Privacy Policy — bipbaji

1. Data Controller Information

bipbaji acts as the data controller for all personal information collected from players who register and interact with our platform. As the data controller, bipbaji determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

This Privacy Policy governs all personal data collected through the bipbaji website and platform, including data submitted during account registration, during the deposit and withdrawal process, during gameplay, via customer support interactions, and through any other touchpoint between you and bipbaji.

This policy applies to all individuals who interact with the bipbaji platform, including registered players, individuals who browse the platform without registering, and individuals who contact us via live chat or email support. By using bipbaji in any capacity, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy.

2. What Data We Collect

bipbaji collects personal data through several channels and across several stages of your interaction with the platform. The following table provides a comprehensive overview of the data categories we collect, the source of that data, and the primary purpose for which it is collected.

Registration & Identity Data

• Full legal name (as it appears on your Bangladeshi national identity card)
• Date of birth (used for age verification — you must be 18 or older)
• Bangladeshi mobile number (serves as primary account identifier)
• Email address
• Residential address (city, district — full address required at KYC stage)
• National Identity Card (NID) number and, where requested, a scanned copy
• Selfie or photograph for biometric identity matching (requested at enhanced KYC stage only)

Financial & Transaction Data

• bKash, Nagad, Rocket, or Upay mobile number used for deposits and withdrawals
• Transaction reference numbers generated by your mobile financial service (MFS) provider
• Deposit amounts, withdrawal amounts, and transaction timestamps
• Account balance history and wagering history
• Bonus credits claimed and wagering progress records

Technical & Device Data

• IP address at registration and at each login event
• Device type, operating system version, and browser type
• Geolocation data (country/city level) derived from IP address
• Session duration and login timestamps
• Cookie identifiers and browser local storage data (see Section 5 for full cookie details)

Behavioural & Gaming Data

• Games played, bet sizes, win/loss records per session
• Sports betting market selections, wager amounts, and settlement outcomes
• Responsible gaming tool usage (deposit limit changes, cool-off requests, self-exclusion requests)
• Customer support interaction transcripts (live chat and email)

3. How We Use Your Data

bipbaji processes personal data only where a lawful basis exists for doing so. The lawful bases we rely upon are: (a) the performance of a contract with you (operating your account and fulfilling your gaming and betting activity); (b) compliance with a legal obligation (KYC, age verification, anti-money-laundering record-keeping); (c) our legitimate interests as a platform operator (fraud prevention, security, service improvement); and (d) your consent (marketing communications, optional product surveys).

bipbaji does not use automated decision-making in a way that produces legal or similarly significant effects on players, except in limited, clearly defined fraud-detection scenarios where automated flags trigger a manual human review. You have the right to request human review of any automated decision that affects your account.

4. Data Sharing & Third Parties

bipbaji does not sell your personal data. We share data with third parties only where necessary to operate the platform, comply with legal requirements, or protect the integrity of our services. The categories of third parties with whom we may share data are described below.

Game Technology Providers

To deliver casino games and live dealer tables, bipbaji integrates game content from certified studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers receive anonymised session data necessary to render game outcomes. They do not receive your full identity, payment details, or NID information.

Payment Service Partners

Transaction data — specifically your registered bKash, Nagad, Rocket, or Upay mobile number and the corresponding transaction reference — is shared with your chosen MFS provider solely to initiate and confirm the deposit or withdrawal you have requested. bipbaji does not retain your MFS account PIN or any sensitive authentication credential.

Identity Verification (KYC) Services

Where enhanced identity verification is required, bipbaji may engage a third-party KYC service provider to assist in verifying NID documents and photograph matching. Any such provider operates under a data processing agreement with bipbaji and is contractually prohibited from using your data for any purpose other than the verification task.

Legal and Regulatory Disclosure

bipbaji may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally compelled to do so by applicable Bangladeshi law, a valid court order, or other binding legal process. In such cases, we will disclose only the minimum data required to satisfy the legal obligation and will, where permitted by law, notify you of the disclosure.

5. Cookies & Tracking Technologies

bipbaji uses cookies and similar technologies — including browser local storage and session storage — to operate core platform functionality, maintain your login session, detect fraud, and understand how players navigate the platform so we can improve the experience.

Cookie Categories

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load balancer routing cookies. You cannot opt out of these without losing core platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about page visits, session durations, and feature usage. This data helps bipbaji identify areas of the platform that need improvement. No personally identifiable information is captured by analytics cookies.
• Functional Cookies: Remember your preferences such as language setting, display options, and responsible gaming notification preferences so you do not have to re-enter them on each visit.
• Marketing Cookies (Consent Required): Used only where you have given explicit consent. These cookies help bipbaji measure the effectiveness of promotional campaigns. You may withdraw consent for marketing cookies at any time via Account Settings.

Managing Cookies

You may control cookie behaviour through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a per-site basis. Please note that blocking strictly necessary cookies will impair platform functionality, including your ability to log in. Detailed browser-specific cookie management instructions are available in your browser's help documentation.

bipbaji does not use third-party advertising network cookies or cross-site tracking pixels. Our analytics are conducted using first-party data only.

6. Data Retention Periods

bipbaji retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedules apply:

• Active account data: Retained for the full duration of your account's active period plus five years following account closure. This retention period satisfies anti-money-laundering record-keeping obligations.
• Transaction records: Retained for seven years from the date of each transaction in accordance with financial record-keeping requirements.
• KYC documents (NID copies, selfies): Retained for five years following account closure, then permanently deleted.
• Customer support transcripts: Retained for three years from the date of each interaction, used for quality assurance and dispute resolution.
• Marketing consent records: Retained for the period of active consent plus three years following withdrawal of consent, as evidence of compliance.
• Anonymised analytics data: May be retained indefinitely in aggregate, non-identifiable form for platform improvement purposes.
• Self-exclusion records: Retained for the duration of the self-exclusion period plus five years to prevent re-registration during an active exclusion.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised using industry-standard data destruction protocols. Backup copies are purged within 90 days of the primary deletion event.

7. Data Security Measures

bipbaji implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational security measures include:

• SSL/TLS Encryption in Transit: All data exchanged between your browser or mobile device and bipbaji servers is encrypted using TLS 1.2 or higher. HTTPS is enforced site-wide with HTTP Strict Transport Security (HSTS) headers.
• Encryption at Rest: Sensitive fields in our database — including identity document references, contact details, and payment identifiers — are stored in encrypted form using AES-256 encryption.
• Access Controls: Access to personal data within bipbaji's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged for audit purposes.
• Two-Factor Authentication (2FA): Available to players via Account Settings and mandatory for all internal administrative access to systems containing personal data.
• Penetration Testing: bipbaji conducts periodic security assessments and vulnerability testing to identify and remediate weaknesses in our systems before they can be exploited.
• Incident Response: bipbaji maintains a documented data breach response procedure. In the event of a data breach that poses a risk to affected players, we will notify impacted individuals without undue delay and take immediate remediation steps.

8. Your Privacy Rights

As a player on bipbaji, you hold meaningful rights over your personal data. bipbaji is committed to honouring these rights and to making the process of exercising them as straightforward as possible. The following rights apply to all registered players:

• Right of Access: You may request a copy of all personal data bipbaji holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of a verified request.
• Right to Rectification: If any personal data held by bipbaji is inaccurate or incomplete, you have the right to request that it be corrected. Basic profile updates (email, mobile number) may be made directly in Account Settings; corrections to identity documents require a support request.
• Right to Erasure: Subject to our legal retention obligations (particularly the five-year post-closure retention for AML compliance), you may request the deletion of your personal data. Where legal obligations prevent full immediate deletion, we will delete all data not subject to a mandatory retention period and advise you of the remaining retention timeline.
• Right to Restrict Processing: In certain circumstances — for example, while a data accuracy dispute is being resolved — you may request that we restrict the processing of your data to storage only.
• Right to Data Portability: You may request that we provide your personal data in a portable format so that it can be transferred to another service provider where technically feasible.
• Right to Object: Where bipbaji relies on legitimate interests as the legal basis for processing, you have the right to object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails or SMS), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact our privacy support team at support@bipbaji with the subject line "Privacy Rights Request". We will verify your identity before processing the request and will respond within 30 calendar days. Where a request is particularly complex or numerous, we may extend this period by a further 30 days with prior notification.

9. Children's Privacy

Parents and guardians who believe their child has accessed or registered on bipbaji are urged to contact us immediately at support@bipbaji so that we may take prompt remedial action. We take the protection of minors extremely seriously and cooperate fully with any parental notification or statutory reporting requirement in this regard.

We also recommend that parents and guardians use parental control software to restrict access to online gambling platforms for minors sharing household devices. bipbaji supports the use of third-party parental control tools and encourages responsible management of shared device access in family settings.

10. Changes to This Policy

bipbaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made, we will notify registered players via a prominent notice on the platform homepage and, where your email address is verified, via a notification to the email address on your account.

The updated Privacy Policy will display a revised effective date at the top of the document. We encourage you to review this page periodically so that you remain informed of how bipbaji handles your personal data. Your continued use of the platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or objections regarding any aspect of this Privacy Policy — current or amended — please do not hesitate to contact our support team at support@bipbaji. We are committed to maintaining an open and transparent dialogue with our players on all matters relating to privacy and data protection.