Your Privacy Matters
at cbaij

cbaij operates an online betting and gaming platform available at cbaij.io, serving players located in Bangladesh. The platform offers cricket betting, slot games, live casino, Aviator, lottery, and related entertainment products. All services are delivered in English, and all monetary amounts are denominated in Bangladeshi Taka (BDT).

This Privacy Policy applies to all personal data collected by cbaij in connection with your use of the platform, regardless of the device or browser you use to access it. It covers data collected directly from you (such as information you provide during registration), data collected automatically (such as technical and usage data), and data received from third-party sources (such as payment processors and identity verification providers).

cbaij is committed to handling your personal data with transparency, care, and respect. We process personal data only where we have a lawful basis to do so, and we take appropriate technical and organisational measures to keep your information secure at all times.

For the purposes of this Privacy Policy, cbaij acts as the data controller in respect of your personal information. This means that cbaij determines the purposes for which your data is collected and the manner in which it is processed.

If you have any questions about how cbaij processes your personal data, or if you wish to exercise any of your data rights, you may contact our designated data privacy point of contact using the details provided in Section 14 of this policy.

cbaij collects personal data from three sources: directly from you, automatically via the platform, and from trusted third parties.

Data Collected Directly from You:

• Registration Data: Full legal name, date of birth, email address, phone number, and city or division within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna).
• Identity Verification (KYC) Data: National identity card number, passport number, or driving licence number; scanned copies of supporting documents where required.
• Financial Data: Mobile banking account numbers for bKash, Nagad, Rocket, and Upay; card numbers (last four digits only, never full card numbers) for Visa and Mastercard transactions.
• Support Communications: Any personal information you include in messages sent to our support team via live chat or email.
• Responsible Gaming Data: Deposit limits, cooling-off periods, and self-exclusion preferences you set in your account.

Data Collected Automatically:

• Technical Data: IP address, browser type and version, device type, operating system, screen resolution, and referral URL.
• Usage Data: Pages visited on cbaij.io, games accessed, bet amounts and outcomes, session duration, and in-platform navigation paths.
• Log Data: Server-side records of all platform interactions, including login timestamps, deposit and withdrawal events, and game round outcomes.
• Cookie Data: Session cookies, functional cookies, and analytics cookies as described in Section 8 of this policy.

Data Received from Third Parties:

• Payment Processors: Transaction status, reference numbers, and basic payment confirmation data from bKash, Nagad, Rocket, Upay, Visa, and Mastercard.
• Identity Verification Providers: Verification status and match scores from automated KYC/AML screening tools where used.
• Game Providers: Game round results and session data from certified providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi.

cbaij processes your personal data for the following purposes, each supported by a specific legal basis:

• Account Registration and Management: To create and maintain your cbaij account, verify your identity, and manage your account preferences. Legal basis: contractual necessity.
• Payment Processing: To process deposits and withdrawals in Bangladeshi Taka via your chosen payment method, and to maintain accurate financial records. Legal basis: contractual necessity; legal obligation.
• Identity Verification and KYC/AML Compliance: To verify your age (21+) and identity, and to carry out anti-money laundering and fraud prevention checks as required. Legal basis: legal obligation; legitimate interest.
• Platform Operation and Security: To detect and prevent fraud, unauthorised access, bot activity, and abuse of promotional offers. Legal basis: legitimate interest.
• Responsible Gaming: To monitor player activity for signs of problem gambling and to apply self-exclusion, deposit limits, and cooling-off periods as requested or as required. Legal basis: legal obligation; legitimate interest.
• Customer Support: To respond to enquiries, complaints, and disputes submitted via live chat or email. Legal basis: contractual necessity; legitimate interest.
• Marketing Communications: To send you promotional emails and bonus notifications about cbaij offers, including BPL cricket season promotions, Eid bonuses, and Pohela Boishakh specials — where you have not opted out. Legal basis: consent; legitimate interest.
• Platform Improvement: To analyse usage patterns and game preferences in order to improve the platform experience for all players. Legal basis: legitimate interest.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and maintain records as required. Legal basis: legal obligation.

cbaij does not sell or rent your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Processors: We share the minimum necessary financial and identity data with bKash, Nagad, Rocket, Upay, Visa, and Mastercard to process your deposit and withdrawal transactions.
• Identity Verification Providers: Where automated KYC checks are required, we share relevant identity data with our verification partners. These partners are contractually bound to process your data only for verification purposes.
• Game Technology Providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive limited session and account data required to deliver their games through the cbaij platform.
• IT and Infrastructure Providers: Cloud hosting and server management partners who process data on our behalf under strict data processing agreements and are not permitted to use your data for their own purposes.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts if required to do so by applicable law, a court order, or a lawful regulatory request. We will notify you of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of cbaij's business, your personal data may be transferred to the acquiring entity. We will notify affected players before any such transfer occurs and will ensure the acquiring entity commits to standards of data protection at least equivalent to those set out in this Privacy Policy.

cbaij retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum of 5 years following account closure. This period reflects our obligations under anti-money laundering regulations and the need to resolve any post-closure disputes.
• Transaction and Betting Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC and Verification Documents: Retained for a minimum of 5 years following the completion of verification, or longer if required by applicable law.
• Support Communications: Retained for 3 years from the date of last correspondence, to enable us to reference prior interactions in the event of a complaint or dispute.
• Technical and Usage Data: Retained for up to 24 months from the date of collection, after which it is aggregated or deleted.
• Cookie Data: Session cookies are deleted when you close your browser. Persistent cookies expire as described in Section 8. Analytics data derived from cookies is retained in aggregated form for up to 24 months.
• Marketing Preferences: Records of your communication preferences, including opt-out records, are retained indefinitely to ensure we honour your choices.

When personal data is no longer required, cbaij will securely delete or anonymise it so that it can no longer be associated with you as an individual. Anonymised and aggregated data — from which no individual can be identified — may be retained indefinitely for platform analytics and improvement purposes.

cbaij takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and the cbaij.io servers is protected by 256-bit SSL/TLS encryption, the same standard used by major financial institutions.
• Data Encryption at Rest: Sensitive personal data stored on our servers — including identity documents, financial data, and passwords — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Only authorised personnel with a legitimate operational reason may access player data, and all access is logged and audited.
• Password Security: Player account passwords are hashed using a strong one-way hashing algorithm. cbaij staff cannot view your password in plain text under any circumstances.
• Two-Factor Authentication: cbaij supports two-factor authentication (2FA) for player accounts to provide an additional layer of security against unauthorised login attempts.
• Intrusion Detection: Our infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous behaviour patterns.
• Third-Party Audits: We periodically engage independent security specialists to conduct penetration testing and vulnerability assessments of the cbaij platform.
• Data Breach Response: In the event of a data breach that is likely to result in a risk to your rights, cbaij will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

While cbaij implements robust security measures, no online platform can guarantee absolute security. You are responsible for keeping your own account credentials — including your username, password, and any 2FA codes — confidential. Do not share your login details with any third party. If you suspect unauthorised access to your account, contact our support team immediately at [email protected].

cbaij uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and deliver a personalised experience. A cookie is a small text file placed on your device when you visit a website. You can control cookies through your browser settings, though disabling certain cookies may affect the functionality of the cbaij platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable core features such as logging in, maintaining your session, and processing transactions. These cookies cannot be disabled as they are required for the service to operate.
• Functional Cookies: These cookies remember your preferences — such as your language setting (English), preferred payment method, and responsible gaming limits — so you do not have to re-enter them on each visit. Expiry: up to 12 months.
• Analytics Cookies: These cookies collect anonymised information about how players use the cbaij platform, such as which pages are visited most frequently and how long players spend on each section. This data is used solely to improve the platform and is never used to identify individual players. Expiry: up to 24 months.
• Security Cookies: These cookies help us detect and prevent fraud, bot activity, and unauthorised access attempts. They form part of our platform security infrastructure. Expiry: session-based or up to 30 days.

cbaij does not use third-party advertising cookies or behavioural tracking cookies that profile you for external advertising networks. We do not permit third-party advertisers to place cookies on cbaij.io.

cbaij's primary operations serve players in Bangladesh. However, some of our technical infrastructure, third-party service providers, and game technology partners may be located in countries outside Bangladesh. As a result, your personal data may be transferred to, stored in, or processed in a jurisdiction other than Bangladesh.

Where such international transfers occur, cbaij takes steps to ensure that your personal data is afforded a level of protection consistent with the standards set out in this Privacy Policy. These steps may include:

• Entering into data processing agreements with third-party recipients that impose obligations consistent with applicable data protection principles.
• Transferring data only to jurisdictions that provide an adequate level of data protection as assessed by relevant standards.
• Applying technical safeguards — including encryption in transit and at rest — to all data transferred internationally.

By using the cbaij platform, you acknowledge that your personal data may be transferred internationally as described in this section, and you consent to such transfers subject to the safeguards described above.

The cbaij platform is strictly for adults aged 21 years and above. cbaij does not knowingly collect, process, or retain personal data from any individual under the age of 21. Our registration process includes age verification steps to prevent minors from creating accounts.

If cbaij becomes aware — through our KYC process or any other means — that a player is under the age of 21, we will immediately suspend the account, reverse any deposits, void any bets placed, and permanently delete the personal data associated with the account.

If you are a parent or guardian and believe that a minor under your care has registered an account on cbaij.io, please contact our support team immediately at [email protected]. We will investigate and take appropriate action within 24 hours of receiving a verified complaint.

As outlined in the summary above, you have a number of rights in relation to your personal data. This section provides further detail on each right and how to exercise it:

• Right of Access (Subject Access Request): You may request a copy of all personal data cbaij holds about you. Your request must be submitted in writing to [email protected] with the subject line "Subject Access Request". We will respond within 30 days. We may ask you to verify your identity before processing the request.
• Right of Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update some information directly through your account settings. For data that cannot be self-corrected, contact [email protected].
• Right of Erasure ("Right to Be Forgotten"): You may request that we delete your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw your consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. We may decline erasure requests where retention is required by law — for example, financial transaction records subject to a 5-year retention obligation.
• Right to Restrict Processing: You may request that we restrict processing of your data while the accuracy of the data or the lawfulness of our processing is under dispute. During a restriction, we may store your data but not actively use it.
• Right of Data Portability: Where processing is based on your consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV). You may also request that we transmit this data directly to another controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. Upon receipt of your objection, we will cease all marketing communications immediately. You may also object to processing based on legitimate interest, though we may continue to process your data if we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

All data rights requests should be submitted to [email protected]. We will acknowledge your request within 5 business days and provide a full response within 30 days. In complex or high-volume cases, we may extend this period by a further 60 days but will notify you of the extension and the reason for the delay.

If you believe that cbaij has processed your personal data in a manner that is inconsistent with this Privacy Policy or applicable data protection principles, you have the right to raise a complaint with us directly. We take all privacy complaints seriously and will investigate thoroughly.

To submit a privacy complaint, please email [email protected] with the subject line "Privacy Complaint". Include your registered username, a clear description of your concern, and any relevant dates or transaction references. We will:

• Acknowledge your complaint within 24 hours of receipt.
• Assign it to our privacy compliance team for investigation.
• Provide a full written response within 10 business days, or notify you if additional time is required.
• Take corrective action where we determine that a breach of this Privacy Policy has occurred.

If you are not satisfied with our response to your privacy complaint, you may have the right to escalate your concern to an appropriate data protection authority or regulatory body in your jurisdiction.

cbaij reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes — those that substantially affect your rights or the way we use your data — we will notify you by:

• Sending an email to your registered email address at least 14 days before the change takes effect.
• Displaying a prominent notice on the cbaij.io homepage and on this Privacy Policy page.
• Updating the "Last Updated" date shown at the top of this page and at the top of the table of contents.

Minor changes — such as typographical corrections, clarifications of existing language, or updates to reflect minor operational changes — may be made without prior notice but will always be reflected in the updated "Last Updated" date.

Your continued use of the cbaij platform after any amendment to this Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the changes, you should stop using the platform and may request voluntary account closure as described in the cbaij Terms & Conditions.

The most current version of this Privacy Policy is always available at cbaij.io/privacy-policy. We recommend reviewing this page periodically to stay informed of any updates.

For all privacy-related enquiries, data rights requests, and complaints, please contact the cbaij privacy team using the details below. All communications should be in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Rights Requests: "Data Rights Request"
• Subject Line for Privacy Complaints: "Privacy Complaint"
• Subject Line for General Privacy Enquiries: "Privacy Enquiry"
• Response Time: Acknowledgement within 24 hours; full response within 30 days for data rights requests, 10 business days for complaints.
• Support Hours: 24 hours a day, 7 days a week, including public holidays in Bangladesh.
• Language: English-language support at all times, available in Bangladesh Standard Time (BST, UTC+6).