bid baji Privacy Policy

This Privacy Policy applies to all users of bid baji, including visitors who browse bid-baji.com without registering and players who hold a registered account. It covers data collected through the website, mobile interface, live chat support system, email communications, and any other channel through which you interact with bid baji.

bid baji is the data controller for all personal information collected through the platform. We process personal data lawfully, fairly, and transparently, collecting only what is necessary for the purposes described in this document. We do not sell your personal data to third parties for their own marketing purposes.

This policy should be read alongside our Terms & Conditions and Responsible Gaming page, which together form the complete set of agreements governing your use of bid baji.

bid baji collects personal data through several channels: directly from you when you register an account, interact with our platform, contact support, or participate in promotions; automatically through technical systems as you use the website; and, where necessary, from third-party verification and payment service providers.

The categories of personal data we collect are described in the table below:

We do not collect special-category sensitive data such as racial or ethnic origin, political opinions, health data, or biometric identifiers unless required by applicable law and with your explicit consent.

bid baji processes your personal data only for clearly defined, lawful purposes. We rely on one or more of the following legal bases when processing your information: performance of a contract (delivering the service you signed up for), compliance with a legal obligation (KYC, AML regulations), our legitimate business interests (fraud prevention, platform security), or your explicit consent (marketing communications).

The specific purposes for which we process your data include:

• Account creation and management: Processing your registration, verifying your identity, maintaining your account profile, and authenticating your logins.
• Service delivery: Enabling you to place bets on cricket markets (BPL, IPL, T20 World Cup), access live casino games, play slots, and use the crash game platform.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, and card payment methods. Transaction data is shared with the relevant payment processor solely for the purpose of completing the transaction.
• KYC and age verification: Verifying that you are aged 18 or above and confirming that the identity and payment information on your account belongs to you. This is a legal and operational requirement for operating a responsible gambling platform.
• Anti-money-laundering (AML) compliance: Monitoring transaction patterns to detect and report suspicious financial activity as required under applicable regulations.
• Responsible gaming monitoring: Analysing your gaming activity to detect patterns that may indicate problem gambling behaviour, and proactively reaching out where our responsible gaming team identifies a concern.
• Customer support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Platform improvement and analytics: Using aggregated, anonymized usage data to understand how players interact with bid baji, identify technical issues, and improve the platform experience.
• Fraud detection and security: Monitoring IP addresses, device fingerprints, and behavioral patterns to detect duplicate accounts, bonus abuse, unauthorized access attempts, and other fraudulent activity.
• Marketing and promotions (with consent): Sending promotional emails and SMS notifications about bonuses, BPL/IPL season offers, Eid promotions, and new game launches — only where you have explicitly opted in to receive such communications. You may withdraw consent at any time via the communication preferences section of your account.

bid baji does not use your personal data for automated decision-making that produces legal effects or significantly affects you without human oversight, except in the context of fraud detection flagging (which is always subject to manual review before any account action is taken).

bid baji does not sell, rent, or disclose your personal data to any third party for their own independent purposes. Data is shared with external parties only in the specific, limited circumstances described below, and always subject to contractual data protection obligations or legal requirements.

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive transaction-specific data (name, account reference, amount) solely for the purpose of processing your deposit or withdrawal. These providers operate under their own regulated privacy frameworks.
• Game software providers: Providers such as Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe receive a session token and anonymized player identifier to deliver live casino and slot game content. They do not receive your full identity data.
• Identity verification services: Third-party KYC service providers may receive copies of your identity documents to perform automated verification checks. These providers are contractually bound to process your data solely for verification purposes and to delete it upon completion of the check.
• Fraud prevention and AML partners: Aggregated behavioral data and, where legally required, specific transaction records may be shared with anti-fraud and anti-money-laundering compliance tools. These tools process data to identify risks and do not retain personal data beyond the period required for the check.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory direction, bid baji will disclose personal data to relevant authorities. We will notify you of such a disclosure where we are legally permitted to do so.
• Professional advisers: Legal counsel, auditors, and accountants engaged by bid baji may access relevant data on a strictly confidential, need-to-know basis in connection with their professional engagement.

All third-party data processors engaged by bid baji are required to sign a data processing agreement that obliges them to process your data only on our instructions, to implement appropriate technical and organizational security measures, and not to engage further sub-processors without our prior written consent.

bid baji uses cookies and similar browser-based tracking technologies to operate the platform correctly, maintain your session while you are logged in, and gather anonymized analytics data that helps us improve the platform. We do not use advertising cookies or participate in cross-site tracking networks.

The specific types of cookies we deploy are:

• Strictly necessary cookies: These are essential for the platform to function. They manage your login session, maintain your account authentication state, and preserve your in-progress game sessions. These cookies cannot be disabled without breaking core functionality.
• Performance and analytics cookies: These cookies collect anonymized data about how players navigate bid baji — which pages are most visited, which games are most played, average session lengths, and error event frequencies. This data is aggregated and used solely to improve the platform. No individual player is identified in analytics reports.
• Functional cookies: These cookies remember your preferences such as language setting, display preferences, and last-visited game category, so you do not need to re-configure these on each visit.
• Fraud prevention cookies: These cookies store a device fingerprint hash to help our security systems identify whether a login attempt is coming from a known, trusted device or an unrecognized device. This is part of our account security infrastructure.

Managing your cookie preferences: You can manage or delete cookies at any time through your browser's settings panel. Please note that disabling strictly necessary cookies will prevent you from logging in and using the platform. Disabling other cookie categories will not affect your ability to play but may reduce the quality of your user experience.

bid baji does not use Flash cookies, web beacons, pixel tags, or any persistent tracking technology beyond those described above. We do not deploy cookies from third-party advertising networks on any page of the bid baji platform.

bid baji implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• Encryption in transit: All data transferred between your device and bid baji's servers is protected by TLS 1.2 or higher. Our platform enforces HTTPS across all pages and subdomains without exception.
• Encryption at rest: Sensitive data fields — including payment account references, identity document records, and KYC files — are encrypted at rest using AES-256 encryption in isolated database partitions.
• Access controls: Employee access to personal data is granted on a strict need-to-know basis. All internal access events are logged and subject to periodic audit. Privileged access to production systems requires multi-factor authentication.
• KYC document isolation: Identity verification documents are stored in a separate, access-controlled environment that is physically and logically isolated from the main player account database.
• Penetration testing: bid baji's platform infrastructure undergoes periodic security assessments, including vulnerability scanning and penetration testing conducted by independent security professionals.
• Incident response: bid baji maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to affected players, we will notify impacted users as required by applicable legal obligations.

Data retention schedule: We retain your personal data for as long as your account remains active. Upon account closure, we retain core account and transaction records for a minimum of 5 years to satisfy financial record-keeping obligations under applicable AML regulations. Support communications are retained for 3 years. Analytics data is anonymized within 13 months of collection. KYC documents are retained for 5 years post-closure and then securely destroyed.

When data reaches the end of its retention period, it is either permanently deleted from all systems or irreversibly anonymized so that it can no longer be linked to an individual player. Players may request early deletion of non-legally-required data at any time; see the Your Privacy Rights section below for the request procedure.

As a player registered with bid baji, you hold the following rights in relation to your personal data. These rights may be subject to certain limitations where legal obligations require us to retain or process specific data regardless of your request — for example, transaction records that must be preserved for AML compliance purposes.

• Right of access: You may request a copy of all personal data we hold about you. We will provide this in a structured, machine-readable format (JSON or CSV) within 30 days of receiving a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay. Minor corrections (such as updating your contact number) can be made directly through your account profile settings.
• Right to erasure: You may request the deletion of your personal data. We will action this request where there is no legal obligation requiring us to retain the data. Where retention is legally required, we will inform you of the specific obligation and the data categories affected.
• Right to restrict processing: You may request that we restrict our processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing based on our legitimate interests.
• Right to data portability: You may request a portable copy of the personal data you have provided to us in a commonly used, machine-readable format, for the purpose of transferring it to another service provider.
• Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis. You also have an unconditional right to object to processing for direct marketing purposes, which will take effect immediately upon receipt of your objection.
• Right to withdraw consent: Where we process your data on the basis of your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

How to exercise your rights: To exercise any of the rights listed above, contact our support team via the in-account live chat (available 24/7) or by emailing [email protected]. Please state clearly which right you wish to exercise and provide sufficient information for us to verify your identity before processing the request. We aim to respond to all privacy rights requests within 30 calendar days. Complex or multiple requests may take up to 90 days, in which case we will notify you of the extended timeline.

bid baji takes privacy seriously and has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection obligations. If you have any questions, concerns, or complaints about how your personal data is handled by bid baji, we encourage you to contact us directly so we can resolve the matter promptly.

Support team (general queries): For account-specific privacy questions, data access requests, or marketing opt-out requests, contact our support team through the in-account live chat, which is available 24 hours a day, 7 days a week, 365 days a year. Our support team responds in both English and Bengali.

Data Protection Officer (formal complaints and escalations): For formal privacy complaints or escalations, contact the Data Protection Officer by emailing [email protected] with the subject line "Privacy — DPO Escalation". We aim to acknowledge all formal complaints within 5 business days and provide a substantive response within 30 calendar days.

Policy updates: bid baji will notify registered players of any material changes to this Privacy Policy via the email address registered to their account, at least 14 days before the changes take effect. Non-material changes (such as typographical corrections or clarifications that do not affect how data is processed) may be made without advance notice. The current version of this Privacy Policy is always available at bid-baji.com/privacy-policy. The effective date shown at the top of this document indicates when the current version came into force.

bid baji is committed to resolving privacy concerns amicably and promptly. If after contacting us you remain dissatisfied with our handling of a privacy matter, you retain the right to escalate your complaint to an appropriate supervisory authority in your jurisdiction.