bajili Privacy Policy

1 Who We Are and How to Contact Us

bajili ("we", "us", "our") operates the online casino and sports betting platform accessible at bajili.app. bajili is the data controller responsible for the personal data of players who register and use the platform. As data controller, bajili determines the purposes and means by which personal data is processed in connection with the operation of the platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data bajili holds about you, please contact our Data Protection team using the details below. bajili is committed to responding to all data-related enquiries within 30 calendar days of receipt.

2 What Personal Data We Collect

bajili collects the following categories of personal data in connection with the registration, operation, and maintenance of player accounts on the platform. The specific data points collected within each category are described below.

bajili does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond identity photographs submitted for KYC), or health data, except where expressly required in connection with responsible gaming self-exclusion requests or similar protective measures.

3 How We Collect Your Data

bajili collects personal data through the following channels and mechanisms:

• Direct collection: Data you provide voluntarily when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or submitting feedback.
• Automated collection: Technical and usage data collected automatically during your interactions with the bajili platform, including through server logs, cookies, and similar tracking technologies (see Section 7).
• Third-party sources: Identity and address verification data received from our KYC service providers when you undergo account verification. Financial transaction data received from payment processors such as bKash, Nagad, Rocket, and Upay. Fraud risk signals received from our fraud prevention partners.

bajili will always make clear at the point of collection which data fields are mandatory (required to operate the account or fulfil a legal obligation) and which are optional. Declining to provide mandatory data may prevent bajili from opening or maintaining your account or processing certain transactions.

4 How We Use Your Personal Data

bajili uses the personal data we collect for the following specific purposes. Each purpose is tied to a lawful basis for processing, as detailed in Section 5.

• To create, manage, and maintain your bajili account, including authenticating your identity on login.
• To process deposits, withdrawals, and other financial transactions, including reconciliation and record-keeping.
• To conduct identity verification (KYC) and age verification in accordance with our responsible gaming and anti-money laundering obligations.
• To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, money laundering, and other prohibited activities.
• To operate and improve the bajili platform, including diagnosing technical issues, analysing usage patterns, and developing new features.
• To provide customer support, respond to enquiries, handle complaints, and resolve disputes.
• To apply and monitor responsible gaming tools, including deposit limits, loss limits, self-exclusion, and time-out features.
• To send transactional communications, including account confirmations, deposit receipts, withdrawal notifications, and security alerts.
• To send promotional communications about bajili bonuses, offers, and platform updates, where you have consented to receive such communications or where bajili has a legitimate interest in informing existing players of relevant offers.
• To comply with applicable legal and regulatory obligations, including responding to lawful requests from competent authorities.

5 Legal Bases for Processing

bajili processes personal data only where a valid legal basis exists for doing so. The principal legal bases on which bajili relies are as follows:

• Contract performance: Processing necessary to create your account, fulfil your bets, process your deposits and withdrawals, and perform all other obligations under our Terms & Conditions.
• Legal obligation: Processing required to comply with applicable anti-money laundering laws, age verification requirements, and other regulatory obligations to which bajili is subject.
• Legitimate interests: Processing necessary for bajili's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and improving the quality and safety of the platform — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and optional analytics cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing and Third-Party Disclosure

bajili does not sell, rent, or trade your personal data. We share personal data only with the following categories of third parties, and only to the extent necessary for the purposes described in this Policy:

• Payment processors: bKash, Nagad, Rocket (Dutch-Bangla Bank Mobile Banking), and Upay receive transaction data necessary to execute deposits and withdrawals on your behalf.
• Identity verification (KYC) providers: Specialist third-party services that assist bajili in verifying the identity and age of players as required by our responsible gaming and anti-money laundering policies.
• Fraud prevention and security services: Providers of device fingerprinting, IP analysis, and transaction monitoring services used to detect and prevent prohibited activity on the platform.
• IT and platform infrastructure providers: Cloud hosting, content delivery, and database service providers that store and process data on bajili's behalf under strict data processing agreements.
• Game content providers: Where required for the technical operation of third-party games (e.g., Pragmatic Play, Evolution Gaming, Spribe), limited session and account data may be transmitted to enable game functionality. Game providers do not receive your full personal profile.
• Legal and regulatory authorities: bajili will disclose personal data to competent authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction, or where necessary to protect bajili's legal rights.

All third parties with whom bajili shares personal data are contractually required to maintain the confidentiality and security of that data and to use it only for the specific purposes authorised by bajili. bajili does not permit third-party processors to use your data for their own independent purposes.

7 Cookies and Tracking Technologies

bajili uses cookies and similar tracking technologies on the bajili.app platform to support platform functionality, analyse user behaviour, and in some cases deliver relevant promotional content. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function correctly, including maintaining your login session, remembering your language preferences, and enabling secure transactions. These cookies cannot be disabled without significantly impairing platform functionality.
• Functional cookies: Used to remember your preferences and settings (such as game display options or responsible gaming limits you have set) so that you do not need to reconfigure them on each visit.
• Analytical cookies: Used to collect aggregated, anonymised data about how players interact with the platform, which pages are most visited, and where technical errors occur. This data is used to improve the bajili platform and player experience. Analytical cookies are set only with your consent.
• Marketing cookies: Used to deliver promotional content relevant to your interests based on your activity on the bajili platform. Marketing cookies are set only with your explicit consent and can be withdrawn at any time via your account settings.

You may manage your cookie preferences at any time through the cookie settings panel available within the bajili platform or through your browser's privacy settings. Please note that disabling certain cookies may affect the functionality of the platform.

8 Data Retention

bajili retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying applicable legal, regulatory, accounting, and reporting requirements. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active status and for a period of five (5) years following account closure.
• Financial transaction records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• KYC and identity verification documents: Retained for five (5) years from the date of verification or from the date of account closure, whichever is later.
• Customer support correspondence: Retained for three (3) years from the date of the last correspondence, or longer if the correspondence relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of your consent and for one (1) year thereafter as evidence of the consent given.
• Technical and usage logs: Retained for up to twelve (12) months for operational and security purposes, after which they are anonymised or deleted.

When personal data is no longer required for any active purpose and the applicable retention period has expired, bajili will securely delete or anonymise that data in a manner that prevents reconstruction of the original information.

9 International Data Transfers

bajili's platform infrastructure may involve the storage or processing of personal data outside of Bangladesh, including in data centres operated by our cloud infrastructure partners. Where personal data is transferred internationally, bajili takes appropriate measures to ensure that such transfers are conducted securely and in accordance with applicable data protection standards.

These measures may include contractual data processing agreements with our service providers that incorporate internationally recognised data protection clauses, encryption of data in transit and at rest, and access controls that restrict data access to authorised personnel only. bajili does not transfer personal data to jurisdictions that do not maintain adequate protections for personal data without first implementing appropriate safeguards.

10 Your Data Rights

As a bajili player, you hold the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact bajili's Data Protection team at [email protected] with the subject line "Data Rights Request".

• Right of access: You have the right to request a copy of the personal data bajili holds about you, along with information about how that data is processed.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you.
• Right to erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to limitations where bajili is required to retain data for legal, regulatory, or fraud-prevention purposes.
• Right to restrict processing: You have the right to request that bajili restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of data or object to its processing.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling, and to processing for direct marketing purposes. Objections to marketing will always be honoured without conditions.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

bajili will respond to all data rights requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, in which case bajili will notify you of the extension and its reasons within the initial thirty-day period.

11 Children's Privacy

bajili is strictly an 18+ platform. bajili does not knowingly collect, store, or process personal data relating to individuals under the age of 18. The registration process for bajili accounts includes a mandatory age confirmation step, and bajili conducts age verification checks as part of its KYC programme.

If bajili becomes aware that personal data has been collected from an individual who is under 18 years of age, that data will be deleted immediately, the associated account will be permanently closed, and any funds held in the account will be handled in accordance with bajili's underage account policy as set out in the Terms & Conditions. Parents or guardians who believe a minor may have registered an account with bajili are encouraged to contact [email protected] immediately for investigation and resolution.

12 Security Measures

bajili implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the bajili platform.
• AES-256 encryption for personal data stored in bajili's databases and file storage systems.
• Role-based access controls ensuring that only authorised bajili personnel with a documented need can access personal data.
• Multi-factor authentication requirements for all bajili staff accounts with access to personal data systems.
• Regular third-party security audits and penetration testing of the bajili platform infrastructure.
• Continuous automated monitoring for suspicious access patterns, data exfiltration attempts, and other security anomalies.
• Documented incident response procedures ensuring that data breaches are identified, contained, and reported in accordance with applicable legal requirements and within defined timeframes.

While bajili takes every reasonable precaution to protect your personal data, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your bajili account credentials. If you suspect that your account has been compromised, please contact bajili support immediately at [email protected].

13 Changes to This Privacy Policy

bajili reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, legal requirements, or platform functionality. When material changes are made, bajili will notify registered players by email and/or by posting a prominent notice on the bajili platform no less than fourteen (14) days before the changes take effect, except where immediate changes are required for legal or security reasons.

The date of the most recent revision is displayed at the top of this document. The current version of this Privacy Policy is always accessible at bajili.app/privacy-policy. Your continued use of the bajili platform following the effective date of any revision constitutes your acknowledgement of the updated Privacy Policy. If you do not agree with any changes, you should close your account before the changes take effect.

14 Contact and Data Enquiries

For all privacy-related enquiries, data rights requests, or concerns about how bajili processes your personal data, please contact our Data Protection team using the details below. bajili is committed to handling all data-related communications with care, confidentiality, and within the response timeframes stated in this Policy.

• Data Privacy Email: [email protected] — Subject line: "Data Privacy Enquiry" (plain text, not a clickable link)
• Data Rights Requests: [email protected] — Subject line: "Data Rights Request"
• Response Commitment: All privacy enquiries are acknowledged within 2 business days and fully resolved within 30 calendar days unless an extension is required.
• Underage Account Reports: [email protected] — Subject line: "Underage Account Report" for priority handling.

For general platform support unrelated to data privacy, please visit the bajili Help Centre via your account dashboard or refer to our FAQ page for answers to common questions.