Your Privacy Matters to Us

1 Information We Collect

When you interact with xabj — whether by visiting the website, registering an account, making a deposit, or contacting our support team — we may collect various categories of personal information. The specific data collected depends on the nature of your interaction with the platform.

Information You Provide Directly

The following information is collected when you register an account or update your profile on xabj:

• Identity data: Full legal name, date of birth, gender, and national identity card or passport number (collected during KYC verification).
• Contact data: Email address, mobile phone number registered in Bangladesh, and residential address including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or Barisal).
• Account credentials: Username and encrypted password. Passwords are stored using one-way hashing and are never accessible in plain text by xabj staff.
• Payment data: Mobile money account details (bKash, Nagad, Rocket, Upay), bank account references, and transaction records. Full card numbers are not stored on xabj servers; card processing is handled by PCI-DSS-compliant payment processors.
• Verification documents: Copies of government-issued identification, proof of address, and proof of payment method ownership, submitted as part of the KYC process.
• Support communications: The content of messages you send to xabj's support team via email or live chat, together with timestamps and resolution notes.

Information Collected Automatically

When you visit xabj.net or use the platform, certain technical data is collected automatically through your browser or device:

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, time spent on each page, click-through paths, game sessions accessed, bet history, and deposit and withdrawal activity.
• Geolocation data: Approximate location derived from your IP address, used to verify that you are accessing the platform from a permitted jurisdiction.
• Cookies and tracking data: Data collected via cookies, web beacons, and similar technologies as described in the Cookies & Tracking section of this policy.

Data Categories Summary

Data Category	Examples	Collection Method
Identity	Name, date of birth, NID number	Registration, KYC form
Contact	Email, phone, address	Registration form
Financial	bKash/Nagad details, transaction history	Deposit/withdrawal flows
Technical	IP address, browser, device type	Automatic (server logs)
Behavioural	Game sessions, bet history, page views	Automatic (platform activity)
Communications	Support emails, chat transcripts	Direct submission

2 How We Use Your Data

xabj processes your personal data only for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we use your personal information are as follows:

Account Management and Service Delivery

We use your identity and contact data to create and maintain your xabj account, verify your eligibility to use the platform, authenticate your identity at login, and deliver the gaming services you have requested. This processing is necessary for the performance of the contract between you and xabj.

Payment Processing

Your financial data is used to process deposits and withdrawals, reconcile transaction records, detect and prevent payment fraud, and comply with anti-money laundering obligations. Transaction records are retained in accordance with the Data Retention section of this policy. All payment data is shared with payment processors (bKash, Nagad, Rocket, Upay, and banking partners) solely to the extent necessary to complete the transaction.

Identity Verification and Regulatory Compliance

xabj is required to verify the identity of its players as part of its Know Your Customer (KYC) and responsible gaming obligations. Verification documents are processed to confirm that you are who you say you are, that you are of legal gambling age (18+), and that you are not a politically exposed person or subject to financial sanctions. This processing is necessary for compliance with applicable legal obligations.

Responsible Gaming Monitoring

Behavioural and usage data — including deposit frequency, session length, betting patterns, and loss trajectories — is analysed to identify signs of problem gambling. Where such signs are detected, xabj may contact you with responsible gaming information or, where required, apply account restrictions. This processing is carried out in your vital interests and as part of xabj's responsible gaming commitments.

Fraud Prevention and Security

Technical data (including IP address, device fingerprint, and login history) is used to detect and prevent fraudulent account access, bonus abuse, collusion, and other prohibited activities described in xabj's Terms & Conditions. This processing is necessary for the legitimate interests of xabj in maintaining platform integrity and protecting all players.

Marketing Communications

With your explicit consent at the time of registration (or subsequently via account settings), xabj may send you promotional emails and platform notifications about bonuses, seasonal promotions (including Eid offers, BPL season promotions, and T20 World Cup specials), and new game releases. You may withdraw this consent at any time by clicking "Unsubscribe" in any marketing email or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to withdrawal.

Platform Improvement and Analytics

Aggregated and anonymised usage data is analysed to understand how players interact with xabj, identify technical issues, optimise page performance, and improve the overall user experience. This data is processed in anonymised or pseudonymised form and cannot be used to identify individual players.

3 Data Sharing & Third Parties

xabj does not sell, rent, or trade your personal information to any third party for their own marketing purposes. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose.

Payment Service Providers

To process your deposits and withdrawals, xabj shares the minimum necessary financial and identity data with authorised payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and card processing networks (Visa, Mastercard). Each payment provider operates under its own privacy policy and is bound by contractual data processing obligations with xabj.

Game and Technology Providers

xabj's gaming catalogue is powered by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive limited session and player data necessary to facilitate game play, calculate RTP, and resolve disputes. Game providers do not receive your full identity or payment details; they receive only the pseudonymous identifiers required to operate their games within the xabj environment.

KYC and Identity Verification Partners

To fulfil its age verification and anti-money laundering obligations, xabj may engage third-party identity verification services. These services receive your verification documents and identity data solely for the purpose of confirming your identity and will not use your data for any other purpose.

Legal and Regulatory Disclosures

xabj may be required to disclose personal data to law enforcement agencies, courts, or regulatory authorities in Bangladesh or other applicable jurisdictions where required by law, court order, or regulatory directive. In such cases, xabj will disclose only the minimum data required to comply with the legal obligation and will, where legally permissible, notify the affected player of the disclosure.

Business Transfers

In the event that xabj undergoes a merger, acquisition, restructuring, or sale of all or a substantial part of its assets, your personal data may be transferred to the successor entity as part of that transaction. We will notify affected players of any such transfer via the registered email address and will ensure that the successor entity is bound by privacy obligations at least as protective as those in this policy.

4 Cookies & Tracking

xabj uses cookies and similar tracking technologies to operate the platform effectively, remember your preferences, and analyse usage patterns. This section explains what cookies are, which types xabj uses, and how you can manage your cookie preferences.

What Are Cookies?

A cookie is a small text file placed on your device by a website you visit. Cookies allow the website to recognise your device on subsequent visits, remember your settings, and collect information about how you use the site. Cookies do not contain executable code and cannot directly harm your device.

Types of Cookies Used by xabj

Cookie Type	Purpose	Duration
Strictly Necessary	Session management, login authentication, CSRF protection, load balancing	Session / up to 24 hours
Functional	Remembering language preferences, display settings, and last-visited game category	Up to 12 months
Analytics	Measuring page performance, identifying technical errors, understanding user journeys	Up to 13 months
Responsible Gaming	Tracking session duration to support time-limit reminders and responsible gaming alerts	Session

Managing Your Cookie Preferences

Strictly necessary cookies cannot be disabled as they are essential for the platform to function. For all other cookie categories, you may manage your preferences through your browser settings. Most modern browsers allow you to block or delete cookies via the browser's privacy or settings menu. Please note that disabling functional or analytics cookies may affect the performance of certain xabj features and may require you to re-enter preferences on each visit.

For detailed guidance on managing cookies in your specific browser, refer to your browser's official help documentation. Common browsers used by players in Bangladesh include Google Chrome, Mozilla Firefox, Microsoft Edge, and Samsung Internet for Android.

5 Data Security & Storage

xabj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated regularly to reflect evolving security standards.

Technical Security Measures

• Transport encryption: All data exchanged between your browser or app and xabj servers is encrypted using TLS 1.2 or higher (256-bit SSL). The xabj.net domain is served exclusively over HTTPS.
• Encryption at rest: Sensitive personal data and financial records stored in xabj's databases are encrypted at rest using AES-256 encryption.
• Password security: Account passwords are stored as salted, one-way cryptographic hashes. xabj staff cannot retrieve your password in plain text under any circumstances.
• Access controls: Access to personal data within xabj's systems is restricted to authorised personnel on a strict need-to-know basis. All internal data access is logged and auditable.
• Intrusion detection: xabj employs automated intrusion detection and anomaly monitoring systems that operate continuously to detect and respond to suspicious activity.
• Regular security audits: xabj's security infrastructure is subject to periodic independent security assessments and penetration testing.

Data Breach Response

In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, xabj will take immediate steps to contain the breach, assess its scope, and mitigate its impact. Affected players will be notified as promptly as possible via their registered email address, with clear information about what data was involved, what steps xabj is taking, and what players can do to protect themselves.

Data Storage Location

xabj stores personal data on secure servers. All data processing activities related to players in Bangladesh are carried out in compliance with applicable data protection principles. Data may be transferred to or accessed from locations outside Bangladesh where necessary for the provision of services (for example, by game providers or payment processors operating internationally). In all such cases, xabj ensures that appropriate contractual safeguards are in place to protect your data.

6 Your Privacy Rights

As a registered player on xabj, you have a number of rights with respect to the personal data we hold about you. xabj is committed to facilitating the exercise of these rights promptly and without undue delay. To exercise any of the rights described below, please contact us at [email protected] with the subject line "Privacy Rights Request".

Right of Access

You have the right to request a copy of the personal data xabj holds about you, together with information about how it is processed, who it is shared with, and how long it is retained. xabj will respond to verified access requests within 30 days of receipt.

Right to Rectification

If any personal data held by xabj is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your contact number or address) can be made directly via your account settings. For corrections to identity or KYC data, please contact support with supporting documentation.

Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent on which processing is based, or where the processing was unlawful. Please note that certain data must be retained for defined periods to comply with legal obligations (including anti-money laundering record-keeping requirements) and cannot be deleted on request during those retention periods.

Right to Restrict Processing

In certain circumstances — such as where you contest the accuracy of data held about you — you may request that xabj restricts processing of that data while the accuracy is verified. During a restriction period, xabj will continue to store the data but will not process it for other purposes.

Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and where the processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON).

Right to Object to Marketing

You may object to the processing of your personal data for direct marketing purposes at any time. Upon receipt of such an objection, xabj will immediately cease processing your data for marketing purposes. You can unsubscribe from marketing communications via the link in any marketing email, or by contacting [email protected].

7 Data Retention

xabj does not retain personal data for longer than is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule summarises our standard retention periods by data category.

Data Category	Retention Period	Basis for Retention
Account & Identity Data	Duration of account + 5 years after closure	Legal obligation (AML/KYC record-keeping)
Financial Transaction Records	7 years from transaction date	Legal obligation (financial reporting)
KYC Verification Documents	Duration of account + 5 years after closure	Legal obligation (AML compliance)
Game Session & Bet History	3 years from session date	Legitimate interest (dispute resolution)
Support Communications	3 years from last interaction	Legitimate interest (complaint resolution)
Marketing Consent Records	Duration of consent + 3 years	Legal obligation (demonstrating consent)
Technical / Server Logs	90 days (rolling)	Legitimate interest (security monitoring)

Upon expiry of the applicable retention period, personal data is either securely deleted or anonymised in a manner that makes re-identification impossible. Anonymised data may be retained indefinitely for statistical and analytical purposes without restriction.

8 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which xabj handles your personal data, please contact us using the details below. All privacy-related correspondence must be in English. We aim to acknowledge all enquiries within 2 business days and to provide a full response within 30 days.

Data Privacy Contact

Email: [email protected] (subject line: "Privacy Rights Request" or "Privacy Enquiry")
Support Hours: Available 24 hours a day, 7 days a week
Response Language: English
Service Area: Players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh

Complaints

If you are not satisfied with xabj's response to a privacy rights request or privacy enquiry, you have the right to escalate your complaint. xabj encourages players to first attempt to resolve any concern directly with our support team, as most issues can be resolved promptly at this level. If you remain dissatisfied following xabj's internal complaints process, you may seek further recourse through applicable consumer protection or data protection channels available in your jurisdiction.

Policy Updates

xabj reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform features. Where material changes are made, xabj will notify registered players via email at least 14 days before the changes take effect, providing a summary of what has changed and a link to the revised policy. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. Continued use of the xabj platform following notification of a policy update constitutes your acknowledgement of the revised policy.