• Session data: login timestamps, session duration, and logout events.
• Cookie and tracking data: as described in detail in Section 5 (Cookies & Tracking) of this policy.

1.3 Information From Third Parties

In limited circumstances, badbaji may receive personal data about you from third parties, including:

• Payment providers: transaction confirmation data from bKash, Nagad, Rocket, or Upay confirming that a deposit or withdrawal was processed successfully.
• Identity verification services: where we engage a specialist KYC provider to cross-check your submitted documents against authoritative data sources.
• Fraud and risk management providers: risk scoring data to help us identify potentially fraudulent account registrations or suspicious financial activity.

The following table summarises the main categories of data we collect and their purpose:

badbaji uses the personal data it collects for clearly defined purposes. We do not use your data in ways that would be incompatible with the purposes stated at the time of collection. The primary purposes for which we process your personal data are as follows:

• Account creation and management: to register your account, authenticate your identity at login, and maintain your account in good standing.
• Service delivery: to process your bets, credit your winnings, execute deposit and withdrawal transactions, and provide access to all games and features on the badbaji platform.
• Identity and age verification: to verify that you are who you say you are and that you are at least 18 years of age, as required by our Terms & Conditions and responsible gaming obligations.
• Fraud prevention and security: to detect, investigate, and prevent fraudulent registrations, money laundering, bonus abuse, identity theft, and other forms of prohibited conduct.
• Responsible gaming compliance: to monitor gaming patterns for indicators of problem gambling, enforce deposit limits and self-exclusion periods you have set, and provide proactive support where appropriate.
• Customer support: to respond to your enquiries, resolve disputes, and process formal complaints in accordance with our published complaints procedure.
• Platform improvement: to analyse aggregated, anonymised usage data to improve the performance, reliability, and user experience of badbaji.
• Marketing communications: to send you promotional offers, bonus notifications, and relevant product updates — but only where you have given us your explicit consent to do so, and always with a clear opt-out mechanism included in every communication.
• Legal and regulatory compliance: to fulfil any legal obligations applicable to badbaji's operations, including responding to valid legal process and cooperating with law enforcement requests.

badbaji does not engage in automated decision-making that produces legally significant effects on individual players, other than automated fraud and age verification checks which are subject to human review upon request.

badbaji processes your personal data on one or more of the following legal grounds depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and badbaji — for example, processing your deposit so you can place a bet, or verifying your identity so we can pay out your winnings.
• Legitimate interests: Processing necessary for badbaji's legitimate business interests, such as detecting fraud, maintaining platform security, and improving the service — provided those interests are not overridden by your own rights and interests.
• Legal obligation: Processing required to comply with applicable legal or regulatory requirements, such as anti-money-laundering record-keeping obligations or responding to valid court orders.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — in particular, sending you marketing and promotional communications. You may withdraw your consent at any time by contacting support@badbaji or updating your communication preferences within your account settings.

Where badbaji relies on consent as the legal basis for a processing activity, withdrawal of that consent will not affect the lawfulness of any processing carried out prior to your withdrawal.

badbaji does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose.

4.1 Service Providers

We engage carefully selected third-party service providers who process data on our behalf and under our instruction. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, and banking partners who facilitate deposit and withdrawal transactions. They receive only the minimum data necessary to process each transaction.
• KYC and identity verification providers: specialist companies that assist with document verification and age checks. They are contractually bound to use your data only for the verification service they provide to badbaji.
• Game studio providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studios whose games are integrated into badbaji. These providers may receive session data required to run the game (e.g., player session token, currency, bet amount). They do not receive your full identity or payment details.
• Fraud and risk management providers: companies that provide risk-scoring and device fingerprinting services to help us identify suspicious activity.
• Cloud infrastructure providers: secure data centre and hosting providers on whose infrastructure badbaji's platform runs.

4.2 Legal and Regulatory Disclosures

badbaji may disclose your personal data to law enforcement agencies, regulatory authorities, or courts where we are required to do so by valid legal process, court order, or applicable law. Where permitted, we will notify you of such a disclosure.

4.3 Business Transfers

In the event that badbaji undergoes a merger, acquisition, or sale of all or a substantial portion of its assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms of the successor entity via your registered contact details.

4.4 No Sale of Data

badbaji uses cookies and similar tracking technologies to operate the platform effectively, enhance your user experience, and gather analytics data that helps us improve our service. A cookie is a small text file stored on your device by your browser when you visit badbaji.

5.1 Types of Cookies We Use

5.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can configure your browser to refuse all cookies, accept only certain types, or delete existing cookies. Please note that disabling strictly necessary or fraud-prevention cookies may prevent you from logging in or using badbaji's core features. Instructions for managing cookies on common browsers are available in each browser's help documentation.

badbaji does not use cookies to serve third-party advertising or to build marketing profiles that are sold or shared with advertisers.

badbaji retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulatory standards. The following general retention principles apply:

• Active account data: retained for the full duration of your account's active status plus a period of up to 5 years after account closure, to satisfy anti-money-laundering record-keeping obligations and to handle any post-closure disputes or legal claims.
• KYC documents: retained for a minimum of 5 years from the date of verification, or longer if required by applicable law or ongoing investigation.
• Transaction records: deposit, withdrawal, bet, and win records are retained for a minimum of 5 years from the date of each transaction.
• Support communications: retained for 3 years from the date of the last interaction, unless the subject matter relates to an unresolved legal claim or formal complaint.
• Marketing consent records: retained for the duration of your consent, plus 2 years from the date of withdrawal to evidence that your consent was validly obtained and that we ceased communications promptly upon withdrawal.
• Technical logs: server access logs and security event logs are retained for 12 months on a rolling basis before being securely deleted.

When data is no longer required under the above retention schedule, it is securely deleted or irreversibly anonymised so that it can no longer be linked to an individual player.

badbaji respects your right to control your own personal data. As a player on our platform, you hold the following rights in relation to the personal data we hold about you:

• Right of Access: You may request a copy of the personal data badbaji holds about you at any time. We will respond to verified access requests within 30 days.
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it. Minor profile details (such as a change of registered mobile number) can be updated directly within your account settings.
• Right to Erasure: You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other lawful ground for processing applies. Note that this right is subject to exceptions — in particular, we are required to retain certain financial and identity records for a minimum of 5 years for legal compliance reasons, and these cannot be erased upon request during that retention period.
• Right to Restrict Processing: In certain circumstances (for example, while a dispute regarding data accuracy is being investigated), you may request that we restrict our processing of your personal data to storage only.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to the processing of your personal data on the grounds of legitimate interests, or to the use of your data for direct marketing purposes. We will cease direct marketing processing immediately upon receipt of an objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of marketing consent can be done via your account settings or by contacting support@badbaji.

To exercise any of the above rights, please contact our support team via live chat or send a written request to support@badbaji with the subject line "Privacy Rights Request". We will verify your identity before processing any request and will respond within 30 days. For complex or multiple requests, this period may be extended by up to a further 30 days, of which we will notify you.

badbaji employs industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption: all data transmitted between your device and badbaji's servers is protected by bank-grade SSL/TLS encryption, indicated by the padlock icon in your browser's address bar.
• Encrypted data storage: sensitive data fields — including identity document images, KYC records, and payment method details — are encrypted at rest using AES-256 encryption on our secure servers.
• Access controls: access to personal data within badbaji is restricted on a strict need-to-know basis. Staff who access player data are subject to confidentiality obligations and role-based access controls.
• Fraud monitoring: automated systems monitor login activity, device changes, and financial transactions in real time for anomalies that may indicate account takeover or fraudulent activity.
• Regular security reviews: badbaji's technical infrastructure undergoes periodic security assessments to identify and remediate vulnerabilities.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, badbaji will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

As part of our account registration and KYC processes, badbaji takes active steps to verify that all players are aged 18 or above before they can deposit funds or place bets. If badbaji becomes aware — through KYC review, self-disclosure, or a third-party notification — that an account has been registered by or on behalf of a person under 18, that account will be immediately suspended, all relevant data will be securely deleted or returned, and any deposited funds will be refunded to the payment method used.

If you are a parent or guardian and believe your child has created an account on badbaji, please contact us immediately at support@badbaji and we will act on your notification without delay. For guidance on protecting minors from accessing gambling platforms, please review our Responsible Gaming page.

badbaji reserves the right to update, amend, or replace any part of this Privacy Policy at any time to reflect changes in applicable law, new data processing activities introduced by platform updates, or improvements to the clarity of our existing disclosures.

When material changes are made to this Privacy Policy, we will notify registered players via their registered mobile number or email address, or via a prominently displayed notice on the badbaji platform upon login. The updated policy will be published on this page with a revised "Last Updated" date at the top of the document.

Your continued use of badbaji following the notification of any changes to this Privacy Policy constitutes your acknowledgement of those changes. If you do not agree with the revised policy, you must stop using badbaji and may request account closure by contacting support@badbaji. Transactions completed and data collected prior to the effective date of any amendment will continue to be governed by the policy in force at that time.

We recommend revisiting this page periodically to stay informed about how badbaji protects your personal data. If any provision of this Privacy Policy is unclear, our support team is available 24 hours a day, 7 days a week to provide plain-English clarification.