Privacy Policy — How baji36 Protects Your Data

baji36 is the data controller responsible for the personal data collected through the baji36.onl platform. As data controller, we determine the purposes and means of processing your personal data and are accountable for ensuring that processing activities comply with applicable data protection principles. If you have any questions or concerns about how your personal data is handled, you may contact us directly at [email protected]. We aim to respond to all privacy-related enquiries within 5 business days.

The categories of personal data that baji36 collects depend on how you interact with the platform. These categories include:

• Registration data: Full name, date of birth, email address, mobile phone number, and residential address provided when you create an account.
• Identity verification data: National Identity Card (NID) number, passport number, driver's licence details, and supporting documentary scans submitted during Know Your Customer (KYC) checks.
• Financial data: Payment method details including bKash wallet numbers, Nagad account numbers, Rocket account numbers, Upay account details, bank account information (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and transaction history including deposits, withdrawals, and bonus transactions.
• Account activity data: Login timestamps, session durations, game history, betting records, wager amounts, win and loss records, and responsible gaming tool usage.
• Device and technical data: IP address, browser type and version, operating system, device identifier, screen resolution, and referring URL, collected automatically when you access the platform.
• Communications data: The content of messages you send to our customer support team, feedback submissions, and any correspondence related to disputes or complaints.
• Marketing preferences: Your opt-in or opt-out status for promotional communications and your expressed preferences for game categories, bonus types, and sporting events.

baji36 processes your personal data only for the following clearly defined purposes:

• Account administration: Creating and maintaining your account, authenticating your identity at login, and enabling you to access all platform features including casino games, cricket betting markets, slots, and live dealer tables.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels; detecting and preventing payment fraud; and maintaining accurate transaction records.
• KYC and regulatory compliance: Verifying your identity and age (21+), conducting anti-money laundering checks, and meeting any other compliance obligations applicable to offshore gaming platforms.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance.
• Responsible gaming: Monitoring account activity for indicators of problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and contacting you with responsible gaming information where appropriate.
• Platform improvement: Analysing aggregated and anonymised usage patterns to improve game selection, website performance, and the overall user experience for Bangladesh-based players.
• Marketing communications: Sending you promotional offers, bonus notifications, and information about new games or betting markets — but only if you have opted in to receive such communications. You may opt out at any time by contacting [email protected].
• Security and fraud prevention: Detecting suspicious login activity, identifying account takeover attempts, and investigating suspected breaches of our Terms and Conditions.

baji36 processes your personal data on the following legal bases, depending on the specific activity:

• Contractual necessity: Processing required to perform our obligations under the account agreement, including enabling gameplay, processing payments, and providing customer support.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering requirements, age verification obligations, and tax record-keeping rules.
• Legitimate interests: Processing carried out to protect the security and integrity of the platform, prevent fraud, improve our services, and conduct responsible gaming monitoring, where these interests are not overridden by your rights.
• Consent: Processing for direct marketing communications, where we rely on your explicit, freely given consent. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

baji36 does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, participating banks, and card scheme operators (Visa, Mastercard) receive the transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification partners: Accredited identity verification service providers receive the minimum data necessary to authenticate your identity documents and confirm your age and address.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session tokens and game result data required to operate their game software. These providers do not receive your name, financial data, or contact details.
• Fraud prevention and security services: Specialist cybersecurity and fraud analytics providers may process technical data (such as IP addresses and device fingerprints) to identify and block malicious activity.
• Law enforcement and regulatory authorities: We may disclose personal data to competent authorities where required by law, court order, or regulatory demand, or where we believe disclosure is necessary to protect the rights, property, or safety of baji36, our members, or the public.
• Business transfers: In the event of a merger, acquisition, or transfer of all or part of our business assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party processors engaged by baji36 are required to handle your data in accordance with strict confidentiality obligations and appropriate data security standards.

baji36 uses cookies and similar tracking technologies to operate and improve the platform. The types of cookies we use include:

• Essential cookies: Required for core platform functionality such as maintaining your login session, remembering your language and currency preferences, and enabling secure access to your account. These cookies cannot be disabled.
• Analytics cookies: Used to collect anonymised information about how visitors interact with the platform, including which pages are most visited, how long sessions last, and which game categories attract the most engagement. This data is used in aggregate form only and cannot be used to identify individual users.
• Preference cookies: Store your personalisation settings such as preferred game categories, notification preferences, and interface customisation choices so that they persist between sessions.
• Security cookies: Help us detect and prevent fraudulent activity, verify that interactions with the platform are genuine, and protect against automated attacks.

You may control cookie preferences through your browser settings. Please note that disabling essential cookies will impair your ability to use core platform features including login and payment processing.

baji36 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes:

• 256-bit TLS encryption for all data transmitted between your device and our servers.
• Encryption at rest for all personal and financial data stored in our databases.
• Strict role-based access controls limiting access to personal data to authorised personnel with a genuine operational need.
• Regular security assessments and penetration testing to identify and address vulnerabilities in our infrastructure.
• Two-factor authentication (2FA) options available to all registered members to strengthen account security.
• Continuous monitoring of platform systems for anomalous activity, potential intrusions, and suspicious login patterns.

While we take all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

baji36 retains personal data for the period necessary to fulfil the purposes for which it was collected, taking into account applicable legal, regulatory, and operational requirements. Our standard retention periods are as follows:

• Active account data: Retained for the full duration of your account's active status plus a post-closure period of 5 years to meet anti-money laundering and compliance record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later, in accordance with standard compliance requirements.
• Transaction records: Financial transaction data is retained for a minimum of 5 years following the date of the transaction.
• Customer support communications: Retained for 2 years from the date of the last interaction in the relevant support thread, unless the communication relates to an unresolved dispute.
• Marketing preference data: Retained until you withdraw consent or request deletion, at which point it is removed within 30 days.
• Technical and device data: Log data and device identifiers are retained for up to 12 months and then automatically purged.

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual.

As an offshore platform serving players in Bangladesh, baji36 may transfer personal data to servers and service providers located outside Bangladesh. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that described in this Policy. Safeguards we apply to international transfers include:

• Engaging only processors that maintain industry-standard data security certifications and contractual data protection obligations.
• Applying data minimisation principles so that only the minimum data necessary is transferred to any offshore processor.
• Conducting regular due diligence on the data handling practices of our third-party service providers.

The baji36 platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by or on behalf of a person under 21, we will promptly delete that data and close the associated account. If you believe that a minor has registered an account or provided data to baji36, please notify us immediately at [email protected] so we can take appropriate action without delay.

baji36 reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will notify registered members by email at the address associated with their account and/or by displaying a prominent notice on the platform prior to the change taking effect. The "Effective" date at the top of this Policy will be updated to reflect the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Continued use of the platform following notification of an amendment constitutes your acceptance of the updated Policy.