x bhaji Privacy Policy
At x bhaji, protecting the personal information of our Bangladesh players is a core commitment — not an afterthought. This Privacy Policy explains in plain terms exactly what data we collect, why we collect it, how we use and store it, who we may share it with, and what rights you hold over your own information.
Our Privacy Commitments
Six principles guide how x bhaji handles every piece of information you share with us. These are our non-negotiable standards.
SSL Encryption on Every Page
All data exchanged between your browser or mobile device and x bhaji is protected by industry-standard SSL/TLS encryption. This applies to account logins, payment transactions, personal data updates, and all API communications — no exceptions.
Your Data Is Never Sold
x bhaji does not sell, rent, or trade your personal information to third-party marketers. When we share data with external partners — such as payment processors or KYC verification services — it is strictly for operational necessity, not commercial gain, and those partners are contractually bound to confidentiality.
Purpose Limitation
We collect only what we need and use it only for the purpose it was collected. Your mobile number is used to verify your account and process bKash or Nagad transactions — not to send you unsolicited promotions. Your NID image is used for age and identity verification only.
You Control Your Data
You have the right to access, correct, export, and request deletion of your personal data at any time by contacting our support team. We will respond to verified data requests within 14 days of receipt.
Defined Retention Periods
We do not hold your data indefinitely. Retention periods are tied to the purpose for which data was collected — active account data is kept while your account is open, and most records are purged within 5 years of account closure, subject to legal obligations.
Responsible Gaming Privacy
Data relating to your responsible gaming settings — including any self-exclusion periods, deposit limits, or session reminders you activate — is treated with the highest level of confidentiality and is never used for marketing profiling or shared with third parties outside mandatory regulatory reporting.
1. Data We Collect
x bhaji collects personal information in order to operate a safe, compliant, and enjoyable online casino and sports betting platform for players in Bangladesh. We collect data through three primary channels: information you provide directly during registration and account use, information we gather automatically as you use the Platform, and information received from trusted third-party service providers.
Information You Provide Directly
When you create an x bhaji account or interact with our Platform, you may provide the following categories of personal data:
| Data Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, Bangladesh National ID (NID) number, NID scan or image, passport or driving licence (where submitted as an alternative) | Account registration and KYC verification |
| Contact Data | Bangladesh mobile phone number, email address, residential district or city (e.g., Dhaka, Chittagong, Sylhet, Khulna) | Account registration and profile updates |
| Financial Data | bKash account number, Nagad number, Rocket number, Upay number, bank account details (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank), Visa/Mastercard card details (last 4 digits only — full card numbers are not stored) | Deposit and withdrawal processing |
| Account Credentials | Username, hashed password (we never store plaintext passwords), security preferences | Account registration and x bhaji Login |
| Communications | Content of messages sent to our support team, including any attachments or screenshots you voluntarily share | Customer support interactions |
| Responsible Gaming Preferences | Self-exclusion periods, deposit limit settings, session time reminders, cooling-off periods | Responsible Gaming tools activation |
Information Collected Automatically
When you access x bhaji through a web browser or mobile device, certain technical and behavioural data is collected automatically. This information helps us secure the Platform, detect fraud, improve game performance, and personalise your experience:
- Device and technical data: IP address, device type, operating system version, browser type and version, screen resolution, device identifiers.
- Usage data: Pages visited, games played, bet amounts and frequency, session start and end times (recorded in Bangladesh Standard Time, BST UTC+6), in-game actions, and navigation paths through the site.
- Location data: Approximate geographic location derived from your IP address (country and city level). We do not collect precise GPS location data.
- Cookie and tracking data: See Section 4 (Cookies & Tracking) for a full breakdown of how cookies are used on the Platform.
Information From Third Parties
In certain circumstances x bhaji receives personal data about you from third-party sources. This includes identity verification data returned by KYC/AML service providers after you submit your NID or passport for verification, transaction confirmation data from payment processors (bKash, Nagad, Rocket, Upay, and banking partners), and fraud-risk signals from security service providers. We use this data solely for the purposes described in Section 2 and do not combine it with data purchased from external marketing databases.
Minimum Data Principle: x bhaji applies a minimum data principle — we collect only the personal data that is strictly necessary for each stated purpose. We do not request information that is irrelevant to operating your account, processing your transactions, or complying with our legal obligations.
2. How We Use Your Data
x bhaji uses your personal data exclusively for the purposes set out in this section. We rely on one or more of the following legal bases for each processing activity: (a) performance of the contract between you and x bhaji; (b) compliance with a legal obligation; (c) our legitimate interests in operating a secure and commercially sustainable platform; or (d) your explicit consent where required.
Account Management and Service Delivery
Your identity, contact, and credential data are used to create and manage your x bhaji account, authenticate your identity at x bhaji Login, process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and banking channels, maintain your BDT wallet balance and transaction history, credit bonuses to your account, and enable access to our full catalogue of casino games and sportsbook markets. This processing is necessary for the performance of the contract between you and x bhaji.
KYC, Age Verification, and Fraud Prevention
We use identity data, financial data, and device data to verify that you are aged 18 or above as required under our platform rules and responsible gaming policy, confirm that the payment methods you use are registered in your own name, detect and prevent fraudulent activity, multi-accounting, bonus abuse, and money laundering, and comply with anti-money-laundering (AML) obligations. This processing is based on legal obligation and legitimate interests.
Customer Support
Data contained in your support communications — including your account details, transaction records, and any documents you share — is used to investigate and resolve queries, disputes, or complaints you raise with our support team. Our support team operates 24/7 on Bangladesh Standard Time and communicates exclusively in English. This processing is based on contract performance and legitimate interests.
Platform Security and Technical Operations
Device data, IP addresses, and usage logs are processed to monitor the Platform for security threats, investigate suspected unauthorised account access, perform load balancing and infrastructure management, diagnose technical faults, and ensure game integrity. This is a legitimate interest processing activity.
Promotions and Marketing Communications
If you have opted in to marketing communications during registration or at a later date, x bhaji may use your contact data (email address and mobile number) to send you information about new games, deposit bonus offers, seasonal promotions (such as Eid, Pohela Boishakh, or BPL cricket season offers), and platform updates. You may opt out of marketing communications at any time by contacting [email protected]. Opting out of marketing does not affect your ability to use the Platform. This processing is based on your consent.
Responsible Gaming Monitoring
x bhaji uses behavioural and usage data — including betting frequency, session length, deposit patterns, and game type preferences — to identify indicators of potentially harmful gambling behaviour. Where our systems or support team identify such indicators, we may proactively reach out to offer responsible gaming tools or information. This processing is a legitimate interest activity conducted in the best interests of our players. See our Responsible Gaming page for full details.
No Automated Decision-Making With Legal Effect: x bhaji does not make decisions that have a significant legal or financial effect on you solely through automated processing without any human review. Where automated systems flag an account for investigation (e.g., for suspected fraud), a member of our team reviews the case before any account action is taken.
3. Data Sharing & Third Parties
x bhaji does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary to fulfil the stated purpose.
Payment Processors
In order to process your deposits and withdrawals, x bhaji must share relevant financial and identity data with the payment service providers you select. These include bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Data shared is limited to what each provider requires to authorise and complete the transaction. These providers operate under their own privacy policies and are independently responsible for how they handle data within their systems.
Identity Verification and KYC Providers
x bhaji uses specialist third-party KYC and AML service providers to verify the identity and age of players. When you submit your NID, passport, or other identity documents, that data is transmitted securely to our verification partner for processing. Verification providers are contractually bound to use your identity data solely for the purpose of returning a verification result to x bhaji and are prohibited from retaining or repurposing your documents.
Technology and Infrastructure Partners
Our Platform is supported by cloud hosting providers, content delivery networks, cybersecurity services, and game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi). These partners may process limited technical data — such as IP addresses and session tokens — in the course of delivering their services to x bhaji. All technology partners are required to operate under data processing agreements that restrict their use of your data.
Legal and Regulatory Disclosure
x bhaji may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity. In such cases, we disclose only what is legally required and, where permitted, will notify the affected account holder.
Business Transfers
In the event that x bhaji undergoes a merger, acquisition, or sale of all or a substantial part of its assets, player account data may be transferred to the acquiring entity as part of that transaction. In such circumstances, the receiving entity will be bound by the terms of this Privacy Policy or an equivalent policy with no lesser protections.
Data Processing Agreements: Every third party that processes personal data on behalf of x bhaji is required to sign a formal data processing agreement before receiving any player data. These agreements specify the purpose of processing, prohibited uses, security standards, and breach notification obligations. We do not use third-party vendors who are unwilling to accept these contractual obligations.
5. Data Security
x bhaji implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures are reviewed and updated on a regular basis in line with evolving industry standards.
Technical Safeguards
- Transport encryption: All data in transit between your device and x bhaji servers is encrypted using TLS 1.2 or higher.
- Data at rest encryption: Sensitive data fields — including identity document images, financial account references, and KYC records — are encrypted at rest using AES-256.
- Password hashing: Account passwords are never stored in plaintext. We use industry-standard cryptographic hashing with salting so that even in the event of a data breach, raw passwords are not exposed.
- Access controls: Access to production systems and player data is restricted to authorised personnel on a strictly need-to-know basis, enforced through role-based access controls and multi-factor authentication for internal staff.
- Intrusion detection: Our infrastructure is monitored 24/7 by automated systems designed to detect and alert on anomalous access patterns, injection attempts, and distributed attacks.
- Regular security audits: x bhaji engages independent security professionals to conduct periodic penetration tests and vulnerability assessments of the Platform.
Organisational Safeguards
- All x bhaji staff with access to personal data are required to complete data protection training and are bound by confidentiality obligations in their employment or contractor agreements.
- Access logs for sensitive data systems are retained and reviewed regularly to detect any unauthorised internal access.
- Third-party vendors are assessed for security compliance before being granted access to x bhaji systems or player data.
Data Breach Response
In the event of a personal data breach that poses a risk to affected players, x bhaji will notify impacted account holders via their registered email address as promptly as possible, and no later than 72 hours after we become aware of the breach. Notifications will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps x bhaji has taken or will take to mitigate the impact. Players who believe their account has been compromised should contact [email protected] immediately.
Your Role in Account Security: x bhaji's technical safeguards protect the data on our side, but your account security also depends on you. Use a strong, unique password for your x bhaji Login that you do not reuse on other sites. Never share your login credentials with anyone. x bhaji support staff will never ask for your password. If you access x bhaji from a shared device (e.g., at a cyber café in Dhaka or Chittagong), always log out completely after your session.
6. Data Retention
x bhaji retains personal data for as long as is necessary to fulfil the purpose for which it was collected, to comply with our legal obligations, and to resolve any disputes or enforce our agreements. The following retention schedule summarises our approach:
| Data Category | Retention Period | Basis |
|---|---|---|
| Active Account Data | For the full duration the account remains open and active | Contract performance |
| KYC / Identity Documents | 5 years from account closure | Legal obligation (AML compliance) |
| Transaction Records | 5 years from the date of each transaction | Legal obligation (financial record-keeping) |
| Betting / Gaming History | 3 years from account closure | Legitimate interests (dispute resolution) |
| Support Communications | 2 years from the date of the last message in each thread | Legitimate interests (complaint history) |
| Marketing Consent Records | Until you withdraw consent plus 1 year for audit trail purposes | Legal obligation (consent management) |
| Security and Fraud Logs | 2 years from the date of the logged event | Legitimate interests (security investigations) |
| Responsible Gaming Settings | 5 years from account closure | Legal obligation and player protection |
At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you. Anonymised and aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business analysis purposes.
If you request deletion of your personal data before the end of the applicable retention period, x bhaji will delete all data it is legally permitted to delete and will inform you of any categories of data that must be retained to comply with legal obligations, along with the applicable retention period for each category.
7. Your Privacy Rights
As a player on x bhaji, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Privacy Rights Request" and a clear description of your request. We will acknowledge your request within 3 business days and respond in full within 14 days (or notify you of any extension, which will not exceed a further 14 days).
Right of Access
You may request a copy of all personal data x bhaji holds about you, along with information about how it is processed, who it has been shared with, and how long it will be retained.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where it has been processed unlawfully — subject to legal retention obligations.
Right to Restriction
You may ask x bhaji to restrict the processing of your data — for example, while a rectification request is under review, or while you contest the legal basis on which we process your data.
Right to Data Portability
Where processing is based on your consent or contract performance and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
Right to Object
You may object at any time to processing based on legitimate interests — including responsible gaming monitoring and analytical profiling. You have an absolute right to object to processing for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right to Lodge a Complaint
If you believe x bhaji has handled your personal data in a way that violates applicable privacy law, you have the right to raise a complaint directly with us or with the relevant data protection authority in your jurisdiction.
Verification Required: To protect your privacy and prevent unauthorised access to your data, x bhaji must verify your identity before processing any data rights request. We will ask you to confirm your registered mobile number, email address, and — for sensitive requests — a piece of information only the genuine account holder would know. We will not process rights requests submitted on behalf of an account holder by a third party without evidence of authorisation.
8. Policy Updates & Contact
x bhaji reviews this Privacy Policy at least once per year and whenever there is a material change to how we collect, use, or share personal data. When we make significant updates, we will notify registered Players via on-site notification or by email to their registered address at least 7 days before the changes take effect.
The "Effective Date" at the top of this document reflects the date the most recent version was published. Continued use of the Platform after that date constitutes acceptance of the updated Privacy Policy. If you do not agree with changes to the Privacy Policy, you should close your account by contacting our support team before the effective date of the update.
Minor Changes
Corrections of typographical errors, clarifications that do not alter the substantive meaning of a provision, and updates to contact details are considered minor changes and may be made without advance notice. The effective date will be updated to reflect even these minor amendments.
How to Contact Us About Privacy
If you have any questions, concerns, or complaints about this Privacy Policy or about how x bhaji handles your personal data, please contact our support team — available 24/7 on Bangladesh Standard Time (BST, UTC+6):
- Email: [email protected]
- Subject line: "Privacy Policy Enquiry" or "Privacy Rights Request"
- Response time: Acknowledgement within 3 business days; full response within 14 days
- Support language: English
- Hours: 24/7, Bangladesh Standard Time
You may also visit our FAQ page for answers to common questions about accounts, payments, and data, or our Responsible Gaming page for information about self-exclusion and player protection tools.
Our Commitment: Privacy is not a compliance checkbox at x bhaji — it is a genuine commitment to the players who trust us with their data. We will always be transparent about what we collect and why, respond promptly to your privacy requests, and work continuously to improve our data protection practices. Thank you for choosing x bhaji as your online casino and sports betting platform in Bangladesh.
Your Privacy Is Protected at x bhaji
Explore our full range of casino games and live sports betting with confidence, knowing your personal data is secured and never sold. Questions? Our team is here around the clock.