xbaje Privacy Policy

This Privacy Policy is issued by xbaje, the operator of the online betting and casino platform accessible at xbaje.lat. xbaje is the data controller responsible for the personal information collected from players and visitors who use the xbaje platform. For the purposes of this Policy, "xbaje", "we", "us", and "our" refer to the xbaje platform and its operating entity. "You", "your", and "player" refer to any individual who accesses, registers with, or uses the xbaje platform.

xbaje is designed and operated specifically for players in the Bangladesh market. All customer support, communications, and data processing activities related to Bangladeshi players are handled in English and managed in accordance with Bangladesh Standard Time (BST, UTC+6). Our platform is exclusively available to adults aged 21 and above.

xbaje collects personal data from you through several channels: directly when you register or interact with the platform, automatically when you use the platform, and occasionally from third-party sources as part of our identity verification obligations. The categories of personal data we collect are set out below.

xbaje uses the personal data we collect for the following clearly defined purposes. We will never use your data for a purpose that is incompatible with what is described in this section without first obtaining your consent or providing you with advance notice.

• Account Creation & Management: To register your account, verify your identity, manage your profile, and maintain accurate account records throughout your relationship with xbaje.
• Payment Processing: To process deposits and withdrawals through your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, or linked bank accounts) and to maintain accurate financial transaction records.
• Service Delivery: To provide access to all xbaje platform features including cricket betting markets, live casino games, slots, crash games (Aviator, Monster Dice, Boat of Fortune), and the xbaje VIP Programme.
• Identity Verification & KYC Compliance: To verify that you meet the minimum age requirement (21+) and to satisfy our Know Your Customer (KYC) obligations, which are standard practice for all responsible online betting and gaming operators.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, multi-accounting, and any other activity that violates our Terms & Conditions or applicable law.
• Customer Support: To respond to your enquiries, resolve disputes, and provide ongoing assistance via live chat and email in English, all coordinated on Bangladesh Standard Time (UTC+6).
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, to enforce deposit limits and self-exclusion requests, and to proactively offer responsible gaming tools where appropriate.
• Platform Improvement: To analyse aggregated, anonymised usage data in order to improve platform performance, fix technical issues, and develop new features that better serve Bangladeshi players.
• Legal & Regulatory Compliance: To meet our obligations under applicable laws, including anti-money laundering (AML) regulations, and to cooperate with lawful requests from competent authorities.
• Marketing Communications (with consent only): To send you promotional offers, bonus notifications, and platform news by email or SMS — but only where you have given your explicit consent to receive such communications. You may withdraw consent at any time by updating your notification preferences in your account settings or by contacting support.

xbaje processes your personal data on one or more of the following legal grounds, depending on the specific purpose for which the data is being used:

• Contractual Necessity: Processing required to perform the contract between you and xbaje — i.e., to provide the betting and gaming services you have signed up for, process your payments, and manage your account. Without this processing, xbaje cannot deliver its core services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification requirements, AML transaction monitoring obligations, and responding to lawful requests from regulatory authorities or law enforcement agencies.
• Legitimate Interests: Processing necessary for xbaje's legitimate business interests, where those interests are not outweighed by your rights and interests. This includes fraud prevention, platform security, internal analytics for service improvement, and responsible gaming monitoring. We conduct a balancing test before relying on this basis to ensure your privacy interests are appropriately protected.
• Consent: Where we rely on your freely given, specific, informed, and unambiguous consent — primarily for optional marketing communications (email newsletters, promotional SMS). You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

xbaje uses cookies and similar tracking technologies (including local storage, session tokens, and pixel tags) to operate the platform efficiently, remember your preferences, maintain your authenticated session, and analyse how players interact with the site.

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account state during gameplay, and prevent session hijacking. They cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised information about how pages are used, which features are accessed most frequently, and where technical errors occur. This data helps us improve platform stability and user experience for our Bangladeshi player base. No personally identifiable information is contained in analytics cookies.
• Functional Cookies: These remember your language preference (English), your chosen display settings, and other personalisation choices to ensure a consistent experience each time you visit xbaje.
• Security Cookies: Used to detect and mitigate fraudulent activity, bot traffic, and multi-account behaviour. These operate silently in the background and are a fundamental component of our account security infrastructure.

xbaje does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your data only in the limited circumstances described below, and only with parties who are bound by appropriate confidentiality and data protection obligations.

• Payment Service Providers: We share financial data with your chosen payment provider (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard) as strictly necessary to process your deposits and withdrawals. Each provider operates under its own published privacy policy and data protection obligations.
• Game Content Providers: Technical session data (player ID, wager amounts, game results) is shared with our licensed game providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — for the purpose of delivering game content, calculating outcomes, and resolving disputes. These providers are contractually prohibited from using this data for any purpose other than game delivery.
• Identity Verification Partners: KYC verification data (identity documents, selfie photos) is processed by our trusted third-party verification service providers, who are subject to strict contractual data processing agreements and are prohibited from retaining your documents beyond the verification process.
• Legal & Regulatory Authorities: xbaje will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, by a valid court order, or as part of our obligations under anti-money laundering regulations. We will, where legally permitted, notify affected players of such disclosures.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of xbaje's assets, your personal data may be transferred to the acquiring entity. You will be notified via your registered email address at least 30 days in advance of any such transfer, and you will have the right to close your account and request data deletion before the transfer takes effect.
• Fraud Prevention Networks: We may share fraud signals and risk indicators (but not full personal profiles) with industry fraud prevention networks for the purpose of protecting the integrity of the online gaming ecosystem. No detailed personal information is shared in this context.

Some of xbaje's third-party service providers — particularly game content providers and cloud infrastructure partners — may process data in countries outside Bangladesh. Where such international transfers occur, xbaje takes appropriate steps to ensure that your personal data receives an equivalent level of protection to that which it would receive if processed domestically.

Safeguards we use for international transfers include: contractual clauses that impose equivalent data protection obligations on the receiving party; transferring data only to service providers who maintain internationally recognised security certifications; and conducting due diligence assessments of recipient countries' data protection standards before establishing data-sharing relationships.

xbaje retains your personal data for no longer than is necessary to fulfil the purposes for which it was collected, including compliance with applicable legal and regulatory retention obligations. The following retention periods apply:

When retention periods expire, xbaje securely deletes or irreversibly anonymises the relevant data. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and platform improvement purposes.

As a player on the xbaje platform, you have the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via live chat or by emailing [email protected]. We will respond to all rights requests within 30 days of receipt.

xbaje operates a strict 21+ age policy. Our platform is not intended for, directed at, or designed to attract individuals under the age of 21. We do not knowingly collect personal data from any individual under 21 years of age. If we become aware that a minor has registered an account or provided personal data through our platform, we will immediately close that account, void any associated activity, and securely delete all personal data collected from that individual.

If you are a parent or guardian and believe that a person under 21 in your household has created an account or provided personal data to xbaje, please contact us immediately at [email protected]. We take underage access extremely seriously and will act on all such notifications without delay. We also encourage parents and guardians to make use of parental control software to prevent underage individuals from accessing online gambling platforms.

xbaje implements a comprehensive, layered approach to data security to protect your personal and financial information against unauthorised access, alteration, disclosure, or destruction. Our key security measures include:

• 256-bit SSL/TLS 1.3 Encryption: All data transmitted between your device and xbaje's servers is encrypted using industry-standard TLS 1.3 protocol, ensuring that your credentials and financial data cannot be intercepted in transit.
• Password Hashing: Account passwords are never stored in plain text. They are processed through a modern, salted cryptographic hashing algorithm (bcrypt) before storage. Even xbaje's own technical staff cannot read your password.
• Two-Factor Authentication (2FA): xbaje strongly recommends that all players enable two-factor authentication on their account for an additional layer of login security. 2FA can be configured through your account security settings.
• Intrusion Detection Systems: Our infrastructure is monitored 24/7 by automated intrusion detection and anomaly-alerting systems that flag suspicious access patterns and respond to potential threats in real time.
• Regular Security Audits: xbaje's platform undergoes periodic independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Access Controls: Internal access to player personal data is strictly limited on a need-to-know basis. All staff with access to personal data undergo background checks and mandatory data protection training. Access logs are maintained and reviewed regularly.
• Data Backups: Player data is backed up regularly to geographically distributed, encrypted storage facilities to ensure business continuity and data availability in the event of a system failure or disaster.

The xbaje platform integrates third-party services to deliver game content, process payments, and verify identities. Each third-party provider operates under its own privacy policy and data protection practices. xbaje selects all third-party partners carefully and requires them to maintain data protection standards consistent with our own. Below is an overview of the categories of third-party services and their data interactions:

• Game Content Providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi): Receive anonymised player session data (player ID, game round details, wager values) strictly for the purpose of game delivery, RNG (Random Number Generator) integrity, and dispute resolution. These providers are contractually prohibited from using this data for marketing or profiling purposes.
• Payment Processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard): Receive the minimum financial data necessary to process your requested transaction. Each processor is a regulated financial service provider operating under its own regulatory framework and privacy obligations. xbaje does not store full card numbers or mobile wallet PINs on its servers.
• KYC & Identity Verification Services: Receive identity document images and facial photographs solely for the purpose of verifying your age and identity. Verification providers are contractually required to delete raw biometric data after the verification process is complete.
• Cloud Infrastructure & Hosting Providers: Store and process platform data on xbaje's behalf under strict data processing agreements. These providers do not have independent access rights to your personal data and may only process it on xbaje's documented instructions.
• Analytics Services: Receive anonymised, aggregated usage data (page views, feature interactions, error logs) for the sole purpose of helping xbaje improve platform performance. No personally identifiable information is included in analytics data streams.

xbaje is not responsible for the privacy practices of third-party websites that may be referenced or linked to from our platform. We strongly recommend that you review the privacy policies of any third-party service you interact with independently of xbaje.

xbaje reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or platform features. When we make material changes to this Policy, we will notify registered players via their registered email address at least 14 days before the updated Policy takes effect. For minor, non-material changes (such as typographical corrections or clarifications that do not alter the substance of our data practices), we may update the Policy without individual notification.

The current version of this Privacy Policy is always accessible at xbaje.lat/privacy-policy. The "Last Updated" date at the top of this page and in the table of contents sidebar will reflect the most recent revision date. Your continued use of the xbaje platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you have the right to close your account and request deletion of your personal data prior to the effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way xbaje handles your personal data, our dedicated support team is available 24 hours a day, 7 days a week, operating on Bangladesh Standard Time (BST, UTC+6).

• Email: [email protected] (plain text — not a clickable link; please copy and paste into your email client)
• Live Chat: Available directly on the xbaje platform, 24/7, in English
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days of receipt
• Data Rights Requests: Please include your registered username and a brief description of your request so we can process it efficiently and securely

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. xbaje is committed to resolving all privacy concerns promptly and fairly, and we encourage you to contact us directly in the first instance so we have the opportunity to address your concerns before any formal escalation.