Privacy Policy — How bajy Collects, Uses, and Protects Your Personal Data

This Privacy Policy ("Policy") describes how bajy ("we", "us", "our", "the Platform") collects, processes, stores, and protects the personal data of individuals ("you", "your", "the Player") who visit, register with, or otherwise interact with the bajy platform available at bajy.io. This Policy is an integral part of bajy's Terms and Conditions and should be read alongside that document.

bajy is committed to handling your personal data with transparency, integrity, and respect. We recognise that players in Bangladesh entrust us with sensitive personal and financial information when they register and transact on the bajy platform, and we take that responsibility seriously. This Policy explains in plain English precisely what data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.

By registering a bajy account or continuing to use the bajy platform after this Policy has been updated, you confirm that you have read this Policy, that you understand its contents, and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the bajy platform and should contact [email protected] to request account closure.

bajy acts as the data controller in respect of the personal data collected from players using the bajy platform. As data controller, bajy determines the purposes for which, and the means by which, personal data is processed. bajy is responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with this Policy.

For all data-related enquiries, including requests to access, correct, or delete your personal data, you may contact bajy's designated data protection contact at:

• Email: [email protected] (plain text — not a clickable link)
• Subject line to use for data requests: "Data Privacy Request — [Your Username]"
• Response target: within 30 calendar days of receipt of your request
• Operating hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)

The categories of personal data that bajy may collect from or about you are set out in the table below. Not all data categories apply to every player — the specific data collected depends on how you use the platform and the verification requirements applicable to your account level.

bajy collects personal data through the following channels and mechanisms:

• Direct registration: When you create a bajy account, you provide identity, contact, and account data directly via the registration form.
• Identity verification submissions: When bajy requests KYC documentation, you upload identity documents (national ID, passport, utility bill) directly to the platform.
• Deposit and withdrawal transactions: When you make a deposit or request a withdrawal, your payment provider transmits the minimum necessary financial data to confirm and complete the transaction.
• Platform usage: bajy's systems automatically log technical and usage data (IP address, device information, session activity) while you are actively using the platform.
• Cookies and local storage: bajy uses cookies and browser local storage as described in Section 7 of this Policy to maintain sessions, detect fraud, and — where consented — personalise the platform experience.
• Customer support interactions: When you contact bajy via live chat or email, your communications and the information you provide are recorded and stored for the purposes of resolving your query and maintaining a support history.
• Third-party verification providers: bajy may use reputable third-party identity verification and fraud screening services to cross-check information you provide. These providers supply bajy with a verification result, not a copy of your raw document data.

bajy uses the personal data it collects for the following clearly defined purposes. We process your data only where we have a lawful basis for doing so — either because processing is necessary to perform the contract with you (providing the bajy service), because we have a legitimate interest, because we are complying with a legal obligation, or because you have given your consent.

• Platform operation and account management: Creating and maintaining your bajy account, processing your bets and game sessions, crediting winnings, and communicating essential account information.
• Payment processing: Facilitating deposits via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and processing withdrawal requests to your nominated payment method.
• Identity verification and age confirmation: Confirming that you are at least 21 years of age and that the identity details you have provided are accurate, in compliance with bajy's responsible gaming obligations.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent account activity, money laundering, bonus abuse, and other prohibited activities described in the Terms and Conditions.
• Responsible gaming: Monitoring betting patterns to identify signs of problem gambling, enforcing self-exclusion and deposit limit requests, and communicating responsible gaming resources where appropriate.
• Customer support: Responding to your enquiries, resolving disputes, and maintaining a record of your support history to improve the quality of assistance we provide.
• Platform improvement and analytics: Analysing aggregated, anonymised usage data to understand how players interact with bajy, identify technical issues, and improve the platform experience.
• Marketing communications (consent-based only): Sending you promotional offers, bonus notifications, and platform updates by email or SMS — but only where you have explicitly opted in to receive such communications. You may withdraw your consent at any time by emailing [email protected].
• Legal and regulatory compliance: Retaining records as required by applicable financial, anti-money laundering, and data protection laws, and responding to lawful requests from competent authorities.

bajy does not sell your personal data to any third party. bajy shares your personal data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive only the transaction data needed to process your deposit or withdrawal. These providers operate under their own privacy policies and security standards.
• Identity verification providers: bajy uses third-party KYC service providers to verify identity documents. These providers receive your verification data under strict data processing agreements and are prohibited from using it for any purpose other than identity verification.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game providers may receive a unique player session token and bet data necessary to run game sessions. They do not receive your full personal profile.
• Fraud and security vendors: bajy may use reputable fraud detection and cybersecurity service providers who process technical data (IP addresses, device fingerprints) on bajy's behalf under strict data processing agreements.
• Legal and regulatory authorities: bajy will disclose personal data to law enforcement, regulators, or courts where required to do so by applicable law, court order, or where disclosure is necessary to protect the rights, property, or safety of bajy, its players, or third parties.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of bajy's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to the way your data is processed as a result.

All third parties with whom bajy shares personal data are required, by contract, to maintain appropriate technical and organisational security measures and to use the data only for the purposes specified in their data processing agreement with bajy.

bajy uses cookies, session tokens, and browser local storage to operate the platform, ensure security, and — where you have consented — to personalise your experience. A cookie is a small text file stored on your device by your browser when you visit the bajy platform. The table below describes the categories of cookies bajy uses:

bajy does not use third-party advertising or cross-site tracking cookies. You can manage or delete cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the bajy platform, including your ability to maintain a logged-in session.

bajy implements a range of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bajy's servers.
• Encryption at rest for sensitive personal and financial data stored in bajy's databases.
• Password hashing using industry-standard cryptographic algorithms — bajy staff cannot read your password in plain text.
• Role-based access controls ensuring that bajy employees can access only the minimum personal data required to perform their job functions.
• Two-factor authentication requirements for bajy's internal administrative systems.
• Regular third-party security audits and penetration testing of the bajy platform.
• Automated intrusion detection and anomaly monitoring systems operating 24/7.
• Formal data breach response procedures, including player notification protocols in accordance with applicable law.

bajy retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

At the end of the applicable retention period, your personal data is securely deleted or permanently anonymised so that it can no longer be associated with you as an individual. Anonymised aggregate data (for example, platform-wide betting statistics with no individual identifiers) may be retained indefinitely for analytical purposes.

As a bajy player, you have the following rights in relation to your personal data. To exercise any of these rights, contact bajy at [email protected] with the subject line "Data Privacy Request — [Your Username]". bajy will respond within 30 calendar days of receiving your request. Verification of your identity may be required before bajy can action your request.

• Right of access: You have the right to request a copy of the personal data bajy holds about you, along with information about how it is processed.
• Right to rectification: If any personal data bajy holds about you is inaccurate or incomplete, you have the right to request that it be corrected.
• Right to erasure ("right to be forgotten"): You may request that bajy delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing. This right is subject to bajy's legal obligations to retain certain data.
• Right to restrict processing: In certain circumstances, you may request that bajy temporarily restrict the processing of your data while a complaint or accuracy dispute is being resolved.
• Right to data portability: Where processing is based on your consent and is carried out by automated means, you may request that bajy provide your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where bajy processes your data based on your consent (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on bajy's legitimate interests, subject to bajy demonstrating compelling grounds.

The bajy platform is strictly intended for adults aged 21 years and above. bajy does not knowingly collect personal data from individuals under the age of 21. The registration process includes an age declaration, and bajy's KYC verification procedures are designed to confirm that all account holders meet the minimum age requirement.

If bajy becomes aware that personal data has been collected from an individual under the age of 21 — whether through a failed age verification, a report from a third party, or any other means — the associated account will be immediately suspended, all balances will be frozen pending investigation, and the personal data of the underage individual will be deleted as soon as is practicable and legally permissible.

Parents and guardians who believe that an individual under the age of 21 in their care may have created a bajy account should contact support @bajy.io immediately. bajy will investigate and take appropriate action as a matter of priority.

bajy's primary servers and data infrastructure are operated with the security and availability of Bangladesh-based players as a priority. In certain circumstances, personal data may be processed by bajy's third-party service providers — such as identity verification vendors, fraud screening tools, and game providers — whose systems are located outside Bangladesh.

Where personal data is transferred to a third-party processor located outside Bangladesh, bajy ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that described in this Policy. These safeguards include contractual data processing agreements incorporating standard data protection clauses and requirements for the recipient to implement technical and organisational security measures consistent with bajy's own standards.

bajy reserves the right to update or amend this Privacy Policy at any time to reflect changes in the law, changes in bajy's data processing practices, or improvements to the platform. When bajy makes material changes to this Policy, the following notification measures will be applied:

• The "Last Updated" date at the top of this Policy will be revised to reflect the date of the change.
• Players with active bajy accounts will receive an email notification to their registered email address summarising the material changes made.
• Where a change requires your renewed consent — for example, a material change to the purposes for which bajy processes your data — bajy will request fresh consent before processing your data under the revised Policy.
• A summary of recent Policy changes will be maintained and made available to players on request by emailing [email protected].

Your continued use of the bajy platform after the effective date of any Policy update constitutes your acknowledgment of the updated Policy. If you do not agree with a change, you have the right to close your account and request erasure of your personal data as described in Section 10 of this Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or bajy's handling of your personal data, please contact bajy's data protection team using the details below. All privacy-related communications are treated as confidential and handled by bajy's compliance function.

bajy is committed to resolving all privacy concerns promptly and transparently. If you feel your concern has not been adequately addressed after contacting bajy directly, you retain the right to escalate the matter to the relevant data protection authority in your jurisdiction.