baj8 Privacy Policy — How We Handle Your Personal Data

Introduction & Scope

This Privacy Policy ("Policy") describes how baj8 ("baj8", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("you", "Player", "User") who access or use the baj8 website and associated platform services at baj8.io (collectively, the "Platform").

This Policy applies to all personal data processed in connection with your registration and use of the baj8 Platform, including data collected through account registration, deposit and withdrawal transactions, gameplay activity, customer support interactions, and any marketing communications you opt into. It applies to all players accessing the Platform from Bangladesh and any other jurisdiction.

By registering a baj8 account, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not create or maintain an account on the Platform.

This Policy should be read alongside our Terms and Conditions, our Responsible Gaming Policy, and any supplementary terms that apply to specific promotions or game types. In the event of conflict, this Policy governs data protection matters specifically.

Data Controller

For the purposes of applicable data protection law, baj8 acts as the data controller in respect of your personal information. As data controller, baj8 is responsible for determining the purposes and means by which your personal data is processed.

All data protection enquiries, subject access requests, correction requests, deletion requests, and formal complaints relating to baj8's handling of your personal data should be directed to the baj8 Data Protection team via the contact details provided in Section 15 of this Policy.

Where baj8 engages third-party service providers (such as payment processors, identity verification providers, or fraud prevention services) to process data on its behalf, those parties act as data processors under baj8's instruction and are contractually required to process data only in accordance with baj8's documented instructions and applicable law.

Data We Collect

baj8 collects the following categories of personal data about you:

baj8 does not collect or store full payment card numbers, CVV codes, bKash PINs, Nagad PINs, or internet banking passwords. Payment credentials are handled exclusively by the relevant licensed payment processor and are never transmitted to or stored on baj8 servers.

How We Collect Your Data

baj8 collects your personal data through the following means:

• Direct collection: Information you actively provide when registering your account, completing KYC identity verification, making deposits or withdrawal requests, submitting support enquiries, or updating your account profile.
• Automated technical collection: Data collected automatically when you visit or use the Platform, including IP address, device identifiers, browser fingerprint, session data, and gameplay logs. This data is collected via server logs, cookies, and similar tracking technologies (see Section 08).
• Third-party sources: Identity verification data obtained from KYC service providers; fraud risk scores obtained from fraud prevention partners; payment verification data from bKash, Nagad, Rocket, and banking partners where required to confirm deposit or withdrawal ownership.
• Inferred data: Insights derived from your usage patterns, such as preferred game categories, typical session length, deposit frequency, and responsiveness to promotional offers. This data is used solely for responsible gaming monitoring and internal service improvement — it is never sold or used for external profiling.

How We Use Your Data

baj8 uses your personal data for the following documented purposes:

• Account creation and management: To register your account, verify your identity, maintain your account balance, and provide access to the Platform's features.
• Payment processing: To facilitate deposits via bKash, Nagad, Rocket, Upay, and supported bank channels, and to process withdrawal requests to your verified payment method in Bangladeshi Taka (৳).
• KYC and age verification: To confirm that you meet the minimum age requirement of 21 years and to verify your identity in accordance with our anti-money laundering obligations. This is a legal requirement and cannot be waived.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-account abuse, collusion, and any other conduct that violates our Terms and Conditions or applicable law.
• Responsible gaming monitoring: To identify behavioural patterns that may indicate problem gambling and to apply appropriate safeguards proactively, in line with our commitment to player welfare.
• Customer support: To respond to your enquiries, process complaints, and maintain records of our communications for quality assurance and dispute resolution purposes.
• Marketing communications (where consented): To send you promotional offers, bonus notifications, and seasonal promotions relevant to BPL, IPL, Eid, Pohela Boishakh, and other events. Marketing communications are sent only to players who have explicitly opted in.
• Platform improvement: To analyse aggregate usage data and improve game selection, website performance, mobile experience, and customer support quality. Analysis is conducted on anonymised or pseudonymised data wherever possible.
• Legal and regulatory compliance: To retain records as required by applicable gaming regulations and anti-money laundering law, and to respond to lawful requests from regulatory authorities.

Legal Bases for Processing

baj8 processes your personal data only where a valid legal basis exists. The legal bases applicable to each processing activity are summarised below:

• Contractual necessity: Processing required to fulfil our obligations under the account agreement with you — including account registration, payment processing, and access to games. Without this processing, we cannot provide the service.
• Legal obligation: Processing required to comply with applicable law, including KYC identity verification, age verification (21+), anti-money laundering record-keeping, and responses to lawful regulatory requests.
• Legitimate interests: Processing carried out in baj8's legitimate interests where those interests are not overridden by your rights — including fraud prevention, security monitoring, responsible gaming monitoring, and internal analytics for service improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — specifically, the sending of marketing and promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

baj8 does not sell, rent, or trade your personal data. We share your data only in the following limited and documented circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive only the minimum transaction data necessary to process your deposit or withdrawal. These parties operate under their own privacy policies and regulatory obligations.
• Identity verification providers: Third-party KYC and age-verification services receive identity documents (NID, passport) and personal details solely for the purpose of verifying your eligibility to use the Platform. These providers are contractually prohibited from using your data for any other purpose.
• Fraud prevention services: Aggregated risk signals — such as IP address, device fingerprint, and behavioural patterns — may be shared with fraud intelligence platforms to protect the Platform and its player community from fraudulent activity.
• Game providers: Providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive a pseudonymised player identifier and relevant game session data to operate their games within the baj8 Platform. They do not receive your full name, NID, or financial details.
• Regulatory and law enforcement authorities: Where baj8 is required by law, court order, or regulatory instruction to disclose player data, we will comply with such requests. Where legally permissible, baj8 will notify the affected player before disclosure.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of baj8's business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and of their rights in relation to it.

All third-party processors engaged by baj8 are required to enter into data processing agreements that restrict their use of player data to the documented purpose, require them to maintain appropriate technical security measures, and prohibit sub-processing without baj8's prior written consent.

Cookies & Tracking Technologies

baj8 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled.
• Functional cookies: Remember your preferences — such as language setting, game lobby layout, and notification preferences — so you do not need to re-enter them on each visit.
• Analytics cookies: Collect anonymised data on how players navigate the Platform — which pages are visited most, where users drop off, and how gameplay sessions are structured. This data is used solely for internal service improvement and is not shared with external analytics platforms for advertising purposes.
• Responsible gaming cookies: Track session duration and deposit activity to power the session time reminder and deposit limit tools available in your account settings.

baj8 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You will not be followed across the web by baj8 advertising as a result of visiting our Platform.

You may manage or disable non-essential cookies through your browser settings. Note that disabling functional cookies may affect your user experience — for example, your session preferences may not be saved between visits.

Data Retention

baj8 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Customer support communications: Retained for two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Marketing consent records: Retained for the duration of the consent plus three (3) years after withdrawal, to demonstrate compliance with consent-based marketing obligations.
• Technical and usage data (logs): Retained for twelve (12) months in active systems, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised aggregate data derived from your activity (for example, aggregate game popularity statistics) may be retained indefinitely as it no longer constitutes personal data.

Data Security

baj8 maintains a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport encryption: All data transmitted between your browser or mobile device and baj8 servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption. The Platform enforces HTTPS at all times; unencrypted HTTP connections are automatically redirected.
• Access controls: Access to systems containing personal data is restricted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication, and access logs are retained for audit purposes.
• Data minimisation at rest: Sensitive data fields — including NID numbers and financial account references — are stored in encrypted form in baj8's database. Encryption keys are managed separately from the data they protect.
• Penetration testing and vulnerability management: baj8 conducts regular security assessments of its platform infrastructure, including penetration tests, to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed personal data breach that is likely to result in a risk to player rights, baj8 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

While baj8 takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying baj8 immediately if you believe your account has been compromised.

Your Rights

As a player whose personal data is processed by baj8, you hold the following rights. To exercise any of these rights, contact the baj8 support team as described in Section 15. baj8 will respond to all verified rights requests within five (5) business days.

• Right of access: You may request a copy of all personal data baj8 holds about you, together with information about how it is used, where it came from, and with whom it has been shared.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data baj8 holds about you. Corrections to identity data may require submission of supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where there is no overriding legal or regulatory obligation to retain it. Note that mandatory AML and regulatory retention requirements may limit the scope of deletion that is legally permissible.
• Right to restriction of processing: You may request that baj8 restrict the processing of your data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing and baj8 is assessing whether its legitimate interests override your objection.
• Right to data portability: You may request a copy of the personal data you have actively provided to baj8 in a structured, commonly used, machine-readable format (such as CSV), for transfer to another service provider.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming purposes. baj8 will assess your objection and cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw marketing consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time via your account notification settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Children & Minors

The baj8 Platform is strictly intended for adults aged 21 years and above. baj8 does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register an account or use the Platform in any capacity.

Age verification is a mandatory step in the KYC process for all new baj8 accounts. Where baj8 suspects or discovers that a player is under the age of 21, the account will be suspended immediately, all transactions will be reviewed, and any deposits made will be returned to the original payment method where legally permissible.

If you are a parent or guardian and believe that a person under 21 in your household has registered a baj8 account, please contact our support team immediately at [email protected]. We will investigate the matter promptly and take appropriate action.

baj8 recommends that parents and guardians use parental control software to restrict access to online gambling platforms on shared or family devices. Free parental control tools are available from a range of providers and can be configured to block access to gambling-related websites and applications.

Third-Party Links

The baj8 Platform does not contain links to external third-party websites for advertising or referral purposes. Game provider branding (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe) may be visible within the game lobby or individual game interfaces, but baj8 does not link outbound to these providers' own websites from the Platform.

Where third-party content is embedded within the Platform — for example, live dealer game streams delivered by Evolution Gaming or Ezugi — that content is governed by the relevant provider's own data processing terms. baj8 enters into data processing agreements with all embedded game providers to ensure that player data shared with those providers for the purpose of operating the game is handled in a manner consistent with this Policy.

baj8 is not responsible for the privacy practices or data handling of any external website or service that you may access independently of the baj8 Platform. We encourage you to review the privacy policy of any third-party service before providing them with your personal information.

Policy Updates

baj8 reserves the right to update or modify this Privacy Policy at any time. Where changes are material — meaning they significantly affect how your data is collected, used, or shared — baj8 will provide advance notice of no less than seven (7) days via a notification displayed prominently on the Platform and, where reasonably practicable, via email to your registered address.

The effective date at the top of this Policy will be updated to reflect the date on which the revised version comes into force. We encourage you to review this Policy periodically to stay informed about how baj8 protects your personal information.

Your continued use of the baj8 Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request account closure by contacting our support team.

Previous versions of this Privacy Policy are archived and available upon request by contacting baj8 support. All archived versions are identified by their effective date and version number.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to raise a privacy-related complaint, please contact the baj8 Data Protection team through the following channels:

• Live Chat: Available 24/7 directly within the baj8 Platform — the fastest method for all privacy enquiries and urgent data rights requests.
• Email: [email protected] — for formal subject access requests, deletion requests, and written privacy complaints. Please include "Privacy Request" in your subject line. Response time: within five (5) business days. All response times apply under Bangladesh Standard Time (BST, UTC+6).

When submitting a data rights request by email, please include your full registered name, the email address associated with your baj8 account, a description of the right you wish to exercise, and any supporting information that will help us locate and verify your records. baj8 may request additional verification before processing requests that affect sensitive account data.

This Privacy Policy was last reviewed and updated on 1 January 2026. This version (2.4) supersedes all previous versions of the baj8 Privacy Policy.