badbajee Privacy Policy

badbajee collects personal information from Players through several channels during the normal course of operating the Platform. The categories of personal data we collect are described in the table below.

badbajee does not knowingly collect personal data from individuals under the age of 18. If the Company becomes aware that data has been collected from an underage individual, that data will be deleted promptly and the associated Account closed. We do not collect special category data (such as racial or ethnic origin, religious beliefs, or health data) unless it is volunteered by a Player in the context of a responsible gaming self-exclusion request.

badbajee uses the personal data collected from Players only for clearly defined, lawful purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected. The primary purposes for which we process personal data are as follows:

• Account administration: Creating and maintaining your badbajee Account, processing deposits and withdrawals, verifying your identity through KYC procedures, and managing your account preferences and communication settings.
• Service delivery: Enabling access to betting markets, casino games, live dealer tables, slots, and all other features of the badbajee Platform that you elect to use.
• Payment processing: Facilitating transactions with payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank to process your deposits and withdrawal requests in Bangladeshi Taka (BDT).
• Fraud prevention and security: Monitoring account activity for signs of fraud, money laundering, underage gambling, or other prohibited conduct in order to protect the integrity of the Platform and the safety of the Player community.
• Legal and regulatory compliance: Meeting obligations under applicable law, responding to lawful requests from law enforcement or financial intelligence authorities, and maintaining transaction records for the periods required by regulation.
• Customer support: Responding to your queries, resolving disputes, processing complaints, and providing technical assistance through live chat, email, and WhatsApp support channels.
• Responsible gaming: Monitoring player behaviour patterns that may indicate problem gambling, enforcing self-exclusion requests, applying deposit and loss limits set by the Player, and communicating responsible gaming resources when appropriate.
• Platform improvement: Analysing aggregated, anonymised usage data to identify technical issues, improve the user experience, and develop new features. This analysis does not involve individual profiling for marketing purposes.
• Marketing communications (opt-in only): Sending promotional offers, bonus notifications, and platform updates to Players who have explicitly opted in to receive such communications. Players may withdraw marketing consent at any time through account settings or by contacting support.

badbajee will not process your personal data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent, except where such processing is strictly required for fraud prevention or legal compliance purposes.

badbajee does not sell, rent, or disclose your personal data to third parties for their own commercial or marketing purposes. Data is shared with third parties only where necessary for the operation of the Platform or where required by law, under the following limited circumstances:

Payment Service Providers

To process your financial transactions, badbajee shares the minimum necessary financial and identity data with payment partners such as bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. These providers operate under their own privacy policies and are bound by applicable financial data protection obligations. badbajee does not store your full mobile banking PIN or bank account passwords.

Game Content Providers

Third-party game studios whose content is available on the badbajee Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive anonymised session data (such as a pseudonymous player identifier and wager amounts) for game auditing, Return-to-Player (RTP) calculation, and fairness certification purposes. These providers do not receive your name, contact details, or payment information.

Identity Verification Partners

For KYC verification, badbajee may use a third-party identity verification service to validate the authenticity of documents submitted by Players. Such partners are contractually required to handle verification data securely, use it solely for the verification purpose, and delete it upon completion of the process.

Legal Authorities

badbajee may be required by law to disclose Player data to law enforcement agencies, financial intelligence units, or other government bodies where a valid legal demand is received. The Company will comply with such obligations while endeavouring to notify the affected Player where legally permissible to do so.

Business Transfers

In the event that badbajee undergoes a merger, acquisition, or transfer of business assets, Player personal data may form part of the transferred assets. Players will be notified via the Platform and their registered contact details before their data is transferred to a new data controller, and the receiving entity will be bound by terms no less protective than this Privacy Policy.

badbajee uses cookies and similar tracking technologies to ensure the Platform functions correctly, to keep your session secure, and to collect anonymised analytics data that helps us improve the user experience. The types of cookies used on the badbajee Platform are described below.

badbajee does not use advertising or retargeting cookies. We do not permit third-party advertising networks to place cookies on the Platform. You may adjust cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to log in and use the Platform securely.

badbajee retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following general retention periods apply:

• Active Account data (identity, contact, and financial records): Retained for the full duration of the Account's activity on the Platform.
• Closed Account data: Retained for a minimum of five (5) years following Account closure to satisfy anti-money laundering record-keeping obligations and to handle any post-closure disputes or regulatory enquiries.
• KYC verification documents: Retained for five (5) years after the verification process is completed, or five (5) years after Account closure, whichever is later.
• Transaction records: Retained for five (5) years in line with standard financial record-keeping requirements.
• Customer support communications: Retained for two (2) years after the support interaction is closed, unless the communication relates to an open dispute or legal matter.
• Analytics data: Anonymised and aggregated after twelve (12) months; no individual Player is identifiable in retained analytics data beyond that point.
• Marketing consent records: Retained for the duration of the Account plus two (2) years after Account closure to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. badbajee does not archive or archive-access data beyond the periods stated above without a specific legal justification. If you wish to request early deletion of your personal data, please refer to the Your Privacy Rights section below.

As a Player on the badbajee Platform, you hold meaningful rights over your personal data. badbajee is committed to honouring these rights promptly and without undue barriers. The rights available to you are described below.

To exercise any of the rights described above, contact the badbajee data team by emailing [email protected] with the subject line "Privacy Rights Request". Please include your registered Account username and mobile number so we can verify your identity before actioning the request. badbajee will respond to all verified privacy rights requests within thirty (30) calendar days. Where a request is complex or involves a large volume of data, this period may be extended by up to a further sixty (60) days, and you will be informed of the extension in advance.

Where a request for erasure conflicts with a mandatory legal retention obligation (for example, a regulatory requirement to retain financial transaction records for five years), badbajee will inform you of the specific legal basis for retaining the data and will delete all other data outside that legal requirement.

badbajee implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Key security controls in place include:

• Transport Layer Security (TLS 1.3): All data in transit between your browser or app and badbajee's servers is encrypted using TLS 1.3 with 256-bit AES cipher suites. The Platform enforces HTTPS-only access; unencrypted HTTP connections are automatically redirected.
• Data encryption at rest: Sensitive data fields stored in badbajee's databases — including identity document references and payment method identifiers — are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within badbajee's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, and all access events are logged and periodically reviewed.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their badbajee Account. The Company requires 2FA for all internal staff accessing systems that handle Player data.
• Vulnerability management: The badbajee Platform undergoes regular security assessments, including penetration testing and code review, to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: badbajee maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to affected Players, impacted individuals will be notified without undue delay and in accordance with applicable legal requirements.

While badbajee takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. Players are encouraged to use a strong, unique password for their badbajee Account, enable 2FA, and report any suspicious Account activity to [email protected] immediately.

badbajee reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, Platform functionality, legal obligations, or regulatory guidance. The "Last updated" date displayed at the top of this Policy indicates when the most recent revision was made.

Where a material change is made to this Policy — for example, a new category of data being collected, a new third-party sharing arrangement, or a change in retention periods — badbajee will notify Players by displaying a prominent notice on the Platform and, where practical, by sending a notification to your registered email address or mobile number.

Your continued use of the badbajee Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the Platform and may request Account closure by contacting [email protected].

Previous versions of this Privacy Policy are available on request. If you wish to review an earlier version, contact the support team and specify the approximate date of the version you require.