ebaji Privacy Policy — How We Protect and Handle Your Personal Data

This Privacy Policy ("Policy") describes how the ebaji online gaming platform ("ebaji", "we", "us", "our"), accessible at ebaji.io and through associated mobile applications, collects, uses, stores, discloses, and protects personal data relating to individuals ("you", "your", "player") who access or use our services.

This Policy applies to all personal data processed in connection with the ebaji platform, including data collected during account registration and identity verification, data generated through your use of games and betting markets, data collected through deposit and withdrawal transactions, and data collected through your communications with the ebaji support team.

By registering an account with ebaji and accepting our Terms & Conditions, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not accept the terms of this Policy, you must not register an account or use the ebaji platform.

This Policy should be read alongside the ebaji Terms & Conditions and Responsible Gaming Policy, both of which are available on the ebaji platform. In the event of any inconsistency between this Policy and the Terms & Conditions on the specific subject of personal data, this Policy takes precedence.

ebaji is an online entertainment and gaming platform operated as a secure and reliable service for players based in Bangladesh. The platform offers live casino games, slots, sports betting including cricket and football, and crash games, all delivered through certified third-party game providers.

For the purposes of this Privacy Policy, ebaji acts as the data controller in respect of personal data collected from registered players. As data controller, ebaji determines the purposes and means of processing personal data and is responsible for ensuring that such processing complies with applicable data protection obligations.

For all privacy-related inquiries, requests, or complaints, please contact the ebaji data protection contact at: [email protected]. All privacy correspondence must be submitted in English and should include your registered username and a clear description of your query or request.

The following table summarises the categories of personal data that ebaji collects, the specific data types within each category, and the primary purpose for which each category is collected.

ebaji does not collect or process sensitive personal data (also referred to as special category data) such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion or cooling-off request, in which case such information is processed solely for the purpose of administering the responsible gaming tool requested.

ebaji collects personal data through the following channels and mechanisms:

• Direct registration: Data you provide when creating your account, completing KYC verification, or updating your account profile.
• Transaction processing: Data generated and received through deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, bank transfer, and card payment processors.
• Platform interaction: Data automatically generated as you browse the platform, navigate game lobbies, place bets, claim bonuses, and interact with platform features.
• Support communications: Data provided when you contact the ebaji support team via email or live chat, including the content of your messages and any attachments you send.
• Cookies and tracking technologies: Data collected via session cookies, persistent cookies, and similar tracking mechanisms placed on your device when you access the ebaji platform. See Section 8 for full details.
• Third-party verification services: Identity and fraud risk data received from KYC verification partners and anti-fraud service providers where you have been referred to such services as part of the account verification process.
• Third-party game providers: Aggregated and anonymised game performance and session data received from certified game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi) for the purpose of dispute resolution and responsible gaming monitoring.

ebaji processes personal data only where a valid lawful basis exists for doing so. The following lawful bases apply to ebaji's data processing activities:

1. Contractual necessity: Processing of identity data, contact data, financial data, and gaming activity data is necessary for the performance of the contract between you and ebaji — specifically, to operate your account, deliver games, process transactions, and provide support.
2. Legal obligation: Processing of identity data, financial data, and transaction records for KYC verification and anti-money laundering compliance is required under applicable legal and regulatory obligations.
3. Legitimate interests: Processing of technical data and usage data for fraud detection, platform security, bot prevention, and service improvement is conducted on the basis of ebaji's legitimate interest in maintaining a safe and reliable platform, provided that such processing does not override your fundamental privacy rights.
4. Consent: Processing of usage and preference data for the purpose of personalised promotional communications is conducted on the basis of your consent, given when you opt in to marketing communications during registration or subsequently through your account settings. You may withdraw this consent at any time by contacting [email protected].

In addition to the primary purposes identified in Section 3, ebaji uses collected personal data for the following operational and compliance purposes:

• Verifying your age and identity to enforce the ebaji 21+ age restriction and prevent underage access to the platform.
• Processing and reconciling deposit and withdrawal transactions in Bangladeshi Taka (BDT) via your selected payment method.
• Monitoring transaction patterns for suspicious activity in accordance with anti-money laundering (AML) obligations, and filing reports where required under applicable law.
• Administering bonuses, promotions, and loyalty programmes, including verifying eligibility, calculating wagering requirement progress, and processing bonus credits and withdrawals.
• Monitoring gaming behaviour patterns to identify signs of problem gambling and to proactively offer or apply responsible gaming tools where appropriate.
• Detecting and preventing fraudulent activity, multi-accounting, bot usage, collusion, and other prohibited activities as defined in the ebaji Terms & Conditions.
• Resolving disputes regarding game outcomes, transaction discrepancies, or bonus calculations, using logged session and transaction data as the authoritative record.
• Sending you transactional and account-management communications (e.g., deposit confirmations, withdrawal status updates, KYC document requests, security alerts) via your registered email address and/or Bangladesh mobile number.
• Sending you promotional communications (e.g., bonus offers, seasonal promotions tied to BPL, IPL, Eid, or Pohela Boishakh) where you have provided consent, and managing your preferences for such communications.
• Improving and developing the ebaji platform through analysis of aggregated, anonymised usage data.

ebaji shares personal data with third parties only where strictly necessary for the purposes described in this Policy, and only under binding contractual data protection obligations. The following categories of third party may receive personal data:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — to process deposit and withdrawal transactions in BDT. Data shared is limited to what is required to complete the specific transaction.
• KYC and identity verification providers: Certified third-party verification services that validate identity documents (NID, passport, driving licence) and confirm age eligibility. Data shared is limited to the identity documents and personal details required for the verification check.
• Anti-fraud and AML screening services: Specialist providers that screen transaction data and account behaviour patterns for fraud indicators and AML risk signals. Data shared is anonymised or pseudonymised where technically feasible.
• Certified game providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and other certified studios — limited session identifiers and game log data are shared as required to deliver games and resolve disputes. These providers do not receive your full identity profile.
• Regulatory and law enforcement authorities: ebaji may be required by applicable law to disclose personal data to government bodies, law enforcement agencies, courts, or financial intelligence units. In such cases, disclosure is made only to the extent required and, where legally permissible, you will be notified.
• Professional advisers: Legal counsel, auditors, and compliance consultants, where they are under a professional duty of confidentiality and require access to personal data to perform their services.

The ebaji platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your login session, to detect fraud and bot activity, and to understand how players use the platform so that it can be improved.

The following categories of cookies are used on the ebaji platform:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing you from using the platform.
• Functional cookies: Store your preferences such as display settings and notification preferences to personalise your experience. Disabling these will not prevent platform use but may reduce your experience quality.
• Analytics cookies: Collect anonymised data about how players navigate the platform, which pages are visited most frequently, and where errors occur. This data is used solely to improve the platform. Where consent has been provided, analytics data may be processed by trusted analytics service providers under data processing agreements.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and multi-accounting. These process device fingerprint data, IP address, and session behaviour patterns.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to or using the ebaji platform. Disabling analytics cookies will not affect your ability to use the platform but will reduce our ability to identify and resolve issues affecting your experience.

ebaji implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the ebaji platform.
• Encryption of sensitive personal data fields (including identity document images and financial data) at rest in the ebaji database environment.
• Role-based access controls ensuring that only authorised team members with a defined operational need can access player personal data.
• Multi-factor authentication for all ebaji staff accessing internal systems that hold personal data.
• Regular penetration testing and vulnerability assessments of the ebaji platform infrastructure.
• Automated monitoring and alerting for abnormal access patterns or potential data breach indicators.
• Contractual data security obligations imposed on all third-party processors who handle personal data on ebaji's behalf.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ebaji will notify you as soon as reasonably practicable via your registered email address, setting out the nature of the breach, the data affected, the likely consequences, and the remedial steps taken. ebaji will also take all technically and operationally feasible steps to contain the breach as quickly as possible.

ebaji retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable legal, regulatory, or compliance obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from ebaji's systems or anonymised such that it can no longer be associated with any identifiable individual. Anonymised data may be retained indefinitely for statistical and analytical purposes.

As a player whose personal data is processed by ebaji, you have the following rights with respect to your personal data. To exercise any of these rights, please contact the ebaji support team at [email protected] with your registered username and a clear description of the right you wish to exercise.

1. Right of access: You have the right to request a copy of the personal data that ebaji holds about you. ebaji will provide a response within 30 days of receiving a valid request.
2. Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Some corrections may require supporting documentation.
3. Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (for consent-based processing), or where you object to processing based on legitimate interests. This right is subject to legal retention obligations — ebaji cannot delete data that must be retained for AML, regulatory, or legal compliance purposes.
4. Right to restriction of processing: You have the right to request that ebaji restricts the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or where you contest the lawfulness of processing.
5. Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a copy of the personal data you have provided to ebaji in a structured, commonly used, machine-readable format.
6. Right to object: You have the right to object to processing of your personal data based on ebaji's legitimate interests. ebaji will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
7. Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

The ebaji platform is strictly for adults aged 21 years and above. ebaji does not knowingly collect personal data from any individual under the age of 21. The platform's registration process includes mandatory age verification, and accounts found to belong to individuals under the age of 21 are immediately suspended and all associated data is deleted, subject to any legal retention obligations relating to the detection and reporting of underage gambling.

If you believe that a minor has accessed the ebaji platform or that ebaji has inadvertently collected personal data from a minor, please contact us immediately at [email protected]. ebaji takes all reports of potential underage access extremely seriously and will investigate and respond to all such reports on a priority basis.

Parents and guardians are encouraged to use parental control software to prevent underage access to online gaming platforms. ebaji recommends that devices used to access the platform are protected with appropriate access controls and that login credentials are never shared with or accessible to minors.

ebaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal or regulatory requirements, or platform features. Where a material change is made to this Policy, ebaji will notify registered players via their registered email address and/or by displaying a prominent notice on the platform prior to the change taking effect.

Continued use of the ebaji platform following notification of any amendment to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the platform and request account closure by contacting [email protected] before the amendment's effective date.

The most current version of this Privacy Policy is always available at ebaji.io/privacy-policy. The effective date displayed at the top of this document indicates when the current version came into force. We encourage you to review this Policy periodically to stay informed of how ebaji protects your personal data.

For all privacy-related queries, data rights requests, or complaints regarding ebaji's handling of your personal data, please contact the ebaji data protection contact using the details below. All correspondence must be in English and should include your registered username and a clear description of your query, request, or complaint.

If you are not satisfied with ebaji's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. ebaji is committed to resolving all privacy complaints in a fair, transparent, and timely manner, and will cooperate fully with any regulatory investigation arising from a complaint that cannot be resolved directly.