mbaji Privacy Policy

Introduction

mbaji ("we", "us", "our", "the Platform") is committed to protecting the personal data of every player who uses our online betting and casino services at mbaji.cc. This Privacy Policy describes the types of personal information we collect, the purposes for which we use that information, the circumstances under which we may share it with third parties, the security measures we apply to protect it, and the rights available to you as a data subject.

This policy applies to all users of the mbaji website, mobile experience, and any associated tools or features — including visitors who browse the platform without registering an account. By accessing or using the mbaji platform in any capacity, you acknowledge that you have read this Privacy Policy and understand how your personal data will be processed.

This Privacy Policy is to be read alongside the mbaji Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference into this document.

Data Controller

For the purposes of this Privacy Policy, mbaji acts as the data controller in respect of all personal data collected from players and website visitors. As data controller, mbaji determines the purposes and means of processing your personal information and is responsible for ensuring that such processing complies with applicable data protection law.

If you have any questions about how mbaji processes your personal data, or if you wish to exercise any of the rights described in Section 11 of this policy, you may contact our dedicated privacy team using the contact details provided in Section 15.

Personal Data We Collect

mbaji collects personal data in several categories depending on how you interact with the platform. The categories of data we may collect are set out in the table below:

mbaji does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than identity photographs required for KYC), or health data, except where strictly required by applicable law or regulation.

How We Collect Your Data

mbaji collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting our support team, or participating in a promotion.
• Automated technologies: Technical and usage data collected automatically when you access the mbaji platform, including via cookies, server logs, and session tracking tools. See Section 8 for full details on our cookie practices.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and our banking partners when you initiate a deposit or withdrawal. We receive only the data necessary to confirm and reconcile the transaction — we do not store full mobile wallet PINs or bank login credentials.
• Identity verification partners: Where mbaji uses a third-party KYC service to assist with document verification, that partner may return a verification result and risk score to mbaji. The underlying document images are handled per the partner's own privacy policy and are not retained by mbaji beyond the verification window.
• Public sources: In limited fraud-prevention scenarios, mbaji may cross-reference publicly available information (such as publicly accessible court records or sanctions lists) to verify player identity or detect prohibited conduct.

How We Use Your Personal Data

mbaji uses the personal data we collect for the following specific purposes:

• Account creation and management: To register your mbaji account, verify your identity and age, maintain your account balance, and provide access to all platform features.
• Payment processing: To process deposits via bKash, Nagad, Rocket, Upay, and partner banks, and to execute withdrawal requests to your verified payment method.
• Legal and regulatory compliance: To fulfil our obligations under applicable Bangladeshi law, including anti-money laundering (AML) requirements, age verification mandates, and any requests from competent authorities.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, money laundering, and other prohibited conduct on the platform.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling behaviour, to enforce player-set deposit limits and self-exclusion requests, and to reach out proactively to players who may be at risk.
• Customer support: To respond to your enquiries, resolve disputes, and improve the quality of our support service through quality-assurance review of chat transcripts and support tickets.
• Platform improvement: To analyse aggregated usage data and identify opportunities to improve platform performance, game selection, and the overall player experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform news by email or SMS — but only where you have provided explicit consent to receive such communications and have not subsequently opted out. You may withdraw marketing consent at any time by contacting [email protected].
• Personalisation: To tailor the content you see on the mbaji platform — such as recommended games or relevant promotions — based on your activity history and preferences.

mbaji will never use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate, clearly communicated legal basis for the new use.

Legal Basis for Processing

mbaji processes your personal data only where a valid legal basis exists for doing so. The legal bases we rely on are as follows:

• Contract performance: Processing that is necessary to fulfil our contractual obligations to you under the mbaji Terms & Conditions — including account management, payment processing, and the delivery of betting and casino services.
• Legal obligation: Processing that is required to comply with applicable Bangladeshi law, regulatory requirements, court orders, or instructions from competent authorities — including AML checks, KYC verification, and data retention obligations.
• Legitimate interests: Processing that is necessary for mbaji's legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, security monitoring, platform analytics, and responsible gaming monitoring.
• Consent: Processing that is based on your freely given, specific, informed, and unambiguous consent — primarily for direct marketing communications. You have the right to withdraw this consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Data Sharing & Third Parties

mbaji does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with carefully selected third parties only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the minimum payment data necessary to process your deposit or withdrawal transactions. Each payment partner is contractually obligated to protect your data and use it solely for payment processing purposes.
• KYC and identity verification partners: A third-party identity verification service may process your KYC documents on mbaji's behalf. This partner is bound by a data processing agreement and may only use your data for the specific purpose of identity and age verification.
• IT and hosting service providers: mbaji's platform is hosted on secure servers managed by reputable cloud infrastructure providers. These providers act as data processors and are contractually prohibited from accessing or using player data for any purpose beyond providing the hosting service.
• Game content providers: Casino and sports betting content is delivered through integrations with licensed game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive your player session identifier and wager data in order to deliver game outcomes; they do not receive your full identity or financial data.
• Law enforcement and regulators: Where required by applicable Bangladeshi law, a valid court order, or a formal request from a competent regulatory or law enforcement authority, mbaji will disclose the minimum necessary personal data in compliance with that legal obligation.
• Professional advisers: mbaji's legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.

Cookies & Tracking Technologies

mbaji uses cookies and similar tracking technologies to operate the platform effectively and to understand how players interact with our services. A cookie is a small text file placed on your device by the mbaji website when you visit. Cookies do not contain your password or any directly sensitive financial information.

The types of cookies mbaji uses are:

• Essential cookies: Required for core platform functionality — including maintaining your login session, remembering your account preferences, and enabling secure payment flows. These cookies cannot be disabled without impairing your ability to use the platform.
• Analytical cookies: Used to collect anonymised and aggregated data about how visitors navigate the mbaji platform, which pages are most visited, and where users encounter errors. This data helps us improve the platform over time. No individual player is identifiable from analytical cookie data.
• Functional cookies: Used to remember your personalisation preferences, such as your preferred language setting or display options, so you do not need to reconfigure them on every visit.
• Marketing cookies: Used, with your consent, to deliver relevant promotional content and to track the effectiveness of mbaji marketing campaigns. These cookies are only activated where you have explicitly consented to marketing communications.

You may manage your cookie preferences through your browser settings at any time. Note that disabling essential cookies will affect your ability to log in and use core platform features. For a full breakdown of the specific cookies deployed by mbaji, please contact [email protected].

Data Retention

mbaji retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data (identity, contact, financial, and account data): Retained for the full duration of your active account relationship with mbaji, plus a minimum period of five (5) years following account closure, in compliance with AML record-keeping obligations under applicable Bangladeshi financial regulations.
• Transaction records (deposit and withdrawal history, bet records): Retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC documents (identity photographs, ID copies): Retained for the duration of the account relationship plus five years post-closure, then securely deleted or anonymised.
• Support communications (chat transcripts, emails): Retained for a period of two (2) years from the date of the communication, unless the communication forms part of an open dispute or legal proceeding, in which case it is retained until final resolution plus one year.
• Marketing consent records: Retained for as long as you remain opted in, plus a reasonable period following opt-out to demonstrate compliance with your withdrawal of consent.
• Technical and usage data: Typically anonymised or deleted within twelve (12) months of collection, unless retained in anonymised aggregate form for longer-term analytics purposes.

At the end of the applicable retention period, mbaji will securely delete or irreversibly anonymise your personal data so that it can no longer be associated with you as an individual.

Data Security

mbaji takes data security seriously and has implemented a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and mbaji's servers, ensuring that your login credentials, payment details, and personal information are encrypted in transit.
• Encrypted storage of sensitive data fields — including passwords (stored as salted cryptographic hashes, never in plain text) and financial identifiers — within mbaji's database infrastructure.
• Access controls: Personal data is accessible internally only to mbaji staff members who require it for their specific role. All internal access is governed by a role-based access control policy and is logged for audit purposes.
• Regular security assessments: mbaji conducts periodic internal and third-party security reviews of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: In the event of a data security incident that affects player data, mbaji has documented procedures for containing the incident, assessing the scope of impact, notifying affected players where required, and reporting to relevant authorities.

While mbaji employs robust security measures, no online platform can guarantee absolute security. You are responsible for keeping your mbaji account credentials confidential and for notifying [email protected] immediately if you suspect that your account has been compromised.

Your Data Rights

As a data subject, you hold the following rights in respect of your personal data processed by mbaji. To exercise any of these rights, please contact us using the details in Section 15. mbaji will respond to all valid data rights requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data mbaji holds about you, together with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data that mbaji holds about you. For basic profile data, you may also update information directly through your account settings.
• Right to erasure ("right to be forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and mbaji has no overriding legitimate interests. Note that erasure may not be possible for data that mbaji is legally required to retain under financial regulations.
• Right to restriction of processing: You have the right to request that mbaji restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing and a decision on that objection is pending.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to mbaji in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another data controller where technically feasible.
• Right to object: You have the right to object at any time to the processing of your personal data where mbaji relies on legitimate interests as the legal basis, including profiling based on legitimate interests. You also have an absolute right to object to processing of your data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

Children's Privacy

The mbaji platform is strictly intended for adults aged 21 and above. mbaji does not knowingly collect, process, or retain personal data from individuals under the age of 21. If you are under 21 years of age, you are not permitted to register an account or use any real-money features of the mbaji platform.

If mbaji becomes aware that personal data has been collected from an individual under the age of 21 — whether through a registration attempt, a KYC review, or any other means — the relevant account will be immediately suspended, all associated personal data will be deleted as promptly as technically possible, and any deposited funds will be returned to the originating payment source pending verification of ownership.

If you are a parent or guardian and you believe that your child under the age of 21 has provided personal data to mbaji, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

Third-Party Links

The mbaji platform may from time to time contain references to or integrations with third-party services — for example, game content delivered by providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. While mbaji takes care to work only with reputable partners, we are not responsible for the privacy practices of any third-party service accessed through or referenced from the mbaji platform.

Each third-party game provider and payment partner operates under their own privacy policy. We encourage you to review the privacy policies of any third-party service you interact with, particularly when you are providing personal information directly to that third party rather than to mbaji.

Updates to This Privacy Policy

mbaji reserves the right to update or revise this Privacy Policy at any time in response to changes in applicable law, new data processing practices, platform feature updates, or guidance from relevant regulatory authorities. When we make material changes to this policy, we will notify you by posting a prominent notice on the mbaji platform homepage and, where practicable, by sending a notification to your registered email address.

The effective date at the top of this document reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically so that you remain informed about how mbaji protects your personal data. Your continued use of the mbaji platform following the effective date of any revision constitutes acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by mbaji, please contact our privacy team using the details below. All privacy-related correspondence should be submitted in English.

• Email: [email protected] — please include "Privacy Request" in your subject line for faster routing.
• Live Chat: Available 24/7 from within your logged-in mbaji account dashboard. Our support agents can escalate privacy requests to the dedicated privacy team on your behalf.
• Response Time: All privacy-related enquiries and formal data rights requests will receive an initial acknowledgement within 48 hours BST and a full written response within 30 calendar days.