mxbaji Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you register an account on the mxbaji platform, you provide us with personal information that is necessary to create and manage your account. This includes your full legal name, date of birth, residential address in Bangladesh, mobile phone number registered to a Bangladeshi network (such as Grameenphone, Robi, Banglalink, Teletalk, or Airtel Bangladesh), and a password of your choosing. You may also provide a profile email address for account communication purposes.

When you submit identity verification documents as part of our Know Your Customer (KYC) process, you will provide additional personal data including a copy of a government-issued photo identity document (such as a National Identity Card, passport, or birth certificate) and confirmation details for your registered payment method. This information is collected solely for the purpose of verifying your identity and preventing fraudulent account activity.

If you contact our customer support team, we will retain a record of that correspondence, including your contact details and the substance of the communication, for the purposes of resolving your query and improving our service quality.

1.2 Information Collected Automatically

When you access the mxbaji platform, certain technical information is collected automatically by our systems. This includes your IP address, device type, operating system, browser type and version, the pages you visit on our platform, the time and date of your visits, session duration, and referring URLs. This information is used to ensure the platform operates correctly on your device, to detect and prevent security threats, and to analyse usage patterns in aggregate form to improve the platform experience.

We also collect information about your activity on the platform, including bets placed, games played, amounts wagered, bonuses claimed, and transaction history. This activity data is necessary for account management, dispute resolution, responsible gaming monitoring, and compliance with our legal obligations.

1.3 Payment and Transaction Data

When you make a deposit or request a withdrawal, we collect transaction reference information from your chosen payment method — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, or Mastercard. We retain the minimum data necessary to reconcile transactions, process withdrawals, and maintain accurate financial records. We do not store full card numbers, CVV codes, bKash PINs, or Nagad PINs on our servers. All payment data in transit is protected by SSL/TLS encryption.

2. How We Use Your Data

mxbaji processes personal data only where there is a lawful basis for doing so. The primary purposes for which we use your data are set out below, along with the corresponding lawful basis for each type of processing.

2.1 Marketing Communications

If you have consented to receive promotional communications from mxbaji, we may send you information about new games, seasonal promotions (such as BPL season offers, Eid bonuses, or Pohela Boishakh specials), and platform updates via SMS to your registered mobile number or to your registered email address. You may withdraw your consent to receive marketing communications at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

2.2 Automated Decision-Making

mxbaji uses automated systems to monitor account activity for signs of fraud, bonus abuse, and problem gambling patterns. These systems may flag accounts for review without human intervention. Where an automated flag results in an account restriction, you have the right to request a manual review by a member of our compliance team. Please contact [email protected] to request such a review.

3. Data Sharing & Disclosure

3.1 Service Providers

mxbaji may share your personal data with carefully selected third-party service providers who assist us in operating the platform. These include payment processing partners (such as the operators of bKash, Nagad, Rocket, and Upay integrations), identity verification service providers, game software studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), cloud hosting and infrastructure providers, and customer support software providers. All such service providers are contractually bound to process your data only for the specific purpose for which it was shared and to apply security standards no less stringent than those we apply ourselves.

3.2 Legal and Regulatory Disclosure

mxbaji may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where we are required to do so by applicable law, court order, or binding regulatory requirement. We will notify you of any such disclosure where we are legally permitted to do so. mxbaji will not disclose your personal data to government authorities voluntarily beyond the minimum required by law.

3.3 Business Transfers

In the event that mxbaji undergoes a corporate restructuring, merger, acquisition, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the way your data is processed as a result.

3.4 No Sale of Data

mxbaji does not sell, rent, exchange, or otherwise transfer your personal data to third-party marketers, data brokers, or advertising networks for their own commercial purposes. Your data is not an asset that mxbaji monetises through data markets.

4. Cookies & Tracking Technologies

4.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They enable the website to remember information about your visit, such as your login session status, language preferences, and certain settings that make the platform more convenient to use on subsequent visits. mxbaji uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate the platform correctly and to understand how it is used.

4.2 Types of Cookies We Use

• Strictly necessary cookies: These are essential to the operation of the mxbaji platform. They enable core functions such as maintaining your login session, remembering your account preferences, and ensuring the platform responds to your actions correctly. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: These cookies remember choices you make — such as your preferred currency display or notification settings — to provide a more personalised experience. Disabling them may reduce the convenience of your visit but will not prevent you from using the platform.
• Analytics cookies: These cookies collect aggregated, anonymised data about how visitors use the mxbaji platform, such as which pages are visited most frequently and where users exit the site. This data helps us improve the platform's design and performance. We do not use analytics cookies to build individual user profiles.
• Security cookies: These cookies are used to detect and prevent fraudulent activity, protect against cross-site request forgery, and maintain the integrity of your account session. They are strictly necessary for the safe operation of the platform.

4.3 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site or global basis. Please note that blocking strictly necessary cookies will prevent you from logging in to or using the mxbaji platform. Instructions for managing cookies in common browsers are available through the help documentation of your specific browser. As the mxbaji platform is designed for use in Bangladesh, we do not currently display a cookie consent banner — your continued use of the platform after reviewing this policy constitutes your acknowledgement of our use of the cookie types described above.

5. Data Retention

5.1 Retention Periods

mxbaji retains your personal data for as long as your player account is active and for a reasonable period thereafter to allow for the resolution of any disputes, the processing of any pending withdrawals, and compliance with our legal and regulatory obligations. The general retention periods that apply to the main categories of personal data we hold are as follows:

• Account registration data (name, date of birth, contact details): Retained for the lifetime of your account and for 5 years following account closure, in line with standard record-keeping obligations for financial services platforms.
• Identity verification documents (KYC records): Retained for 5 years following account closure or the date the documents were submitted, whichever is later.
• Transaction and financial records: Retained for 7 years following each transaction, consistent with standard financial record-keeping requirements.
• Activity and betting history: Retained for the lifetime of your account and for 3 years following account closure.
• Customer support correspondence: Retained for 3 years from the date of the last interaction in each support case.
• Marketing consent records: Retained for the duration of your consent and for 1 year following withdrawal of consent, for the purpose of demonstrating compliance.

5.2 Deletion and Anonymisation

When personal data is no longer required and the applicable retention period has expired, mxbaji will either securely delete the data or anonymise it so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical and analytical purposes. We conduct periodic reviews of our data holdings to identify and action data that has reached its retention limit.

6. Data Security Measures

6.1 Technical Safeguards

mxbaji employs a range of technical security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include SSL/TLS encryption for all data transmitted between your device and our servers, encrypted storage for sensitive data fields at rest, firewalls and intrusion detection systems on our server infrastructure, and regular security testing of the platform. Our platform is designed to resist common web application attack vectors including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).

6.2 Access Controls

Access to personal data within mxbaji's internal systems is governed by a role-based access control policy. Staff members are granted access to personal data only to the extent required for their specific job function. All staff with access to personal data receive data protection training and are bound by confidentiality obligations. Access permissions are reviewed regularly and revoked promptly when a staff member changes role or leaves the organisation.

6.3 Data Breach Response

In the event that mxbaji becomes aware of a personal data breach — that is, a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data — we will take immediate steps to contain the breach, assess its scope and impact, and implement remediation measures. Where a breach poses a material risk to affected players, we will notify those players without undue delay via the contact details registered to their account.

6.4 Your Responsibilities

The security of your mxbaji account also depends on you taking reasonable precautions to protect your login credentials. You should use a strong, unique password for your mxbaji account, never share your password or OTP codes with any other person, and log out of your account when using a shared or public device. If you suspect your account credentials have been compromised, please contact [email protected] immediately so that we can take protective action.

7. Your Rights as a Data Subject

As a player using the mxbaji platform, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact us at [email protected] with a clear description of your request. We will respond to all verified data rights requests within a reasonable timeframe and will not charge a fee for reasonable requests.

7.1 Right of Access

You have the right to request a copy of the personal data that mxbaji holds about you, along with information about how that data is being processed. This is sometimes referred to as a subject access request (SAR). We will provide a copy of your data in a commonly used electronic format where this is technically practicable.

7.2 Right to Rectification

If any personal data that mxbaji holds about you is inaccurate or incomplete, you have the right to request that we correct or update it. You can update basic account information such as your contact details directly through your account settings. For corrections to identity documentation or KYC records, please contact our support team.

7.3 Right to Erasure

In certain circumstances, you have the right to request that mxbaji delete personal data it holds about you. This right applies where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent and there is no other lawful basis for processing, or where the data has been processed unlawfully. Please note that this right is subject to override by legal retention obligations — mxbaji cannot delete data that it is required to retain by applicable law, such as financial transaction records.

7.4 Right to Restriction of Processing

You may request that mxbaji restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved, or while you are awaiting the outcome of an objection to processing request. During a restriction period, mxbaji will continue to store your data but will not actively process it for other purposes without your consent.

7.5 Right to Data Portability

Where mxbaji processes your personal data on the basis of your consent or the performance of a contract, and that processing is carried out by automated means, you have the right to receive a copy of the data in a structured, commonly used, machine-readable format. You may also request that we transmit this data directly to another service provider where technically feasible.

7.6 Right to Object

You have the right to object at any time to the processing of your personal data where that processing is based on mxbaji's legitimate interests. Where you object, mxbaji will cease processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of a legal claim. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.

8. Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way mxbaji handles your personal data, please contact our support team. We are available 24 hours a day, 7 days a week, and all communications are handled in English to serve our players across Bangladesh — including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

You can reach us by email at: [email protected]

Please include "Privacy Enquiry" in the subject line of your email so that our team can route your message to the appropriate person. We will acknowledge receipt of your enquiry within 2 business days (Bangladesh Standard Time, UTC+6) and will aim to provide a substantive response within 14 calendar days.

8.1 Updates to This Privacy Policy

mxbaji reserves the right to update this Privacy Policy at any time. Where changes are material — that is, where they significantly affect the way we collect, use, or share your personal data — we will notify you via the mobile number or email address registered to your account and will publish the revised Policy on this page with an updated effective date. Your continued use of the mxbaji platform following the effective date of any revision constitutes your acknowledgement of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically. The version published on this page is always the current version. If there is any conflict between a previously communicated version and the current published version, the current published version shall prevail.