How xbeji Collects, Uses, and Protects Your Personal Data

1. Who We Are

xbeji is an online casino and sports betting platform accessible at xbeji.io, serving players primarily based in Bangladesh. References to "xbeji", "we", "us", or "our" throughout this Privacy Policy refer to the xbeji platform and the entity responsible for operating it and for determining how your personal data is collected and used.

xbeji provides real-money casino games, live dealer tables, slots, sports betting (including cricket, football, and kabaddi), and associated account management services. In the course of providing these services to players across Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, and Mymensingh, xbeji necessarily collects and processes certain personal data, as described in this policy.

If you have any questions about this Privacy Policy or about how xbeji handles your personal data, please contact our support team at [email protected] or via 24/7 live chat from within your account dashboard. We aim to respond to all privacy-related queries within 48 hours.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected by xbeji in connection with:

• Registration and maintenance of a player account on xbeji.io;
• All deposits, withdrawals, and payment transactions processed through the Platform;
• All gameplay activity, bet placement, game results, and account history generated on the Platform;
• Communications between you and xbeji via live chat, email, or any other support channel;
• Your use of the xbeji website, including pages visited, features accessed, and device/browser information collected automatically.

This policy applies to all players regardless of where in Bangladesh they are located and regardless of which device or connection method they use to access the Platform. It applies from the moment you first visit xbeji.io, even before you create an account.

3. Data We Collect

xbeji collects the following categories of personal data. The specific data points collected from you will depend on how you use the Platform and which services you access.

We do not knowingly collect sensitive data such as racial or ethnic origin, religious beliefs, political opinions, or biometric data (other than photographs submitted for identity verification purposes as part of KYC). If you voluntarily include such information in communications with our support team, we will use it only to respond to your query and will not retain it beyond that purpose.

4. How We Collect Data

xbeji collects your personal data through the following means:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact customer support, or update your account settings, you provide data to xbeji directly;
• Automatically: When you access xbeji.io, our servers and analytics systems automatically record Technical Data and Usage Data (including IP address, device identifiers, pages visited, and session duration) via server logs, cookies, and similar tracking technologies — see Section 8 for full details;
• From payment providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, or BRAC Bank, xbeji receives transaction confirmation data from those providers, including transaction reference numbers and timestamps;
• From identity verification providers: Where xbeji uses a third-party KYC or anti-fraud service to verify your submitted identity documents, that provider may return a verification result and associated data points to xbeji as part of the verification process;
• From other players (fraud reporting): In limited circumstances, data about an account may be received as part of a fraud report or suspicious activity alert raised by another player or by an automated fraud detection system.

5. Legal Basis for Processing

xbeji processes your personal data on the following legal grounds:

• Contract performance: Processing your identity data, contact data, and financial data is necessary to create and maintain your account, process deposits and withdrawals, settle bets, and deliver the services you have contracted with xbeji to receive. Without this processing, xbeji cannot provide its services to you;
• Legal obligation: xbeji is subject to obligations relating to anti-money laundering (AML), Know Your Customer (KYC) compliance, fraud prevention, and responsible gaming requirements. Processing your identity and transaction data to comply with these obligations is legally required, irrespective of your consent;
• Legitimate interests: xbeji processes Technical Data, Usage Data, and Gameplay Data to operate, secure, and improve the Platform, to detect and prevent fraud and abuse, and to ensure fair play. These processing activities serve the legitimate interests of xbeji and its player community, and do not override your fundamental privacy rights;
• Consent: Where xbeji sends you optional marketing communications (such as promotional emails about new games, tournaments, or seasonal offers tied to events like BPL, Eid, or Pohela Boishakh), we will do so only with your prior consent, which you may withdraw at any time by contacting support.

6. How We Use Your Data

xbeji uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, verify your identity, maintain your account record, and communicate with you about your account status;
• Payment processing: To facilitate deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, DBBL, BRAC Bank), verify that payments originate from accounts registered in your name, and maintain a complete and accurate transaction history;
• KYC and fraud prevention: To comply with our Know Your Customer obligations, verify your age (minimum 21 years), detect and investigate suspicious or fraudulent account activity, prevent money laundering, and protect the integrity of the Platform for all players;
• Gameplay and sportsbook services: To record bet placements, process game outcomes, settle sports bets, maintain your bet history and game round records, and resolve any disputes arising from game results;
• Responsible gaming: To record and enforce the responsible gaming preferences you set (deposit limits, cooling-off periods, self-exclusion), to monitor account activity for signs of problem gambling, and to make welfare contacts where our responsible gaming protocols identify potential harm;
• Customer support: To respond to your queries, resolve disputes, process complaints, and maintain a record of communications for quality assurance purposes;
• Platform improvement: To analyse aggregate Usage Data and Technical Data to identify areas for improvement, fix bugs, optimise performance, and develop new features that improve the player experience;
• Legal compliance: To meet reporting obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions where necessary.

7. Who We Share Data With

xbeji shares personal data with third parties only to the extent necessary to operate the Platform, meet legal obligations, or protect the security of the Platform and its players. We do not sell personal data. The categories of third parties with whom we may share your data are as follows:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank (DBBL), and BRAC Bank receive transaction data necessary to process your deposits and withdrawals. Each of these providers operates under its own privacy policy and is responsible for the data they receive in connection with payment processing;
• Identity verification (KYC) providers: Third-party services used to verify the authenticity of identity documents submitted during the KYC process. These providers receive your name, date of birth, document images, and document reference numbers for the sole purpose of identity verification;
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session and game-round data to facilitate game delivery and technical support. These providers do not receive your identity or payment data;
• IT and infrastructure providers: Cloud hosting, server infrastructure, and cybersecurity providers who process data on our behalf under strict data processing agreements that prohibit any use of your data beyond the services they provide to xbeji;
• Regulatory and law enforcement authorities: Where required by applicable law, or in response to a lawful formal request, xbeji may disclose account data, transaction records, or identity information to the relevant authority. xbeji will only comply with requests that meet the legal threshold required under applicable law;
• Fraud prevention networks: In cases of suspected fraud, money laundering, or account abuse, limited data may be shared with industry fraud prevention databases or networks to protect the Platform and other players from harm.

All third parties that process personal data on behalf of xbeji are required to maintain appropriate technical and organisational security measures and to process data only for the purpose for which it was shared. xbeji does not transfer personal data to parties located outside of its operational jurisdiction without ensuring that appropriate data protection safeguards are in place.

8. Cookies & Tracking Technologies

xbeji uses cookies and similar tracking technologies on xbeji.io. A cookie is a small text file placed on your device when you visit a website. Cookies allow the website to remember your preferences, maintain your session, and collect usage data.

xbeji uses the following types of cookies:

• Strictly necessary cookies: These are required for the Platform to function. They maintain your login session, remember your account preferences, and enable core security features. These cookies cannot be disabled without impairing your ability to use the Platform;
• Functional cookies: These remember your preferences (such as your preferred language, game view settings, and deposit method) to provide a more personalised experience. They are not strictly required but significantly improve usability;
• Analytics cookies: These collect anonymised data about how visitors use xbeji.io — including which pages are visited most, how long sessions last, and where users exit the site. This data is used to improve the Platform. Individual users are not identified by analytics cookies;
• Security cookies: These assist in fraud detection and account protection by identifying unusual access patterns, such as a login from an unrecognised device or geographic location that deviates significantly from your usual access behaviour.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. xbeji does not use third-party advertising cookies or cross-site tracking cookies that profile your behaviour across other websites.

9. Data Security

xbeji takes the security of your personal data seriously and has implemented a layered set of technical and organisational measures to protect it against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• TLS/SSL encryption: All data transmitted between your device and xbeji's servers is protected by Transport Layer Security (TLS) encryption, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit;
• Encrypted data storage: Sensitive data — including identity documents, payment account references, and KYC records — is stored in encrypted form. Access to this data is restricted to authorised personnel with a legitimate operational need;
• Access controls: xbeji operates strict role-based access controls on all internal systems. Staff members can only access the personal data required for their specific role. All internal access to sensitive player data is logged and audited;
• Two-factor authentication (2FA): xbeji's internal administrative systems require two-factor authentication. Players are also encouraged to enable 2FA on their own accounts via account settings for an additional layer of protection;
• Regular security reviews: xbeji conducts periodic reviews of its security infrastructure, access control policies, and data handling procedures to identify and remediate vulnerabilities;
• Incident response: In the event of a data security incident that affects your personal data, xbeji will notify affected players without undue delay and will take immediate steps to contain the incident, assess its scope, and prevent recurrence.

While xbeji takes all reasonable steps to secure your data, no platform can guarantee absolute security. You are responsible for keeping your account password confidential and for notifying xbeji immediately if you suspect unauthorised access to your account.

10. Data Retention

xbeji retains your personal data for as long as is necessary for the purposes described in this Privacy Policy, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

When the applicable retention period expires, xbeji will securely delete or irreversibly anonymise your personal data. Anonymised data (from which you cannot be identified) may be retained for statistical and analytical purposes beyond these periods without time limit.

11. Your Rights

As a player on xbeji, you have the following rights in relation to your personal data. To exercise any of these rights, please contact xbeji at [email protected] with the subject line "Data Rights Request" and your registered account username. xbeji will respond within a reasonable timeframe and will request identity verification before fulfilling any data rights request.

• Right of access: You may request a copy of all personal data xbeji holds about you. We will provide this in a clear, structured format;
• Right to rectification: If any personal data held by xbeji about you is inaccurate or incomplete, you may request that we correct or update it. Note that some data (such as your registered name or date of birth) may require KYC re-verification before changes are applied;
• Right to erasure: You may request that xbeji delete your personal data. This right is subject to overriding legal retention obligations (see Section 10). For example, xbeji cannot delete transaction records that must be retained under AML obligations, but can delete optional data such as marketing preferences and optional profile information;
• Right to restrict processing: In certain circumstances — for example, while you dispute the accuracy of data we hold — you may request that we restrict our processing of your personal data to storage only, pending resolution of the dispute;
• Right to data portability: You may request that xbeji provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service;
• Right to withdraw marketing consent: Where xbeji processes your data for marketing purposes on the basis of your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal;
• Right to object: You may object to processing carried out on the basis of xbeji's legitimate interests. xbeji will assess whether its legitimate interests are overridden by your privacy interests on a case-by-case basis.

12. Children & Minors

If you are a parent or guardian and believe that a minor under your care has created an account on xbeji.io, please contact us immediately at [email protected]. We will investigate promptly and take appropriate action, including account closure and data deletion where required.

xbeji's age verification procedures — including NID checks, date of birth verification at registration, and KYC document review — are specifically designed to prevent underage access to the Platform. These controls are reviewed and updated regularly as part of our responsible gaming commitments. For further information, see our Responsible Gaming page.

13. Third-Party Links

xbeji.io may contain links to pages or content provided by third-party game studios, sports data providers, or payment partners. These linked pages or services operate under their own privacy policies and are not governed by this Privacy Policy. xbeji is not responsible for the privacy practices of third-party websites or services, even if those services are integrated into or accessible from the xbeji Platform.

We recommend that you review the privacy policies of any third-party services you interact with in connection with your xbeji account — particularly your chosen payment provider (bKash, Nagad, Rocket, Upay, Visa, Mastercard, DBBL, or BRAC Bank) — to understand how they handle your personal data independently of xbeji.

14. Changes to This Policy

xbeji reserves the right to update or amend this Privacy Policy at any time. Where a material change is made — meaning a change that affects how your personal data is processed, your rights, or the categories of third parties with whom data is shared — xbeji will provide notice via email to your registered address or via a prominent notice on the Platform, at least seven (7) days before the change takes effect.

For minor, non-material changes (such as formatting updates, clarifications that do not alter the substance of the policy, or updates to contact details), xbeji may update the policy without advance notice, and the effective date at the top of this document will be updated accordingly. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. The version of the policy in force on the date of any data processing event is the version that governs that event.

15. Contact Us

For any questions, concerns, or formal requests relating to this Privacy Policy or to the personal data xbeji holds about you, please use the following contact details:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 within your xbeji account dashboard — average response time under 2 minutes
• Email response time: Under 4 hours for general queries; up to 48 hours for formal data rights requests requiring internal review

When submitting a data rights request, please include your registered account username, the email address associated with your account, and a clear description of your request. This will help our team process your request as efficiently as possible. Identity verification will be required before any personal data is disclosed or modified in response to a rights request.