xbazi Privacy Policy

xbazi collects the following categories of personal data from players who register and use the platform:

Identity Data: Full legal name, date of birth, nationality, and copies of government-issued identification documents such as your National Identity Card (NID) or passport. This data is collected as part of our Know Your Customer (KYC) and age verification obligations.

Contact Data: Mobile phone number, residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar), and email address where provided. Your mobile number must be linked to your registered payment method.

Financial Data: Mobile banking account identifiers associated with bKash, Nagad, Rocket, and Upay accounts; bank account details for supported bank partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank); deposit and withdrawal transaction history; account balances; and bonus credit records.

Technical Data: IP address, device type and operating system, browser type and version, screen resolution, time zone (Bangladesh Standard Time, UTC+6), session duration, and referral URL. This data is collected automatically when you access the xbazi platform.

Usage Data: Pages visited, games played, bets placed (sport, market, stake, outcome), casino session data, search queries on the platform, and feature interactions. This data helps us improve platform performance and personalise your experience.

Communications Data: Records of correspondence between you and the xbazi support team, including chat transcripts, email exchanges, and support ticket history.

Verification Data: Selfies, utility bills, bank statements, or other proof-of-address documents submitted during enhanced KYC checks or withdrawal verification processes.

xbazi collects personal data through the following methods:

• Direct submission: When you complete the registration form, submit KYC documents, contact our support team, or fill out any other form on the xbazi platform, you are providing data directly to us.
• Automated collection: When you visit the xbazi website or use the platform, we automatically collect technical and usage data via server logs, cookies, and similar tracking technologies. See Section 8 (Cookies & Tracking) for full details.
• Payment providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a supported bank, the payment gateway shares transaction confirmation data with xbazi, including the mobile number or account identifier associated with the transaction.
• Identity verification partners: xbazi may use third-party identity verification services to cross-check documents you submit during KYC. These services share verification results (pass/fail and risk flags) with xbazi.
• Game and sports data providers: Game studios (such as Pragmatic Play, Evolution Gaming, Spribe) and sports data providers share game session results and bet settlement data with xbazi as part of our platform integrations.

xbazi uses your personal data for the following purposes:

• Account management: To register your account, verify your identity and age (21+), authenticate your logins, and manage your player profile throughout the account lifecycle.
• Payment processing: To process deposits and withdrawals via your registered payment method, reconcile transactions, and maintain accurate financial records of your account balance.
• Regulatory compliance: To conduct Know Your Customer (KYC) checks, anti-money laundering (AML) screening, and fraud detection as required by our internal compliance programme.
• Platform improvement: To analyse usage patterns, identify technical issues, optimise game performance, and develop new features that improve the xbazi player experience.
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and maintain records of our communications for quality assurance purposes.
• Responsible gaming: To monitor betting patterns for signs of problem gambling, enforce deposit limits and self-exclusion requests, and send responsible gaming notifications where appropriate.
• Marketing (where consented): To send you promotional offers, bonus notifications, and seasonal campaign communications (e.g., BPL promotions, Eid offers, Pohela Boishakh specials) where you have not opted out of marketing. You may opt out at any time.
• Security: To detect, investigate, and prevent fraud, account takeovers, bonus abuse, and other malicious or prohibited activity on the platform.
• Legal obligations: To comply with any applicable law, court order, regulatory request, or lawful authority demand that requires us to process or disclose personal data.

xbazi will not use your personal data for any purpose that is incompatible with those listed above without first providing you with appropriate notice and, where required, obtaining your consent.

xbazi processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and xbazi — i.e., to operate your player account, process payments, and deliver the betting and gaming services you have requested.
• Legal obligation: Processing is necessary to comply with applicable legal and regulatory obligations, including age verification (21+), KYC identity checks, and AML screening requirements.
• Legitimate interests: Processing is necessary for xbazi's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided these interests are not overridden by your data protection rights.
• Consent: For optional processing activities such as sending you marketing communications, xbazi relies on your consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xbazi does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the minimum data necessary to process your deposit and withdrawal transactions.
• Identity verification providers: Third-party KYC and AML screening services receive copies of identity documents you submit for the sole purpose of verifying your identity and age.
• Game technology providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a player session token and game-specific data necessary to deliver their games on the xbazi platform. These providers do not receive your full personal profile.
• IT and hosting providers: Third-party cloud infrastructure, database, and security service providers who host and maintain the xbazi platform under strict data processing agreements that prohibit any secondary use of your data.
• Legal and regulatory authorities: Where required by applicable law, court order, or a lawful request from a regulatory or law enforcement authority, xbazi may be required to disclose personal data. xbazi will notify you of such disclosure where permitted by law.
• Professional advisors: Legal counsel, auditors, and compliance consultants who require access to data in connection with their professional services, subject to professional confidentiality obligations.

All third-party recipients of your personal data are required to handle it in accordance with applicable data protection standards and are prohibited from using it for any purpose other than the specific service they provide to xbazi.

xbazi retains your personal data for as long as your account is active and for a period thereafter as required by our legal, regulatory, and business obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active status plus a minimum of five (5) years following account closure, to satisfy financial record-keeping and AML compliance requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction records: Deposit and withdrawal records are retained for a minimum of five (5) years from the date of the transaction in accordance with financial record-keeping standards.
• Support communications: Chat transcripts and email records are retained for up to three (3) years from the date of the interaction, unless they relate to an open dispute or regulatory enquiry.
• Technical and usage data: Aggregated or anonymised analytics data may be retained indefinitely. Individual-level technical data (e.g., IP logs) is retained for up to twelve (12) months unless retained longer for fraud investigation purposes.
• Marketing preferences: Records of your marketing consent or opt-out status are retained for as long as your account exists and for three (3) years thereafter.

When personal data is no longer required for any of the purposes for which it was collected, xbazi will securely delete or anonymise it in accordance with our internal data disposal procedures.

xbazi implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport encryption: All data transmitted between your device and xbazi servers is encrypted using 256-bit SSL/TLS protocols. Our platform enforces HTTPS on all pages and rejects unencrypted connections.
• Access controls: Access to systems holding personal data is restricted to authorised xbazi personnel on a strict need-to-know basis. All internal access is logged and audited. Administrative access requires multi-factor authentication.
• Data storage security: Personal data is stored on servers protected by firewalls, intrusion detection systems, and regular security patching. Sensitive data fields (e.g., identity document scans) are encrypted at rest.
• Fraud and anomaly detection: xbazi's platform employs automated monitoring systems that flag unusual account activity, suspicious login patterns, and potential fraud indicators in real time.
• Incident response: In the event of a data breach that is likely to result in a risk to the rights and freedoms of players, xbazi will take immediate containment action and notify affected players without undue delay via their registered contact details.
• Employee training: All xbazi personnel who handle personal data receive regular data protection training and are bound by confidentiality obligations.

While xbazi takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for keeping your own xbazi Login credentials confidential and for ensuring that your device is protected against malware and unauthorised access. If you believe your account has been compromised, contact [email protected] immediately.

xbazi uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on the xbazi platform:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your session state, remember your login status, and enable core security features. These cookies cannot be disabled without preventing you from using the platform.
• Performance and analytics cookies: These cookies collect anonymised data about how players use the xbazi platform — which pages are visited most frequently, how long sessions last, and where errors occur. This data is used solely to improve platform performance.
• Functional cookies: These cookies remember your preferences such as language settings, preferred payment method, and display options to provide you with a more personalised experience on return visits.
• Security cookies: These cookies support fraud detection and account security functions, including identifying device fingerprints associated with known fraudulent activity and preventing cross-site request forgery (CSRF) attacks.

xbazi does not use third-party advertising or behavioural targeting cookies. You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to access and use the platform. Most modern browsers allow you to view, block, and delete cookies through the browser's settings menu.

As a player on the xbazi platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact xbazi at [email protected] with your account details and a clear description of your request. xbazi will respond within a reasonable timeframe and in any event within thirty (30) calendar days of receiving a verified request.

• Right of access: You have the right to request a copy of the personal data xbazi holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request that xbazi corrects any personal data we hold about you that is inaccurate or incomplete.
• Right to erasure: You have the right to request that xbazi deletes your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (see Section 6).
• Right to restriction: You have the right to request that xbazi restricts the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where xbazi relies on legitimate interests as the legal basis for processing. xbazi will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where xbazi processes your data on the basis of your consent (e.g., for marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

xbazi will not charge a fee for handling your data rights requests unless the request is manifestly unfounded or excessive. In such cases, xbazi may charge a reasonable administrative fee or decline to act on the request, and will inform you of this decision with reasons.

The xbazi platform is strictly intended for adults aged 21 years and above. xbazi does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process. Where xbazi has reasonable grounds to believe that a registered player is under the age of 21, the account will be suspended immediately and any funds held in the account returned in accordance with xbazi's underage gambling procedures.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account or provided personal data to xbazi without your consent, please contact us immediately at [email protected]. We will investigate and, where confirmed, delete the account and all associated personal data as promptly as possible.

xbazi strongly encourages parents and guardians to use parental control software and mobile banking account restrictions to prevent minors from accessing online gambling platforms.

xbazi reserves the right to update or revise this Privacy Policy at any time. When material changes are made, the revised Policy will be published on this page with an updated effective date. For significant changes that materially affect how we process your personal data, xbazi will notify registered players via an on-platform notification or by email to the address associated with their account, where applicable.

Your continued use of the xbazi platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the changes and, where applicable, your consent to the updated data processing practices. We encourage you to review this page periodically. The version currently displayed is the version that governs your use of the platform.