Privacy Policy
for nbajii

nbajii does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information. If you voluntarily disclose such information in a support communication, it will be handled with heightened care and will not be processed for any purpose beyond resolving your specific query.

Where age verification or identity verification requires you to submit a copy of a government-issued document — such as a National Identity Card (NID), passport, or driving licence — that document is processed solely for the purpose of confirming your identity and eligibility to hold an Account. Document images are stored securely and are not used for any other purpose.

nbajii shares your personal data only with the categories of recipients listed below, and only to the extent strictly necessary for the stated purpose. All third-party service providers who receive your data are contractually required to protect it to a standard no less rigorous than that applied by nbajii itself.

3.1 Payment Processors

When you make a deposit or request a withdrawal, the financial data necessary to complete that transaction — such as your mobile wallet number or bank reference — is shared with the relevant payment processor (for example, bKash, Nagad, Rocket, Upay, or your bank). nbajii does not store full payment credentials on its own servers; all sensitive financial data is handled directly by the payment processor in accordance with their own security standards.

3.2 Identity Verification Providers

To comply with age verification and anti-money laundering obligations, nbajii may share identity and contact data with specialist third-party identity verification providers. These providers confirm the authenticity of the documents you submit and cross-reference your details against publicly available records. Verification providers are prohibited from retaining your data beyond the period required to complete the verification check.

3.3 Game Software Providers

Games available on nbajii are powered by third-party software studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. To facilitate gameplay, limited technical data — such as a pseudonymous session identifier and bet/win values — is transmitted to the relevant game provider. These providers do not receive your full identity or contact data. All game providers operating on the nbajii platform are subject to data processing agreements.

3.4 Legal and Regulatory Authorities

nbajii may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by applicable law, a valid court order, or a lawful regulatory instruction. In such circumstances, nbajii will disclose only the minimum data necessary to satisfy the legal obligation and, where legally permitted, will notify the affected User.

3.5 No Sale of Personal Data

nbajii does not sell, rent, or otherwise commercially transfer your personal data to any third party for that party's own marketing or commercial purposes. Any sharing of data beyond the categories described above requires your explicit prior consent, which you may withdraw at any time by contacting the support team.

nbajii retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the lifetime of your Account plus a minimum of five years following Account closure, to satisfy anti-money laundering record-keeping obligations.
• Transaction and financial data: Retained for a minimum of seven years following the date of each transaction, in accordance with standard financial record-keeping requirements applicable to payment services operating in Bangladesh.
• Support communications: Retained for three years from the date of the most recent interaction on a given support ticket, or until any associated dispute is fully resolved.
• Technical and analytics data: Aggregated analytics data is retained indefinitely in anonymised form. Raw technical logs (IP addresses, session data) are retained for no more than 12 months unless required for an active fraud investigation.
• Marketing preference data: Retained until you withdraw your consent to receive marketing communications, at which point your contact details are removed from all active marketing lists within 30 days.

Where data is retained beyond the period necessary for its primary purpose — solely to satisfy a legal obligation — it is held in a restricted state, accessible only to the compliance team and only for the specific purpose of meeting that obligation. It will not be used for any operational, marketing, or analytical purpose during the retention-only period.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that makes re-identification impossible. Anonymised, aggregated statistical data may be retained indefinitely for business analysis and platform improvement purposes.

nbajii implements a layered security architecture designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. The following technical and organisational measures are in place at all times:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the nbajii servers, ensuring that your login credentials, financial data, and personal information cannot be intercepted in transit.
• Encrypted data storage for all sensitive fields including passwords (stored as salted hashes, never in plain text), payment references, and identity document images.
• Access controls and role-based permissions that limit internal access to personal data on a strict need-to-know basis. Support staff, compliance officers, and technical teams each have access only to the data categories required for their specific function.
• Regular security audits and vulnerability assessments conducted by the internal security team and periodic reviews by external security consultants.
• Intrusion detection systems that monitor platform traffic in real time and flag anomalous activity for immediate investigation.
• Secure data centre infrastructure with physical access controls, redundant power systems, and environmental monitoring to protect hardware on which your data is stored.

While nbajii takes every reasonable technical precaution, no internet-based service can guarantee absolute security. You are responsible for maintaining the security of your own Account credentials and for notifying us immediately if you suspect any unauthorised access to your Account. In the event of a data breach that is likely to result in a risk to your rights and freedoms, nbajii will notify affected Users without undue delay and will take all necessary steps to contain and remediate the incident.