xbjj Privacy Policy
Your privacy matters to xbjj. This Privacy Policy explains in plain terms what personal data we collect, why we collect it, how we use and protect it, and what rights you hold over your own information as an xbjj player based in Bangladesh.
Our Privacy Principles at a Glance
xbjj is committed to responsible data handling. The six cards below summarise the core principles that guide every decision we make about your personal information.
Purpose Limitation
xbjj collects personal data only for clearly defined, legitimate purposes: account management, identity verification, fraud prevention, and service improvement. We do not collect data speculatively or beyond what is necessary for those purposes.
Data Minimisation
We ask for the minimum amount of personal information required to provide each service. If a piece of data is not needed for a specific function, we do not request it. Optional fields are clearly labelled as such during account registration.
Storage Security
All personal data stored by xbjj is protected using 256-bit SSL/TLS encryption in transit and AES-256 encryption at rest. Access to production databases is restricted to authorised personnel only, under strict role-based access controls.
No Data Selling
xbjj does not sell, rent, or commercially trade your personal data to any third party. Data shared with service providers is shared solely to enable them to perform specific contracted functions on our behalf, under binding confidentiality obligations.
Your Control
You have the right to access, correct, export, and in certain circumstances delete your personal data. You can manage communication preferences in your account settings at any time, or contact [email protected] to exercise any of your data rights.
Transparency
We keep this Privacy Policy up to date and notify registered users of any material changes. The effective date at the top of this page always reflects the most recent revision. We write in plain English so our obligations are clear to every player.
1. Data We Collect
xbjj collects personal data through three primary channels: information you provide directly, information generated automatically through your use of the platform, and information received from trusted third-party partners.
Information You Provide Directly
When you register an account, make a deposit, request a withdrawal, contact customer support, or interact with any xbjj feature, you may provide us with personal information. The categories of data you provide directly include:
| Data Category | Examples | Required? |
|---|---|---|
| Identity Data | Full legal name, date of birth, national ID (NID) number, passport number | Required |
| Contact Data | Email address, mobile phone number, residential district (e.g., Dhaka, Chittagong) | Required |
| Financial Data | bKash account number, Nagad number, Rocket number, Upay number, bank account details, Visa/Mastercard details (tokenised) | Required |
| Verification Documents | Photo of NID card, passport scan, selfie for liveness check, driving licence | Required |
| Account Credentials | Username, hashed password, security questions | Required |
| Responsible Gaming Data | Deposit limits, loss limits, session timer settings, self-exclusion records | Optional |
| Support Communications | Email threads, live chat transcripts, dispute records | Optional |
Information Collected Automatically
When you access xbjj, our systems automatically collect technical and behavioural data about your session. This data is used for security monitoring, fraud detection, and service improvement. It includes:
| Data Category | Examples | Type |
|---|---|---|
| Device Data | Device type, operating system version, browser type, screen resolution, device fingerprint | Automatic |
| Network Data | IP address, approximate geolocation (city-level), ISP name, connection type | Automatic |
| Usage Data | Pages visited, games played, session duration, bet history, click patterns, navigation path | Automatic |
| Transaction Logs | Deposit/withdrawal timestamps, amounts, payment method used, processing status | Automatic |
| Cookie & Tracking Data | Session cookies, preference cookies, analytics identifiers — see Section 3 for details | Automatic |
2. How We Use Your Data
Every use of your personal data by xbjj is tied to a specific, lawful purpose. We do not process your data in ways that are incompatible with the purposes for which it was originally collected.
xbjj processes your personal data under the following lawful bases:
Contract Performance
The majority of our data processing is necessary to fulfil the contract we have with you as a registered user. This includes creating and managing your account, processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and card channels, delivering game outcomes, applying bonus credits, and communicating account-related notices such as transaction confirmations and security alerts.
Legal Obligation
xbjj is required by applicable law to conduct Know Your Customer (KYC) identity verification, retain transaction records for defined periods, report suspicious financial activity where required, and comply with any lawful requests from competent authorities. Processing in this category is mandatory — without it, we cannot legally operate the platform.
Legitimate Interests
xbjj processes certain data on the basis of legitimate interests, where those interests are not overridden by your privacy rights. This includes:
- Fraud detection and prevention — monitoring account activity and transaction patterns to identify and stop fraudulent behaviour before it causes harm to you or to xbjj
- Platform security — detecting unauthorised access attempts, bot activity, and other security threats to our systems
- Responsible gaming monitoring — identifying betting patterns that may indicate problem gambling behaviours, enabling proactive intervention
- Platform analytics and improvement — understanding how users interact with the platform to improve navigation, game selection, and overall experience
- Duplicate account detection — using device fingerprinting and behavioural signals to identify users who attempt to register more than one account
Consent
Where xbjj relies on your consent as the lawful basis for processing, this is clearly stated at the point of data collection. Specifically, consent is sought before sending you marketing communications such as promotional emails about bonuses, seasonal offers (e.g., Eid promotions, Pohela Boishakh special offers, BPL cricket season promotions), and new game announcements. You can withdraw marketing consent at any time by updating your communication preferences in your account settings or by emailing [email protected]. Withdrawing marketing consent does not affect the lawfulness of processing carried out prior to that withdrawal, and it does not affect processing carried out under other lawful bases (contract, legal obligation, legitimate interests).
Marketing Communications
We send promotional emails only to users who have opted in during registration or subsequently via account settings. Each marketing email includes an unsubscribe link. Unsubscribing takes effect within 48 hours of confirmation.
Automated Decision-Making
xbjj uses automated systems to flag potentially suspicious account activity and bonus abuse patterns. Where an automated flag results in account restriction, you have the right to request human review of that decision by contacting [email protected].
Game & Bet Personalisation
With your consent, xbjj may use your game history and preferences to surface relevant game recommendations, such as cricket betting markets during BPL or IPL season. This feature can be turned off via account settings at any time.
3. Cookies & Tracking Technologies
xbjj uses cookies and similar tracking technologies to keep the platform functional, secure, and personalised. This section explains what cookies we use and how you can manage them.
A cookie is a small text file placed on your device when you visit a website. Cookies allow websites to remember information about your visit — such as your login state, your language preference, or items in your session — so that you do not have to re-enter them on every page. xbjj uses cookies and similar technologies (such as localStorage and session identifiers) for the purposes described in the table below.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Maintain your authenticated session, CSRF protection tokens, load balancing, fraud-prevention fingerprint. Cannot be disabled — essential for the platform to function. | Session / up to 24 hours |
| Functional | Remember your display preferences, notification settings, game lobby filters, and last-visited sections of the platform. | Up to 30 days |
| Analytics | Collect aggregated, anonymised data about page visits, feature usage, and session behaviour to help us improve the xbjj platform. Requires consent. | Up to 13 months |
| Security & Fraud | Device fingerprinting and anomaly-detection signals used to identify bot activity, account takeover attempts, and duplicate account creation. | Up to 90 days |
Managing Your Cookie Preferences
You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to be notified before a cookie is placed. The following guidance applies to common browsers used by our Bangladeshi players:
- Google Chrome: Settings → Privacy and Security → Cookies and other site data
- Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
- Samsung Internet (popular on Android in Bangladesh): Settings → Privacy → Cookies
- Safari (iOS): Settings → Safari → Privacy & Security → Block All Cookies
Please note that disabling strictly necessary cookies will prevent you from logging in to your xbjj account and using core platform features. Disabling functional cookies will cause the platform to lose your saved preferences between sessions.
4. Data Sharing & Third Parties
xbjj does not sell your personal data. We share it only where necessary to deliver the service, comply with law, or protect against fraud — and only with parties bound by strict confidentiality obligations.
In the course of providing the xbjj service, we may share certain categories of your personal data with the following categories of third parties:
Payment Service Providers
To process your deposits and withdrawals, xbjj shares the minimum necessary transaction data with your chosen payment provider — for example, your bKash or Nagad account number when initiating an MFS transfer, or tokenised card data when processing a Visa or Mastercard payment. These providers are independent data controllers with their own privacy policies, which we encourage you to review. xbjj does not have access to your full card number at any stage — card data is handled entirely within the payment processor's PCI-DSS certified environment.
Identity Verification Providers
To comply with our KYC obligations, xbjj uses third-party identity verification services to validate the authenticity of documents you submit (such as your National ID card or passport). These providers process identity data on our behalf under strict data processing agreements that prohibit them from using your data for any purpose other than the verification service they are contracted to provide.
Game Software Providers
The games available in the xbjj Casino lobby are supplied by licensed third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, a session identifier and certain anonymised gameplay data is shared with the relevant provider to operate the game, calculate outcomes, and verify the integrity of results. Full identity or payment data is not shared with game providers.
Legal & Regulatory Disclosure
xbjj may be required to disclose personal data to law enforcement agencies, financial intelligence units, or courts in response to a lawful request, court order, or legal obligation. In such cases, we will disclose only the data specifically required to comply with the request, and where permitted by law, we will notify you of the disclosure. We will not comply with requests that we have reason to believe are unlawful or disproportionate.
Business Transfers
In the event that xbjj undergoes a merger, acquisition, corporate restructuring, or sale of assets, personal data held by xbjj may be transferred to the successor entity as part of that transaction. In such circumstances, we will ensure that any successor entity is bound by privacy obligations no less protective than those in this Privacy Policy, and we will notify registered users via the email address on file.
5. Data Retention
xbjj retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law.
The table below summarises our standard retention periods by data category. These periods may be extended where required by law, by an ongoing investigation, or by a legal dispute in which the data is relevant.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | Anti-money laundering (AML) legal obligation |
| Transaction Records | 7 years from transaction date | Financial record-keeping requirements |
| KYC Verification Documents | 5 years post-account closure | AML / fraud prevention legal obligation |
| Support Communications | 3 years from last interaction | Dispute resolution and service quality review |
| Session & Usage Logs | 13 months | Security monitoring and fraud detection |
| Marketing Consent Records | Duration of consent + 3 years | Proof of lawful basis for marketing |
| Self-Exclusion Records | Minimum 6 years from exclusion date | Responsible gaming compliance |
| Anonymous Analytics Data | Up to 26 months (aggregated) | Long-term platform improvement analysis |
When a retention period expires and there is no legal basis to continue holding the data, xbjj securely deletes or anonymises the data using industry-standard methods. Anonymised data — from which no individual can reasonably be identified — may be retained indefinitely for statistical and analytical purposes.
If you request deletion of your personal data before the expiry of a mandatory retention period, we will restrict active processing of your data to the minimum required for legal compliance, but we cannot delete it entirely until the mandatory period has passed. We will confirm the specific retention end date when we process your deletion request.
Account Deletion Requests
To request deletion of your xbjj account and associated personal data, email [email protected] from your registered email address with the subject line "Data Deletion Request". We will acknowledge your request within 72 hours and provide a deletion timeline based on applicable retention obligations.
Secure Deletion Methods
At the end of applicable retention periods, xbjj uses cryptographic erasure for encrypted data stores and secure overwriting protocols for physical media. Third-party processors are contractually required to certify deletion of any personal data they hold on our behalf.
6. Security Measures
xbjj implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction.
256-bit SSL/TLS
All data transmitted between your device and xbjj servers is encrypted using TLS 1.3. The padlock icon in your browser confirms this connection is active during every session.
AES-256 at Rest
Personal data stored in xbjj databases is encrypted at rest using AES-256. Database access is restricted to a small number of authorised engineering personnel under role-based access control.
Fraud Monitoring
xbjj operates 24/7 automated fraud and anomaly detection systems. Unusual account access patterns, logins from new devices, and large withdrawal requests are flagged for additional security review before processing.
Two-Factor Authentication
xbjj supports two-factor authentication (2FA) for registered accounts. We strongly recommend enabling 2FA in your account security settings to protect your account against unauthorised access.
Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, xbjj will notify affected users promptly — within 72 hours of becoming aware of the breach — providing a description of the nature of the breach, the categories of data affected, and the steps we are taking to address it.
You also play an important role in keeping your account secure. We recommend that you use a strong, unique password for your xbjj account, enable two-factor authentication, never share your login credentials with anyone, and log out of your account on shared devices . If you suspect that your account has been accessed without your authorisation, contact [email protected] immediately so we can freeze the account and investigate.
7. Your Privacy Rights
As an xbjj user, you hold meaningful rights over your personal data. We are committed to honouring these rights promptly and without unnecessary barriers.
Right of Access
You have the right to request a copy of all personal data xbjj holds about you, along with information about how it is used and with whom it is shared. We will respond within 30 days of a verified request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most contact details directly in your account settings, or email [email protected] for identity data corrections.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other lawful basis applies. Mandatory legal retention periods may limit the immediate scope of deletion.
Right to Restrict Processing
You may request that xbjj restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or while a legitimate interests assessment is under review.
Right to Data Portability
Where processing is based on your consent or a contract, and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) for transfer to another service.
Right to Object
You have the right to object to processing carried out on the basis of legitimate interests, including profiling. You also have an absolute right to object to processing of your data for direct marketing purposes, which takes effect immediately upon receipt of your objection.
How to Exercise Your Rights
To exercise any of the rights described above, please send a written request to [email protected] from the email address registered to your xbjj account. Include your full name, username, and a clear description of the right you wish to exercise. We may need to verify your identity before processing the request — this is to ensure that we do not disclose or alter data in response to fraudulent requests.
xbjj will acknowledge all data rights requests within 5 business days and will complete the requested action (or provide a reasoned explanation if we are unable to comply) within 30 calendar days. In complex or high-volume cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.
Exercising your privacy rights is always free of charge. We will never charge a fee for processing a data rights request unless the request is manifestly unfounded or excessive in its frequency, in which case we reserve the right to charge a reasonable administrative fee or decline to act — and we will explain our reasons in writing.
8. Policy Updates & Contact
xbjj reviews this Privacy Policy regularly and will update it when our practices change or when required by law. We will always notify you of material changes.
How We Notify You of Changes
When we make material changes to this Privacy Policy — meaning changes that meaningfully affect how we collect, use, or share your personal data — we will notify registered users via the email address on file at least 14 days before the updated policy takes effect. The updated policy will also be posted on this page with a revised effective date at the top. For minor changes (such as corrections of typographical errors or clarifications that do not affect the substance of our practices), we will update this page without individual notification, though the effective date will still be updated to reflect the revision.
Continued use of the xbjj platform after the effective date of a revised Privacy Policy constitutes acceptance of the revised terms. If you do not agree with a material change to this Privacy Policy, you should stop using the platform and may close your account by contacting [email protected]. Any data subject rights requests (including deletion) submitted in connection with a policy disagreement will be handled in accordance with our retention obligations as described in Section 5.
Contact Information
If you have any questions, concerns, or complaints regarding this Privacy Policy or the way xbjj handles your personal data, please contact us at:
- Email (plain text, not a link): [email protected]
- Subject line for privacy queries: "Privacy Policy Enquiry"
- Response time: Within 3 business days (Bangladesh Standard Time, UTC+6)
xbjj takes all privacy complaints seriously. If you submit a complaint, we will investigate and respond with our findings and any remedial action taken. If you are not satisfied with our response, you have the right to escalate your complaint to an appropriate supervisory authority in your jurisdiction.
Children & Minors
xbjj is an adults-only platform. Our services are strictly intended for individuals aged 18 years and above. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal information to xbjj without your consent, please contact us immediately at [email protected] and we will take prompt action to delete the data and close the account.
Governing Language
This Privacy Policy is written in English and the English version is the authoritative version. In the event of any inconsistency between this English text and any translated or summarised version, the English text shall prevail.
Explore xbjj With Confidence
Your data is protected at every step. Now discover the full range of games and betting markets xbjj has to offer — from BPL cricket to 3,500+ slots and live dealer tables.