sbaji Privacy Policy

sbaji operates as an online sports betting and casino platform serving players located in Bangladesh. In the course of providing our services — including account registration, deposit and withdrawal processing, customer support, and promotional communications — we necessarily collect and process certain personal data about our registered players.

sbaji is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This Privacy Policy is designed to give you a complete and honest account of our data practices so that you can make informed decisions about your use of the Platform.

This policy applies to all personal data collected through the sbaji website at sbaji.io, any associated subdomains, mobile web interfaces, and all communications between sbaji and registered players via email or support channels. It applies to all players based in Bangladesh and to any other individuals whose data is processed in connection with sbaji's services.

For the avoidance of doubt, this Privacy Policy should be read alongside sbaji's Terms and Conditions and Responsible Gaming policy, both of which form part of the overall agreement between you and sbaji.

sbaji collects the following categories of personal data from players, depending on the nature of your interaction with the Platform:

sbaji collects personal data through the following channels and methods:

• Direct submission by you: Data you actively provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or responding to promotional surveys.
• Automated collection: Technical data such as IP addresses, device identifiers, browser types, and session logs are collected automatically when you access the Platform through our server logs, analytics systems, and fraud detection infrastructure.
• Cookies and tracking technologies: sbaji uses cookies and similar technologies on our website to support session management, remember account preferences, and measure website performance. See Section 7 for full details on our cookie practices.
• Payment providers: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, or a cryptocurrency channel, the payment provider may share transaction confirmation data (such as transaction reference numbers and timestamps) with sbaji for the purpose of reconciling your account balance. sbaji does not receive your full payment credentials from these providers.
• Identity verification services: Where sbaji uses a third-party KYC or identity verification service to verify your age or identity, that service may provide confirmation of verification status and relevant identity data back to sbaji.
• Fraud detection and anti-abuse systems: sbaji's fraud prevention systems may correlate data across sessions, accounts, and transactions to identify prohibited conduct such as multi-accounting, bonus abuse, and money laundering activity.

sbaji processes your personal data only for specific, defined purposes. We do not use your data for any purpose beyond those listed below without first obtaining your explicit consent or updating this Privacy Policy with advance notice.

• Account management: To create, maintain, and administer your sbaji account, including verifying your identity and age (21+ requirement), resetting your password, and managing your account preferences.
• Service delivery: To process your wagers, settle bets, credit winnings, and maintain accurate records of your gaming activity on the Platform.
• Payment processing: To process deposit and withdrawal requests via bKash, Nagad, Rocket, Upay, USDT, and Bitcoin, and to maintain auditable transaction records.
• Customer support: To respond to your support queries, investigate account issues, and resolve disputes submitted to [email protected].
• Responsible gaming: To monitor your gaming behaviour for indicators of problem gambling, to apply deposit limits or self-exclusion restrictions you have requested, and to proactively reach out where we identify potential harm.
• Fraud prevention and security: To detect and prevent fraudulent activity, multi-accounting, money laundering, underage gambling, and other prohibited conduct. This includes automated analysis of account and transaction patterns.
• Promotional communications: To send you personalised promotional offers, bonus notifications, and platform updates by email or in-platform notification — but only where you have opted in to marketing communications. You may withdraw this consent at any time by contacting [email protected].
• Legal and regulatory compliance: To comply with applicable legal obligations, including responding to lawful requests from competent authorities, maintaining required records, and fulfilling any anti-money laundering (AML) obligations.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the sbaji Platform's performance, user experience, and product offerings. This analysis does not identify individual players.

sbaji processes your personal data on the following legal grounds, depending on the specific purpose of the processing:

• Contractual necessity: The majority of our data processing — including account management, payment processing, bet settlement, and customer support — is necessary for the performance of the contract between you and sbaji (your account agreement and our Terms and Conditions). Without this data, we would be unable to provide the sbaji service to you.
• Consent: Where we send you promotional or marketing communications, we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate interests: sbaji processes certain data on the basis of our legitimate business interests, including fraud prevention, platform security, and the improvement of our services. We only rely on this basis where our interests are not overridden by your privacy rights and interests.
• Legal obligation: Where we are required to process or retain data to comply with an applicable legal obligation — for example, transaction record-keeping requirements or responses to lawful authority requests — we process such data on the basis of legal obligation.

sbaji does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. We share your data only in the following limited and controlled circumstances:

• Payment processing partners: We share relevant transaction data with bKash, Nagad, Rocket, Upay, and our cryptocurrency payment processors solely for the purpose of completing your requested deposits and withdrawals. These partners process your data as independent controllers under their own privacy policies.
• Identity verification (KYC) providers: Where KYC verification is required, we may share your identity documents and verification request data with a trusted third-party verification service. This service processes your data strictly on our behalf and under contract.
• Game technology providers: Your gaming session data (such as game round IDs and bet amounts) is shared with licensed game providers — including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe — to the extent required to deliver their game content through the sbaji Platform. These providers operate under strict contractual and regulatory obligations.
• Fraud and security service providers: sbaji works with specialist fraud detection and cybersecurity service providers who process account and transaction data on our behalf to identify and prevent prohibited conduct. These providers are contractually bound to use your data only for the purposes sbaji has specified.
• Legal and regulatory authorities: sbaji may disclose your personal data to law enforcement agencies, regulatory authorities, or other competent bodies where we are required to do so by applicable law, court order, or other legal process. We will notify you of such disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of sbaji's assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify affected players of any such transfer and the privacy choices available to them.

The sbaji website uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. A cookie is a small text file placed on your device by our web server when you visit sbaji.io. The following types of cookies are used on the Platform:

• Essential cookies: These cookies are strictly necessary for the Platform to function. They enable core features such as maintaining your logged-in session, remembering your language and currency preferences, and keeping your account secure during a session. These cookies cannot be disabled without significantly impairing the functionality of the Platform.
• Analytics cookies: sbaji uses aggregated, anonymised analytics data to understand how players navigate the Platform, which pages receive the most traffic, and where users may encounter difficulties. This data helps us improve the Platform's performance and usability. Analytics cookies do not identify individual players.
• Fraud prevention cookies: sbaji's anti-fraud and device fingerprinting systems use cookies and similar identifiers to associate browsing sessions with registered accounts and to detect patterns indicative of multi-accounting, automated bots, or other prohibited conduct.
• Preference cookies: These cookies remember settings you have chosen on the Platform, such as your preferred notification settings, to save you from re-entering preferences on each visit.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored on your device. Please note that blocking essential cookies will prevent you from logging in and using the sbaji Platform effectively. For more information on managing cookies in your specific browser, please consult your browser's help documentation.

sbaji does not use cookies to serve third-party advertising or to track your activity across unrelated websites.

sbaji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: All personal data associated with an active sbaji account is retained for the full duration of your account relationship with sbaji.
• Closed account data: Following account closure — whether initiated by you or by sbaji — we retain your identity, contact, financial, and gaming data for a minimum period of five (5) years. This retention period is required to comply with applicable anti-money laundering (AML) record-keeping obligations and to allow for the resolution of any post-closure disputes.
• Transaction records: Records of all deposits, withdrawals, and bet settlements are retained for a minimum of five (5) years from the date of each transaction.
• KYC / identity verification documents: Copies of identity verification documents (NID, passport, selfie) are retained for the duration of the account relationship and for five (5) years after account closure.
• Support communications: Email correspondence and support ticket records are retained for three (3) years from the date of the last communication, unless the subject matter relates to an ongoing dispute or formal complaint, in which case records are retained until the matter is fully resolved.
• Marketing data: Where you have opted in to marketing communications, your contact details and preference data are retained until you withdraw consent or for two (2) years from your last engagement with a marketing communication, whichever comes first.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

sbaji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes the following key controls:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and the sbaji Platform is protected by industry-standard 256-bit SSL/TLS encryption. This ensures that your login credentials, personal details, and payment information cannot be intercepted in transit.
• Password security: sbaji stores account passwords as salted cryptographic hashes — your actual password is never stored in readable form in our systems. Even in the unlikely event of a data breach, your password cannot be recovered from our stored hash.
• Access controls: Access to personal data within sbaji's internal systems is restricted on a strict need-to-know basis. Staff members access only the data required to perform their specific job function, and all access is logged and audited.
• Payment data isolation: sbaji does not store full payment credentials for bKash, Nagad, Rocket, or Upay accounts. Payment transactions are completed through the respective provider's secure interface, and sbaji receives only transaction confirmation references, not raw payment credentials.
• Intrusion detection and monitoring: sbaji operates continuous network monitoring and intrusion detection systems to identify and respond to potential security threats in real time.
• Session management: Active sessions on the sbaji Platform are subject to automatic timeout after periods of inactivity to reduce the risk of unauthorised access to unattended devices.
• Regular security assessments: sbaji conducts periodic security assessments and vulnerability testing of its Platform infrastructure to proactively identify and remediate potential weaknesses.

As a registered player whose personal data is processed by sbaji, you hold the following rights in relation to that data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [your username]". We will respond within 30 days of receiving your request.

• Right of access: You have the right to request a copy of all personal data that sbaji holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: If you believe that any personal data sbaji holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: In certain circumstances — for example, where you withdraw consent and there is no other legal basis for processing, or where the data is no longer necessary for the original purpose — you may request that sbaji delete your personal data. Please note that this right is subject to sbaji's legal and regulatory obligations to retain certain data for specified minimum periods (see Section 8).
• Right to restrict processing: You may request that sbaji restrict the processing of your personal data in specific circumstances, such as where you contest the accuracy of the data or object to our processing on legitimate interest grounds.
• Right to data portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object at any time to the processing of your personal data where that processing is based on legitimate interests. You also have an unconditional right to object to the processing of your data for direct marketing purposes.
• Right to withdraw consent: Where sbaji processes your data on the basis of your consent — for example, for marketing communications — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

sbaji strictly prohibits the use of its Platform by individuals under the age of 21. The sbaji service is designed exclusively for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21.

During the account registration process, sbaji requires all applicants to confirm that they are 21 years of age or older. sbaji also conducts age verification checks as part of its KYC process and reserves the right to require documentary proof of age at any point during the account lifecycle.

If sbaji becomes aware that personal data has been collected from an individual who is under the age of 21, we will take immediate steps to delete that data from our systems and close the associated account. Any funds deposited by an underage player will be returned via the original payment method after deducting any amounts required for regulatory reporting purposes.

Parents and guardians who believe that a minor in their care has registered a sbaji account or provided personal data to sbaji are encouraged to contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

The sbaji Platform may, from time to time, contain references or navigational links to third-party websites or services — for example, links to payment provider information pages or game studio information. These third-party sites operate independently of sbaji and are governed by their own privacy policies.

sbaji has no control over the content, privacy practices, or data handling of any third-party website, and we accept no responsibility or liability for those practices. We strongly recommend that you review the privacy policy of any third-party site you visit before submitting any personal data to it.

The presence of a link to a third-party site on the sbaji Platform does not constitute an endorsement, recommendation, or approval of that site's content or privacy practices by sbaji.

sbaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or improvements to our Platform. The most current version of this Privacy Policy will always be available at sbaji.io/privacy-policy and will display the effective date of the most recent revision at the top of the document.

Where we make material changes to this Privacy Policy — meaning changes that significantly affect how we collect, use, or share your personal data — we will provide advance notice of at least seven (7) days via email to the address registered on your sbaji account, or via a prominent in-platform notification displayed upon login.

Your continued use of the sbaji Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised policy. If you do not agree with the changes, you should cease using the Platform and may close your account in accordance with the procedures described in the Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to sbaji's data practices more generally, please contact our dedicated data privacy support team using the details below. All communications should be submitted in English. Our support team is available 24 hours a day, 7 days a week, including Bangladesh public holidays.

• Email: [email protected]
• Subject line for data rights requests: "Data Rights Request — [your username]"
• Subject line for privacy concerns: "Privacy Concern — [brief description]"
• Support hours: 24/7, Bangladesh Standard Time (UTC+6)
• Response time: Within 30 days for formal data rights requests; within 48 hours for general privacy enquiries

sbaji is committed to resolving all privacy-related enquiries fairly and promptly. Where a concern cannot be resolved through direct communication with our support team, you retain the right to escalate the matter through any dispute resolution mechanism described in the Terms and Conditions.