Privacy Policy — How xabaji Collects, Uses, and Protects Your Data

Information We Collect

xabaji collects personal information from players and website visitors in several ways — directly from you when you register an account or interact with the platform, automatically through your use of the website, and in some cases from third-party service providers. The following describes the categories of personal data we collect and the context in which each type is gathered.

Information You Provide Directly

When you create a xabaji account, complete identity verification, make deposits or withdrawals, or contact our support team, you provide us with personal information. This includes:

• Full legal name as it appears on your government-issued identification
• Date of birth (used for age verification — xabaji is strictly 18+ only)
• Residential address, including city, district, and postal code
• Email address and mobile phone number
• Username and encrypted password
• Copies of identity documents submitted for KYC verification (National Identity Card, passport, or driving licence)
• Proof of address documents (utility bills, bank statements dated within three months)
• Payment method details, including mobile wallet numbers (bKash, Nagad, Rocket, Upay) and bank account references
• Communications you send to our support team via email or live chat

Information Collected Automatically

When you visit the xabaji website or use the platform, certain technical and behavioural data is collected automatically through your device and browser. This includes:

• IP address and approximate geographic location (city and country level)
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and navigation paths through the site
• Game sessions played, bet amounts, and game outcomes (for account integrity and responsible gaming monitoring)
• Login timestamps and session durations
• Referral source (how you arrived at the xabaji website)
• Cookie identifiers and local storage data (see the Cookies section below)

Information from Third Parties

In certain circumstances, xabaji may receive information about you from third-party sources. These include identity verification agencies used during KYC processing, payment processors who confirm the status of transactions, and fraud detection services that cross-reference account activity against known patterns of financial crime. Information received from these sources is used solely in connection with the purpose for which it was obtained — namely, verifying your identity, processing your payments, and protecting the integrity of the platform.

How We Use Your Data

xabaji processes your personal data for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The following table summarises the primary purposes for which your data is used and the legal basis that justifies each use.

Marketing Communications

xabaji may send you promotional emails, SMS messages, or platform notifications about bonuses, new game releases, seasonal promotions (such as Eid specials, BPL season offers, and Pohela Boishakh promotions), and other xabaji news. These communications are sent only where you have opted in to receive them. You may withdraw your consent and unsubscribe from marketing communications at any time by updating your account notification preferences or by contacting [email protected]. Withdrawal of consent for marketing does not affect your ability to continue using the xabaji platform.

Automated Decision-Making

xabaji uses automated systems to detect fraudulent activity, identify potential bonus abuse, and flag accounts that may require responsible gaming intervention. Where an automated decision results in a material consequence for your account — such as a temporary suspension or a withdrawal hold — you have the right to request a manual review of that decision by contacting our support team. xabaji will review your case promptly and provide a written explanation of the decision.

Cookies and Tracking Technologies

xabaji uses cookies and similar technologies — including web beacons, pixel tags, and local storage — to operate the platform effectively, remember your preferences, and understand how players interact with the site. A cookie is a small text file that is stored on your device by your browser when you visit a website.

Types of Cookies Used by xabaji

• Strictly Necessary Cookies: These are essential for the platform to function. They enable core features such as account login sessions, maintaining your session state during gameplay, and security token management. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These remember your preferences and settings — such as your preferred language, notification settings, and display choices — so you do not need to reconfigure them each time you visit.
• Analytics Cookies: xabaji uses first-party analytics tools to understand how players navigate the platform, which games are most popular, where users encounter difficulties, and how the site can be improved. These cookies collect data in aggregated, anonymised form and do not identify you personally.
• Security Cookies: These assist in detecting and preventing fraudulent activity, unauthorised account access, and bot-driven abuse. They form part of xabaji's overall platform security infrastructure.

Managing Your Cookie Preferences

You can control and manage cookies through your web browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and be notified when new cookies are set. Please note that disabling strictly necessary cookies will impair your ability to use core xabaji platform features, including logging in and maintaining an active game session. Instructions for managing cookies are available in the help documentation for your specific browser (Chrome, Firefox, Safari, Edge, Opera, or Samsung Internet).

Data Sharing and Third Parties

xabaji does not sell your personal data to third parties. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for each specific purpose.

Service Providers and Technology Partners

xabaji works with a range of third-party service providers who support the operation of the platform. These include game technology providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), payment processing partners (bKash, Nagad, Rocket, Upay, and banking institutions including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank Bangladesh, and Sonali Bank), identity verification agencies, IT infrastructure providers, and customer support software vendors. Each of these partners receives access to personal data only to the extent required to perform their specific service. They are contractually prohibited from using your data for any purpose beyond that service.

Legal and Regulatory Disclosures

xabaji may be required by law, court order, or regulatory authority to disclose personal data about a player or account. Where legally permitted to do so, xabaji will notify the affected player prior to making such a disclosure. Examples of circumstances that may trigger mandatory disclosure include anti-money laundering investigations, law enforcement requests supported by appropriate legal process, and regulatory compliance audits.

Business Transfers

In the event that xabaji undergoes a merger, acquisition, restructuring, or sale of assets, personal data held by xabaji may be transferred to the successor entity as part of that transaction. In such circumstances, the successor entity will be required to honour the commitments made in this Privacy Policy. Players will be notified of any material change to data controller identity that results from such a transaction.

Aggregate and Anonymised Data

xabaji may share aggregated, statistical data with third parties — for example, publishing platform-wide statistics on game popularity or deposit trends. This data does not identify individual players and is not considered personal data for the purposes of this policy.

Data Security and Storage

xabaji takes the security of your personal data seriously. We implement a layered set of technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures are reviewed and updated regularly to reflect current best practices in information security.

Technical Safeguards

• All data transmitted between your browser and xabaji's servers is encrypted using TLS 1.2 or higher (HTTPS across the entire platform)
• Player passwords are stored as salted cryptographic hashes — xabaji staff cannot read your password in plain text
• Access to production databases is restricted to authorised personnel only, via multi-factor authenticated administrative channels
• Payment processing systems are segregated from the main application infrastructure and meet PCI-DSS standards
• Regular penetration testing and security audits are conducted by qualified security professionals
• Automated intrusion detection systems monitor platform traffic for anomalous behaviour 24 hours a day, 7 days a week

Organisational Safeguards

• Access to personal data is restricted on a need-to-know basis within xabaji's operational team
• All staff with access to personal data are subject to confidentiality obligations and receive data protection training
• Third-party service providers are vetted for security compliance before being granted access to any personal data
• A documented data breach response procedure is in place, ensuring rapid identification, containment, and notification in the event of a security incident

Data Storage Location

xabaji's platform data is stored on secure servers. Where data is processed or stored outside of Bangladesh, xabaji ensures that appropriate contractual safeguards are in place to maintain the same level of data protection that applies domestically. Players based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and other locations across Bangladesh can be assured that their data is handled with the same security standards regardless of where it is physically stored.

Your Privacy Rights

As a player on the xabaji platform, you hold specific rights in relation to the personal data we hold about you. xabaji is committed to honouring these rights fully and promptly. To exercise any of the rights described below, please contact our support team at [email protected] with a clear description of your request. We will respond within a reasonable timeframe and will not charge a fee for handling straightforward requests.

Right of Access

You have the right to request a copy of the personal data that xabaji holds about you. Upon receipt of a valid access request, xabaji will provide a summary of the categories of data held, the purposes for which it is processed, and a copy of the data itself in a readable format.

Right to Rectification

If any personal data held by xabaji about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update certain account details (such as your email address or phone number) directly through your account settings. For corrections to identity documents or other KYC data, please contact our support team.

Right to Erasure

You may request that xabaji delete your personal data in certain circumstances — for example, if the data is no longer necessary for the purpose for which it was collected, or if you withdraw your consent and there is no other legal basis for continued processing. Please note that xabaji is subject to legal obligations that require retention of certain data (such as financial transaction records) for specified minimum periods, even after an account is closed. In such cases, xabaji will delete the data as soon as the retention obligation expires.

Right to Restriction of Processing

In certain circumstances — such as while a dispute about data accuracy is being resolved — you may request that xabaji restrict the processing of your personal data. During a restriction period, xabaji will store the data but will not actively process it beyond what is strictly necessary.

Right to Data Portability

Where xabaji processes your personal data on the basis of your consent or to perform a contract with you, you have the right to receive a copy of that data in a structured, commonly used, machine-readable format. You may also request that xabaji transmit this data directly to another service provider where technically feasible.

Right to Object

You have the right to object to xabaji's processing of your personal data where that processing is based on our legitimate interests. You also have an absolute right to object to the use of your data for direct marketing purposes, which xabaji will honour immediately upon receipt of your objection.

Data Retention Policy

xabaji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following describes the retention periods applied to the main categories of personal data held by xabaji.

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised. xabaji applies automated retention schedules to ensure that data is not held beyond its required period without active review.

Changes to This Privacy Policy

xabaji reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, the "Last Updated" date displayed at the top of this page will be revised, and registered players will be notified via the email address held on their account.

We encourage you to review this Privacy Policy periodically to stay informed about how xabaji handles your personal data. Your continued use of the xabaji platform following the publication of any updated Privacy Policy constitutes your acknowledgement of the changes.

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data xabaji holds about you, please contact our dedicated support team. We are available 24 hours a day, 7 days a week, and will handle all privacy-related enquiries in English.