bajy Privacy Policy — How We Handle Your Data

1. Introduction

bajy operates the online casino and sports betting platform accessible at bajy.org (the "Platform"). bajy is committed to protecting the privacy of all players who use the Platform. This Privacy Policy sets out the categories of personal data bajy collects, the purposes for which that data is processed, the legal bases for processing, the third parties with whom data may be shared, and the rights available to you as a data subject.

This Privacy Policy should be read alongside bajy's Terms and Conditions. By registering an account and using the Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree to the terms of this Privacy Policy, you must not use the bajy Platform.

2. Data We Collect

bajy collects personal data in the following categories. The table below summarises each category, the specific data items within it, and the primary purpose for which that category is collected:

3. How We Use Your Data

bajy processes your personal data only for specific, legitimate purposes. The primary purposes for which bajy uses your data are:

• ▸To create and manage your bajy account, including verifying your identity, age and eligibility to use the Platform in accordance with bajy's Terms and Conditions.
• ▸To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa and Mastercard, and to maintain accurate records of all financial transactions on your account.
• ▸To operate and deliver the gaming services available on the bajy Platform, including sports betting markets, live casino games, slots and crash games, and to resolve any disputes regarding game outcomes or transactions.
• ▸To comply with our anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements and any other applicable legal or regulatory obligations that require us to collect, retain or report personal data.
• ▸To monitor player activity for responsible gaming purposes — including identifying patterns that may indicate problem gambling behaviour — and to apply deposit limits, session time reminders, loss limits or self-exclusion where appropriate.
• ▸To detect and prevent fraud, cheating, multi-accounting, money laundering and other prohibited activities, and to protect the integrity of the bajy Platform and its player community.

4. Legal Basis for Processing

bajy processes your personal data on the following legal bases: (a) Contractual necessity — processing required to fulfil bajy's obligations to you under the Terms and Conditions, including account management, payment processing and delivery of gaming services. (b) Legal obligation — processing required to comply with applicable AML, KYC and other regulatory requirements. (c) Legitimate interests — processing for fraud detection, security, platform integrity and responsible gaming monitoring, where those interests are not overridden by your data protection rights. (d) Consent — where bajy asks for your consent for a specific processing activity (for example, optional marketing communications), such consent is freely given and may be withdrawn at any time by contacting [email protected].

5. Your Data Rights

As a data subject, you have a number of rights in relation to the personal data bajy holds about you. These rights are set out below. To exercise any of these rights, contact bajy's support team at [email protected] with a clear description of the request. bajy will respond within 30 days.

Please note that some rights are subject to exceptions. For example, bajy is required by law to retain certain financial and KYC records for a minimum period regardless of a deletion request. Where an exception applies, bajy will explain the reason in its response to your request.

6. Cookies and Tracking Technologies

bajy uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website when you visit it. bajy uses cookies to keep your session active while you are logged in, to remember your preferences, and to collect anonymised usage data that helps bajy improve the Platform's performance and user experience.

Cookie Categories Used on bajy

• ▸Essential cookies — required for the Platform to function correctly. These include session authentication tokens and CSRF protection cookies. These cannot be disabled without breaking core Platform functionality.
• ▸Functional cookies — used to remember your logged-in state, language preference and other user-interface settings between sessions. These are not required for core functionality but improve your experience on return visits.
• ▸Analytics cookies — used to collect anonymised data about how players use the Platform (e.g. pages visited, session duration, error events). This data is used solely to improve Platform performance. bajy does not use third-party advertising or retargeting cookies.

You can manage cookie preferences through your device's browser settings. Disabling essential cookies will prevent you from logging in to your bajy account. bajy does not currently use a cookie consent banner, as the only non-essential cookies used are functional and analytics cookies that do not track you across third-party sites.

7. Sharing Your Data

bajy does not sell your personal data. bajy may share your personal data with third parties only in the following limited circumstances:

• ▸Payment processors — bajy shares the minimum necessary financial data with payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard) solely to process your deposits and withdrawals. These providers are contractually bound to process your data only for that purpose.
• ▸Game providers — bajy's casino and sports betting content is delivered by third-party providers including Pragmatic Play, Evolution Gaming, Spribe and Ezugi. These providers may receive anonymised session data necessary to deliver game content and verify outcomes. They do not receive your identity documents or payment details.
• ▸Regulatory and law enforcement authorities — bajy may be required by applicable law to disclose certain personal data to regulatory bodies, tax authorities, financial intelligence units or law enforcement agencies. bajy will disclose only the data specifically required and will notify you where legally permitted to do so.
• ▸KYC verification partners — bajy may use third-party identity verification services to assist with document verification as part of the KYC process. These partners are bound by strict data processing agreements and may not use your data for any purpose other than identity verification on bajy's behalf.

8. Data Retention

bajy retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Registration data and account records are retained for the duration of the account's active status and for a minimum of five years following account closure, in accordance with standard AML record-keeping requirements. Financial transaction records are retained for a minimum of seven years following the transaction date in accordance with financial reporting obligations applicable to offshore gaming operators.

KYC identity documents are retained for the period required by the applicable AML framework, typically five years from the date the business relationship ends. Gaming activity data is retained for a minimum of three years from the date of the relevant gaming session for dispute resolution purposes. Where you exercise your right to erasure, bajy will delete all data that is not subject to a legal retention obligation within 30 days of verifying your identity and request.

9. Data Security

bajy implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These measures include SSL/TLS encryption for all data transmitted between your device and bajy's servers, encrypted storage of sensitive account and identity data, access controls that limit data access to authorised personnel only, and regular security reviews of the Platform's infrastructure.

While bajy takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, bajy will notify affected account holders without undue delay and will take immediate steps to contain the breach and mitigate its impact.

10. Children and Minors

The bajy Platform is strictly for adults aged 21 and above. bajy does not knowingly collect personal data from any person under the age of 21. If bajy discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be permanently closed. If you believe that bajy may have inadvertently collected personal data from a minor, please contact [email protected] immediately.

11. Third-Party Links

The bajy Platform may contain links to third-party websites or services, for example links to payment provider information pages. bajy is not responsible for the privacy practices of any third-party website. If you click through to a third-party site, that site's own privacy policy will govern the collection and use of your personal data on that site. bajy recommends that you review the privacy policy of any third-party site you visit.

12. Changes to This Privacy Policy

bajy reserves the right to update this Privacy Policy at any time. Where changes are material, bajy will notify registered account holders via their registered mobile number or email address at least seven days before the updated policy takes effect. The effective date and version number at the top of this page will always reflect the current version. Continued use of the bajy Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

13. Contact and Data Requests

For all privacy-related queries, data subject access requests, rectification requests, erasure requests, or to withdraw consent for any optional data processing activity, please contact bajy's support team by email. Include your registered mobile number and a clear description of your request. bajy will acknowledge your request within two business days and provide a full response within 30 days of verifying your identity.

You may also wish to review bajy's Terms & Conditions.