bibaji Privacy Policy

This Privacy Policy ("Policy") explains how bibaji ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects the personal information of users ("you", "your", "the Player") who access or use the bibaji website at bibaji.vip, including all games, betting services, promotional features, and customer support channels offered thereon.

bibaji is committed to handling your personal data with care, transparency, and respect. We operate in accordance with globally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, integrity, confidentiality, and accountability. While Bangladesh does not yet have a comprehensive data protection law identical in structure to the EU's General Data Protection Regulation (GDPR), bibaji voluntarily adopts GDPR-aligned principles as a baseline standard for all players, including those based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and elsewhere across Bangladesh.

By registering an account on bibaji or otherwise using the platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, please do not create or continue to use a bibaji account.

For the purposes of this Policy, bibaji acts as the data controller with respect to personal data collected directly from players through the bibaji.vip platform. As data controller, bibaji determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with the principles set out in this Policy.

If you have any questions about how bibaji processes your personal data, or if you wish to exercise any of the rights described in Section 9 of this Policy, you may contact our designated data privacy team using the contact details provided in Section 14.

bibaji collects personal data through several channels, including direct submission by you during registration, automatic collection during your use of the platform, and in limited circumstances from third-party sources such as payment providers. The categories of data we collect are described below.

3.1 Registration Data

When you create a bibaji account, we collect the following information directly from you:

• Full legal name
• Date of birth (to verify you are aged 18 or above)
• Email address
• Mobile phone number
• Residential address (including city, district, and postcode)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and Know Your Customer (KYC) obligations, and to verify player age, bibaji may request the following documents:

• Government-issued National Identity Card (NID) or passport
• Recent utility bill or bank statement confirming residential address (dated within 3 months)
• In certain cases, a selfie photograph for liveness verification

3.3 Financial and Transaction Data

When you make deposits or withdrawals using payment methods such as bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, or Mastercard, we collect transactional data including:

• Payment method type and associated account identifiers (e.g., bKash mobile number)
• Transaction amounts, timestamps, and reference numbers
• Deposit and withdrawal history associated with your account

bibaji does not store full card numbers, CVV codes, or banking passwords. Payment processing for card transactions is handled by PCI DSS-compliant third-party payment processors.

3.4 Gaming and Behavioural Data

We automatically collect data relating to your use of the platform, including:

• Game sessions played (titles, duration, stakes, outcomes)
• Sports bets placed (event, market, odds, outcome)
• Bonus claims and wagering activity
• Session login and logout timestamps
• Responsible gaming tool usage (e.g., deposit limits set, cooling-off periods activated)

3.5 Technical and Device Data

When you access bibaji, our servers automatically log certain technical data:

3.6 Communications Data

If you contact bibaji customer support via email or live chat, we retain records of your communications, including the content of messages and any attachments, for the purpose of resolving your query and maintaining a service history.

bibaji uses the personal data it collects only for specific, defined purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we process personal data are:

• Account management: Creating, maintaining, and securing your bibaji account, including authentication and password recovery.
• Age and identity verification: Confirming that you are aged 18 or above and that the identity information you have provided is accurate and genuine.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other accepted payment channels.
• Service delivery: Providing access to all games, sports betting markets, promotions, and other platform features.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, duplicate accounts, and other forms of abuse.
• Responsible gaming: Monitoring gaming behaviour to identify players who may be at risk, and providing access to self-exclusion and limit-setting tools.
• Customer support: Responding to your queries, complaints, and account requests.
• Legal compliance: Meeting bibaji's obligations under applicable anti-money laundering legislation and responding to lawful requests from competent authorities.
• Marketing communications: Sending you promotional offers and platform updates by email or SMS — but only where you have opted in to receive such communications. You may opt out at any time.
• Platform improvement: Analysing aggregated, anonymised usage data to improve game selection, user experience, and platform performance.

bibaji processes personal data only where a valid legal basis for doing so exists. The legal bases applicable to the processing activities described in this Policy are as follows:

• Contractual necessity: Processing is required to enter into or perform the contract between you and bibaji (i.e., to operate your account and provide gaming services).
• Legal obligation: Processing is required to comply with applicable legal obligations, including KYC/AML requirements and lawful government or regulatory requests.
• Legitimate interests: Processing is necessary for bibaji's legitimate interests — including fraud prevention, network security, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on your freely given, informed, and specific consent — for example, for direct marketing communications or optional analytics cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

bibaji does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share personal data with third parties only in the limited circumstances described below.

6.1 Payment Service Providers

To process deposits and withdrawals, we share necessary transactional data with payment service providers including the operators of bKash, Nagad, Rocket, and Upay, as well as card processing partners for Visa and Mastercard transactions. These providers receive only the data required to execute the specific transaction and are bound by their own data protection obligations.

6.2 Identity Verification Partners

bibaji may use third-party KYC and AML screening services to assist with identity verification and fraud detection. These partners process identity documents and verification data on bibaji's behalf and are contractually bound to handle that data securely and only for the purposes for which it was shared.

6.3 Technology Infrastructure Partners

bibaji uses third-party cloud hosting, content delivery, and software infrastructure providers to operate the platform. These providers may process certain technical and personal data as data processors acting under bibaji's instructions. They are not permitted to use that data for their own purposes.

6.4 Game Content Providers

Game studios and content providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive limited session and game data necessary to deliver their games within the bibaji platform. Game providers do not receive your full personal profile.

6.5 Legal and Regulatory Disclosure

bibaji may disclose personal data to law enforcement agencies, regulatory authorities, or other competent bodies where required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity.

bibaji uses cookies and similar tracking technologies to operate the platform, remember your preferences, and gather anonymised usage statistics. A cookie is a small text file placed on your device by your browser when you visit a website.

7.1 Types of Cookies We Use

7.2 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will impair your ability to log into and use the bibaji platform, as session cookies are essential to authentication. Analytical and marketing cookies may be disabled without affecting core platform functionality.

bibaji retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The general retention periods applied by bibaji are as follows:

• Active account data: Retained for the duration of your account and for a period of five (5) years following account closure, to satisfy AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last communication in a support thread.
• Marketing preferences and consent records: Retained for the duration of your account and for three (3) years following account closure or opt-out.
• Technical / server log data: Retained for up to ninety (90) days, after which it is deleted or anonymised.

When personal data is no longer required, bibaji securely destroys or anonymises it in accordance with its internal data disposal procedures.

bibaji recognises and respects the data rights of all players. Subject to applicable law and certain limited exceptions (for example, where retaining data is required by AML legislation), you hold the following rights in relation to your personal data:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". bibaji will respond to all valid requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, with prior notification to you.

bibaji employs a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your browser and the bibaji servers.
• Encryption at rest for sensitive stored data including identity documents and payment identifiers.
• Role-based access controls ensuring that only authorised personnel with a legitimate business need can access personal data.
• Two-factor authentication (2FA) available for all player accounts as an optional but strongly recommended security layer.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Intrusion detection systems monitoring platform infrastructure for anomalous activity in real time.
• Staff training on data protection principles and secure data handling practices.

While bibaji takes every reasonable step to protect your data, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, bibaji will notify affected players without undue delay, in accordance with applicable data breach notification requirements.

bibaji is an 18+ platform and is not directed at, designed for, or intended to be used by persons under 18 years of age. We do not knowingly collect, solicit, or retain personal data from minors. If bibaji becomes aware that personal data has been collected from a person under 18, that data will be permanently deleted and the associated account will be immediately closed.

If you are a parent or guardian and believe that a minor in your care has registered an account on bibaji, please contact us immediately at [email protected] so that we can take appropriate action.

The bibaji platform may from time to time contain references to third-party payment services such as bKash, Nagad, Rocket, and Upay. When you interact with those third-party services — for example, when completing a bKash mobile money transaction — you are subject to the privacy policies of those providers, not this Policy.

bibaji is not responsible for the privacy practices, data security measures, or content of any third-party service. We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of bibaji.

bibaji reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, changes in applicable law, or updates to our platform's features and services. The "Last Updated" date at the top of this Policy indicates when it was most recently revised.

Where we make material changes to this Policy — meaning changes that significantly affect how we process your personal data or the rights available to you — we will notify you by email to the address registered on your account at least 14 days before the changes take effect. Your continued use of the bibaji platform after notification of material changes constitutes your acceptance of the updated Policy.

We encourage you to revisit this page periodically to stay informed about how bibaji protects your privacy.

If you have any questions, concerns, or complaints about this Privacy Policy or about the way bibaji handles your personal data, please contact our data privacy team. We are available 24 hours a day, 7 days a week, on Bangladesh Standard Time (BST, UTC+6).

Please include your registered account username and a clear description of your question or request. All privacy-related enquiries are handled with strict confidentiality by a dedicated member of the bibaji compliance team.