xbajff Privacy Policy

1. Data We Collect and How We Collect It

1.1 Information You Provide Directly

When you register an account with xbajff, we collect the personal information you submit during the registration process. This includes your full legal name, date of birth, residential address, email address, and mobile phone number. If you proceed through our Know Your Customer (KYC) verification process, we additionally collect copies of identity documents such as your National Identity Card (NID), passport, or driver's licence, along with proof of residential address.

When you contact our support team via live chat or email, we retain a record of that correspondence, including the content of your messages and any attachments you provide. This information is used to resolve your query and to improve our support quality.

1.2 Information Collected Automatically

When you access and use the xbajff platform, certain technical data is collected automatically by our systems. This includes your IP address, device type, operating system, browser type and version, screen resolution, language settings, session start and end times, pages visited, games played, bets placed, and in-platform navigation paths. This data is collected using server logs, session tracking, and cookies (see Section 4 for full cookie details).

We also collect geolocation data at the level of your city or region, derived from your IP address. We do not collect precise GPS coordinates from your device. Geolocation data is used to verify that you are accessing the platform from an eligible location and to display region-appropriate content.

1.3 Financial Transaction Data

All deposit and withdrawal transactions conducted through the xbajff platform generate a financial record. This includes the transaction amount in BDT (৳), the payment method used (such as bKash, Nagad, Rocket, or bank transfer), the transaction timestamp, the transaction reference number assigned by the payment provider, and the resulting account balance. We do not store full payment account credentials on our servers. Mobile wallet numbers and bank account identifiers are stored in a masked or tokenised form to the extent technically possible.

1.4 Information From Third Parties

In some circumstances, xbajff may receive personal information about you from third-party sources. This can include identity verification data returned by KYC service providers, fraud risk scores from payment fraud prevention services, and publicly available information that we may access as part of an investigation into suspected account misuse. Any third-party data received in this manner is handled in accordance with this Privacy Policy and is not used for any purpose beyond the specific reason it was obtained.

2. How We Use Your Personal Data

xbajff uses the personal data we collect for the following specific purposes:

Purpose	Legal Basis	Data Used
Account registration and management	Contract performance	Name, email, phone, date of birth, address
Identity and age verification (KYC)	Legal obligation	NID, passport, proof of address
Processing deposits and withdrawals	Contract performance	Payment method details, transaction records
Fraud detection and prevention	Legitimate interest / Legal obligation	IP address, device data, transaction patterns
Customer support	Contract performance	Support correspondence, account activity
Responsible gaming monitoring	Legal obligation / Legitimate interest	Play patterns, deposit frequency, self-exclusion records
Promotional communications	Consent	Email address, player preferences
Platform analytics and improvement	Legitimate interest	Anonymised usage data, session data

xbajff does not use automated decision-making processes that produce legal or similarly significant effects on individual players without human review. Where automated systems flag an account for investigation (for example, due to suspected fraud or unusual activity), a member of our compliance team reviews the case before any account action is taken.

2.1 Marketing Communications

If you have opted in to receive promotional communications from xbajff, we may send you emails or in-platform notifications about bonuses, promotions, new games, seasonal offers (such as BPL cricket season promotions, Eid bonuses, and Pohela Boishakh offers), and platform updates. You may withdraw your consent to marketing communications at any time by contacting our support team or by using the unsubscribe mechanism included in each marketing email. Withdrawal of marketing consent does not affect the legal processing of your data for account management, transactions, and legal compliance.

3. Data Sharing and Third Parties

3.1 Service Providers

To operate the xbajff platform, we engage a number of third-party service providers who process personal data on our behalf. These include game software providers (such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe), payment processing partners (including the technical intermediaries that facilitate bKash, Nagad, Rocket, and Upay transactions), identity verification service providers, cloud hosting and infrastructure providers, and customer support platform operators. All such service providers are bound by data processing agreements that require them to process your data only as instructed by xbajff and to maintain appropriate security standards.

3.2 Legal and Regulatory Disclosures

xbajff may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, safety, or property of xbajff, our players, or the public. We will only make such disclosures to the extent required and will, where legally permissible, notify affected players of any such disclosure.

3.3 Business Transfers

In the event that xbajff undergoes a merger, acquisition, or sale of all or part of its assets, personal data held about players may be transferred to the acquiring entity as part of that transaction. In such circumstances, we will notify affected players via the email address registered to their account before their personal data is transferred and becomes subject to a different privacy policy.

3.4 No Sale of Personal Data

xbajff does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party for that party's own marketing, advertising, or commercial purposes. Any data shared with third parties is shared strictly for the operational and legal purposes described in this policy.

4. Cookies and Tracking Technologies

4.1 What Cookies Are

Cookies are small text files placed on your device by your web browser when you visit the xbajff platform. They enable the platform to remember your preferences, maintain your logged-in session, and gather anonymous analytics data about how the platform is used. Cookies cannot execute code, carry viruses, or directly access your personal files.

4.2 Types of Cookies Used by xbajff

• Strictly Necessary Cookies: These are essential for the platform to function. They maintain your login session, remember your language preferences, handle security tokens, and enable the basic navigation of the site. The platform cannot function correctly without them, and they cannot be disabled.
• Performance and Analytics Cookies: These cookies collect anonymised information about how visitors use the platform — which pages are most visited, how long sessions last, and where users navigate between games. This data is used to improve platform performance and user experience. It is aggregated and does not identify individual players.
• Functionality Cookies: These remember your preferences such as your preferred game category, display settings, and recent searches, so that you have a more personalised experience each time you visit.
• Fraud Prevention Cookies: These cookies assist our fraud detection systems by recording device identifiers and behavioural signals that help distinguish legitimate players from automated bots or bad actors attempting account takeover.

4.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site or global basis. Please note that disabling certain cookies may impair the functionality of the xbajff platform, including the ability to stay logged in between sessions or to receive personalised game recommendations.

5. Data Retention and Storage

xbajff retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account registration data (name, contact details, date of birth): Retained for the duration of your active account relationship with xbajff, plus five years following account closure. This is required to comply with anti-money-laundering regulations and to handle any post-closure disputes.
• KYC and identity verification documents: Retained for a minimum of five years from the date of verification, as required by financial crime prevention obligations.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping requirements.
• Customer support correspondence: Retained for three years from the date of the final message in each support interaction, after which it is securely deleted.
• Marketing consent records: Retained for three years from the date of consent, or until you withdraw consent, whichever is earlier.
• Technical and analytics data: Aggregated and anonymised after 12 months; raw session logs are retained for a maximum of 90 days.

When the applicable retention period expires, personal data is securely deleted or, where deletion is not technically feasible for archived data, permanently anonymised so that it can no longer be linked to any individual.

6. Your Privacy Rights

As a player on the xbajff platform, you hold the following rights with respect to your personal data:

• Right of Access: You may request a copy of all personal data xbajff holds about you. We will provide this in a structured, commonly used format within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account information directly within your account settings, or contact support for changes that require manual processing.
• Right to Erasure: You may request the deletion of your personal data. We will honour this request where no legal or contractual obligation requires us to retain the data. Note that transaction records and KYC data are subject to mandatory retention periods and cannot be deleted on request during those periods.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: Where data is processed on the basis of your consent or for contract performance, you may request a machine-readable copy of your personal data for portability to another service.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for responsible gaming purposes. We will review such objections on a case-by-case basis.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

To exercise any of the above rights, please contact our support team via live chat (available 24/7, Bangladesh Standard Time UTC+6) or at the email address below. We will verify your identity before processing any data rights request to protect against fraudulent access to another player's data. We aim to respond to all verified requests within 30 calendar days.

7. Data Security Measures

xbajff takes the security of your personal data seriously and maintains a range of technical and organisational measures designed to protect it from unauthorised access, accidental loss, destruction, or disclosure.

7.1 Technical Safeguards

All data in transit between your device and xbajff's servers is encrypted using SSL/TLS protocols. Data at rest — including account records, KYC documents, and financial transaction logs — is stored on encrypted servers hosted in secure data centres with physical access controls. Access to production databases is restricted to a small number of authorised personnel and is subject to multi-factor authentication requirements.

7.2 Organisational Safeguards

xbajff staff who have access to personal data are trained in data protection obligations and are bound by confidentiality agreements. Access to personal data is granted on a strict need-to-know basis — support agents, for example, can see only the account information needed to resolve your query and do not have access to full payment credentials or raw KYC documents beyond what is necessary for their role.

7.3 Incident Response

In the event of a data security incident that poses a risk to the rights and freedoms of players, xbajff will take immediate steps to contain the breach, assess its scope, and notify affected players as soon as reasonably practicable. We will provide affected players with clear information about what data was involved, the likely consequences of the breach, and the steps we are taking or have taken to address it.

8. Changes to This Privacy Policy

xbajff reserves the right to update or revise this Privacy Policy at any time. When we make material changes to the policy, we will update the effective date at the top of this page and, where the changes are significant, notify registered players via their registered email address or via a prominent in-platform notification.

We encourage you to review this Privacy Policy periodically so that you remain informed about how your personal data is being handled. Your continued use of the xbajff platform following the posting of any revised policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should discontinue use of the platform and may request account closure in accordance with our Terms & Conditions.

For the avoidance of doubt, the English-language version of this Privacy Policy published on this page is the definitive and legally authoritative version. In the event of any discrepancy between this version and any other translated or summarised version, the English text on this page shall prevail.