Your Privacy Matters to sbaje

1. Data We Collect

sbaje collects personal data from players registered in Bangladesh through several distinct channels. We collect only the information that is necessary to deliver our services, verify player identity, process payments, and fulfil our responsible gaming obligations. The categories of personal data we collect are described below.

1.1 Registration Data

When you create an sbaje Account, we collect the information you provide directly:

• Full legal name (as it appears on your National Identity Card or passport)
• Date of birth (used for mandatory age verification — sbaje is an 18+ platform)
• Email address
• Mobile phone number (used for account security and payment verification)
• Residential address in Bangladesh (city, district, and postal code)
• Preferred currency (Bangladeshi Taka, BDT)
• Username and encrypted password

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, sbaje may request copies of identity documents to verify the information you provided at registration. This may include:

• National Identity Card (NID) issued by the Bangladesh Election Commission
• Valid passport or birth registration certificate
• Proof of address — such as a utility bill, bank statement, or official correspondence from a Bangladeshi authority dated within the last three months
• Proof of payment method ownership (for example, a screenshot confirming bKash or Nagad account registration in your name)

KYC documents are uploaded through our secure verification portal and handled in accordance with the data security standards described in Section 7 of this policy.

1.3 Transaction Data

Every financial transaction conducted through the sbaje platform generates a record that we retain for regulatory and fraud-prevention purposes:

• Deposit amounts, timestamps, and the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Withdrawal requests, amounts, destination account identifiers (e.g., bKash mobile number), and processing status
• Bonus credits and bonus usage history
• Wallet balance snapshots at the time of each transaction

1.4 Betting and Gaming Activity Data

sbaje records all betting and gaming activity associated with your Account, including:

• Sports bets placed — market, selection, stake, odds, and settlement outcome
• Casino game sessions — game title, provider (e.g., Pragmatic Play, Evolution Gaming, Spribe), session duration, stakes, and results
• Bet slip history, including voided and pending bets
• Responsible gaming tool usage — deposit limit changes, cool-off activations, self-exclusion requests

1.5 Technical and Device Data

When you access the sbaje platform, our servers and analytics systems automatically collect certain technical information:

• IP address and approximate geolocation (used to validate Bangladesh-market access and detect VPN usage)
• Device type, operating system, and browser version
• Session start and end times, pages visited, and features interacted with
• Referring URL (the page or search result that directed you to sbaje)

2. How We Use Your Data

sbaje processes your personal data for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the original reason it was collected. The table below summarises our primary processing activities and their legal basis.

2.1 Marketing Communications

sbaje may send you promotional emails about upcoming offers, seasonal bonuses (for example, BPL season promotions, Eid special offers, or Pohela Boishakh cashback campaigns), and new platform features. You will only receive marketing communications if you opted in at the time of registration or subsequently updated your communication preferences in your Account dashboard. You may withdraw your consent at any time by updating your preferences in-account or by emailing [email protected] with the subject line "Unsubscribe".

2.2 Automated Decision-Making

sbaje uses automated systems to detect unusual betting patterns, potential bonus abuse, and signs of problem gambling. Where an automated process leads to a material decision about your Account — such as a temporary suspension or the triggering of a responsible gaming intervention — you have the right to request human review of that decision by contacting our support team.

3. Data Sharing

sbaje does not sell your personal data to third parties. We share your information only in the circumstances described below, and only to the extent necessary for the specified purpose.

3.1 Service Providers and Technology Partners

sbaje works with a carefully selected group of third-party service providers who process personal data on our behalf under strict data processing agreements. These include:

• Game providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session and stake data to deliver their games and calculate results. They do not receive your full registration profile.
• Payment processors — bKash, Nagad, Rocket, and Upay receive only the transaction details necessary to process your deposit or withdrawal. Card networks (Visa, Mastercard) receive tokenised payment references.
• Identity verification providers — KYC document review is conducted through a third-party verification platform operating under a data processing agreement with sbaje. Uploaded documents are stored on their encrypted servers and are not shared further.
• Analytics and platform monitoring tools — anonymised or pseudonymised session data may be processed by platform performance and fraud-monitoring tools to maintain service quality.

3.2 Legal and Regulatory Disclosures

sbaje may disclose your personal data to competent authorities, law enforcement agencies, or financial intelligence units where we are required to do so by applicable law, by a court order, or in connection with an investigation into fraud, money laundering, or match-fixing activity. In such circumstances, sbaje will disclose only the minimum data required and will, where legally permitted, notify you that a disclosure has been made.

3.3 Business Transfers

In the event that sbaje undergoes a merger, acquisition, or sale of substantially all of its assets, player data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer by email or via an on-platform announcement at least 30 days before the transfer takes effect, and you will be provided with the option to close your Account and withdraw your funds prior to completion.

4. Cookies & Tracking

The sbaje platform uses cookies and similar tracking technologies to deliver core functionality, remember your preferences, measure platform performance, and (where you have consented) personalise the experience. A cookie is a small text file stored on your device by your browser when you visit a website.

4.1 Categories of Cookies Used by sbaje

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. They cannot be disabled without breaking core functionality such as login and deposit flows.
• Functional Cookies: Remember your preferences such as language, display settings, and recently viewed game categories. These improve your experience but are not essential to core platform operation.
• Analytics Cookies: Collect anonymised data about how players navigate the platform — which pages are most visited, where users drop off, and how long sessions last. This data is used exclusively to improve sbaje's services and is not linked to individually identifiable profiles.
• Performance Cookies: Monitor platform response times and identify technical errors. These help our engineering team maintain platform stability and minimise downtime.

4.2 Managing Cookies

You can control and delete cookies through your browser settings. Most modern browsers (Chrome, Firefox, Safari, Edge) allow you to block third-party cookies, clear existing cookies, or receive a notification before a cookie is stored. Please note that disabling strictly necessary cookies will prevent you from logging in to your sbaje Account and accessing betting and gaming services. Blocking functional or analytics cookies will not affect your ability to use the platform but may reduce the quality of your experience.

4.3 Do Not Track

Some browsers transmit a "Do Not Track" (DNT) signal to websites. sbaje currently does not alter its data collection practices in response to DNT signals, as there is no universally accepted standard for interpreting and honouring DNT requests. If you have concerns about tracking, we recommend managing cookies directly via your browser settings as described above.

5. Data Retention

sbaje retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or accounting obligations. The retention periods applied to the main categories of personal data are as follows:

Once a retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual. Where data is anonymised rather than deleted, the resulting anonymised dataset may be retained indefinitely for aggregate analytics purposes.

6. Your Rights

As a data subject, you hold a set of rights with respect to the personal data sbaje holds about you. sbaje is committed to honouring these rights promptly and without undue obstruction. To exercise any of the rights listed below, please contact our data team at [email protected] with the subject line "Data Rights Request" and include your registered email address and Account username.

6.1 Summary of Your Data Rights

• Right of Access: You may request a copy of all personal data sbaje holds about you, along with information about how it is being used. We will provide this within 30 days of a verified request.
• Right to Rectification: If any personal data sbaje holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor account details (such as phone number or address) can also be updated directly through your Account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. Please note that where retention is required by legal obligation (for example, transaction records subject to anti-money-laundering rules), sbaje may be unable to delete certain data until the applicable retention period expires.
• Right to Restriction of Processing: In certain circumstances — for example, while a rectification request is being assessed — you may request that we restrict how your data is used without deleting it.
• Right to Data Portability: You may request a structured, machine-readable export of the personal data you provided to sbaje for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing carried out on the basis of sbaje's legitimate interests, including profiling for responsible gaming monitoring. sbaje will cease processing unless compelling legitimate grounds can be demonstrated that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7. Data Security

sbaje implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. No platform can guarantee absolute security, but we apply industry-standard best practices consistently across all systems that handle player data.

7.1 Technical Safeguards

• 256-bit SSL/TLS Encryption: All data transmitted between your device and sbaje's servers is encrypted using TLS 1.2 or higher. This applies to login requests, deposit flows, and all API calls made by our platform.
• Encrypted Data Storage: Sensitive fields — including passwords (stored as salted hashes), payment method identifiers, and KYC document files — are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. All staff who handle personal data undergo training on data protection obligations and are bound by confidentiality agreements.
• Intrusion Detection and Monitoring: sbaje's infrastructure is monitored around the clock for anomalous activity. Automated alerts are triggered by unusual login patterns, high-volume data queries, and other indicators of potential breach.
• Regular Security Audits: sbaje engages third-party security specialists to conduct periodic penetration testing and vulnerability assessments of our platform infrastructure.

7.2 Your Responsibilities

While sbaje takes robust measures to protect your data on our end, the security of your Account also depends on the steps you take. You are responsible for:

• Choosing a strong, unique password for your sbaje Account and not reusing it across other services
• Keeping your login credentials strictly confidential and not sharing them with any third party
• Logging out of your Account when using shared or public devices
• Notifying sbaje immediately at [email protected] if you suspect your Account has been accessed without your authorisation

7.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, sbaje will take immediate remediation action and notify affected individuals without undue delay. Notifications will be sent to the registered email address on your Account and will include a description of the nature of the breach, the data categories affected, the likely consequences, and the steps sbaje has taken or intends to take to address the breach.

8. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how sbaje has handled your personal data, please contact our support team in the first instance:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for privacy matters: "Privacy Policy Query" or "Data Rights Request"
• Response time: Within 72 hours for standard queries; within 30 calendar days for formal data rights requests
• Availability: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

sbaje is committed to resolving all privacy-related concerns promptly and fairly. If you are not satisfied with our response, you have the right to escalate your complaint through appropriate channels available to you under the laws applicable in Bangladesh.

8.1 Changes to This Privacy Policy

sbaje reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When material changes are made, we will provide prominent notice on the platform and, where practicable, send an email notification to your registered address at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the sbaje platform following the effective date of any revised Privacy Policy constitutes your acceptance of those changes.