Privacy Policy — How x baje Handles Your Data
At x baje, protecting your personal information is a responsibility we take seriously. This Privacy Policy explains in plain English exactly what data we collect, why we collect it, how we store it, and the rights you hold over your own information as a player on our platform.
Privacy at a Glance
Six principles that define how x baje approaches your personal data — every day, on every interaction.
Minimal Collection
x baje collects only the personal data that is strictly necessary to provide you with a safe, legal, and functional account. We do not collect data for its own sake or sell player profiles to advertisers.
No Data Selling
x baje does not sell, rent, or trade your personal data to any third party for commercial purposes. Your information is used solely to operate the platform, comply with legal obligations, and improve your experience.
SSL Encryption
All data transmitted between your device and x baje is protected by industry-standard SSL/TLS encryption. Sensitive account and payment information is never transmitted or stored in plain text under any circumstances.
Player Control
You have meaningful control over your personal data. You can request access to what we hold, ask for corrections, request deletion, or withdraw consent for optional processing at any time by contacting our support team.
Defined Retention
x baje retains your personal data only for as long as your account is active and for the legally required period after closure. We do not hold data indefinitely. Retention periods are documented in this policy.
Transparent Communication
If x baje ever experiences a data security incident that affects your personal information, we commit to notifying you via your registered email address promptly and without unnecessary delay.
Data We Collect
x baje collects personal data through several channels: directly from you when you register an account or contact our support team, automatically through your use of the platform, and in limited circumstances from third-party verification and payment service providers. The categories of personal data we collect are described below.
1.1 Registration Data
When you create an x baje account, we collect your full legal name as it appears on your National Identity Card (NID), your date of birth, your email address, your mobile phone number registered in Bangladesh, and a username and password of your choosing. This information is required to create and administer your account and to comply with our age verification and Know Your Customer (KYC) obligations.
1.2 Identity Verification Data
As part of our KYC process — which is required before we can process your first withdrawal — we collect a copy of your government-issued identity document (National Identity Card or passport), and where required, a recent utility bill or bank statement confirming your registered address. These documents are processed securely and retained only for the period required by our compliance obligations.
1.3 Financial Data
When you make a deposit or request a withdrawal, x baje records transactional data including the payment method used (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, or BRAC Bank), the mobile number or account number associated with the transaction, transaction amounts, timestamps, and transaction reference numbers. x baje does not store full payment credentials. Authentication for mobile financial services (bKash, Nagad, Rocket, Upay) is handled directly by those providers' own secure interfaces.
1.4 Usage and Technical Data
x baje automatically collects technical data when you use the platform, including your IP address, device type and model, operating system and version, browser type and version, screen resolution, session duration, pages visited, games played, bets placed, and timestamps of all platform interactions. This data is used for fraud prevention, platform security, product improvement, and responsible gaming monitoring.
1.5 Communications Data
If you contact x baje's support team via live chat or email, we retain a record of that correspondence, including the content of messages and any attachments, for quality assurance, dispute resolution, and regulatory compliance purposes. Support interactions are logged against your account where you are a registered player.
Special Category Data: x baje does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information. If you voluntarily disclose health-related information in the context of a responsible gaming request (for example, when requesting self-exclusion), that information will be handled with the highest level of care and used solely for the purpose for which it was shared.
The following table summarises the primary categories of data collected by x baje and the legal basis for processing each category:
| Data Category | Examples | Legal Basis |
|---|---|---|
| Registration Data | Name, email, phone, date of birth | Contract performance; Legal obligation |
| Identity Verification | NID copy, address document | Legal obligation (KYC/AML) |
| Financial Data | Transaction records, payment method | Contract performance; Legal obligation |
| Usage & Technical Data | IP address, device info, session logs | Legitimate interests (security, fraud prevention) |
| Communications Data | Support chat logs, emails | Legitimate interests (dispute resolution) |
| Marketing Preferences | Opt-in/opt-out status, promo responses | Consent |
How We Use Your Data
x baje uses personal data collected from players for the following specific and documented purposes. We do not use your data in ways that are incompatible with the purposes stated in this policy without first seeking your consent or establishing a new lawful basis for the processing.
- Account creation and management: To register your player account, verify your identity and age, maintain your account settings, and communicate with you about your account status.
- Transaction processing: To process your deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and BRAC Bank, and to maintain accurate financial records of all transactions associated with your account.
- Platform security and fraud prevention: To monitor platform activity for signs of fraudulent behaviour, account sharing, bonus abuse, money laundering, or other prohibited conduct as defined in our Terms & Conditions. Technical and usage data plays a central role in this function.
- Regulatory and legal compliance: To meet our obligations under applicable laws, including anti-money laundering (AML) requirements, age verification mandates, and any lawful requests from relevant authorities.
- Responsible gaming monitoring: To identify patterns of play that may indicate problem gambling behaviour, to enforce self-exclusion requests, deposit limits, and other player protection tools, and to contact players where our responsible gaming systems flag a concern.
- Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and improve the quality of our support services based on interaction history.
- Product and service improvement: To analyse aggregated, anonymised usage data to understand how players interact with the platform and to make informed decisions about product development, game selection, and user experience improvements.
- Marketing communications (with consent only): To send you promotional emails, bonus offers, and seasonal promotions — including those tied to BPL cricket season, IPL, Eid, Pohela Boishakh, and Victory Day — where you have opted in to receive such communications. You may withdraw your consent at any time by updating your account preferences or contacting support.
Marketing opt-out: If you have previously opted in to receive promotional communications from x baje and wish to stop receiving them, you can update your preferences at any time from within your account settings or by emailing [email protected]. Opting out of marketing communications will not affect your ability to use the platform or receive service-critical account notifications.
x baje does not use automated decision-making processes that produce legal or similarly significant effects on individual players without human oversight. Where automated systems flag an account for review (for example, for suspected fraud or responsible gaming concerns), a member of our compliance or player protection team reviews the flagged activity before any account action is taken.
Data Sharing & Third Parties
x baje does not sell your personal data. We share personal data with third parties only in the limited and specific circumstances described below, and only to the extent necessary for the stated purpose.
3.1 Payment Service Providers
To process deposits and withdrawals, x baje shares the minimum necessary transactional data with the relevant payment service providers — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and BRAC Bank. Each of these providers operates under its own privacy policy and is independently responsible for the security of payment data processed through its platform. x baje does not receive or store full payment credentials from any of these providers.
3.2 Identity Verification Partners
In some cases, x baje may use third-party identity verification services to assist with KYC document checks. Where this occurs, only the specific documents and data required for verification are shared. These partners are contractually bound to use your data solely for the verification purpose and to maintain appropriate security standards.
3.3 Game Technology Providers
Games on x baje are supplied by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe. These providers may receive technical session data (such as game round identifiers and stake amounts) for the purpose of game integrity, dispute resolution, and RNG audit trails. No personally identifiable information beyond what is required for these technical functions is shared with game providers.
3.4 Legal and Regulatory Authorities
x baje may disclose personal data to law enforcement agencies, regulatory bodies, or other governmental authorities where required to do so by law, by court order, or where we reasonably believe that disclosure is necessary to prevent fraud, money laundering, or imminent harm to any individual. In such cases, x baje will disclose only the minimum data required to satisfy the lawful request.
3.5 Business Transfers
In the event that x baje undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, personal data held by x baje may be transferred to the relevant successor entity as part of that transaction. Where such a transfer occurs, the successor entity will be required to honour the commitments made in this Privacy Policy, and affected players will be notified via their registered email address prior to any material change in how their data is handled.
No cross-border transfers to high-risk jurisdictions: x baje's primary data processing infrastructure is hosted within data centres operating under strong security and data protection standards. Where any data processing occurs outside Bangladesh, x baje ensures that appropriate contractual safeguards are in place to protect your personal data to a standard equivalent to that described in this policy.
Data Retention
x baje retains personal data for the minimum period necessary to fulfil the purposes described in this policy and to comply with applicable legal obligations. The retention periods applicable to each category of data are set out below.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | Legal and regulatory compliance |
| KYC / Identity Documents | Duration of account + 5 years post-closure | AML legal obligation |
| Financial Transaction Records | Duration of account + 7 years post-closure | Financial record-keeping legal obligation |
| Support Communications | 3 years from last interaction | Dispute resolution and quality assurance |
| Usage and Technical Logs | 12 months rolling | Security monitoring and fraud prevention |
| Marketing Consent Records | Until consent is withdrawn + 3 years | Evidence of lawful basis for marketing |
Following the expiry of the applicable retention period, x baje will securely delete or irreversibly anonymise the relevant personal data. Anonymised data — which cannot be linked back to any individual — may be retained for longer periods for statistical and analytical purposes without restriction.
If you request deletion of your personal data and x baje is not subject to a legal obligation to retain it, we will action your request within thirty (30) calendar days and confirm the deletion to you in writing. Where a legal retention obligation prevents us from deleting specific data immediately, we will restrict its processing and delete it as soon as the retention period has expired.
Data Security
x baje implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include but are not limited to the following:
- SSL/TLS encryption: All data transmitted between your device and x baje's servers is encrypted using Transport Layer Security (TLS). This prevents interception of data in transit by unauthorised parties.
- Encrypted data storage: Sensitive personal data, including identity documents and financial records, is stored in encrypted form at rest. Encryption keys are managed under strict access controls.
- Access controls: Access to personal data within x baje's systems is restricted to authorised personnel who require that access to perform their job functions. Access is granted on a least-privilege basis and is subject to regular review.
- Two-factor authentication: x baje strongly encourages all players to enable two-factor authentication (2FA) on their accounts. Our internal administrative systems also require 2FA for all staff accessing player data.
- Penetration testing and security audits: x baje's platform and infrastructure undergo periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
- Incident response: x baje maintains a documented data security incident response procedure. In the event of a security breach affecting your personal data, x baje will notify you via your registered email address promptly and will take all necessary steps to contain the breach and mitigate its impact.
Your responsibility: While x baje takes all reasonable steps to protect your data on our end, you also play an important role in keeping your account secure. Use a strong, unique password for your x baje account. Do not share your login credentials with anyone. Log out of your account when using a shared or public device. Enable two-factor authentication in your account security settings. Contact our support team immediately if you suspect your account has been accessed without your authorisation.
Your Privacy Rights
As a player on x baje, you have the following rights with respect to your personal data. x baje is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights described below, contact our support team at [email protected] with the subject line "Privacy Rights Request".
Right of Access
You have the right to request a copy of the personal data x baje holds about you. We will provide this within 30 days of your verified request, in a commonly used electronic format.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Account details such as your email address can also be updated directly in your account settings.
Right to Erasure
You may request that x baje delete your personal data. This right applies where the data is no longer necessary for the purpose it was collected, or where you withdraw consent and no other lawful basis applies. Legal retention obligations may limit this right in some cases.
Right to Restrict Processing
In certain circumstances, you may request that x baje restrict the processing of your personal data — for example, while a dispute about its accuracy is being resolved — without requiring full deletion.
Right to Data Portability
Where x baje processes your data on the basis of your consent or to perform a contract with you, you have the right to receive your data in a structured, machine-readable format and to request that it be transmitted to another service provider where technically feasible.
Right to Object
You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where your individual circumstances warrant it.
x baje will respond to all privacy rights requests within thirty (30) calendar days of receiving a verified request. In complex cases, this period may be extended by a further sixty (60) days, in which case we will notify you of the extension and the reason for it within the initial 30-day window. There is no charge for exercising your privacy rights unless a request is manifestly unfounded or excessive.
Policy Updates & Contact
x baje reviews this Privacy Policy periodically and will update it when necessary to reflect changes in our data processing practices, changes to the services we offer, or changes to applicable law. The effective date at the top of this policy will be updated whenever a material change is made.
Where a change to this Privacy Policy is material — meaning it affects your rights or the way your data is used in a significant way — x baje will notify you via your registered email address at least fourteen (14) calendar days before the change takes effect. Non-material changes (such as corrections to typographical errors or clarifications that do not alter the substance of the policy) may take effect immediately upon publication.
Your continued use of x baje following the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any change to this policy, you should stop using x baje and may request account closure by contacting our support team.
This Privacy Policy was last reviewed and updated on 1 January 2026. It applies to all personal data collected by x baje from that date forward, as well as to personal data collected prior to that date that remains in x baje's systems.
Privacy enquiries and complaints: If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or wish to raise a complaint about how x baje has handled your personal data, please contact our privacy team at [email protected] with the subject line "Privacy Enquiry". x baje commits to acknowledging all privacy enquiries within 48 hours and providing a substantive response within 10 business days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority.
x baje is committed to resolving all privacy complaints fairly and transparently. We treat every enquiry about data handling with the seriousness it deserves, because the trust of every player who chooses x baje as their online casino and sports betting platform in Bangladesh is something we work to earn and maintain every day.
Ready to Explore x baje?
Now that you understand how x baje protects your data, dive into the platform — browse our games, check our FAQ, or log in to your account.
Log In to x baje Read Our FAQ Browse Slots Cricket Betting