cbaj Privacy Policy

cbaj ("cbaj", "we", "us", "our") operates the online sports betting and casino platform accessible at cbaj.io (the "Platform"). We are committed to protecting the privacy and personal data of all players, visitors, and users who interact with the Platform ("you", "your").

This Privacy Policy describes how cbaj collects, uses, stores, shares, and protects personal data in connection with the operation of the Platform. It also describes the rights available to you in relation to your personal data and how you may exercise those rights.

This Privacy Policy should be read alongside the cbaj Terms & Conditions and the Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and the Terms & Conditions regarding the handling of personal data, this Privacy Policy shall prevail.

Effective Date: This Privacy Policy is effective as of January 2026. The version date is displayed at the top of the hero section of this page. cbaj reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered players via the Platform.

cbaj collects personal data in the following categories, depending on how you interact with the Platform:

2.1 Registration Data

When you create a cbaj account, we collect:

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Residential address (including city, district, and postal code)
• Mobile phone number
• Email address (where provided)
• Chosen username and encrypted password

2.2 Identity Verification Data

As part of our Know Your Customer (KYC) obligations, cbaj may request:

• Government-issued photo identification (National ID card, passport, or driving licence)
• Proof of residential address (utility bill, bank statement, or similar document)
• Source of funds documentation where required by anti-money-laundering procedures

2.3 Transaction Data

When you deposit or withdraw funds, cbaj records:

• Transaction amounts in Bangladeshi Taka (৳)
• Payment method used (e.g., bKash, Nagad, Rocket, Upay)
• Mobile financial service account reference numbers (where applicable)
• Transaction timestamps (Bangladesh Standard Time, UTC+6)
• Transaction status and history

2.4 Gameplay & Betting Data

cbaj records details of your activity on the Platform, including:

• Bets placed, markets selected, odds accepted, and stakes wagered
• Casino games played, session durations, and game outcomes
• Bonus offers claimed and wagering progress
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

2.5 Technical & Device Data

When you visit or use the Platform, we automatically collect:

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Pages visited, time spent on pages, and navigation paths
• Cookie identifiers and session tokens (see Section 6)

2.6 Communications Data

If you contact cbaj's support team, we retain records of:

• Live chat transcripts
• Email correspondence
• Support ticket content and resolution history

cbaj uses the personal data we collect for the following purposes:

cbaj does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Our responsible gaming monitoring systems may flag accounts for manual review based on activity patterns, but all consequential decisions are reviewed by a human team member.

cbaj processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and cbaj — including account management, payment processing, and the delivery of betting and gaming services.
• Legal obligation: Processing required to comply with applicable legal requirements, including anti-money-laundering laws, age verification obligations, and responses to lawful requests from authorities.
• Legitimate interests: Processing carried out in cbaj's legitimate business interests — such as fraud detection, platform security, responsible gaming monitoring, and general analytics — where those interests are not overridden by your privacy rights.
• Consent: Where you have provided explicit consent, such as opting in to receive promotional communications. You may withdraw consent at any time by contacting support without affecting the lawfulness of processing carried out before withdrawal.

cbaj does not sell, rent, or trade your personal data to third parties. We share your data only in the following limited circumstances:

5.1 Payment Providers

To process your deposits and withdrawals, cbaj shares relevant transaction data with your chosen mobile financial service provider — bKash, Nagad, Rocket, or Upay — as necessary to complete the transaction. Each provider operates under its own privacy policy.

5.2 Identity Verification Services

cbaj may use third-party KYC (Know Your Customer) service providers to verify your identity documents. These providers process your identification data solely for verification purposes and are contractually prohibited from using it for any other purpose.

5.3 Game Providers

Game studios whose products are available on the cbaj Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — receive limited session and gameplay data necessary to deliver their games and validate outcomes. These providers are bound by data processing agreements with cbaj.

5.4 Legal & Regulatory Authorities

cbaj may disclose your personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or lawful regulatory request. cbaj will notify you of such disclosures where legally permitted to do so.

5.5 Business Transfers

In the event that cbaj undergoes a business restructuring, merger, acquisition, or sale of assets, personal data held by cbaj may form part of the transferred assets. In such circumstances, cbaj will take reasonable steps to ensure that your privacy rights continue to be protected and will notify affected players as appropriate.

cbaj uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. cbaj uses the following categories of cookies:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication tokens, security cookies, and load-balancing cookies. These cookies cannot be disabled without significantly impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences, such as your preferred language settings, responsible gaming tool configurations, and last-visited game categories. These improve your experience on the Platform.
• Analytical Cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform. This data helps cbaj identify areas for improvement and optimise the user experience. No individual player is identifiable from analytical cookie data.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and suspicious access patterns that could compromise the integrity of the Platform or the security of player accounts.

cbaj does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings, though disabling essential cookies may limit your ability to use certain Platform features.

cbaj takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the cbaj Platform.
• Encryption at rest for sensitive stored data, including identity documents and financial records.
• Access controls that restrict internal access to personal data on a strict need-to-know basis. cbaj staff who handle personal data are trained in data protection principles.
• Regular security audits and penetration testing of Platform infrastructure.
• Secure password hashing using industry-standard algorithms. cbaj never stores passwords in plain text.
• Two-factor authentication options for player accounts to provide an additional layer of login security.

While cbaj employs robust security measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, cbaj will notify affected players without undue delay once the breach has been identified and assessed.

You play an important role in keeping your account secure. You must keep your cbaj login credentials confidential and must not share them with any other person. If you suspect unauthorised access to your account, contact cbaj support immediately via in-platform live chat.

cbaj retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Active Accounts: Personal data associated with an active cbaj account is retained for the duration of the account relationship and for a reasonable period thereafter to handle any post-closure queries or disputes.
• Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of five (5) years from the date of the transaction, in accordance with anti-money-laundering record-keeping requirements.
• Identity Verification Documents: KYC documentation is retained for the duration of the account relationship and for a minimum of five (5) years following account closure.
• Support Communications: Live chat transcripts and email correspondence are retained for a period of two (2) years from the date of the interaction, or longer where the communication relates to an ongoing dispute or investigation.
• Technical & Analytical Data: Anonymised analytical data may be retained indefinitely as it cannot be used to identify individual players. Identifiable technical data such as IP address logs is retained for a maximum of twelve (12) months.

Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request early deletion of your data subject to cbaj's legal obligations — see Section 9 for details of your rights.

As a cbaj player, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data cbaj holds about you at any time. cbaj will provide this information within a reasonable timeframe following identity verification.
• Right to Rectification: If any personal data cbaj holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update certain account details directly through the Platform, or by contacting support.
• Right to Erasure: You may request that cbaj delete your personal data. This right is subject to cbaj's legal obligations to retain certain records — for example, transaction history required under anti-money-laundering regulations cannot be deleted on request. Where deletion is possible, cbaj will carry it out promptly.
• Right to Restriction of Processing: In certain circumstances, you may request that cbaj restrict the processing of your personal data — for example, while a correction request is being assessed.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of cbaj's legitimate interests. cbaj will assess whether its legitimate interests override your right to object on a case-by-case basis.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact the cbaj support team via in-platform live chat or at [email protected]. cbaj will respond to all data rights requests within 30 days. Where a request is complex or cbaj receives a large number of concurrent requests, this period may be extended by a further 60 days, and you will be notified accordingly.

cbaj strictly enforces a minimum age requirement of 21 years. The Platform is not directed at, and is not intended for use by, any person under the age of 21. cbaj does not knowingly collect personal data from individuals under 21 years of age.

If cbaj becomes aware that personal data has been collected from a person under the age of 21, all such data will be deleted immediately and the associated account will be closed. Any deposits made by an underage player will be returned to the originating payment method after verification.

Parents and guardians who believe that a minor under their care has registered on or used the cbaj Platform are urged to contact the cbaj support team immediately via in-platform live chat so that the matter can be resolved without delay.

cbaj supports parental control software tools that can be used to restrict access to online gambling platforms. We encourage parents and guardians to make use of these tools where appropriate to prevent underage access to gambling content.

The cbaj Platform integrates third-party services to deliver game content, process payments, and support platform operations. When you interact with these services, additional data processing may occur under those providers' own privacy policies:

• Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi provide game software and live dealer environments. Your gameplay data is shared with these providers to the extent necessary to deliver and validate game outcomes.
• Payment Providers: bKash, Nagad, Rocket, and Upay process payment transactions. Your mobile financial service account details are shared with the relevant provider only to the extent required to complete your requested transaction.
• KYC & Fraud Prevention: Third-party identity verification and fraud detection services may process your identity documents and transaction behaviour data under contractual data processing agreements with cbaj.

cbaj is not responsible for the privacy practices of third-party providers once data leaves cbaj's direct control. We encourage you to review the privacy policies of the payment and game providers you interact with on the Platform.

The cbaj Platform does not contain links to external third-party websites for browsing or marketing purposes. All links within the Platform navigate to cbaj's own pages.

cbaj may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. The effective date at the top of the hero section of this page will be updated whenever a new version is published.

Where changes are material — meaning they significantly affect how cbaj processes your personal data or alter your rights in a meaningful way — cbaj will notify registered players via a notification on the Platform prior to the changes taking effect. For non-material updates (such as clarifications of existing practices, corrections of typographical errors, or minor formatting changes), the revised Policy will be published without individual notice.

Continued use of the cbaj Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any update, you should cease using the Platform and request account closure via the support team.

Previous versions of the Privacy Policy are available on request by contacting the cbaj support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or cbaj's handling of your personal data, please get in touch using the following channels:

• In-Platform Live Chat: Available 24/7 with an average response time of 2–5 minutes. This is the fastest way to reach cbaj's support team.
• Email: [email protected] — for written privacy enquiries and formal data rights requests.

cbaj serves players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. All privacy communications are handled in English.

When submitting a data rights request, please include your registered account username and a brief description of your request. cbaj will verify your identity before processing any request involving access to, correction of, or deletion of personal data.