Your Privacy Matters at xbja

xbja is an online betting and casino platform operating at xbja.io. xbja is the data controller responsible for personal data collected through the Platform. When this Privacy Policy refers to "xbja", "we", "us", or "our", it means the xbja Platform and the entity operating it.

xbja is designed for Bangladeshi players and operates in English. All customer support is available 24 hours a day, 7 days a week, via live chat inside your account dashboard or by email at [email protected]. Privacy-related inquiries may be directed to the same support channel and will be escalated to the appropriate team for handling.

xbja takes its obligations as a data controller seriously. We apply appropriate technical and organisational measures to protect the data we hold, and we only process personal data for the purposes described in this policy or as otherwise required by applicable law.

xbja collects the following categories of personal data, depending on how you interact with the Platform:

• Identity Data: Full legal name, date of birth, gender, and copies of identity documents (National Identity Card, passport, or birth certificate) provided during KYC verification.
• Contact Data: Email address, mobile phone number, and residential address provided at registration or subsequently updated in your account profile.
• Financial Data: Mobile banking account references (bKash, Nagad, Rocket, Upay), bank account details where applicable, deposit and withdrawal transaction records, and balance history. xbja does not store full card numbers; card payment processing is handled by PCI-DSS compliant third-party processors.
• Technical Data: IP address, device identifiers, browser type and version, operating system, screen resolution, time zone, and connection type collected automatically when you access the Platform.
• Usage Data: Pages visited, games accessed, bets placed and settled, session start and end times, in-game actions, search queries within the Platform, and feature interactions.
• Communications Data: Content of live chat conversations, emails, and any written feedback or complaints submitted to xbja support.
• Marketing Preference Data: Your consent status and channel preferences for receiving promotional communications from xbja.

You are not required to provide all of the above categories to browse xbja. However, certain categories — particularly Identity Data, Contact Data, and Financial Data — are mandatory for account registration, KYC verification, and transaction processing. Failure to provide mandatory data will prevent you from accessing the relevant services.

xbja collects personal data through the following means:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your profile settings.
• Automated collection: Technical and usage data collected automatically as you browse and interact with the Platform, including via cookies, server logs, and analytics tools.
• Third-party payment processors: Transaction confirmation and reference data received from bKash, Nagad, Rocket, Upay, or card payment processors when you initiate a deposit or withdrawal.
• Identity verification providers: Confirmation signals from third-party KYC or document verification services engaged to validate the authenticity of identity documents you submit.
• Fraud and AML screening tools: Risk-scoring data generated by automated systems that analyse transaction patterns and behavioural signals to detect suspicious activity.

xbja does not collect data from social media platforms, purchase data from data brokers, or use third-party advertising networks to build profiles on Platform users.

xbja uses personal data for the following specific purposes:

• Creating, maintaining, and administering your xbja account, including verifying your identity and age in compliance with our 21+ policy.
• Processing deposits, withdrawals, and bet settlements in Bangladeshi Taka (৳) through your chosen payment method.
• Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, and other prohibited conduct as defined in the Terms & Conditions.
• Providing customer support, responding to inquiries, and resolving disputes through live chat and email channels.
• Delivering responsible gaming interventions — including automated alerts, limit enforcements, and self-exclusion processing — based on usage and transaction patterns.
• Sending transactional communications such as deposit confirmations, withdrawal notifications, password reset emails, and security alerts.
• Sending marketing communications (promotions, bonus offers, event notifications) where you have given explicit consent and in accordance with Section 12.
• Improving Platform features, game availability, and user experience through aggregated, anonymised analytics.
• Complying with applicable legal obligations, including responding to lawfully issued requests from competent authorities.

xbja does not make any fully automated decisions that produce significant legal effects on players without human review. Where automated systems flag an account for fraud review or responsible gaming intervention, a human operator reviews the case before any permanent account action is taken.

xbja does not sell, rent, or trade personal data to any third party for commercial purposes. We share personal data only in the following strictly defined circumstances:

• Payment processors: Transaction data shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard solely to execute and confirm payment instructions you initiate.
• Identity verification providers: Identity document data shared with contracted KYC service providers to validate the authenticity and validity of documents you submit. These providers act as data processors under binding confidentiality agreements.
• Game content providers: Limited technical session data (not your personal identity) shared with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi solely to deliver live game sessions within the Platform.
• Legal and regulatory authorities: Personal data disclosed in response to lawfully issued court orders, regulatory notices, or law enforcement requests that xbja is legally obligated to comply with.
• Business transfers: In the event of a merger, acquisition, or asset sale involving xbja, personal data may be transferred to the acquiring entity as part of the transaction, subject to the same level of protection described in this policy.

xbja retains personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account's existence plus a minimum of five years following account closure, to meet financial record-keeping and AML compliance obligations.
• KYC and identity documents: Retained for a minimum of five years from the date of verification or account closure, whichever is later, in accordance with anti-money laundering requirements.
• Transaction records: Retained for a minimum of five years from the date of the transaction.
• Support communications: Retained for two years from the date of the communication unless the matter is subject to an ongoing dispute or legal proceeding, in which case retention continues until resolution.
• Marketing preference data: Retained until you withdraw consent or close your account, whichever comes first.
• Technical and usage data: Retained in anonymised or aggregated form indefinitely for analytics purposes; identifiable technical data is deleted after 13 months.

When personal data is no longer required for the purposes outlined above, xbja securely deletes or anonymises it using industry-standard data destruction procedures. Requests for earlier deletion are considered under Section 7 (Your Rights), subject to any overriding legal retention obligations.

You have the following rights in relation to the personal data xbja holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Request" and a description of your request. We will acknowledge your request within 5 business days and respond in full within 30 calendar days.

• Right of Access: Request a copy of the personal data xbja holds about you, along with information about how it is processed.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data held in your account.
• Right to Erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xbja's legal retention obligations.
• Right to Restriction: Request that processing of your data be restricted in certain circumstances — for example, while the accuracy of data is contested or while a complaint is being investigated.
• Right to Object: Object to processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on legitimate interests, subject to xbja's right to demonstrate compelling grounds.
• Right to Data Portability: Request a copy of data you have provided to xbja in a structured, machine-readable format where processing is based on consent or contractual necessity.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xbja uses cookies and similar tracking technologies to operate the Platform effectively and deliver a consistent user experience. A cookie is a small text file placed on your device by a website. The following categories of cookies are used on xbja:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies (keeping you logged in), security tokens (CSRF protection), and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby layout preferences, and responsible gaming tool configurations. Disabling these may reduce the quality of your experience but will not prevent you from using the Platform.
• Analytics Cookies: Collect anonymised, aggregated data about how users navigate the Platform — pages visited, time spent, error events — to help xbja identify and fix usability issues. Used with consent only.

xbja does not use advertising cookies, cross-site tracking pixels, social media widgets, or any third-party cookies placed by advertising networks. You may manage cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in to your account.

xbja operates a strict minimum age policy of 21 years. The Platform is not directed at, and does not knowingly collect personal data from, any individual under the age of 21. All registration flows include an age declaration requirement, and xbja conducts KYC age verification on all accounts.

If xbja discovers or is notified that an account belongs to a person under the age of 21, the account will be immediately suspended, all associated personal data will be flagged for deletion subject to any legally required retention, and the matter will be escalated for investigation. Any winnings associated with an underage account will be voided in accordance with the Terms & Conditions.

xbja is an offshore platform serving Bangladeshi players. As a result, some personal data may be processed on servers or by service providers located outside Bangladesh. xbja takes appropriate steps to ensure that any such international transfer of personal data is subject to safeguards consistent with applicable data protection standards, including the use of standard contractual clauses and due diligence on the data protection practices of all data processors engaged outside Bangladesh.

By registering an account and using xbja, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside your country of residence. xbja will always handle your data in accordance with this Privacy Policy regardless of where it is processed.

xbja applies a multi-layered approach to data security. The following technical and organisational measures are in place to protect personal data against unauthorised access, loss, or disclosure:

• TLS 1.3 encryption for all data in transit between players' devices and xbja servers.
• AES-256 encryption for sensitive data stored at rest, including identity document files and financial reference data.
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access account data.
• Comprehensive access audit logging with automated alerts for anomalous access patterns.
• Regular internal and third-party security assessments, including penetration testing of Platform infrastructure.
• Segregated network architecture to isolate payment processing environments from general Platform infrastructure.
• Incident response procedures with defined escalation paths for security events, including a player notification protocol for material data breaches.

While xbja implements strong security measures, no online platform can guarantee absolute security. Players should take steps to protect their own account credentials, use strong and unique passwords, and report any suspected unauthorised access to [email protected] immediately.

xbja may send promotional communications — including bonus offers, free bet alerts, seasonal promotions tied to events like the BPL, IPL, T20 World Cup, or Eid — to players who have given explicit consent to receive such communications at the time of registration or subsequently through their account settings.

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your account dashboard or by emailing [email protected] with the subject line "Unsubscribe". Withdrawal of marketing consent will be processed promptly and will not affect your ability to use the Platform or receive transactional communications related to your account activity.

xbja does not engage in unsolicited SMS marketing, cold calling, or WhatsApp broadcast campaigns. All marketing communications from xbja will clearly identify xbja as the sender and include an opt-out mechanism.

The xbja Platform does not contain links to external third-party websites. All navigation within xbja remains within the xbja.io domain. However, game content delivered by third-party studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others) is rendered within the Platform via embedded iframes or API-driven interfaces. These game environments are operated by the respective studios and are subject to their own data handling practices for in-session technical data.

xbja is not responsible for the privacy practices of game content providers operating within their own embedded environments. Where personal data is shared with game providers, it is limited to the minimum necessary for session delivery — typically a pseudonymous session token — and is governed by data processing agreements between xbja and each provider.

xbja reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, applicable law, or operational requirements. When material changes are made, xbja will notify registered players via the email address on their account at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page and in the Table of Contents will be revised each time the policy is amended. Continued use of the Platform following the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree to the updated terms, you should cease use of the Platform and contact [email protected] to request account closure.

We encourage all players to review this Privacy Policy periodically to stay informed about how xbja handles and protects their personal data. Previous versions of this policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way xbja handles your personal data, please contact us using the following channels:

• Email: [email protected] (subject line: "Privacy Request" or "Data Complaint")
• Live Chat: Available 24/7 inside your xbja account dashboard
• Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

xbja is committed to resolving privacy concerns promptly and fairly. We will acknowledge all privacy-related contacts within 5 business days and aim to provide a full written response within 30 calendar days. For complex matters involving data access, erasure, or portability, the response period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with xbja's response to your privacy concern, you have the right to escalate the matter through appropriate legal channels available to you in your jurisdiction. xbja takes all privacy complaints seriously and will co-operate fully with any legitimate inquiry or investigation.