sbajee Privacy
Policy

1. Introduction

sbajee is committed to protecting the privacy and personal data of every player and visitor on its platform. We recognise that trust is foundational to the relationship between a player and an online gaming operator, and we take our obligations in respect of data protection seriously.

This Policy applies to all personal data processed by sbajee in connection with the operation of the sbajee platform, including data collected during account registration, during the sbajee Login process, during payment transactions, during gameplay, and through your interactions with our customer support team.

This Policy should be read together with the sbajee Terms & Conditions and our Responsible Gaming Policy. In the event of a conflict between this Policy and any other sbajee document regarding privacy matters, this Policy shall take precedence.

2. Data Controller

For the purposes of this Policy, sbajee acts as the data controller in respect of all personal data collected from players and visitors on the sbajee platform. As data controller, sbajee determines the purposes and means of processing personal data collected through the Platform.

You may contact sbajee's data protection point of contact at any time by emailing [email protected] with the subject line "Data Protection Enquiry". We aim to respond to all data-related enquiries within five business days (Bangladesh Standard Time, UTC+6).

3. Personal Data We Collect

sbajee collects personal data in the following categories:

3.1 Identity and Contact Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used for age verification — sbajee is strictly 18+ only)
• Residential address, city, and postal code (used for KYC verification)
• Mobile phone number registered in your name
• Email address used for account communications

3.2 Account and Authentication Data

• sbajee Login username chosen during registration
• Password (stored only as a salted cryptographic hash — sbajee never stores plaintext passwords)
• Account creation date and timestamp
• Login history including IP addresses, device types, and timestamps

3.3 Financial and Transaction Data

• Deposit and withdrawal amounts in Bangladeshi Taka (BDT)
• Payment method identifiers (e.g., bKash account number, Nagad number, Rocket number, last four digits of Visa or Mastercard) — full card numbers are never stored by sbajee
• Transaction reference numbers and timestamps
• Bonus claims, wagering activity, and promotional participation records

3.4 Gameplay and Behavioural Data

• Games played, bet amounts, win and loss records, and session durations
• Sports betting selections, odds accepted, and settlement outcomes
• Responsible gaming tool usage (deposit limits set, cooling-off periods activated, self-exclusion requests)
• In-platform chat and customer support interaction records

3.5 Technical and Device Data

• IP address and approximate geolocation derived from IP
• Browser type, version, and operating system
• Device identifiers (where permitted by your device settings)
• Referring URL and on-site navigation path data
• Cookie identifiers (see Section 10 for full cookie details)

3.6 Identity Verification (KYC) Documents

• Scanned or photographed copies of government-issued photo ID (National ID Card, Passport, or Driving Licence)
• Proof of address documents (utility bill, bank statement, or official government correspondence)
• Proof of payment method ownership where required for withdrawal processing

4. How We Collect Your Data

sbajee collects personal data through the following means:

• Direct submission: Data you provide when creating your account, completing the KYC verification process, submitting a deposit or withdrawal request, or contacting customer support.
• Automated collection: Data collected automatically when you access the Platform, including technical and device data recorded by our servers and analytics systems during each session.
• Third-party verification providers: Where sbajee uses specialist KYC and identity verification partners to validate documents you have submitted, those partners may provide additional data points to confirm your identity.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard payment gateways when you initiate a deposit or withdrawal.
• Game content providers: Gameplay data including bet history and session records provided by our certified game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others).

5. How We Use Your Personal Data

sbajee uses your personal data only for the purposes set out in the table below. We do not use your data for any purpose incompatible with the reason it was originally collected without first obtaining your explicit consent.

6. Legal Basis for Processing

sbajee processes your personal data on one or more of the following legal grounds:

• Contractual necessity: Processing required to fulfil our obligations to you under the sbajee Terms & Conditions, including account management, transaction processing, and customer support.
• Legal obligation: Processing required to comply with applicable anti-money laundering regulations, identity verification requirements, and financial record-keeping obligations.
• Legitimate interests: Processing necessary for sbajee's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent, such as sending promotional communications or placing non-essential analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Third Parties

7.1 Service Providers

sbajee shares personal data with carefully selected third-party service providers who process data on our behalf and under our documented instructions. These include identity verification and KYC providers, payment gateway operators (bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing partners), game content providers, cloud infrastructure providers, and customer support platform vendors. All such providers are contractually bound to process your data only for the purposes specified by sbajee and to maintain appropriate security standards.

7.2 Legal and Regulatory Disclosure

sbajee may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where we are required to do so by applicable law, court order, or where disclosure is necessary to protect the legal rights of sbajee or to prevent fraud, money laundering, or other criminal activity.

7.3 No Sale of Personal Data

sbajee does not sell, rent, lease, or trade your personal data to third-party marketers, data brokers, or advertising networks. Your personal data is used exclusively for the purposes described in this Policy.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of sbajee's assets, your personal data may be transferred to the successor entity as part of that transaction. sbajee will provide reasonable notice of any such transfer and the privacy protections applicable to your data following the transaction.

8. Data Retention

sbajee retains personal data for the following periods:

• Active account data: Retained for the full duration of your account's active status on the sbajee platform.
• Post-closure retention: Following account closure, sbajee retains identity, KYC, and transaction data for a minimum of five years to comply with anti-money laundering and financial record-keeping obligations. This period may be extended where required by law or where data is relevant to an ongoing investigation or dispute.
• Gameplay and session logs: Retained for a minimum of two years from the date of the relevant session, after which they are anonymised or deleted.
• Customer support records: Retained for three years from the date of the final communication in a support thread, unless the matter is subject to an ongoing dispute or legal proceeding.
• Marketing data: Retained only until you withdraw your consent to marketing communications, at which point your details are removed from active marketing lists within 30 days.

When personal data is no longer required for the purpose for which it was collected and no retention obligation applies, sbajee will securely delete or anonymise the data in accordance with our internal data destruction procedures.

9. Security Measures

sbajee implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data exchanged between your browser or app and sbajee servers is encrypted using TLS 1.2 or higher (256-bit encryption).
• Encryption at rest: Sensitive data fields — including identity documents and payment method identifiers — are encrypted at rest using AES-256.
• Password security: User passwords are never stored in plaintext. sbajee stores only bcrypt-hashed, salted password representations. Staff members do not have access to your password.
• Access controls: Access to production systems and personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for administrative systems.
• Regular security reviews: sbajee conducts periodic internal security reviews and vulnerability assessments to identify and remediate potential weaknesses in the platform.
• Incident response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, sbajee will notify affected players promptly by email and take all reasonable steps to contain and remediate the incident.

While sbajee applies robust security standards, no system is entirely immune to risk. You are responsible for maintaining the security of your sbajee Login credentials and for notifying sbajee immediately if you suspect any unauthorised access to your account.

10. Cookies and Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. sbajee uses cookies and similar technologies (such as local storage and session tokens) to maintain the functionality of the Platform and to understand how players use it.

10.2 Types of Cookies Used by sbajee

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your sbajee Login session state, remember your language preferences, and protect the Platform against cross-site request forgery. These cookies cannot be disabled without affecting platform functionality.
• Analytics Cookies: These cookies collect aggregated, anonymised information about how players navigate the sbajee platform. This data helps sbajee improve the user experience and optimise game discovery. Analytics cookies are placed only where you have provided consent.
• Preference Cookies: These cookies remember choices you have made on the Platform — such as your preferred game category or display settings — so that you do not need to reconfigure them on each visit.

10.3 Managing Cookies

You may control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the sbajee platform and may prevent you from logging in or completing transactions. Detailed guidance on managing cookies is available through your browser's help documentation. sbajee does not respond to "Do Not Track" browser signals at this time.

11. Your Data Rights

Subject to applicable law, you have the following rights in relation to the personal data sbajee holds about you:

• Right of Access: You may request a copy of all personal data sbajee holds about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. For account-level corrections, you may update certain fields directly through your account settings after sbajee Login.
• Right to Erasure: You may request deletion of your personal data where retention is no longer necessary for the original collection purpose and where no legal retention obligation applies. Note that regulatory obligations may require sbajee to retain certain data even after account closure.
• Right to Restriction: In certain circumstances, you may request that sbajee restrict the processing of your personal data — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that sbajee provide your personal data in a structured, machine-readable format.
• Right to Object: Where processing is based on legitimate interests, you have the right to object to that processing. sbajee will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time by contacting support or updating your account preferences. Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.

To exercise any of the above rights, please contact sbajee at [email protected] with the subject line "Data Rights Request – [Your Username]". We may request verification of your identity before processing the request to protect against unauthorised access to your data.

12. Minors and Under-18 Protection

The sbajee platform is strictly intended for adults aged 18 years and above. sbajee does not knowingly collect personal data from individuals under the age of 18. If you are under 18, you must not register an account, attempt sbajee Login, or use the Platform in any capacity.

If sbajee discovers or has reasonable grounds to believe that a registered account is held by or has been used by an individual under the age of 18, we will immediately suspend the account, void any outstanding balances derived from gameplay, and permanently close the account. Any personal data collected in connection with an underage account will be deleted in accordance with our data retention procedures.

If you are a parent or guardian and believe that a minor in your care has registered on the sbajee platform, please contact us immediately at [email protected] so that we can take appropriate action.

13. Changes to This Privacy Policy

sbajee reserves the right to update or amend this Privacy Policy at any time. When a material change is made, sbajee will notify registered players by email to the address on file and will display a prominent notice on the Platform upon next sbajee Login. The updated Policy will take effect from the date of publication at sbajee.bid/privacy-policy.

Your continued use of the sbajee platform following publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must discontinue use of the Platform and contact sbajee support to request account closure.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to sbajee's data processing practices, please contact our support team using the details below. All data protection enquiries are handled by our dedicated compliance team.

• Email: [email protected] — subject line: "Privacy Policy Enquiry"
• Live Chat: Available through the sbajee platform following sbajee Login, 24 hours a day, 7 days a week
• Response Time: Email responses within 5 business days; urgent data breach notifications within 72 hours (Bangladesh Standard Time, UTC+6)

sbajee is committed to resolving all privacy-related concerns promptly and transparently. If you are not satisfied with our response, you retain the right to escalate your complaint to the appropriate data protection authority in your jurisdiction.