baja Privacy Policy

baja collects several categories of personal data from players who register and use the platform. The specific data collected depends on the services you access and the actions you take on the platform. Categories of data we may collect include:

Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identity documents (such as National ID, passport, or driver's licence) provided during Know Your Customer (KYC) verification.

Contact Data: Email address, mobile phone number, and residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, or Rajshahi) and postal code.

Financial Data: Payment method details (bKash account number, Nagad mobile number, Rocket account, bank account details for Dutch-Bangla Bank, BRAC Bank, or card details for Visa and Mastercard), transaction history including deposit and withdrawal amounts in BDT, and source-of-funds documentation where required by our anti-money laundering compliance framework.

Account Data: Username, encrypted password, account registration date, account status, session history, betting history, game play records, bonus usage, wagering activity, and responsible gaming preferences such as deposit limits and self-exclusion status.

Technical Data: IP address, device type, operating system, browser type and version, screen resolution, time zone setting (Bangladesh Standard Time, UTC+6), referring URLs, and unique device identifiers.

Usage Data: Information about how you navigate and interact with the baja platform, including pages visited, time spent on each section, click patterns, game categories browsed, search queries, and session duration.

Communications Data: Records of correspondence between you and baja's customer support team, including emails, live chat transcripts, complaint submissions, and feedback forms.

Verification Data: Selfies or photographs submitted for facial verification during enhanced KYC checks, and utility bills or bank statements provided as proof of address.

baja collects personal data through the following channels and mechanisms:

• Direct submission: Data you actively provide when registering your account, completing KYC verification, making a deposit or withdrawal, contacting customer support, completing a responsible gaming self-assessment, or updating your account profile.
• Automated technologies: Technical and usage data collected automatically when you visit and interact with the baja platform, including via cookies, web beacons, pixel tags, server logs, and local storage. See Section 06 for more detail on cookies and tracking technologies.
• Payment processors: Financial transaction confirmation data passed to baja by bKash, Nagad, Rocket, Upay, and card processing partners when a payment instruction is executed.
• Identity verification providers: Results of automated identity verification checks, including document authenticity scores and facial match confidence levels, provided by our third-party KYC service partners.
• Fraud and risk partners: Device fingerprint data, IP reputation scores, and behavioural risk signals provided by our anti-fraud and AML compliance technology partners.
• Publicly available sources: In limited circumstances, we may cross-reference data against publicly available sources such as sanctions lists, politically exposed persons (PEP) databases, and adverse media monitoring services as part of our compliance programme.

baja uses the personal data it collects for the following purposes:

baja processes your personal data only where a valid legal basis exists. The primary legal bases we rely on are as follows:

• Contractual necessity: Processing required to perform our contractual obligations to you under the baja Terms & Conditions, including account management, payment processing, bet settlement, and customer support.
• Legal obligation: Processing necessary to comply with applicable legal requirements, including anti-money laundering (AML) obligations, KYC verification requirements, sanctions screening, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing carried out for baja's legitimate business interests, provided those interests are not overridden by your fundamental rights. This includes fraud detection, platform security, responsible gaming monitoring, and internal analytics. We conduct a balancing test before relying on this basis.
• Consent: Processing for which you have given clear, freely given, specific, and informed consent, such as receiving marketing communications from baja. You may withdraw your consent at any time by contacting [email protected] or updating your communication preferences in account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

baja does not sell, rent, or trade your personal data to any third party for commercial gain. We may share your personal data with the following categories of recipients only to the extent necessary and for the purposes described in this Policy:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank, to the extent required to process your deposit and withdrawal transactions.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive limited technical session data to facilitate gameplay and resolve game disputes. These providers operate under contractual obligations to protect your data.
• KYC and identity verification providers: Third-party identity verification platforms that process identity documents and perform facial recognition checks on our behalf as data processors under strict contractual controls.
• Fraud prevention and AML partners: Technology providers who assist in detecting fraudulent account activity, suspicious transactions, and compliance screening against sanctions and PEP databases.
• IT and infrastructure providers: Cloud hosting, data storage, content delivery, and cybersecurity partners who process data as data processors on baja's behalf under binding data processing agreements.
• Legal and professional advisers: Lawyers, accountants, auditors, and compliance consultants who require access to data in the course of providing professional services to baja, under obligations of professional confidentiality.
• Law enforcement and regulatory authorities: Where required by applicable law, court order, or legitimate legal process, baja may disclose personal data to competent governmental bodies or law enforcement agencies. baja will, where legally permitted, notify the affected player of such disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of baja's business, personal data may be transferred to the acquiring entity as part of the transaction. Affected players will be notified of any change in data controller and their rights in connection with the transfer.

All third parties with whom baja shares personal data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose beyond the specific processing task assigned to them.

baja uses cookies and similar tracking technologies on its platform. Cookies are small text files stored on your device that help us recognise you, remember your preferences, and understand how you use our platform. The types of cookies we use include:

• Strictly necessary cookies: Essential for the platform to function correctly. These include session authentication tokens, security cookies used to prevent cross-site request forgery (CSRF), and cookies that remember your login state. These cookies cannot be disabled without affecting core platform functionality.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how players navigate and use the baja platform. This data helps us identify pages with high exit rates, slow load times, or usability issues so we can improve the player experience. No individually identifiable data is sent to analytics systems.
• Functional cookies: Used to remember your preferences such as selected language, last-visited game category, and responsible gaming settings so you do not need to reconfigure them on every visit.
• Fraud prevention cookies: Used to generate a device fingerprint that helps our security systems detect anomalous login activity, account takeover attempts, and multi-accounting behaviour.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in and using the baja platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

baja retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the lifetime of your baja account and for a minimum of 5 years following account closure, to meet anti-money laundering and fraud prevention record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping standards.
• Customer support communications: Retained for 3 years following the resolution of the relevant support case, complaint, or dispute.
• Marketing data (consent-based): Retained until you withdraw your consent to receive marketing communications, after which your contact details are removed from active marketing lists. A suppression record may be retained to ensure we honour your opt-out preference on an ongoing basis.
• Technical and usage logs: Retained for up to 24 months, after which they are deleted or permanently anonymised.

When personal data is no longer required and there is no legal basis for retention, baja will securely delete or irreversibly anonymise it. Secure deletion includes overwriting storage media to prevent recovery of deleted data.

baja employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• TLS/SSL encryption: All data transmitted between your device and the baja platform is encrypted using industry-standard TLS 1.2 or higher protocols, ensuring that data in transit cannot be intercepted in readable form.
• Encryption at rest: Sensitive personal data and financial records stored in baja's databases are encrypted at rest using AES-256 encryption.
• Access controls: Access to production systems and personal data is restricted to authorised personnel only, on a strict need-to-know basis. All privileged access is logged, monitored, and subject to regular review.
• Two-factor authentication (2FA): Internal staff accounts with access to player data require 2FA. Player-facing 2FA is enforced for login and withdrawal requests via OTP sent to your registered mobile number.
• Regular security testing: baja conducts periodic vulnerability assessments and penetration tests of its platform and infrastructure to identify and remediate security weaknesses before they can be exploited.
• Data breach response: In the event of a personal data breach that poses a risk to player rights and freedoms, baja will notify affected players and relevant authorities within 72 hours of becoming aware of the breach, where technically and legally feasible.

While baja maintains robust security measures, no internet-based platform can guarantee absolute immunity from all cyber threats. Players are encouraged to use strong, unique passwords for their baja accounts, enable OTP verification, and report any suspicious account activity to [email protected] immediately.

baja recognises and supports the following data rights for all players. To exercise any of these rights, submit a written request to [email protected]. baja will acknowledge your request within 5 business days and aim to respond substantively within 30 calendar days.

The baja platform is strictly intended for adults aged 21 years and above. baja does not knowingly collect, process, or retain personal data from any individual under the age of 21. Registration on the baja platform requires confirmation of age eligibility, and identity verification checks are conducted to enforce this requirement.

If baja becomes aware that personal data has been collected from a person under the age of 21 without the appropriate consent or in error, that data will be deleted immediately and the associated account will be permanently closed, with any balance forfeited in accordance with the baja Terms & Conditions.

Parents and guardians who believe their child may have registered on the baja platform are urged to contact [email protected] immediately so that the account can be investigated and closed without delay.

baja operates as an offshore platform, and some of the third-party service providers we work with — including cloud infrastructure providers, KYC verification partners, and game content providers — may be located in, or process data in, jurisdictions outside Bangladesh.

When personal data is transferred internationally, baja takes appropriate steps to ensure that the transfer is lawful and that an adequate level of protection is applied to your data in the receiving jurisdiction. These steps may include:

• Transferring data only to jurisdictions recognised as providing an adequate level of data protection.
• Entering into contractual agreements with data processors that impose binding data protection obligations equivalent to those described in this Policy.
• Applying technical safeguards, including end-to-end encryption, to data transmitted across international networks.

If you wish to obtain further information about the specific safeguards applied to international transfers of your personal data, please contact [email protected].

baja may update this Privacy Policy from time to time to reflect changes in our data practices, platform services, or applicable legal requirements. When updates are made, the revised Policy will be published on this page with a revised "Last Updated" date at the top of the document.

For material changes that significantly affect how we process your personal data, baja will provide advance notice via email to your registered address or via a prominent notice on the platform at least 14 days before the changes take effect. Your continued use of the baja platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

We encourage all players to review this Privacy Policy periodically to stay informed about how baja protects your personal data. Previous versions of this Policy are available upon request by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or the way baja processes your personal data, please contact our Data Protection team using the details below:

If you are not satisfied with how baja has handled your personal data or responded to your data rights request, you have the right to lodge a formal complaint. baja takes all privacy complaints seriously and will investigate every complaint submitted in good faith through the above contact channel.

baja is committed to resolving data protection disputes directly with players wherever possible. If a satisfactory resolution cannot be reached through our internal complaints process, you may seek further recourse through applicable legal channels in your jurisdiction.