nbaja Privacy Policy

Section 1

Data We Collect

When you register for and use the nbaja platform, we collect personal data across several categories. The scope of data collected depends on your level of engagement with the platform — basic browsing requires minimal data, while full account registration, KYC verification, and financial transactions require more detailed information. Below is a structured overview of what we collect and at what stage.

nbaja does not knowingly collect personal data from individuals under the age of 18. If we become aware that data has been collected from a minor, that data will be deleted immediately and the associated account will be closed. We encourage parents and guardians to monitor internet activity among young people in their household.

Section 2

How We Use Your Data

Every piece of personal data that nbaja collects serves a defined, legitimate purpose. We do not process data for its own sake or allow collected information to be used for purposes beyond those listed below. Our lawful bases for processing your personal data include contractual necessity (to deliver the service you signed up for), legal obligation (compliance with anti-money-laundering and responsible gaming requirements), legitimate interest (fraud prevention, platform security), and consent (marketing communications where explicitly opted in).

• Account creation and management: Identity and contact data are used to create and maintain your registered nbaja account, authenticate your logins, and communicate account-related updates such as password reset instructions, deposit confirmations, and withdrawal notifications.
• Payment processing: Financial data including mobile wallet numbers and bank details are used exclusively to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and partner banks. We do not store full payment credentials beyond what is necessary for transaction reference.
• Identity verification (KYC): KYC documents and identity data are used to verify that you meet the 18+ age requirement, to confirm that your payment method is registered in your own name, and to comply with anti-money-laundering obligations. Verified KYC status is a prerequisite for withdrawal processing.
• Fraud prevention and security: Technical and behavioural data is analysed to detect unusual account activity, identify potential multi-accounting, flag suspicious betting patterns, and prevent unauthorised access to player accounts. This processing protects both individual players and the integrity of the platform.
• Responsible gaming compliance: Behavioural data — including session length, betting frequency, and deposit volumes — is monitored to identify players who may be exhibiting signs of problem gambling. This allows nbaja to proactively offer responsible gaming tools such as deposit limits, time-out periods, and self-exclusion in accordance with our Responsible Gaming Policy.
• Customer support: Communications data (support tickets, chat transcripts, email correspondence) is retained to resolve disputes, investigate complaints, and maintain a record of interactions for quality assurance purposes.
• Platform improvement: Aggregated and anonymised behavioural data is used to understand how players navigate the nbaja platform, which features are most used, and where the user experience can be improved. This analysis does not identify individual players.
• Marketing communications (opt-in only): Where you have explicitly consented to receive promotional communications, we may use your contact data to send you information about bonuses, new games, seasonal promotions (such as BPL betting offers or Eid special events), and platform updates. You can withdraw consent at any time by contacting [email protected].

Section 3

Data Sharing & Third Parties

nbaja does not sell your personal data. We do not rent it, trade it, or share it with advertising networks or data brokers. Personal data is shared with third parties only to the extent necessary to operate the platform, comply with legal obligations, or protect the safety of players and the platform. All third-party service providers who receive your data are subject to data processing agreements that bind them to handle your information with the same standard of care applied by nbaja.

The categories of third parties with whom data may be shared are as follows:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive the minimum financial data necessary to process deposit and withdrawal transactions. These providers operate under their own regulated privacy frameworks and are not permitted to use your data for any purpose other than processing the specific transaction.
• Identity verification partners: Third-party KYC and identity verification services may receive copies of your submitted identity documents to perform automated document authenticity checks. These partners are bound by strict data handling agreements and may not retain your documents beyond the verification period.
• Game content providers: Third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session and gameplay data necessary to deliver and maintain the game experience. This data is typically anonymised at the API level and does not include your full identity details.
• Technology and infrastructure providers: Hosting, content delivery, and security infrastructure providers may process server logs that include technical data such as IP addresses. These providers operate under confidentiality obligations and are selected for their compliance with recognised security standards.
• Legal and regulatory authorities: nbaja may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a legally enforceable order, warrant, or statutory obligation. In such cases, nbaja will disclose only the minimum information required and, where legally permissible, will notify the affected player.
• Business transfers: In the event of a merger, acquisition, or sale of assets, player data may be transferred to the acquiring entity as part of the transaction. Players will be notified in advance of any such transfer and will be informed of any changes to this Privacy Policy that result from the transaction.

nbaja does not transfer personal data to countries or territories that do not provide an adequate level of data protection without first implementing appropriate safeguards such as standard contractual clauses or equivalent data transfer mechanisms.

Section 4

Cookies & Tracking Technologies

The nbaja platform uses cookies and similar tracking technologies (including local storage and session tokens) to deliver a functional, secure, and personalised experience. Cookies are small text files placed on your device when you visit the platform. They allow nbaja to remember your preferences, maintain your login session, and understand how you interact with the site.

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in or using core platform features. Functional and analytics cookies can be disabled without preventing basic access to the platform.

Section 5

Data Retention & Storage

nbaja retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Our general data retention principles are set out below.

• Active account data: Identity, contact, and financial data associated with an active player account is retained for the full duration of the account relationship plus a minimum period of five years following account closure. This retention period is necessary to comply with anti-money-laundering record-keeping obligations.
• KYC documents: Copies of government-issued identity documents and proof of address submitted during KYC verification are retained for a minimum of five years from the date of submission. After this period, documents are securely deleted unless a specific legal hold is in place.
• Transaction records: Records of all deposits, withdrawals, and betting activity are retained for a minimum of seven years to satisfy financial record-keeping requirements. These records are stored in encrypted format with access restricted to authorised compliance personnel.
• Support communications: Customer support tickets, live chat transcripts, and email correspondence are retained for three years from the date of the interaction. After this period, records are deleted unless they relate to an open or escalated dispute.
• Technical and log data: Server logs, IP address records, and session logs are retained for a maximum of 12 months. After this period, they are either deleted or anonymised so that they can no longer be linked to an individual player.
• Marketing consent records: Records of marketing consent (including the date, method, and scope of consent given) are retained for the duration of the marketing relationship and for three years following withdrawal of consent, as evidence of lawful processing.

All stored personal data is protected by encryption both at rest (AES-256) and in transit (TLS 1.3). Physical and logical access to data storage systems is restricted to authorised nbaja personnel on a need-to-know basis. Data deletion procedures are carried out securely to prevent recovery of deleted information.

Section 6

Your Privacy Rights

As a player on the nbaja platform, you hold a set of rights in relation to the personal data we hold about you. nbaja is committed to honouring these rights promptly and without creating unnecessary obstacles. To exercise any of the rights listed below, contact us at [email protected] with the subject line "Privacy Rights Request" and include your registered account username or email address for identification purposes.

• Right of access: You have the right to request a copy of the personal data that nbaja holds about you. We will provide this in a structured, commonly used format within 30 days of receiving a verified request. Where a request is complex or numerous, this period may be extended by a further 30 days, with notice provided to you.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Basic contact details (such as email address or phone number) can be updated directly through your account settings. For identity data changes, a support request and supporting documentation may be required.
• Right to erasure: You may request that nbaja delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where you object to processing and there are no overriding legitimate grounds. Note that erasure requests may not be fulfilled where retention is required by law (such as AML record-keeping obligations).
• Right to restrict processing: You may request that nbaja limit the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is being considered.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to object: You have the right to object at any time to processing of your personal data for direct marketing purposes. Upon receiving such an objection, nbaja will cease marketing communications immediately. You may also object to processing based on legitimate interest grounds, though such objections are subject to a balancing assessment.
• Right to withdraw consent: Where processing is based solely on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Section 7

Data Security Measures

Protecting the personal data of our players is a core operational priority at nbaja. We have implemented a layered security architecture that combines technical controls, procedural safeguards, and ongoing monitoring to minimise the risk of unauthorised access, data breaches, or loss of personal information.

• Encryption in transit: All data exchanged between your device and the nbaja platform is encrypted using TLS 1.3 (Transport Layer Security). This ensures that your login credentials, payment details, and personal information cannot be intercepted during transmission.
• Encryption at rest: Personal data stored on nbaja servers is encrypted using AES-256, an industry-standard symmetric encryption algorithm. Encryption keys are stored separately from the data they protect and are rotated on a scheduled basis.
• Access controls: Access to systems containing personal data is governed by the principle of least privilege. Staff members can access only the data required for their specific role. Access is managed through role-based access controls, multi-factor authentication requirements, and regular access reviews.
• Intrusion detection and monitoring: nbaja operates continuous security monitoring across its infrastructure to detect and respond to anomalous activity, attempted intrusions, and potential security incidents in real time. Security events are logged and reviewed by the platform's security operations function.
• Vulnerability management: The nbaja platform undergoes regular security assessments including automated vulnerability scanning and periodic penetration testing. Identified vulnerabilities are triaged and remediated according to risk priority, with critical issues addressed within 24 hours of discovery.
• Data breach response: In the event of a confirmed data breach affecting player personal data, nbaja will follow an established incident response procedure that includes containment, impact assessment, regulatory notification (where applicable), and player notification. Players whose data has been materially compromised will be notified without undue delay.

While nbaja applies rigorous security measures, no internet-based platform can guarantee absolute security. We encourage all players to use a strong, unique password for their nbaja account, to enable any available two-step verification, and to log out of their account after each session — particularly when using shared or public devices.

Section 8

Policy Updates & Contact

nbaja reviews this Privacy Policy on a regular basis to ensure it accurately reflects our data practices and remains aligned with applicable legal requirements. We may update this policy at any time. When we make a material change — one that significantly affects how your data is collected, used, or shared — we will notify registered players via their registered email address before the change takes effect. For non-material changes (such as clarifications of existing practices or corrections to formatting), we will update the policy and revise the effective date shown at the top of this page.

Continued use of the nbaja platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We recommend bookmarking this page and reviewing it periodically, particularly if you are a regular user of the platform.

This Privacy Policy should be read in conjunction with the Terms & Conditions and the Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the nbaja platform.

nbaja is committed to building and maintaining the trust of every player on the platform. We treat your personal data with the care and respect it deserves — as a genuine commitment, not a compliance checkbox. If you ever feel that your privacy has not been respected, please tell us. We take every concern seriously and will work transparently with you to resolve it.