Privacy Policy
for bajilav

bajilav collects personal data from you in three principal ways: information you provide directly during account registration and ongoing use of the platform; information generated automatically by your use of the platform; and information received from trusted third-party partners involved in payment processing and identity verification. We collect only the data that is necessary for the purposes described in this Privacy Policy.

bajilav processes your personal data only for specific, explicit, and legitimate purposes. We do not use your data in any manner that is incompatible with the purposes stated below. Each processing activity is grounded in one of the following legal bases: performance of our contract with you, compliance with a legal obligation, your explicit consent, or our legitimate interests where those interests do not override your fundamental rights.

• Account management: Creating and maintaining your bajilav player account, verifying your identity, and enabling secure login from your registered Bangladesh mobile number or email address.
• Payment processing: Executing BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Verifying that payment accounts are registered in your own name.
• Regulatory compliance: Fulfilling Know Your Customer (KYC), Anti-Money Laundering (AML), and age verification obligations. Maintaining transaction records as required by applicable law.
• Platform personalisation: Displaying game recommendations, tailoring promotional offers to your activity, and providing language and currency settings consistent with the Bangladesh market (English language, BDT currency).
• Responsible gaming: Monitoring account activity for signs of problem gambling behaviour and applying self-exclusion, deposit limit, and time-out settings at your request or where required by our responsible gaming policy.
• Security and fraud prevention: Detecting unauthorised account access, identifying duplicate accounts, investigating bonus abuse, and applying AML transaction monitoring.
• Customer support: Responding to your queries, processing complaints, and maintaining a record of support interactions for quality assurance.
• Service improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience. Individual players are not identified in these analyses.
• Marketing communications: Sending promotional emails or SMS notifications regarding bonuses, tournaments, and seasonal offers — only where you have provided explicit consent and have not subsequently opted out.

bajilav uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your session security, and to collect aggregated first-party analytics data. A cookie is a small text file placed on your device when you visit a website. Cookies on bajilav fall into two categories: strictly necessary cookies and analytics cookies.

• Strictly necessary cookies: These are required for the platform to operate. They manage your authenticated session, maintain your preferred language (English) and currency (BDT) settings, and protect against cross-site request forgery. These cookies cannot be disabled without impairing your ability to use bajilav.
• Analytics cookies: bajilav uses first-party analytics cookies to understand how players navigate the site — which pages are visited most frequently, which games attract the most engagement, and where users encounter technical difficulties. This data is aggregated and anonymised before analysis. No individual player profiles are built for advertising purposes.

bajilav does not place third-party advertising cookies or tracking pixels from external networks on your device. We do not participate in cross-site behavioural advertising programmes. Where a third-party service provider (such as a payment gateway or an identity verification partner) sets its own cookies during a bajilav session, those cookies are governed by that provider's own privacy policy and are strictly limited to the technical function for which the provider was engaged.

bajilav does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share your data only with carefully selected service partners who process it exclusively on our behalf, under written data processing agreements that prohibit any secondary use, and with authorities where we are legally required to do so.

The categories of third parties with whom bajilav shares personal data are as follows:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card network processors receive the financial data necessary to execute your deposit and withdrawal instructions. These providers tokenise payment credentials and are bound by their own security and data protection standards.
• Identity verification partners: Specialist KYC and AML compliance providers receive identity documents and facial photographs solely for the purpose of verifying your identity and age. Documents are not retained by the verification partner beyond the period required to complete verification.
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session data (such as bet amount, game result, and timestamp) necessary to deliver game functionality and resolve any technical disputes. These providers do not receive your full personal profile.
• Cloud infrastructure and hosting providers: bajilav's platform is hosted on secure, access-controlled cloud infrastructure. Hosting providers have no independent right to access or use player personal data.
• Regulatory and law enforcement authorities: bajilav will disclose personal data to competent authorities where required by applicable law, court order, or regulatory directive. We will notify affected players of any such disclosure to the extent permitted by law.

bajilav retains your personal data for as long as your account remains active and for a defined period thereafter, in order to fulfil our legal and regulatory obligations. We do not retain data beyond what is necessary for the stated purpose. The following retention periods apply:

• Account and identity data: Retained for the full lifetime of your active bajilav account, plus a minimum of five years following account closure, in compliance with AML record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five years from the date of each transaction, consistent with financial record-keeping standards applicable in the Bangladesh market.
• KYC documentation: Identity documents and verification photographs are retained for the duration of your account and for five years post-closure. Documents are stored in encrypted form with access restricted to authorised compliance personnel only.
• Support communications: Chat transcripts and email correspondence are retained for three years from the date of the interaction, or longer if the communication relates to an unresolved dispute or ongoing legal matter.
• Analytics and usage data: Aggregated, anonymised analytics data is retained indefinitely for platform improvement purposes. This data cannot be linked back to any individual player after anonymisation.
• Marketing consent records: Records of your marketing consent or opt-out are retained for the lifetime of your account plus three years, to demonstrate compliance in the event of a complaint.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately technically feasible (for example, in archived backup systems), data is isolated from active processing until it can be securely deleted in the next scheduled purge cycle.

As a bajilav player, you hold the following rights in relation to the personal data we hold about you. These rights may be exercised at any time by submitting a written request to support@bajilav. We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. In exceptional cases involving complex or multiple requests, this period may be extended by a further 30 days, of which you will be notified.

• Right of access: You may request a copy of all personal data bajilav holds about you, along with information about how it is being processed. This is provided free of charge for the first request per 12-month period.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. Account profile data such as contact number and address may be updated directly through your bajilav account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. Note that bajilav is legally required to retain certain data for the retention periods described in Section 5, and erasure requests will be fulfilled to the extent permitted by those obligations.
• Right to restrict processing: You may request that bajilav restrict the processing of your data while a rectification or erasure request is being evaluated, or where you contest the legal basis for processing.
• Right to data portability: You may request an export of your personal data in a structured, commonly used, machine-readable format (JSON or CSV) covering account information and transaction history.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including any profiling used for personalised game recommendations or promotional targeting. You may also withdraw marketing consent at any time.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

bajilav implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme covers technical, organisational, and physical controls applied across all systems that store or process player data.

• Encryption in transit: All data exchanged between your device and bajilav is encrypted using TLS 1.2 or higher. Connections that do not meet this standard are rejected.
• Encryption at rest: Personal data stored on bajilav's servers — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. bajilav staff are granted role-based permissions; access to sensitive player data requires multi-factor authentication and is logged for audit purposes.
• Payment tokenisation: bKash wallet numbers, Nagad account references, and card data are tokenised by our payment processor. bajilav's own systems never store raw payment credentials in plain text.
• Penetration testing: bajilav's platform undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach that poses a risk to player rights, bajilav will notify affected players without undue delay and take immediate steps to contain the breach and prevent recurrence.

Whilst bajilav takes every reasonable technical and organisational precaution to protect your data, no transmission over the internet or electronic storage system is entirely infallible. You are responsible for maintaining the security of your own login credentials and for ensuring that any devices used to access bajilav are adequately protected against malware and unauthorised access.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data bajilav holds about you, please contact our support team in English. All privacy-related enquiries are handled by our compliance team, who are responsible for overseeing data protection matters across the bajilav platform.

bajilav reviews and updates this Privacy Policy periodically to reflect changes in our practices, legal obligations, or the services we offer. The effective date at the top of this document indicates when the current version came into force. We recommend reviewing this page at regular intervals. Material changes that affect your rights will be communicated directly to your registered email address prior to taking effect.

Your continued use of the bajilav platform after any update to this Privacy Policy is published constitutes your acknowledgement of the revised terms. If you do not agree with any change to this Privacy Policy, you should discontinue use of the platform and may request account closure by contacting support@bajilav.