bbaj Privacy Policy

Who We Are

bbaj is an online casino and sports betting platform accessible at bbaj.io, operated for the benefit of players based primarily in Bangladesh. Throughout this Privacy Policy, references to "bbaj", "we", "us", or "our" refer to the bbaj platform and its operating entity. References to "you", "your", or "player" refer to any individual who accesses, registers on, or otherwise uses the bbaj platform.

bbaj acts as the data controller in respect of all personal data collected from players through the registration process, ongoing account activity, KYC verification, customer support interactions, and use of the platform's games and features. As data controller, bbaj determines the purposes and means by which personal data is processed, and bears responsibility for ensuring that processing is carried out lawfully, fairly, and transparently.

For any data-related enquiries, including requests to exercise your rights under this policy, please contact our support team at [email protected] (plain text — not a clickable link).

Data We Collect

bbaj collects personal data through several channels: directly from you during registration and account management, automatically through your use of the platform, and from third-party service providers where applicable. The categories of data we collect are described below.

We do not collect sensitive personal data such as biometric data, health information, political opinions, or religious beliefs. Where KYC documents incidentally contain such information, we process only the data fields relevant to identity and age verification and disregard all other content.

How We Use Your Data

bbaj uses personal data collected from players for the following specific purposes. We process data only for the purposes stated here and do not repurpose it for unrelated activities without first informing you and, where required, obtaining your consent.

• Account creation and management: To register your account, verify your identity, maintain your player profile, and enable access to all platform features.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain accurate transaction records on your account.
• KYC and compliance: To verify your age (21+ requirement), confirm your identity, and fulfil our obligations under applicable anti-money-laundering and fraud prevention standards.
• Platform security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, and other prohibited conduct described in our Terms & Conditions.
• Responsible gaming: To monitor gameplay patterns for indicators of problem gambling behaviour, apply self-exclusion restrictions, and enforce deposit limits you have set.
• Customer support: To respond to your enquiries, resolve disputes, and maintain a record of communications relevant to your account.
• Service improvement: To analyse aggregated, anonymised usage data in order to improve platform performance, game selection, and user experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may opt out at any time.
• Legal obligations: To comply with any request from a competent legal authority, court order, or regulatory directive that lawfully requires disclosure of player data.

Legal Basis for Processing

bbaj processes your personal data on the following legal grounds, depending on the specific processing activity involved:

• Contractual necessity: The majority of our data processing — including account management, transaction processing, and KYC verification — is necessary for the performance of the contract between you and bbaj as set out in our Terms & Conditions. Without this processing, we cannot operate your account.
• Legal obligation: Certain processing activities, particularly those related to identity verification, record-keeping, and cooperation with law enforcement, are carried out to fulfil legal obligations applicable to bbaj's operations.
• Legitimate interests: Processing activities related to platform security, fraud prevention, and service analytics are conducted on the basis of bbaj's legitimate interest in operating a safe, reliable, and commercially viable platform. These interests are balanced against your privacy rights and do not override them.
• Consent: Where bbaj processes your personal data for direct marketing purposes, we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time by contacting support or updating your communication preferences in your account settings, without affecting the lawfulness of processing carried out before withdrawal.

Cookies & Tracking Technologies

bbaj uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session, and collect anonymous analytics data. The types of cookies we use are described below:

• Strictly necessary cookies: These cookies are essential for the platform to function correctly. They enable you to log in, navigate between pages, and maintain your session. Without them, the platform cannot operate. These cookies cannot be disabled.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and previously visited game categories — to personalise your experience on return visits.
• Analytics cookies: bbaj uses anonymised, aggregated analytics data to understand how players navigate the platform, which games are most popular, and where technical issues occur. This data does not identify individual players and is used solely to improve the service.
• Security cookies: These cookies help detect and prevent fraudulent activity, including account takeover attempts and automated bot interactions with the platform.

bbaj does not use third-party advertising cookies or allow external ad networks to place tracking technologies on the platform. Your browsing activity on bbaj.io is not shared with advertisers for retargeting purposes.

Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies will impair the functionality of the platform, including the ability to log in and place bets. Disabling functional and analytics cookies will not prevent you from using the platform but may reduce the quality of your experience.

Data Sharing & Disclosure

bbaj does not sell, rent, or trade your personal data. We share personal data with third parties only in the specific circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: We share transactional data with payment processors including bKash, Nagad, Rocket, Upay, Visa, and Mastercard, strictly for the purpose of processing your deposits and withdrawals. These processors are subject to their own data protection obligations and are contractually bound to use your data only for payment processing purposes.
• Game providers: When you play a game supplied by a third-party provider such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, limited technical data (such as a session token and bet values) is shared with the provider to enable the game to function. Game providers do not receive your identity data or contact details.
• KYC verification partners: Where bbaj uses a third-party identity verification service to validate documents submitted during the KYC process, that service will process the documents on our behalf under a data processing agreement.
• Legal and regulatory authorities: bbaj will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by a lawful order, subpoena, or legal obligation. We will notify you of such disclosure where permitted by law to do so.
• Business continuity: In the event of a merger, acquisition, or sale of all or part of bbaj's business, player data may be transferred to the successor entity as part of the transaction. Players will be notified of any such transfer and their rights under this policy will continue to apply.

All third parties with whom bbaj shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the purposes specified in their agreement with bbaj.

International Data Transfers

The bbaj platform serves players primarily in Bangladesh, and we endeavour to process and store data within jurisdictions that provide an adequate level of data protection. However, certain third-party service providers — including game providers and technical infrastructure partners — may process data in locations outside Bangladesh.

Where personal data is transferred internationally, bbaj takes reasonable steps to ensure that appropriate safeguards are in place, including contractual data protection clauses with the receiving party that require them to maintain security standards equivalent to those applied by bbaj itself.

By using the bbaj platform, you acknowledge that your data may be processed outside Bangladesh in the circumstances described above, subject to the safeguards described in this section.

Data Retention

bbaj retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or compliance obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account's active status and for a minimum of 5 years following account closure, to support any post-closure compliance reviews or dispute resolution processes.
• KYC documents: Retained for a minimum of 5 years from the date of submission, in line with anti-money-laundering record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction, for financial audit and compliance purposes.
• Customer support records: Retained for 3 years from the date of the most recent interaction, unless the record relates to an unresolved dispute or legal matter, in which case it is retained until final resolution.
• Marketing consent records: Retained for the period during which marketing communications are sent, plus 2 years following any opt-out, to demonstrate compliance with consent obligations.
• Technical logs: Retained for 12 months on a rolling basis for security monitoring and fraud detection purposes.

When personal data is no longer required and there is no legal basis for continued retention, it is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

Your Rights

bbaj recognises the following rights in respect of your personal data. To exercise any of these rights, please contact our support team at [email protected] (plain text — not a clickable link), clearly stating your registered username and the specific right you wish to exercise.

• Right of access: You may request a copy of all personal data that bbaj holds about you. We will provide this within a reasonable timeframe, typically within 30 days of the verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Identity data corrections may require re-submission of KYC documents.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right is subject to overriding legal retention obligations.
• Right to restriction: You may request that bbaj restrict processing of your data — meaning we store it but do not actively use it — while a dispute over its accuracy or the lawfulness of its processing is being resolved.
• Right to data portability: You may request a copy of the personal data you provided to bbaj in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object: You may object to processing carried out on the basis of legitimate interests, or to direct marketing processing at any time. Where an objection is raised, bbaj will cease the processing activity unless compelling legitimate grounds exist that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

bbaj will respond to all rights requests within 30 days of receipt of a verified request. In cases of complexity or volume, this period may be extended by a further 30 days, and we will inform you of any such extension within the initial 30-day period.

Children & Minors

The bbaj platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21, and we actively apply age verification measures during the registration and KYC processes to prevent access by minors.

If bbaj becomes aware that personal data has been collected from a person under the age of 21 — whether through registration fraud, a failed age verification, or any other means — we will take the following immediate steps:

• Suspend the account pending investigation.
• Permanently close the account upon confirmation that the player is under 21.
• Securely delete all personal data associated with the underage account as promptly as possible, subject to any legally mandated retention of records relating to the incident.
• Return any verifiable Real Money deposits to the originating payment method, minus any amounts lost in play prior to detection.

If you are a parent or guardian and believe that a person under your care has registered on bbaj, please contact us immediately at [email protected] (plain text — not a clickable link) so that we can investigate and take appropriate action without delay.

Security Measures

bbaj employs a layered security framework designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our principal security measures include:

• Transport security: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• Access controls: Access to player data is restricted to authorised personnel on a strict need-to-know basis. Access is governed by role-based permissions and is subject to audit logging. All access events are recorded and reviewed periodically.
• Password security: Player passwords are stored as one-way cryptographic hashes using industry-standard hashing algorithms. bbaj staff cannot read your password; they can only reset it through a verified process.
• Intrusion detection: Our platform infrastructure is monitored continuously for unusual activity patterns, including repeated failed login attempts, abnormal transaction volumes, and known attack signatures.
• Penetration testing: bbaj engages independent security professionals to conduct periodic penetration tests and vulnerability assessments of the platform, with identified vulnerabilities remediated according to their severity rating.
• Incident response: In the event of a personal data breach that is likely to result in risk to affected players, bbaj will notify affected individuals without undue delay and will take all reasonable steps to contain and remediate the breach.

While bbaj applies robust technical and organisational security measures, no digital platform can guarantee absolute security. You play an important role in protecting your own data by maintaining strong, unique passwords and by reporting any suspected unauthorised account access to support immediately.

Third-Party Links

The bbaj platform does not contain links to third-party websites for advertising or promotional purposes, and we do not embed third-party tracking pixels or widgets that would allow external parties to collect data about your platform activity.

Game interfaces supplied by third-party providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi are rendered within the bbaj platform environment. While bbaj has contractual data protection obligations with these providers, the game providers operate their own technical infrastructure and are subject to their own privacy policies in relation to the limited technical data they receive to enable gameplay.

bbaj is not responsible for the privacy practices of game providers or payment processors operating their own independent platforms. We encourage you to review the privacy documentation of any third-party service with which you interact directly outside of the bbaj platform.

Policy Amendments

bbaj reserves the right to amend this Privacy Policy at any time to reflect changes in our services, applicable data protection standards, or operational requirements. When material changes are made to this policy, we will notify registered players via the email address associated with their account at least 14 days before the changes take effect.

Non-material changes — such as corrections of typographical errors, clarifications that do not alter the substance of any provision, or updates to contact details — may be made without prior notice. The effective date displayed at the top of this page will always reflect the date of the most recent revision.

Continued use of the bbaj platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the revised policy, you should cease using the platform and contact support to close your account prior to the effective date.

We recommend that you review this Privacy Policy periodically so that you remain informed about how bbaj handles your personal data. Previous versions of this policy are available on request by contacting our support team.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your personal data by bbaj, please contact our support team using the details below. We aim to acknowledge all data-related enquiries within 24 hours of receipt and to provide a substantive response within 30 days.

• Support email: [email protected] (plain text — not a clickable link)
• Platform: bbaj.io
• Response time: Acknowledgement within 24 hours; substantive response within 30 days
• Languages: English
• Operating hours: Available 7 days a week, Bangladesh Standard Time (UTC+6)

When contacting us regarding a data rights request, please include your registered username and the mobile number associated with your payment wallet (bKash, Nagad, or Rocket) so that we can locate your account and verify your identity before processing the request. This verification step is necessary to protect your data from unauthorised access requests made by third parties.