mbaji Privacy Policy

This Privacy Policy ("Policy") describes how mbaji ("we", "us", "our") collects, processes, stores, and protects personal data that you ("you", "the Player") provide or that we generate when you access or use the mbaji platform at mbaji.one. This Policy applies to all players who register an account, use any game or betting service, contact support, or otherwise interact with mbaji, regardless of the device or browser used.

By registering an account or using any part of the mbaji platform, you acknowledge that you have read and understood this Policy. This Policy is incorporated by reference into mbaji's Terms and Conditions. If you do not agree with any part of this Policy, you should discontinue use of the platform and contact support to close your account. This Policy is written in English; in the event of any conflict between an English version and a translated version, the English version shall prevail.

mbaji processes personal data strictly for the purposes described in this Policy. We do not use your data for purposes incompatible with those for which it was originally collected. The primary purposes for which we process your personal data are as follows:

• Account creation, management, and authentication — to register your account, verify your identity, maintain your account profile, and authenticate your login sessions securely.
• Payment processing and KYC compliance — to process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladeshi bank accounts, and to comply with know-your-customer identity verification requirements.
• Responsible gaming and player protection — to monitor gameplay patterns for signs of problem gambling behaviour, enforce self-exclusion tools, deposit limits, and session reminders, and to meet our responsible gaming obligations.
• Security and fraud prevention — to detect, investigate, and prevent fraudulent transactions, money laundering, underage gambling, collusion, and other prohibited conduct as defined in the mbaji Terms and Conditions.
• Customer support — to respond to your enquiries, resolve disputes, process complaints, and deliver support communications via live chat and email.
• Platform improvement and analytics — to analyse aggregated, anonymised usage data to improve platform performance, user experience, and the range of games and betting markets available on mbaji.

Where mbaji uses your personal data for marketing communications — such as notifying you of a new promotion, a bonus offer, or a new game launch relevant to your interests — we will do so only where you have given explicit consent or where we have a legitimate interest to do so and you have not opted out. You may withdraw consent for marketing communications at any time by contacting support at [email protected].

mbaji does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data with third parties only in the following limited circumstances:

• Payment processors and financial institutions — we share the minimum transaction data necessary with mobile wallet providers (bKash, Nagad, Rocket, Upay) and banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank) to process your deposits and withdrawals. These partners operate under their own privacy policies and are bound by applicable Bangladeshi financial regulations.
• Game and platform technology providers — our game content providers (including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Spribe, and Ezugi) may receive anonymised gameplay session data for the purpose of game performance monitoring and RNG audit compliance. They do not receive personally identifiable information about individual players.
• Identity verification and KYC service providers — we may engage specialist third-party KYC providers to assist with document verification. Any such provider is contractually bound to process identity documents solely for verification purposes and to delete or return documents upon completion of the verification process.
• Law enforcement and regulatory authorities — we will disclose personal data to competent governmental or law enforcement authorities where required to do so by applicable law, court order, or regulatory direction. Where legally permissible, we will notify you of such a disclosure request before complying.

In all cases where we share data with third-party processors, we require those processors to handle personal data in a manner consistent with this Policy and applicable data protection law. We do not authorise third-party processors to use your personal data for their own independent purposes.

mbaji retains personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable law. Account profile data, KYC documents, and transaction records are retained for a minimum of five years following account closure, in compliance with anti-money laundering record-keeping obligations. This retention period may be extended where an account is subject to an ongoing investigation or legal proceeding.

Technical and device logs (including IP address logs) are retained for a maximum of 12 months from the date of collection, after which they are permanently deleted or anonymised. Marketing communication preferences and consent records are retained for the duration of your account and for 3 years following account closure, to demonstrate compliance in the event of a dispute. Once a retention period has expired, personal data is securely deleted or irreversibly anonymised.

To exercise any of the rights described above, contact mbaji's support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 2 business days and provide a substantive response within 30 days, measured in Bangladesh Standard Time (BST, UTC+6). We may request proof of identity before processing a data rights request to protect against unauthorised access to another player's data.

mbaji reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will update the "Last updated" date at the top of this Policy. For changes that materially affect how we process your personal data or your rights in relation to it, we will endeavour to notify registered players via a notification on the mbaji platform before the change takes effect.

Minor updates — such as clarifications of existing clauses or corrections to contact details — may be made without advance notice beyond the "Last updated" date change. The version of this Policy displayed on mbaji.one at any given time is the current and operative version. We encourage you to review this Policy periodically.