jbaj Privacy Policy — How We Handle Your Data in Bangladesh

Registration and Identity Data

When you create a jbaj account, we collect your full legal name, date of birth, mobile number registered in Bangladesh, and the login credentials you choose (username and encrypted password). If you are required to complete KYC verification, we may additionally collect a copy of your national identity card, passport, or other government-issued identification document, along with a selfie or proof-of-address document as required.

Transaction and Financial Data

jbaj records all deposit and withdrawal transactions conducted through your account, including the payment method used (such as bKash, Nagad, Rocket or bank transfer), the transaction amount in BDT, the date and time of the transaction, and the transaction reference number provided by the payment provider. This data is retained for fraud prevention, regulatory compliance, and dispute resolution purposes.

Device and Usage Data

When you access jbaj, we automatically collect certain technical information to operate and secure the platform. This includes your IP address, device type and operating system, browser type and version, session duration, pages and games accessed during each visit, and login timestamps. This data is used for security monitoring, fraud detection, and platform performance optimisation. It is not used to build personal advertising profiles.

Purposes for Processing

• To create and manage your jbaj account, including verifying your identity and age through KYC procedures
• To process deposits and withdrawals via bKash, Nagad, Rocket, and bank transfer in BDT, and to maintain accurate transaction records
• To detect, investigate and prevent fraudulent activity, money laundering, unauthorised account access, and other security threats
• To provide customer support and respond to account queries, disputes and complaints submitted by Members
• To send transactional notifications relating to your account activity, such as deposit confirmations, withdrawal status updates, and security alerts

Contractual Necessity

The primary basis for jbaj's processing of your personal data is contractual necessity. When you register an account and agree to the jbaj Terms and Conditions, a contract is formed between you and jbaj. Processing your identity, payment, and gaming data is necessary to fulfil jbaj's obligations under that contract — specifically to provide you with a functioning account, process your transactions, award bonuses, and deliver gaming services.

Legitimate Interests and Legal Obligations

In addition to contractual necessity, jbaj processes certain data on the basis of legitimate interests — particularly for fraud prevention, platform security, and responsible gaming monitoring. jbaj also processes data to comply with legal obligations such as anti-money laundering (AML) requirements. Where jbaj relies on legitimate interests, we balance those interests against your rights and freedoms and ensure that processing is proportionate.

Payment Service Providers

To process deposits and withdrawals, jbaj shares necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, and participating Bangladeshi banks. This data sharing is limited to the information required to execute and verify the specific transaction and is governed by each provider's own privacy terms. jbaj does not share account gaming history or bonus data with payment providers.

Identity Verification Partners

Where jbaj uses third-party KYC verification services to confirm a Member's identity or age, the relevant identity documents and verification data are shared with that verification partner under a data processing agreement. Verification partners are contractually prohibited from using your identity data for any purpose other than completing the verification check requested by jbaj.

Legal and Regulatory Disclosure

jbaj may be required to disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where required by applicable law, court order, or in connection with the investigation of suspected financial crime, fraud, or other serious misconduct. In such cases, jbaj will disclose only the minimum personal data required to comply with the legal obligation and will, where permitted by law, notify the affected Member.

Essential Cookies

jbaj places essential cookies that are strictly necessary for the platform to function. These include session cookies that keep you logged in during a gaming session, security tokens that protect against cross-site request forgery, and preference cookies that remember your display settings. Essential cookies cannot be disabled without breaking the functionality of the platform. They do not track your activity across other websites and do not build advertising profiles.

Analytics and Performance

jbaj may use anonymised, aggregated analytics data to understand how players use the platform and to improve performance and user experience. Any analytics processing uses anonymised or pseudonymised data that cannot be linked back to an individual Member. jbaj does not use third-party analytics services that place tracking cookies on your device without your consent.

How Long We Keep Your Data

jbaj retains personal data for as long as your account is active and for a further period after account closure as required for legal, compliance, and fraud prevention purposes. Account registration data and KYC documents are retained for a minimum of five years following account closure. Transaction records are retained for a minimum of seven years in accordance with financial record-keeping requirements. Technical usage logs are retained for a shorter period, typically 12 months, unless a longer retention period is required for an ongoing security investigation.

Deletion on Request

Where a Member requests deletion of their personal data following account closure and where jbaj is not required by law to retain that data, jbaj will delete or anonymise the data within a reasonable period. Some data that is required to be retained for legal or compliance reasons cannot be deleted on request, but jbaj will explain the basis for retention if asked. Deletion requests should be submitted to [email protected] with the subject line "Data Deletion Request" and your registered account details.

Rights Available to You

• Right of access — you may request a copy of the personal data jbaj holds about you
• Right to rectification — you may request correction of inaccurate personal data held in your account
• Right to erasure — you may request deletion of your personal data subject to legal retention requirements
• Right to restriction — you may request that jbaj limits the processing of your data in certain circumstances
• Right to object — you may object to processing carried out on the basis of legitimate interests, including direct marketing

How to Exercise Your Rights

To submit a data rights request, please email [email protected] with the subject line "Privacy Rights Request" and include your registered account username and mobile number so we can verify your identity before processing the request. jbaj will respond to all valid data rights requests within 30 days of receipt. Where a request is complex or where we receive a high volume of requests, we may extend this period by a further 30 days and will notify you accordingly.

Technical Safeguards

jbaj implements industry-standard technical security measures to protect your personal data from unauthorised access, disclosure, alteration or destruction. All data transmitted between your device and the jbaj platform is encrypted using 256-bit SSL (Secure Sockets Layer) technology. Account passwords are stored in hashed form and are never stored or transmitted in plain text. Payment data is handled through secure, tokenised integrations with our payment partners and is never stored on jbaj servers in raw form.

Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Members, jbaj will notify affected Members without undue delay after becoming aware of the breach. Notification will be sent to the mobile number or email address registered on the affected account. The notification will describe the nature of the breach, the data affected, the likely consequences, and the steps jbaj is taking to address it.

21+ Policy Strictly Enforced

jbaj services are strictly intended for adults aged 21 and above. jbaj does not knowingly collect personal data from individuals under the age of 21. If jbaj becomes aware that personal data has been collected from an individual who is under 21, that data will be deleted promptly and the associated account will be closed. If you believe that a person under the age of 21 has registered an account on jbaj, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

How We Notify You of Updates

jbaj reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. When material changes are made, jbaj will display a notice on the platform and, where appropriate, send a notification to your registered mobile number or email address. The date at the top of this Policy indicates when it was last revised. Your continued use of the jbaj platform following the posting of an updated Privacy Policy constitutes your acceptance of that updated Policy.