cbaje Privacy Policy — How We Handle Your Data

Introduction

cbaje ("we", "us", "the Platform") operates the online gaming platform accessible at cbaje.ws. In the course of providing our services to registered players across Bangladesh, we collect, process, and store certain categories of personal data. This Privacy Policy sets out in plain terms how that data is handled, who may access it, how long we retain it, and what rights you have as a data subject.

By registering an account on cbaje or by continuing to use the platform after this Privacy Policy has been made available to you, you acknowledge that you have read and understood its contents. If you disagree with any part of this policy, you should discontinue use of the platform and may request account closure by contacting our support team at [email protected].

Your Data Rights at a Glance

1. What Data We Collect

cbaje collects personal data in three broad categories: data you provide directly when creating and managing your account, data generated automatically when you use the platform, and data received from third-party payment processors when you make deposits or withdrawals.

Data You Provide Directly

• Registration data: full name, date of birth, registered mobile number (used as account identifier and for OTP verification), and preferred language.
• Identity verification documents: national ID, passport, or other government-issued identification submitted during KYC verification.
• Correspondence: messages sent to cbaje support, feedback submissions, and complaint records.
• Responsible gaming preferences: deposit limits, session reminders, and self-exclusion elections recorded at your request.

Data Generated Automatically

• Device and connection data: device type, operating system version, browser type, mobile network operator, and IP address at time of login.
• Gameplay and transaction logs: games played, bet amounts, game outcomes, deposit history, withdrawal history, and bonus activity. These records are retained for audit and regulatory compliance purposes.
• Session data: login timestamps, session duration, pages visited, and navigation patterns within the platform.

Data from Payment Partners

• Transaction reference numbers and status confirmations from bKash, Nagad, Rocket, Upay, and bank transfer partners.
• Partial masked card numbers (last four digits only) for Visa and Mastercard transactions.
• Payment account holder name confirmation used for identity matching and anti-fraud checks.

2. How We Use Your Data

cbaje uses the personal data we collect for the following purposes. Each purpose is matched to a lawful basis described in Section 3 below:

• Account creation and management: to register your account, verify your identity, and maintain your account profile throughout your time on the platform.
• Transaction processing: to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, and card payment channels.
• Customer support: to respond to your enquiries, resolve complaints, and provide assistance with account and gameplay issues.
• Fraud prevention and security: to detect, investigate, and prevent fraudulent transactions, money laundering, underage access, and other prohibited conduct.
• Responsible gaming: to administer deposit limits, session reminders, cooling-off periods, and self-exclusion settings requested by players or triggered by our responsible gaming monitoring systems.
• Platform improvement: to analyse aggregate, anonymised gameplay and navigation data for the purpose of improving game selection, platform performance, and the overall user experience.

3. Legal Basis for Processing

cbaje processes personal data only where a lawful basis exists. The bases we rely on are:

• Contract performance: processing necessary to fulfil our obligations under the account agreement — including account management, transaction processing, and customer support.
• Legal obligation: processing required to comply with anti-money laundering (AML), know-your-customer (KYC), and other applicable legal obligations.
• Legitimate interests: processing necessary for fraud detection, platform security, abuse prevention, and improving the platform — where such interests are not overridden by your rights and freedoms.
• Consent: where you have explicitly opted in to receive promotional communications or marketing messages, cbaje will process the relevant contact data on the basis of your consent. You may withdraw consent at any time by contacting support.

4. Sharing Your Data

cbaje does not sell your personal data. We share data only in the following limited circumstances, and only to the extent strictly necessary:

• Payment processors: we share transaction-related data (amount, reference, account identifier) with bKash, Nagad, Rocket, Upay, and banking partners solely to process your deposit and withdrawal requests.
• Game providers: game providers such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and Microgaming may receive your account session token (not your personal identity) to facilitate gameplay. They do not receive your name, mobile number, or financial data.
• Law enforcement and regulatory bodies: where required by law or court order, cbaje will disclose relevant personal data to competent authorities. We will notify you of such disclosure where permitted to do so.
• Service providers: third-party IT infrastructure, hosting, and technical service providers who process data on our behalf under strict data processing agreements. They are not permitted to use your data for their own purposes.

All third parties who receive personal data from cbaje are contractually bound to protect that data and to use it only for the specific purpose for which it was shared. cbaje does not transfer personal data to parties outside of those described above.

5. Payment Data and Financial Information

cbaje does not store full payment credentials. For mobile financial service transactions via bKash, Nagad, Rocket, and Upay, cbaje retains only the transaction reference number, the amount, and the masked sender identifier (typically a mobile number with the middle digits replaced). For card transactions, cbaje retains only the last four digits of the card number, the card type (Visa or Mastercard), and the transaction reference. Full card numbers, CVV codes, and expiry dates are never stored on cbaje's systems.

All financial data transmitted between you and cbaje — including deposit requests, withdrawal requests, and transaction confirmations — is protected by 256-bit SSL encryption. This is the same encryption standard used by major international banks.

6. Cookies and Tracking Technologies

cbaje uses cookies and similar lightweight tracking technologies to operate the platform, maintain your login session, remember your preferences, and analyse how the platform is used in aggregate. We do not use third-party advertising cookies or tracking pixels that report your activity to external ad networks.

Types of Cookies We Use

• Strictly necessary cookies: required for the platform to function, including session management, login state, and security tokens. These cannot be disabled without breaking core functionality.
• Functional cookies: used to remember your language preference, display settings, and responsible gaming tool configurations between sessions.
• Analytics cookies: used to collect anonymised, aggregated data about how players navigate the platform. This data is used exclusively to improve platform performance and is never linked back to an individual player's identity.

Most mobile browsers allow you to control cookie settings. Restricting necessary cookies may affect your ability to log in or use certain platform features. For functional and analytics cookies, you may adjust your preferences at any time through your account settings or by contacting support.

7. Data Retention

cbaje retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply: active account data is retained for the lifetime of the account; transaction records are retained for a minimum of five (5) years from the date of the transaction in accordance with standard financial record-keeping requirements; KYC and identity verification documents are retained for a minimum of five (5) years from the date of account closure or last transaction, whichever is later.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual. Backup copies are subject to the same deletion schedule and are not retained beyond the standard retention period for the relevant data category.

8. Data Security

cbaje implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include: 256-bit SSL/TLS encryption for all data in transit between your device and our servers; OTP-based two-factor authentication at account login and during password resets; access controls that limit staff access to personal data on a strict need-to-know basis; regular security testing of platform infrastructure; and segregation of player funds from operational funds.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cbaje will notify affected players without undue delay via their registered mobile number. We will also take immediate steps to contain and remediate the breach.

9. Your Data Rights

As a player on cbaje, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team at [email protected] with your registered mobile number and a description of your request. We will respond within thirty (30) days:

• Right of access: you may request a copy of all personal data cbaje holds about you, including what categories of data are held, the purposes for which they are processed, and with whom they have been shared.
• Right to rectification: if any personal data we hold about you is inaccurate or incomplete, you may ask us to correct it. We will action your request promptly.
• Right to erasure: you may ask us to delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully. This right is subject to our legal retention obligations.
• Right to restrict processing: you may ask cbaje to suspend processing of your personal data in certain circumstances — for example, while a rectification request is pending or while you contest the lawfulness of processing.
• Right to data portability: you may request that cbaje provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider where technically feasible.

cbaje will not charge a fee for handling data rights requests. We reserve the right to verify your identity before actioning a request. Where a request is manifestly unfounded or excessive, we may decline to action it and will explain our reasons in writing.

10. Children and Minors

cbaje is strictly an adults-only platform. The minimum age to register an account or use any of cbaje's services is 21 years. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that we have collected personal data from a person under 21, we will immediately suspend the relevant account, void any associated transactions, and securely delete all personal data associated with that account. If you have reason to believe that a minor is using cbaje, please contact us immediately at [email protected].

11. Updates to This Policy

cbaje may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When material changes are made, we will notify registered players via SMS to their registered mobile number at least five (5) days before the updated policy takes effect. The date at the top of this page always shows when the policy was last revised. Continued use of the platform after the effective date of an updated policy constitutes acceptance of the revised terms.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how cbaje handles your personal data, please contact our support team. We are available 24 hours a day, 7 days a week and will respond to all privacy-related enquiries within thirty (30) days.

Email: [email protected]