Your Privacy Matters at rbaja

rbaja operates as the data controller for all personal data collected through the rbaja platform. As data controller, rbaja determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out in accordance with applicable data protection principles.

All data protection queries, access requests, and complaints should be directed to our support team using the contact details provided in Section 15 of this Policy. We aim to acknowledge all data-related requests within 5 business days and to resolve them fully within 30 calendar days.

rbaja collects the following categories of personal data from players:

Identity and Contact Data

• Full legal name as it appears on your National ID, passport, or birth certificate
• Date of birth (used for mandatory 21+ age verification)
• Residential address in Bangladesh (district, city, postal code)
• Mobile phone number linked to your registered payment account
• Email address (where provided for account communications)

Financial and Payment Data

• Mobile payment account numbers (bKash, Nagad, Rocket, Upay) used for deposits and withdrawals
• Deposit amounts, withdrawal amounts, and transaction histories
• KYC documentation submitted for identity and payment verification

Account and Gaming Activity Data

• Account username and encrypted password credential
• Betting history, game play records, wager amounts, and outcomes
• Bonus claims, wagering requirement progress, and promotion participation history
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)
• Account login timestamps and session durations

Technical and Device Data

• IP address and approximate geolocation (city/country level)
• Device type, operating system version, and browser type
• Referral source and landing page URL at the time of account registration
• Cookie identifiers and session tokens (see Section 8 for full cookie details)

Communications Data

• Records of live chat conversations and email correspondence with our support team
• Complaints, feedback submissions, and their resolution records

rbaja collects your personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automatically through platform use: When you browse the rbaja website or app, place bets, play casino games, or interact with any feature, our systems automatically collect technical and activity data.
• From payment processors: When you initiate a transaction through bKash, Nagad, Rocket, or Upay, we receive a transaction reference, amount, and sender account number from the relevant payment provider to reconcile your deposit or withdrawal.
• From identity verification services: Where we engage a third-party KYC provider to verify your identity documents, that provider shares a verification result and relevant identity data with us.
• From cookies and analytics tools: Our platform uses first-party cookies and analytics tools to understand how players navigate the site and to maintain session security. See Section 8 for details.

rbaja uses your personal data for the following purposes:

Where rbaja relies on consent as the legal basis for processing (e.g., marketing communications), you may withdraw that consent at any time by contacting [email protected] or updating your communication preferences within your account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

rbaja processes your personal data on the following legal grounds:

• Contract Performance: Processing that is necessary to register your account, accept your bets, process transactions, and deliver the services described in our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, anti-money-laundering record-keeping, and responsible gaming obligations.
• Legitimate Interests: Processing necessary for rbaja's legitimate business interests, including fraud detection, platform security monitoring, responsible gaming analytics, and product improvement — provided those interests are not overridden by your rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent at any time without penalty.

rbaja does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited circumstances:

• Payment Processors: bKash, Nagad, Rocket (Dutch-Bangla Bank), and Upay (United Commercial Bank) — to facilitate deposits and withdrawals. These providers receive only the data necessary to complete the transaction.
• Identity Verification Providers: Third-party KYC service providers engaged to verify government-issued identity documents during the account verification process.
• Fraud Prevention Services: We may share device fingerprint data, IP addresses, and transaction patterns with fraud detection service providers to identify and block suspicious activity.
• Responsible Gaming Bodies: In circumstances where a Player has self-excluded and is attempting to circumvent that exclusion across multiple platforms, limited data may be shared with responsible gaming networks.
• Legal and Regulatory Authorities: Where required by law, court order, or regulatory directive, rbaja will disclose personal data to the relevant authority. We will notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of rbaja's business, personal data held by rbaja may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

All third-party service providers engaged by rbaja are required to process personal data strictly in accordance with our instructions and to apply appropriate technical and organisational security measures.

All financial transactions on rbaja are processed through trusted Bangladesh mobile financial services — bKash, Nagad, Rocket, and Upay. rbaja does not store full payment credentials on its own servers. The mobile number associated with your payment account is stored as a reference for transaction reconciliation and withdrawal processing only.

rbaja applies the following standards to payment data handling:

• Payment transaction references are encrypted at rest using AES-256 encryption.
• Deposit and withdrawal records are retained for a minimum of 7 years in compliance with financial record-keeping obligations.
• rbaja will never request your bKash, Nagad, Rocket, or Upay PIN or full account password. If you receive any communication purporting to be from rbaja requesting such information, treat it as fraudulent and contact [email protected] immediately.

rbaja uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit our site. We use the following categories of cookies:

Strictly necessary cookies are placed without prior consent as they are essential for platform operation. Functional, analytics, and marketing cookies are placed only with your consent. You may manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies may prevent you from logging in or using core platform features.

rbaja retains personal data for the period necessary to fulfil the purpose for which it was collected, and for any additional period required by law. The following general retention guidelines apply:

• Active account data: Retained for the full duration of your account being active on the platform.
• KYC and identity verification records: Retained for a minimum of 5 years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of each transaction.
• Customer support communications: Retained for 3 years from the date of the last communication in a support case.
• Gaming activity logs: Retained for 2 years from the date of the activity, unless required longer for dispute resolution or regulatory purposes.
• Marketing consent records: Retained for 3 years from the date consent was given or last updated.
• Self-exclusion records: Retained indefinitely to prevent re-registration by excluded players.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where anonymised data is retained for aggregate analytics purposes, this is no longer considered personal data and is not subject to this Policy.

rbaja applies a layered security approach to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• TLS/SSL Encryption: All data transmitted between your device and the rbaja platform is encrypted in transit using TLS 1.2 or higher.
• Encryption at Rest: Sensitive personal data and financial records stored on our servers are encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Staff with access to player data are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication (2FA): All rbaja administrative systems require multi-factor authentication. We recommend that players also enable 2FA on their accounts where available.
• Regular Security Audits: rbaja conducts periodic internal security reviews and vulnerability assessments to identify and remediate potential weaknesses in our data infrastructure.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, rbaja will notify affected players without undue delay and will take immediate remediation action.

As a user of the rbaja platform, you have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered account details.

rbaja will respond to all valid data rights requests within 30 calendar days. In complex cases this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it. We will ask you to verify your identity before processing any data rights request.

rbaja is strictly a 21+ platform. We do not knowingly collect, process, or retain personal data relating to any individual under the age of 21. If you are under 21 years of age, you must not register an account, deposit funds, or participate in any betting or gaming activity on our platform.

If rbaja becomes aware that personal data has been collected from a person under 21 — whether through a false date of birth provided at registration or any other means — we will immediately suspend the account, void any associated transactions, and securely delete that individual's personal data from our systems, subject to any overriding legal obligation to retain records of the fraud attempt.

Parents and guardians who believe their child may have registered on rbaja should contact [email protected] immediately. We will investigate and take prompt action.

Where rbaja engages third-party service providers — such as KYC verification services, fraud detection platforms, or cloud infrastructure providers — that process data outside Bangladesh, we ensure that appropriate safeguards are in place to protect your personal data to a standard equivalent to that described in this Policy.

Safeguards for international transfers include contractual clauses that obligate the receiving party to protect your data, and where available, reliance on jurisdictions that provide an adequate level of data protection as recognised by applicable standards. We do not transfer personal data to jurisdictions with inadequate data protection frameworks without ensuring contractual protections are in place.

For information about the specific safeguards applied to any international data transfer affecting your personal data, contact us at [email protected].

rbaja reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will notify registered players by posting a prominent notice on the rbaja platform and, where we hold a valid email address for your account, by sending a direct notification to that address.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how rbaja protects your personal data. Your continued use of the platform following notification of any changes constitutes acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise a data right, or wish to raise a complaint about how rbaja has handled your personal data, please contact our support team using the details below.

Support Email: [email protected]

Please include "Privacy Policy" or "Data Rights Request" in your subject line so our team can route your message to the appropriate person promptly. We aim to acknowledge all privacy-related contacts within 2 business days.

Our support team operates 24 hours a day, 7 days a week, responding in English. For urgent data security concerns — such as suspected unauthorised access to your account — please use the live chat function on the rbaja platform for the fastest response. Live chat response times are under 2 minutes during normal operating conditions (Bangladesh Standard Time, UTC+6).