Privacy Policy — How nbaj Protects Your Personal Data

01 Information We Collect

nbaj collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and occasionally from third-party service providers such as payment processors. The categories of data we collect are described in detail below.

1.1 Registration & Account Data

When you create an nbaj account, we collect the following information:

• Full legal name — as it appears on your government-issued identification document.
• Date of birth — used to verify that you meet the 18+ age requirement.
• Residential address — including division, district, and postcode within Bangladesh.
• Mobile phone number — used for OTP verification, security alerts, and (if consented to) promotional SMS.
• Email address — used for account notifications, support correspondence, and (if consented to) promotional emails.
• Account credentials — your chosen username and a hashed representation of your password. nbaj never stores your password in plain text.
• 6-digit withdrawal PIN — stored in encrypted form, used exclusively to authorise withdrawal requests.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer obligations, we may request and retain copies of the following documents when your account reaches the relevant activity thresholds:

• National Identity Card (NID), passport, or Bangladesh driving licence.
• Proof of residential address (utility bill, bank statement, or official correspondence dated within 90 days).
• Payment method verification (screenshot or statement confirming ownership of the bKash, Nagad, Rocket, or bank account linked to your nbaj account).
• Source of funds documentation, where requested for large deposit volumes in accordance with AML obligations.

KYC documents are stored in an encrypted document vault with access restricted to authorised compliance personnel only. These documents are not used for any purpose other than identity verification, fraud prevention, and legal compliance.

1.3 Financial Transaction Data

We record all financial transactions associated with your account, including:

• Deposit amounts, timestamps, payment method used, and transaction reference numbers.
• Withdrawal requests, amounts, destination payment method, and processing status.
• Bonus credits, wagering activity, and promotion redemption history.
• Account wallet balance history, including all debit and credit events.

nbaj does not store full bKash wallet numbers, Nagad PINs, or bank card numbers on our own servers. Payment credentials are processed and tokenised by the respective payment provider and only a masked reference is retained in our records.

1.4 Gameplay & Betting Data

We record a complete log of your gaming and betting activity on the platform. This includes every bet placed, game session initiated, round outcome, odds accepted, live casino table joined, slot spin recorded, and any crash game round participated in. This data is retained for dispute resolution, responsible gaming monitoring, and regulatory compliance purposes. It is not sold or shared for commercial profiling.

1.5 Technical & Device Data

When you access nbaj, our servers and analytics systems automatically record certain technical information:

• IP address — used for geographic access verification, fraud detection, and abuse prevention. IP logs are retained for 90 days unless flagged for investigation.
• Device type and operating system — used to optimise platform rendering and detect anomalous access patterns.
• Browser type and version — used for compatibility and security assessment.
• Session timestamps — login time, logout time, and total session duration per visit.
• Referral source — the URL or channel through which you arrived at nbaj.bid, if applicable.

1.6 Communication Data

We retain records of all support interactions conducted through live chat and email, including the content of messages exchanged, timestamps, issue categories, and resolution outcomes. These records are kept for quality assurance, dispute resolution, and training purposes and are stored for a minimum of 2 years.

02 How We Use Your Information

nbaj processes personal data only for clearly defined, legitimate purposes. We do not use your information in ways that are incompatible with the purposes described at the time of collection. The table below maps each data category to its primary processing purpose and the legal basis on which that processing relies.

2.1 Responsible Gaming Monitoring

nbaj uses automated analysis of gameplay and deposit patterns to identify indicators of problem gambling behaviour. This processing is conducted in the legitimate interests of player welfare and does not constitute commercial profiling. Alerts generated by this system are reviewed by the responsible gaming team and may result in outreach to the player concerned or activation of protective account restrictions.

2.2 Fraud & AML Detection

We apply automated and manual review processes to detect fraud, money laundering, and bonus abuse. This processing is a legal obligation under applicable anti-money laundering frameworks. Where suspicious activity is identified, we may be legally required to file a report with relevant financial intelligence authorities without notifying the account holder.

2.3 Marketing Communications

nbaj may send you promotional messages by SMS or email relating to new games, seasonal offers (Eid, Pohela Boishakh, BPL season), deposit bonuses, and loyalty rewards — but only if you have given explicit consent during registration or have subsequently opted in through your account settings. Each marketing message includes a clear opt-out instruction. Withdrawing marketing consent does not affect your ability to use the nbaj platform or receive service-related communications.

03 Data Sharing & Third Parties

nbaj does not share your personal data with external parties except in the specific, limited circumstances described below. All third-party processors engaged by nbaj are contractually required to handle your data in accordance with strict confidentiality and security standards consistent with the principles of this Privacy Policy.

3.1 Payment Service Providers

To process deposits and withdrawals, nbaj shares the minimum necessary transaction data with the relevant payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. The data shared is limited to the transaction amount, your account reference, and the payment credential token provided by the processor. Each payment provider operates under its own privacy policy and data protection framework, which we encourage you to review independently.

3.2 Game Software Providers

Live casino games hosted by Evolution Gaming, Ezugi, and Pragmatic Play Live may involve the transmission of a pseudonymous player identifier and session data to the studio's game servers for the purpose of rendering the game and recording outcomes. No directly identifying personal information (such as your name, address, or payment details) is shared with game studios. Game providers are contractually restricted from using session data for any purpose other than game delivery and dispute resolution.

3.3 Identity Verification Partners

nbaj may engage third-party KYC verification service providers to assist with document authentication and liveness checks during enhanced verification workflows. These providers receive only the data necessary to perform the specific verification task and are prohibited from retaining your documents beyond the verification period.

3.4 Legal & Regulatory Disclosure

nbaj may disclose personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts where required to do so by applicable law, a valid legal order, or where disclosure is necessary to protect the rights, property, or safety of nbaj, its players, or the public. We will notify affected players of such disclosure requests where we are legally permitted to do so.

3.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving nbaj, player data may be transferred to the acquiring entity as part of the transaction. In such circumstances, nbaj will ensure that the receiving entity is bound by privacy obligations no less protective than those set out in this Privacy Policy. Affected players will be notified in advance of any such transfer where practicable.

04 Cookies & Tracking Technologies

nbaj uses cookies and similar tracking technologies to operate the platform, maintain your session state, remember your preferences, and analyse aggregate usage patterns. By continuing to use the nbaj website after being informed of this policy, you consent to the use of cookies as described below.

4.1 Types of Cookies Used

4.2 Managing Cookie Preferences

You can manage or disable non-essential cookies through the cookie preferences panel accessible from the footer of any nbaj page, or through your browser's built-in cookie management settings. Please note that disabling essential cookies will impair your ability to log in, maintain a game session, or process transactions on the platform. nbaj does not respond to browser-level "Do Not Track" signals, but you may control our analytics cookies independently of your browser settings through the platform's preference panel.

4.3 No Third-Party Advertising Cookies

nbaj does not deploy third-party advertising or retargeting cookies (such as Google Ads, Facebook Pixel, or similar tracking pixels) on the platform. No data about your nbaj browsing or betting activity is shared with advertising platforms for the purpose of serving you targeted advertisements on other websites or applications.

05 Data Security & Storage

nbaj implements a layered security architecture to protect personal and financial data against unauthorised access, disclosure, alteration, and destruction. The following technical and organisational measures are among those currently in place:

• 256-bit SSL/TLS encryption on all data in transit between your device and nbaj servers.
• Encryption at rest for database records containing personal identifiers, KYC documents, and financial data.
• Bcrypt password hashing — passwords are never stored in plain text and cannot be recovered even by nbaj staff.
• Role-based access controls (RBAC) — internal access to personal data is restricted strictly to staff roles that require it for their function.
• Multi-factor authentication (MFA) required for all staff accessing internal administrative systems.
• Regular penetration testing conducted by independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Intrusion detection and monitoring — 24/7 automated alerting for anomalous access patterns, brute-force attempts, and unusual data export activity.
• Secure data backup — encrypted backups stored in geographically separate facilities with access controls equivalent to the primary environment.
• Incident response plan — a documented and tested procedure for detecting, containing, and notifying affected parties in the event of a data breach.

5.1 Player Responsibility

While nbaj takes all reasonable technical precautions to protect your data, the security of your account also depends on actions taken on your side. You are responsible for keeping your password confidential, not sharing your withdrawal PIN with any third party, logging out after each session when using a shared device, and reporting any suspected unauthorised access to [email protected] immediately. nbaj cannot be held liable for data breaches resulting from the compromise of your own device or credentials through means outside of our control.

06 Data Retention

nbaj retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable legal, regulatory, and contractual obligations. The general retention periods for each data category are as follows:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual. Anonymised and aggregated data (from which no individual can reasonably be identified) may be retained indefinitely for statistical and business analysis purposes.

6.1 Account Closure & Data Deletion Requests

If you request the closure of your nbaj account, your personal data will be retained for the post-closure period specified above, as required by law. During this period, your account will be deactivated and inaccessible, but the data will remain on secure storage for compliance purposes. Once the retention period expires, all personal data associated with your account will be permanently and irreversibly deleted. Deletion requests that conflict with legal retention obligations will be acknowledged with a clear explanation of why the data cannot yet be removed and when deletion is expected to occur.

07 Your Privacy Rights

nbaj respects your rights over your own personal data. The following rights are available to all players who hold or have held an nbaj account. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". All requests are processed within 30 days of receipt.

1. Right of Access: You may request a copy of all personal data nbaj holds about you, including your account information, transaction history, KYC records, and gameplay logs. We will provide this in a commonly used electronic format.
2. Right to Rectification: If any personal data held by nbaj is inaccurate or incomplete, you may request that it be corrected. Please note that corrections to identity or KYC data may require re-verification of supporting documents.
3. Right to Erasure: You may request the deletion of your personal data. This right is subject to legal retention obligations (see Section 6). Where deletion is not immediately possible due to those obligations, we will inform you of the earliest date on which deletion can take place.
4. Right to Restrict Processing: In certain circumstances — such as while a dispute is being investigated — you may request that nbaj restrict the processing of your data to storage only, without using it for any other purpose.
5. Right to Data Portability: You may request a structured, machine-readable export of the personal data you have provided to nbaj, for the purpose of transferring it to another service provider of your choice.
6. Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though nbaj may continue processing where it can demonstrate compelling legitimate grounds that override your interests.
7. Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7.1 Complaints

If you are dissatisfied with how nbaj has handled your personal data or responded to a privacy rights request, we encourage you to contact our support team in the first instance so that we may attempt to resolve the matter directly. Written complaints submitted to [email protected] will receive a formal written response within 14 days.

08 Changes to This Policy

nbaj reviews this Privacy Policy periodically and will update it whenever there are material changes to our data processing practices, applicable legal requirements, or the services we offer. The date of the most recent revision is displayed prominently in the hero section at the top of this page.

Where changes are material — meaning they meaningfully affect the way we collect, use, or share your personal data — we will notify all registered players via the email address on their account at least 14 days before the revised policy takes effect. For minor clarifications or corrections that do not change the substance of how your data is handled, the updated policy will be published without prior individual notification.

Continued use of the nbaj platform after a revised Privacy Policy comes into effect constitutes your acceptance of the updated terms. If you do not agree with the changes, you should discontinue use of the platform and contact [email protected] to request account closure before the revised policy takes effect.

8.1 Contact for Privacy Matters

For all privacy-related queries, data subject requests, or concerns about how nbaj handles your personal information, please contact us using the details below:

We are committed to addressing every privacy concern promptly, transparently, and with the seriousness it deserves. Your trust in nbaj depends on our consistent respect for your personal data, and we take that responsibility seriously.