Privacy Policy — How nbajae Protects Your Data

nbajae collects personal data from Players in a number of ways — directly when you register an Account or interact with our services, automatically through your use of the Platform, and occasionally from third-party sources where permitted by law. The categories of personal data we collect are described below.

Registration and Account Data

When you create an nbajae Account, we collect the personal data you provide in the registration form. This includes your full legal name, date of birth, gender, nationality, residential address (including city, district, and postal code), a valid mobile number registered in Bangladesh, and an email address. You will also create a username and password, which are credentials unique to your Account.

Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may request copies of identity documents such as your National Identity Card (NID) issued by the Bangladesh Election Commission, passport, driving licence, or birth certificate. We may also request a recent utility bill or bank statement as proof of address. These documents are processed and stored securely and are used exclusively for identity and age verification purposes.

Financial Data

When you make a deposit or request a withdrawal, we collect details of the payment method used, including your bKash, Nagad, Rocket, or Upay account number, or the last four digits and issuing bank of any Visa or Mastercard used. We do not store full card numbers. All payment data is transmitted through secure, encrypted channels.

Transactional Data

We maintain a complete record of all financial transactions conducted through your nbajae Account, including deposits, withdrawals, bet placements, game results, bonus credits, and any adjustments made by our compliance team. This data is retained for audit, dispute resolution, and regulatory compliance purposes.

Device and Technical Data

When you access the nbajae Platform, our servers automatically collect certain technical data including your IP address, browser type and version, operating system, device type, screen resolution, time zone (we note that Bangladesh Standard Time is UTC+6), referring URL, and session duration. This data is used to optimise Platform performance and detect fraudulent access attempts.

Behavioural and Usage Data

We collect data about how you interact with the Platform, including which games you play, how long you play them, your betting patterns, your preferred sports markets (such as BPL cricket, T20 matches, and IPL fixtures), and your response to promotional offers. This data is used to personalise your experience and to meet our responsible gaming obligations.

Communications Data

When you contact the nbajae support team via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution outcome. These records help us maintain quality assurance and resolve any future disputes.

Data Category	Examples	Source
Identity Data	Name, date of birth, NID, passport	Provided by you
Contact Data	Mobile number, email, address	Provided by you
Financial Data	bKash / Nagad / card details	Provided by you
Transactional Data	Deposits, withdrawals, bets, winnings	Generated automatically
Technical Data	IP address, browser, device type	Collected automatically
Behavioural Data	Game preferences, session length	Collected automatically
Communications Data	Chat logs, support emails	Generated by interactions

nbajae uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The primary purposes for which we process your data are set out below.

Account Management and Service Delivery

We use your registration data and Account credentials to create and maintain your Account, authenticate your logins, process your deposits and withdrawals in BDT, display your transaction history, and deliver the full range of betting, casino, and gaming services available on the Platform.

Identity Verification and Fraud Prevention

Your KYC documents and financial data are processed to verify your identity and age, to screen against sanctions lists, and to detect and prevent fraudulent activity, money laundering, and other financial crimes. This processing is a legal and operational requirement that we cannot waive.

Responsible Gaming

nbajae uses your behavioural and transactional data to monitor gameplay patterns for signs of problem gambling. Where our responsible gaming systems flag unusual activity — such as a significant increase in bet frequency, loss-chasing behaviour, or extended uninterrupted play sessions — our team may contact you to check in and offer self-exclusion or deposit limit tools. For more information, visit our Responsible Gaming page.

Customer Support

Communications data is used to respond to your enquiries, resolve disputes, and improve the quality and consistency of our support service. Support interactions are reviewed periodically for quality assurance purposes.

Marketing and Promotions

With your consent (collected at registration and adjustable at any time via your Account settings), nbajae may use your contact data and behavioural data to send you personalised promotional communications via SMS and email. These may include offers tied to upcoming BPL fixtures, Eid seasonal bonuses, Pohela Boishakh promotions, and daily reload offers. You may opt out of marketing communications at any time without affecting your access to the Platform.

Platform Improvement and Analytics

Aggregated and anonymised technical and behavioural data is used to analyse Platform performance, identify and fix technical issues, and improve the user experience for all Players. This analysis does not involve identifying individual Players.

Legal and Regulatory Compliance

Certain processing activities are necessary to comply with applicable legal obligations, including responding to lawful requests from Bangladesh law enforcement authorities and retaining financial records for audit purposes.

Every processing activity conducted by nbajae in respect of your personal data is grounded in one of the following recognised legal bases:

• Contractual Necessity: Processing your registration data, identity verification documents, financial data, and transactional data is necessary to perform the contract between you and nbajae (i.e., the Terms & Conditions you agreed to at registration). Without this processing, we cannot provide the Services.
• Legal Obligation: Certain processing activities — particularly KYC verification, anti-money-laundering screening, and the retention of financial records — are required by applicable law. This processing is mandatory and cannot be declined.
• Legitimate Interests: We process technical and behavioural data on the basis of our legitimate interests in operating a secure, reliable, and fair platform. These interests do not override your fundamental rights and freedoms, and we conduct a proportionality assessment for each such processing activity.
• Consent: Where we rely on your consent as the legal basis for processing — primarily for marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place before withdrawal.

nbajae does not sell your personal data to third parties. We may, however, share your data with carefully selected third parties where necessary to operate the Platform and meet our legal obligations. All third parties with whom we share data are contractually bound to handle it securely and in accordance with applicable data protection standards.

Game Providers

When you play games provided by third-party studios — including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe — limited technical data such as your session token and game result data is shared with the relevant provider to ensure correct game delivery and fair result verification. These providers do not receive your full personal profile.

Payment Processors

To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, we share the minimum necessary financial data with the relevant payment processor or financial institution. These processors operate under their own data protection frameworks and are required to comply with applicable financial regulations.

Identity Verification Providers

KYC document verification may be performed with the assistance of accredited third-party identity verification service providers. These providers process your identity documents solely to confirm authenticity and return a verification result to nbajae. They do not retain your documents beyond the period necessary to complete verification.

Fraud Prevention and Security Services

We share technical data (including IP addresses and device fingerprints) with fraud detection and cybersecurity service providers to identify and block fraudulent access attempts, bot activity, and account takeover attempts.

Law Enforcement and Regulatory Authorities

nbajae will disclose personal data to law enforcement agencies, regulatory authorities, or other public bodies when required to do so by a valid legal order, court order, or statutory obligation under applicable Bangladeshi law. We will notify affected Players of such disclosures where we are legally permitted to do so.

The nbajae Platform uses cookies and similar tracking technologies to ensure proper platform functionality, maintain session security, and gather anonymised analytics data to improve platform performance. The following categories of cookies are used:

Cookie Type	Purpose	Required?
Essential Cookies	Maintain your login session, remember your language preference, enable core platform functions such as deposit flows and game loading.	Yes — cannot be disabled
Security Cookies	Detect and prevent fraudulent activity, cross-site request forgery (CSRF), and unauthorised session hijacking attempts.	Yes — cannot be disabled
Performance Cookies	Collect anonymised data about page load times, error rates, and feature usage to help our development team identify and fix performance issues.	Optional
Preference Cookies	Remember your in-platform settings such as preferred game categories, notification preferences, and display settings.	Optional

nbajae does not use third-party advertising cookies or cross-site tracking cookies. Optional cookies may be declined or cleared via your browser settings at any time. Please note that disabling essential or security cookies may prevent certain platform features from functioning correctly.

Most modern browsers allow you to control cookie settings via the browser's privacy or settings menu. You can typically choose to block all cookies, accept only essential cookies, or clear existing cookies at any time. For guidance specific to your browser, consult your browser provider's documentation.

nbajae retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your Account's active life and for a period of 5 years following permanent Account closure, in order to comply with applicable financial record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of 5 years from the date of verification, in line with anti-money-laundering regulatory standards.
• Transactional Records: All financial transaction data is retained for a minimum of 7 years to support audit and dispute resolution processes.
• Support Communications: Chat logs and email correspondence are retained for 3 years from the date of the interaction.
• Technical and Behavioural Data: Aggregated and pseudonymised usage data is retained for up to 2 years for analytics purposes. Raw technical logs are retained for a shorter period of up to 90 days.
• Marketing Preferences: Records of your consent or withdrawal of consent for marketing communications are retained for the life of your Account and for 3 years following Account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked back to any individual. Where data must be retained to comply with a specific legal obligation, it will be held in a restricted access environment until the obligation is discharged.

As a Player on the nbajae Platform, you hold a number of rights in respect of the personal data we hold about you. nbajae is committed to honouring these rights promptly and without unnecessary friction. Your rights are summarised below:

To exercise any of the above rights, please contact the nbajae support team via the live chat function inside the Platform or by emailing [email protected]. We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. In cases of particular complexity, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

nbajae takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, alteration, or disclosure. Our security infrastructure includes the following:

• SSL/TLS Encryption: All data transmitted between your device and the nbajae Platform is protected by SSL/TLS encryption. Look for the padlock icon and "https" prefix in your browser's address bar when accessing the Platform.
• Encrypted Data Storage: Sensitive data categories — including identity documents, payment instrument details, and Account credentials — are stored in encrypted form at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within nbajae's internal systems is restricted on a strict need-to-know basis. Team members are granted the minimum level of access necessary to perform their role. Access is logged and reviewed regularly.
• Two-Factor Authentication (2FA): We encourage all Players to enable 2FA on their nbajae Accounts as an additional layer of protection. 2FA significantly reduces the risk of unauthorised account access even if your password is compromised.
• Intrusion Detection: Our platform employs automated intrusion detection systems that monitor for unusual access patterns, brute-force login attempts, and other indicators of malicious activity, triggering alerts and automated protective responses in real time.
• Regular Security Audits: nbajae conducts periodic internal and third-party security reviews of its platform infrastructure and data handling processes to identify and remediate vulnerabilities before they can be exploited.

Despite our commitment to maintaining strong security measures, no online platform can guarantee absolute security against all threats. In the event of a data breach that is likely to affect your rights and freedoms, nbajae will notify affected Players without undue delay and will take all necessary steps to mitigate the impact of the breach.

You also have a responsibility to contribute to the security of your Account by maintaining the confidentiality of your login credentials, enabling 2FA, and reporting any suspected unauthorised access to our support team promptly. See Section 4 of our Terms & Conditions for more detail on your account security obligations.

The nbajae Platform integrates with a number of third-party services to deliver games, process payments, and ensure platform security. While nbajae selects its third-party partners carefully and requires them to adhere to appropriate data protection standards, we are not responsible for the privacy practices of third parties operating their own independent services.

Game Provider Integrations

When you launch a game provided by a third-party studio such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, or Spribe, your game session is delivered via that provider's servers. The technical data shared with game providers is limited to what is necessary to authenticate the session, deliver the game, and return the result. Game providers are contractually prohibited from using this data for their own marketing purposes.

Payment Gateway Integrations

Payment transactions are processed through the respective gateways of bKash, Nagad, Rocket, Upay, and card processors. When you initiate a payment, you may interact directly with that payment provider's interface. nbajae does not store your full payment credentials — only a tokenised reference is retained for transaction reconciliation. Each payment provider operates under its own published privacy policy.

No External Advertising Networks

nbajae does not integrate third-party advertising networks, social media tracking pixels, or cross-site user tracking technologies on the Platform. Any performance analytics tools used operate on anonymised, aggregated data only and do not share individual-level data with external parties.

nbajae may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. When we make material changes — meaning changes that substantially affect how we use your personal data or your rights in respect of it — we will notify you by posting a prominent notice on the Platform and, where appropriate, by direct communication to your registered contact details.

For minor, non-material updates (such as typographical corrections, clarifications of existing practices, or updates to reflect new payment providers), we may update this Policy without advance notice. The "Last Reviewed" date displayed in the hero section and the Document Info panel will always reflect the most recent revision.

Your continued use of the nbajae Platform after any updated Privacy Policy takes effect constitutes your acknowledgment of the changes. If you do not agree with any material change to this Policy, you should cease using the Platform and request Account closure before the revised Policy takes effect.

The most current version of this Privacy Policy is always available at https://nbajae.net/privacy-policy. We recommend reviewing it periodically, particularly at the start of each new cricket season or after any significant nbajae platform update.