Privacy Policy — bdbhaji

1. Information We Collect

bdbhaji collects personal data from you through several channels: directly when you register an account or interact with our services, automatically as you navigate the platform, and from third-party payment processors and identity verification partners. The categories of data we collect are described below.

1.1 Registration & Account Data

• Full legal name and date of birth (used for age and identity verification).
• Username chosen at registration — this is your public-facing identifier on the platform.
• Email address — used for account communications, security alerts, and promotional messages where you have opted in.
• Bangladeshi mobile number — required for SMS-based two-step verification and for linking your bKash or Nagad mobile wallet for deposits and withdrawals.
• Residential address in Bangladesh — collected during enhanced identity verification (KYC) checks.
• Government-issued identification documents (National Identity Card number, passport number) — requested during KYC; images or scans are stored in encrypted form and accessed only by authorised compliance staff.

1.2 Financial & Transaction Data

• Deposit and withdrawal amounts in Bangladeshi Taka (৳), transaction timestamps, and reference numbers.
• Mobile financial service account identifiers (bKash, Nagad, Rocket, Upay account numbers registered in your name) — stored in masked format after verification.
• Bank account details where bank transfer is used (BRAC Bank, City Bank, Islami Bank, Sonali Bank, Dutch-Bangla Bank, etc.).
• Wagering history: game types, stake amounts, outcomes, bonus usage, and session durations.

1.3 Technical & Usage Data

• IP address and approximate geolocation data — used for fraud detection, access control, and regulatory compliance.
• Device type, operating system, browser type and version — collected to optimise platform rendering and detect suspicious access patterns.
• Session logs including login times, page navigation sequences, and feature interactions — used for security monitoring and platform performance analytics.
• Referral source information (if you arrived at bdbhaji via an affiliate link or promotional URL).

1.4 Communications Data

• Records of live chat conversations with bdbhaji support agents — retained for quality assurance and dispute resolution purposes.
• Email correspondence between you and bdbhaji in connection with account queries, complaints, or verification requests.
• Feedback and survey responses submitted voluntarily through the platform.

3. Data Sharing & Third Parties

bdbhaji does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share data only where necessary to operate the platform, meet legal obligations, or protect the interests of our players. The categories of third parties with whom we may share your data are set out below.

• Payment processing partners: bKash, Nagad, Rocket, Upay, and banking partners (BRAC Bank, City Bank, Islami Bank, Sonali Bank, Dutch-Bangla Bank) receive the minimum financial data necessary to execute deposit and withdrawal transactions. Each payment partner operates under its own privacy policy and data security obligations.
• Identity verification providers: Where bdbhaji uses a third-party KYC service to verify identity documents, your name, date of birth, and document images may be transmitted to that provider over an encrypted channel. Verification providers are contractually bound to process your data solely for the purpose of completing the verification check.
• Game content providers: Certified game studios including Pragmatic Play, Evolution Gaming, Spribe, Microgaming, Ezugi, and NetEnt may receive anonymised session identifiers necessary to deliver game content and record game outcomes. No personally identifiable information beyond an anonymised player token is shared with game providers.
• Fraud prevention and security services: bdbhaji may share IP addresses, device fingerprints, and transaction patterns with specialist fraud prevention partners to identify and block suspicious activity. This processing is based on our legitimate interest in maintaining a secure platform.
• Legal and regulatory authorities: bdbhaji will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid legal process, or a court order. We will notify affected players of such disclosures to the extent permitted by law.
• Platform infrastructure providers: Cloud hosting and server infrastructure providers who process data on our behalf under strict data processing agreements that prohibit them from using your data for any purpose other than providing infrastructure services to bdbhaji.

All third-party processors engaged by bdbhaji are required to implement technical and organisational security measures equivalent to or exceeding those applied by bdbhaji itself. We conduct periodic due diligence reviews of our key data processing partners to verify continued compliance with data security standards.

5. Data Security Measures

bdbhaji applies a layered security architecture to protect your personal and financial data from unauthorised access, accidental loss, destruction, or disclosure. Our security programme encompasses technical, physical, and organisational controls aligned with industry best practices for online gaming platforms.

• Encryption in transit: All data exchanged between your device and bdbhaji is encrypted using TLS 1.3. Our SSL certificate is validated and renewed on a continuous basis. HTTPS is enforced across all pages — there is no HTTP fallback.
• Encryption at rest: Personal data stored in bdbhaji databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised backend systems and authenticated administrative users with logged access trails.
• Password hashing: Account passwords are never stored in plain text. bdbhaji uses bcrypt with a high work factor to hash all user passwords prior to storage. The original password is irrecoverable from the stored hash.
• Two-step SMS verification: All registered accounts may activate SMS-based two-step verification (2SV) using your registered Bangladeshi mobile number. When enabled, any login from an unrecognised device requires an SMS confirmation code in addition to your password. We strongly recommend enabling 2SV on your account.
• Session management: Active sessions are terminated automatically after a defined period of inactivity. Session tokens are rotated on authentication events. Concurrent session detection alerts are generated for simultaneous logins from different IP addresses.
• Access controls: Internal access to player personal data is restricted on a need-to-know basis using role-based access control (RBAC). All internal data access events are logged and subject to regular audit review.
• Incident response: bdbhaji maintains a documented security incident response procedure. In the event of a data breach that poses a risk to your rights and freedoms, affected players will be notified promptly via their registered email address with details of the breach and recommended protective actions.

While bdbhaji implements robust security controls, no internet-connected system can be guaranteed to be completely secure. You also play an important role in protecting your account — keep your password unique and confidential, enable two-step verification, and contact support immediately if you suspect unauthorised activity on your account.

7. Your Privacy Rights

As a registered player on bdbhaji, you have the following rights in relation to your personal data. These rights may be subject to limitations where their exercise would conflict with our legal obligations — for example, our obligation to retain financial records for AML compliance purposes.

• Right of access: You may request a copy of the personal data bdbhaji holds about you. We will provide this in a structured, machine-readable format within 14 business days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update most registration details (email address, mobile number, display preferences) directly from your account settings page.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where the data has been processed unlawfully. This right is subject to our legal retention obligations — financial transaction records and KYC documents must be retained for the periods specified in Section 6 regardless of an erasure request.
• Right to restrict processing: You may request that bdbhaji restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where processing is unlawful but you prefer restriction to erasure.
• Right to data portability: Where processing is based on your consent or a contract, you may request that we provide your personal data in a portable format so that it can be transferred to another service provider of your choice.
• Right to object: You may object to the processing of your personal data where bdbhaji relies on its legitimate interests as the lawful basis. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where we process your data on the basis of your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing. To withdraw consent for marketing messages, update your preferences in account settings or contact support.

To exercise any of the above rights, please contact the bdbhaji data team via in-platform live chat or by sending a written request to the support email address displayed in the footer of this page. We will verify your identity before processing any data subject request to prevent unauthorised disclosure. All requests will be actioned within 14 business days. There is no fee for submitting a data subject request.