Privacy Policy — xtbajee

1 Information We Collect

xtbajee collects personal information in two primary ways: information you provide directly when using the platform, and information collected automatically through your interaction with the site. We collect only what is necessary to provide a secure, compliant, and enjoyable gaming experience.

1.1 Information You Provide Directly

When you register for or use an xtbajee account, you provide us with the following categories of personal information:

1.2 Information Collected Automatically

When you visit xtbajee.net or use our platform, certain technical data is collected automatically by our servers and analytics systems. This includes:

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile, tablet, desktop), screen resolution, and time zone setting;
• Usage Data: Pages visited, time spent on each page, game sessions started and completed, betting history, login timestamps, and session duration;
• Transaction Data: Records of all deposits, withdrawals, wagers placed, bonuses claimed, and winnings received on your account;
• Cookie & Tracking Data: Session identifiers, functional cookies, and analytics data as described in Section 4 of this Privacy Policy.

1.3 Information from Third Parties

In certain circumstances, xtbajee may receive personal data about you from third-party sources. These include identity verification service providers who assist with KYC (Know Your Customer) checks, payment processors such as bKash, Nagad, and Rocket who confirm the status of your transactions, and fraud prevention partners who flag potentially suspicious account activity. Data received from third parties is handled with the same level of care and security as data you provide directly.

2 How We Use Your Data

xtbajee processes your personal data only for specific, documented purposes. We do not use your data in ways that are incompatible with the purposes for which it was collected. The following table outlines how each category of data is used and the legal basis for that use.

2.1 Service Delivery

The primary purpose for which xtbajee processes your personal data is to provide the gaming and sports betting services you have requested. This includes:

• Creating and maintaining your xtbajee player account;
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and Dutch-Bangla Bank;
• Settling your bets and crediting winnings to your account balance;
• Applying responsible gaming tools such as deposit limits, session limits, and self-exclusion;
• Responding to your customer support enquiries and resolving disputes.

2.2 Legal and Compliance Obligations

xtbajee is required by law to collect and retain certain categories of personal data. These obligations include:

• Verifying the identity and age of all registered players (anti-money laundering and age verification requirements);
• Maintaining complete records of all financial transactions for audit and tax purposes;
• Investigating and reporting suspicious financial activity to relevant authorities where required;
• Complying with any lawful order from a competent court or regulatory authority requiring disclosure of player data.

2.3 Security and Fraud Prevention

xtbajee uses personal data — particularly device data, IP addresses, and transaction patterns — to detect and prevent fraudulent activity on the platform. This includes identifying duplicate accounts, flagging unusual betting patterns, preventing unauthorised account access, and protecting the integrity of our payment systems. Fraud prevention processing is carried out in our legitimate interests and is necessary to maintain a safe environment for all players.

2.4 Service Improvement and Analytics

Anonymised and aggregated usage data is used by xtbajee to understand how players interact with the platform, which games and features are most popular, and where technical issues may be occurring. This data is used to improve the site's functionality, performance, and user experience. Where analytics are based on aggregated, non-identifiable data, no individual player can be identified from this analysis.

2.5 Marketing Communications

With your explicit consent at the time of registration or subsequently through your account settings, xtbajee may send you promotional communications about bonuses, new game launches, seasonal promotions (such as Eid or Pohela Boishakh special offers), and platform updates. You may withdraw your consent to marketing communications at any time by updating your notification preferences in your account settings or by contacting [email protected]. Withdrawal of marketing consent does not affect your ability to continue using the platform.

3 Data Sharing & Third Parties

3.1 Principle of Minimum Disclosure

xtbajee shares your personal data with third parties only where strictly necessary to deliver our services, meet legal obligations, or protect the security of the platform. We do not sell, rent, or trade your personal data to any third party for commercial or advertising purposes. Every third party with whom xtbajee shares data is contractually bound to handle that data in accordance with applicable data protection principles.

3.2 Categories of Third-Party Recipients

The following categories of third parties may receive limited personal data from xtbajee in the course of normal platform operations:

• Payment Processors: bKash, Nagad, Rocket, Upay, and Dutch-Bangla Bank receive your payment account identifiers and transaction amounts to process deposits and withdrawals. They do not receive your full gaming history or verification documents.
• Game Providers: Licensed game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, and Playtech receive a session token and anonymised player identifier to manage your game session. They do not receive your full name, mobile number, or payment details.
• Identity Verification Services: Where required for KYC compliance, a specialist verification provider may receive your submitted identity documents to confirm their authenticity. This data is handled under strict confidentiality agreements.
• IT and Infrastructure Providers: Cloud hosting, server management, and security monitoring providers may have access to system data — including log files containing IP addresses — as a necessary part of their infrastructure services.
• Legal and Regulatory Authorities: xtbajee will disclose personal data to competent courts, law enforcement agencies, or regulatory authorities where required to do so by a legally binding order or applicable law.

3.3 No Cross-Border Transfer Without Safeguards

Where any of the third parties described above are located outside Bangladesh, xtbajee ensures that appropriate contractual safeguards are in place before transferring your personal data internationally. Such safeguards include standard contractual clauses and data processing agreements that require the recipient to maintain data protection standards equivalent to those applied by xtbajee.

4 Cookies & Tracking Technologies

4.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits, remember your preferences, and maintain your login session. xtbajee uses cookies and similar technologies (such as local storage and session tokens) to ensure the platform functions correctly and securely.

4.2 Types of Cookies Used by xtbajee

xtbajee does not deploy third-party advertising cookies or cross-site tracking cookies. Analytics cookies used by xtbajee are first-party only, meaning the data they collect is processed exclusively by xtbajee and is not shared with external advertising networks.

4.3 Managing Cookies

You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, accept cookies only from specific websites, or delete all cookies on exit. Please note that disabling strictly necessary cookies will impair the functionality of xtbajee.net — in particular, you will not be able to maintain a logged-in session. Disabling functional cookies may cause your preferences to reset on each visit. Disabling analytics and security cookies will not prevent you from using the platform but may affect our ability to protect your account from fraud.

5 Data Security & Retention

5.1 Security Measures

xtbajee implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS Encryption: All data in transit between your browser and xtbajee's servers is encrypted using current Transport Layer Security (TLS) protocols;
• Encryption at Rest: Sensitive data fields — including payment account references and identity document scans — are encrypted within our database storage systems;
• Access Controls: Access to personal data within xtbajee's internal systems is restricted on a strict need-to-know basis. Staff members can access only the data required to perform their specific role;
• Regular Security Audits: xtbajee conducts periodic internal security reviews and works with certified third-party security professionals to identify and remediate vulnerabilities;
• Incident Response: In the event of a confirmed data security incident that poses a risk to your personal data, xtbajee will notify affected players without undue delay and will take immediate corrective action.

5.2 Retention Periods

xtbajee retains personal data for as long as your account remains active and for a defined period thereafter, as required by legal and compliance obligations. The general retention schedule is as follows:

• Active account data: Retained for the full duration of your account's activity on the platform;
• Transaction and betting records: Retained for a minimum of 5 years following the date of the transaction, in line with standard financial record-keeping requirements;
• Identity verification documents: Retained for a minimum of 5 years following account closure;
• Support communications: Retained for 3 years following the resolution of the support case;
• Analytics data: Aggregated and anonymised — retained indefinitely in non-identifiable form. Raw session logs are deleted within 24 months.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised so that it can no longer be associated with you as an individual.

6 Your Privacy Rights

As a player on xtbajee, you have a number of rights in relation to the personal data we hold about you. These rights are set out below. To exercise any of these rights, contact xtbajee's support team at [email protected] with the subject line "Privacy Rights Request". We will respond to all valid requests within 30 days of receipt.

6.1 Right of Access

You have the right to request a copy of all personal data xtbajee holds about you — commonly referred to as a Subject Access Request (SAR). We will provide the data in a clear, structured format. Processing a SAR is free of charge for one request per 12-month period.

6.2 Right to Rectification

If any personal data xtbajee holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For basic contact and profile information, you may be able to update this directly within your xtbajee account settings. For identity data and payment details, please contact support to initiate a verified correction request.

6.3 Right to Erasure

In certain circumstances, you have the right to request that xtbajee delete your personal data. This right applies where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent (in cases where consent was the legal basis for processing), or where the data has been unlawfully processed. Please note that this right is subject to xtbajee's overriding legal obligations to retain certain categories of data — in particular, financial transaction records — for the minimum retention periods described in Section 5.2.

6.4 Right to Restriction

You have the right to request that xtbajee restricts the processing of your personal data in specific circumstances — for example, while the accuracy of data you have contested is being verified, or where you have objected to processing based on our legitimate interests and that objection is under consideration.

6.5 Right to Object

You have the right to object to xtbajee's processing of your personal data where that processing is based on our legitimate interests. You also have an unconditional right to object to the use of your data for direct marketing purposes. If you object to marketing, we will stop sending you promotional communications immediately upon receipt of your objection.

7 Children's Privacy

xtbajee's services are strictly intended for adults aged 18 years and above. 18+

xtbajee does not knowingly collect, store, or process personal data belonging to persons under the age of 18. Our registration process includes mandatory age declaration and date-of-birth verification steps specifically designed to prevent under-18 access. If xtbajee becomes aware that personal data has been collected from a person under 18 — whether through a false declaration at registration or any other means — all data associated with that individual will be permanently deleted and the account will be closed immediately.

If you are a parent or guardian and you believe that a minor in your care has accessed xtbajee and provided personal data, please contact us immediately at [email protected]. We will investigate and resolve the matter promptly.

8 Changes to This Policy

xtbajee reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, or improvements to the clarity of our disclosures. The effective date shown at the top of this page will be updated whenever a material revision is made.

Where a change is material — meaning it significantly affects how we collect or use your personal data — xtbajee will notify registered players by email to the address on their account prior to the change taking effect. For minor or clarificatory changes, updating the effective date on this page constitutes sufficient notice.

We encourage all players to review this Privacy Policy periodically. Continued use of the xtbajee platform following notification of a policy change constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy or about how xtbajee handles your personal data, please contact our support team at [email protected]. Support is available 24 hours a day, 7 days a week, including Bangladesh public holidays (BST, UTC+6).