Your Privacy at bagh baji

1. Data We Collect

bagh baji collects personal data through several channels: directly from you when you register an account or complete KYC verification, automatically when you use the platform, and — in limited circumstances — from third-party identity verification and payment service providers. We collect only the data that is necessary and proportionate to the purposes described in this policy.

1.1 Registration & Account Data

When you create a bagh baji account, we collect the following information:

• Your full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify that you meet the 18+ age requirement).
• Email address and/or mobile phone number.
• Username and encrypted password.
• Your residential address and, where applicable, city or region within Bangladesh.
• Preferred currency (Bangladeshi Taka, BDT).

1.2 KYC Identity Verification Data

Prior to processing any withdrawal, bagh baji is required to conduct Know Your Customer (KYC) verification. As part of this process, we may collect and store:

• A scanned or photographed copy of a government-issued photo ID — National ID card, passport, or driving licence.
• A selfie photograph taken at the time of identity verification, used for facial matching purposes.
• Proof of ownership of the payment method used for deposits (for example, a screenshot of your bKash or Nagad account confirming your registered name and number).
• Proof of address documentation where required by our compliance obligations.

1.3 Transactional & Betting Data

We retain a complete record of all financial and gaming activity associated with your account, including:

• Deposit and withdrawal amounts, dates, times, and payment method references.
• All bets placed, including market, selection, stake, odds, and settlement outcome.
• Bonus claims and wagering progress records.
• Account balance history.

1.4 Technical & Device Data

When you access bagh baji through a browser or mobile device, we automatically collect certain technical data, including:

• IP address and approximate geographic location derived from IP data.
• Device type, operating system, and browser version.
• Pages visited, time spent on each page, and navigation path through the platform.
• Session start and end timestamps.
• Referring URL (the address of the page that linked you to bagh baji, where applicable).

1.5 Communications Data

When you contact our support team via live chat or email at [email protected], we retain a record of the correspondence including the content of messages, timestamps, and any resolution actions taken. This data is used to resolve disputes, improve service quality, and maintain an audit trail of support interactions.

2. How We Use Your Data

bagh baji processes your personal data for the following specific and lawful purposes:

Purpose	Data Categories Used	Legal Basis
Creating and managing your player account	Registration data, contact details	Contractual necessity
Processing deposits and withdrawals	Transactional data, payment method details	Contractual necessity
KYC identity verification	KYC documents, selfie photograph, address proof	Legal obligation
Fraud prevention and anti-money laundering monitoring	Transactional data, technical data, KYC data	Legal obligation, legitimate interest
Responsible gaming monitoring and intervention	Betting history, session data, account behaviour patterns	Legal obligation, legitimate interest
Customer support and dispute resolution	Communications data, account data, transactional data	Contractual necessity, legitimate interest
Platform analytics and service improvement	Technical data, session data (anonymised where possible)	Legitimate interest
Marketing communications (with your consent)	Contact details, betting preferences	Consent (opt-in only)

bagh baji does not use your personal data for any purpose not listed in the table above without first obtaining your explicit consent or being required to do so by applicable law. We do not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances.

3. Data Sharing & Third Parties

bagh baji shares your personal data with third parties only where strictly necessary and only for the purposes described in this policy. All third-party service providers engaged by bagh baji are contractually bound to process your data only on our instructions, to implement appropriate security measures, and to comply with applicable data protection obligations.

3.1 Categories of Third-Party Recipients

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own regulatory obligations and privacy frameworks.
• Identity Verification Services: bagh baji may use third-party KYC and document verification providers to authenticate the identity documents you submit. These providers process only the data required for verification and do not retain it beyond the verification lifecycle.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a player session token and anonymised session identifier necessary to launch and authenticate game sessions. They do not receive your full personal profile.
• Analytics Providers: Anonymised platform usage data may be shared with analytics service providers to help bagh baji understand how the platform is used and identify areas for improvement. No personally identifiable information is included in these analytics data transfers.
• Legal and Regulatory Authorities: bagh baji will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory directive. This includes disclosures required under anti-money laundering legislation.

3.2 No Sale of Personal Data

bagh baji does not and will never sell, lease, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Any assertion to the contrary is false. If you receive communications purporting to come from bagh baji but which you did not request, please contact our support team immediately, as these may be phishing attempts.

3.3 International Data Transfers

Some of the third-party service providers engaged by bagh baji may process data outside of Bangladesh. Where international data transfers occur, bagh baji ensures that adequate safeguards are in place — including standard contractual clauses or equivalent data transfer mechanisms — to maintain the protection of your personal data to a standard consistent with this policy.

4. Cookies & Tracking Technologies

bagh baji uses cookies and similar tracking technologies on its website and mobile platform. Cookies are small text files placed on your device by the website you are visiting. They serve a number of purposes, from keeping you logged in to helping us understand how players use the platform.

4.1 Types of Cookies We Use

4.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view all cookies currently stored on your device, block cookies from specific websites, and delete existing cookies. Note that blocking all cookies will prevent you from logging in to the bagh baji platform, as the session management cookies described above are essential to authentication. For guidance on managing cookies in your specific browser, consult the help documentation of the browser you are using.

bagh baji does not use third-party advertising cookies and does not participate in cross-site behavioural advertising networks. Your browsing activity on the bagh baji platform is not shared with or sold to advertising technology companies.

5. Data Retention & Storage

bagh baji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply:

• Active account data: Retained throughout the active lifetime of your account and for a minimum of 5 years following permanent account closure.
• KYC identity verification documents: Retained for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction records (deposits, withdrawals, bets): Retained for a minimum of 5 years following the date of each transaction.
• Customer support correspondence: Retained for 3 years from the date of the last interaction in each support case.
• Technical and session data: Retained in identifiable form for up to 12 months, after which it is either deleted or anonymised for aggregate analytics purposes.
• Marketing consent records: Retained for the duration of your consent and for 3 years following its withdrawal, to demonstrate compliance.

At the end of the applicable retention period, personal data is securely and permanently deleted from bagh baji systems, or anonymised in a manner that makes re-identification impossible. Data held in encrypted backup systems is managed under the same retention schedule and is purged during routine backup rotation cycles.

6. Data Security Measures

bagh baji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• SSL/TLS encryption: All data in transit between your device and bagh baji servers is encrypted using industry-standard TLS protocols. This protects your personal and financial data from interception during transmission.
• Encryption at rest: Sensitive personal data stored on bagh baji servers — including KYC documents and payment details — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data within the bagh baji organisation is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of data access required to perform their specific role. All access is logged and audited.
• Two-factor authentication: Internal bagh baji systems that hold personal data require multi-factor authentication from all staff accessing them, reducing the risk of credential-based breaches.
• Security monitoring: bagh baji operates continuous monitoring of its infrastructure for anomalous activity, intrusion attempts, and data exfiltration indicators. Alerts are reviewed by our security team around the clock.
• Penetration testing: The platform undergoes periodic security assessments by qualified independent professionals to identify and remediate vulnerabilities before they can be exploited.

7. Your Privacy Rights

As a bagh baji player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team via live chat or at [email protected]. We will respond to all valid requests within 30 days of receipt. Identity verification is required before any data request is fulfilled.

7.1 Right of Access

You have the right to request a copy of the personal data that bagh baji holds about you. This is commonly referred to as a Subject Access Request (SAR). bagh baji will provide a structured summary of your personal data, the purposes for which it is processed, the categories of recipients it has been shared with, and the applicable retention period.

7.2 Right to Rectification

If any personal data bagh baji holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Some data — such as your legal name and date of birth — can only be corrected upon submission of supporting documentation confirming the accurate information.

7.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to its processing and there are no overriding legitimate grounds to continue. Please note that bagh baji is subject to legal obligations — particularly under anti-money laundering law — that require us to retain certain categories of data for defined minimum periods regardless of erasure requests. In such cases, bagh baji will inform you of the specific legal basis for retention.

7.4 Right to Withdraw Marketing Consent

If you have opted in to receive marketing communications from bagh baji, you may withdraw your consent at any time. You can do this by updating your notification preferences in your account settings or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to the withdrawal, and does not affect processing carried out on other legal grounds such as contractual necessity or legal obligation.

7.5 Right to Restrict Processing

In certain circumstances, you have the right to request that bagh baji restricts the processing of your personal data — for example, while the accuracy of data is being contested or while an objection to processing is under consideration. During a restriction period, bagh baji will continue to store the data but will not actively process it for other purposes.

7.6 Right to Object

You have the right to object to the processing of your personal data where bagh baji relies on legitimate interest as the legal basis for processing. bagh baji will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is required for the establishment, exercise, or defence of legal claims.

8. Contact & Policy Updates

8.1 How to Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the bagh baji data protection team using the following details:

8.2 Updates to This Privacy Policy

bagh baji reviews this Privacy Policy on a regular basis and reserves the right to update it at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The date at the top of this page indicates when the policy was last reviewed. Where changes are material — meaning they significantly affect how we handle your data or reduce your privacy protections — bagh baji will notify registered players via email at least 14 days before the changes take effect.

Your continued use of the bagh baji platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you must close your account and cease using the platform prior to the effective date of the changes. We encourage all players to review this page periodically to stay informed about how bagh baji protects their data.

8.3 Children's Privacy

The bagh baji platform is strictly intended for adults aged 18 years and above. bagh baji does not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data has been collected from a minor, we will immediately and permanently close the associated account, delete the data as far as legally permissible, and take appropriate follow-up action. If you believe a minor has created a bagh baji account, please contact our support team immediately.