xbji Privacy Policy — How We Protect Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how xbji ("xbji", "we", "us", "our") collects, uses, stores, discloses, and protects personal information provided by users ("Player", "User", "you") of the xbji platform accessible at https://xbji.io and all associated services.

xbji is committed to handling your personal data responsibly and in accordance with applicable data protection standards. By registering an account, making a deposit, or otherwise using the xbji platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your data as described herein.

This Policy applies to all data collected through the xbji website, mobile-optimised interface, email communications, live chat support, and any other channel through which you interact with xbji. It should be read alongside the xbji Terms & Conditions and the Responsible Gaming Policy, both of which form part of your overall agreement with xbji.

If you have any questions about this Policy or how your data is handled, please contact us at [email protected] before using the platform.

2. Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a natural person, either directly (e.g., full name, mobile number) or indirectly (e.g., device ID combined with behavioural data).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, alteration, and deletion.
• "Controller" means xbji, acting as the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third party that processes Personal Data on behalf of xbji under a data processing agreement (e.g., payment providers, identity verification services).
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" means identity and address verification documents submitted during the Know Your Customer process, including but not limited to national identity cards, passports, and utility statements.
• "Cookie" means a small text file placed on your device by the xbji website to store session information, preferences, and analytics data.

3. Data We Collect

xbji collects personal data through several channels and at different stages of your interaction with the platform. The categories of data collected are set out below.

3.1 Registration Data

When you create an xbji account, we collect: full legal name, date of birth, residential address (including district and division within Bangladesh, such as Dhaka, Chittagong, Sylhet, Khulna, or Rajshahi), email address, and mobile phone number. This information is mandatory — without it, we cannot create or maintain a valid account.

3.2 Identity Verification (KYC) Data

Before processing your first withdrawal, xbji requires identity verification. Documents collected may include: National Identity Card (NID), passport, or driving licence; a recent utility bill, bank statement, or mobile money statement (bKash, Nagad, Rocket) confirming your address; and in some cases a selfie photograph holding your identity document. These documents are stored securely and used solely for verification purposes.

3.3 Financial Data

xbji collects data relating to your financial transactions on the platform, including: deposit amounts and timestamps, withdrawal requests and their status, payment method identifiers (e.g., the last four digits of a card, or the mobile number associated with a bKash or Nagad wallet), transaction reference numbers, and account balance history. Full card numbers and mobile banking PINs are never stored by xbji — these are handled exclusively by your payment provider.

3.4 Activity & Behavioural Data

xbji automatically collects data about how you use the platform, including: pages visited and time spent, games played (including game titles, bet amounts, and outcomes), login and logout timestamps, device type, operating system and browser version, IP address, and approximate geolocation derived from IP. This data is used for service improvement, fraud detection, and responsible gaming monitoring.

3.5 Communications Data

When you contact xbji support by email or live chat, we retain a record of those communications, including the content of messages, timestamps, and any attachments. This data is used to resolve your query and to improve service quality.

3.6 Marketing Preferences

Where you have opted in to marketing communications, xbji retains a record of your preferences, including the types of promotions you have expressed interest in and whether you have previously unsubscribed from specific communication channels.

4. How We Use Your Data

xbji uses the personal data it collects for the following specific purposes:

Purpose	Data Used	Necessity
Account creation and management	Registration data, email, mobile number	Essential for service delivery
Identity and age verification (KYC)	KYC documents, selfie, date of birth	Required before first withdrawal
Processing deposits and withdrawals	Financial data, payment method identifiers	Essential for payment processing
Fraud detection and prevention	Activity data, IP address, device fingerprint	Legitimate security interest
Responsible gaming monitoring	Betting history, session data, activity patterns	Player welfare obligation
Customer support	Communications data, account history	Service delivery
Marketing communications (opt-in only)	Email, mobile number, marketing preferences	Consent-based only
Platform analytics and improvement	Behavioural data, device data (anonymised)	Legitimate business interest
Legal and regulatory compliance	All categories as required	Legal obligation

xbji will not use your personal data for any purpose that is incompatible with those listed above without first informing you and, where required, obtaining your consent.

5. Legal Basis for Processing

xbji processes your personal data only where a valid legal basis exists. The legal bases we rely on are:

• Contractual necessity: Processing is necessary to perform our obligations under the Terms & Conditions you agreed to at registration — including account management, payment processing, and KYC verification.
• Legitimate interests: xbji has a legitimate interest in detecting and preventing fraud, protecting the security of its platform, and improving its services through anonymised analytics. We have assessed that these interests do not override your privacy rights when appropriate safeguards are in place.
• Legal obligation: Certain data processing is required to comply with applicable laws, including anti-money laundering (AML) regulations, financial record-keeping requirements, and any lawful request from a competent authority.
• Consent: Where processing is not covered by the above — such as sending optional promotional emails or SMS messages — xbji will request your explicit consent and will not proceed without it. You may withdraw consent at any time by contacting [email protected].

6. Cookies & Tracking Technologies

The xbji platform uses cookies and similar tracking technologies to deliver, maintain, and improve its services. The categories of cookies we use are described below:

6.1 Essential Cookies

These cookies are strictly necessary for the platform to function. They manage your login session, maintain security tokens, and ensure that the site operates correctly across page navigations. Essential cookies cannot be disabled without breaking core platform functionality.

6.2 Analytics Cookies

Analytics cookies help xbji understand how players interact with the platform — which pages are visited most frequently, how long sessions last, and where users encounter difficulties. Data collected through analytics cookies is aggregated and anonymised. xbji uses this information exclusively to improve user experience and platform performance.

6.3 Functional Cookies

Functional cookies remember your preferences — such as your chosen language, display settings, and whether you have previously dismissed certain notification banners. They improve your experience without tracking you across unrelated sites.

6.4 Managing Cookies

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, though disabling essential cookies will impair your ability to use the xbji platform. For detailed guidance, refer to the help documentation for your browser. xbji does not use cross-site tracking cookies or cookies that profile you for advertising purposes on third-party websites.

7. Third-Party Data Sharing

xbji does not sell your personal data. Data may be shared with the following categories of third party, strictly limited to what is necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transactional data necessary to process your deposits and withdrawals. Each provider operates under their own privacy policy and applicable financial regulations.
• Identity verification providers: Third-party KYC and age verification services receive copies of identity documents you submit. These providers are contractually bound to use your data solely for identity verification and to maintain appropriate security standards.
• Game software providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymised player identifier to deliver game content. They do not receive your name, contact details, or payment information.
• Fraud prevention and security services: xbji uses third-party tools to detect unusual account activity and potential fraud. These services receive behavioural and device data in an anonymised or pseudonymised form.
• Legal and regulatory authorities: xbji will disclose personal data to competent authorities where required to do so by applicable law, court order, or regulatory direction. xbji will notify affected players of such disclosure where it is legally permitted to do so.
• IT infrastructure and hosting providers: Servers and cloud infrastructure used by xbji are operated by third-party providers. These providers act as data processors under binding agreements and do not access player data for any independent purpose.

All third parties with whom xbji shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the purpose for which it was shared.

8. Data Retention

xbji retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any legal or regulatory requirements that mandate a longer retention period. The following retention periods apply as a general guide:

• Account and registration data: Retained for the duration of your account and for a period of 5 years following account closure, in accordance with applicable financial record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of submission, or longer if required by applicable anti-money laundering regulations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Communications and support records: Retained for 2 years from the date of the most recent communication in a support thread.
• Analytics and behavioural data: Retained in anonymised, aggregated form indefinitely for platform improvement purposes. Raw non-anonymised behavioural logs are deleted after 12 months.
• Marketing preference data: Retained until you withdraw consent or request deletion, at which point it is erased promptly.

When data is no longer required and no legal retention obligation applies, xbji deletes or permanently anonymises it using secure data destruction methods.

9. Your Privacy Rights

As a user of the xbji platform, you have the following rights with respect to your personal data. To exercise any of these rights, contact [email protected] with the subject line "Privacy Rights Request". xbji will respond within 30 calendar days.

• Right of access: You may request a copy of all personal data xbji holds about you, along with information about how it is used and with whom it is shared.
• Right to rectification: If any personal data held by xbji is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure: You may request that xbji delete your personal data. Erasure requests are honoured where no overriding legal obligation requires continued retention. Note that transaction and KYC records may be retained for the legally mandated periods described in Section 8 even following an erasure request.
• Right to restriction: You may request that xbji restrict the processing of your data — for example, while the accuracy of the data is being contested — rather than deleting it outright.
• Right to data portability: You may request a copy of the personal data you provided to xbji in a structured, commonly used, machine-readable format (e.g., CSV), where technically feasible.
• Right to object: You may object at any time to processing of your personal data based on legitimate interests (including profiling for fraud detection), and to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

10. Data Security

xbji employs a range of technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• All data transmitted between your device and xbji servers is protected by 256-bit SSL/TLS encryption.
• Sensitive data including KYC documents and financial records is stored in encrypted databases with access restricted to authorised personnel only.
• xbji conducts regular internal security reviews and vulnerability assessments to identify and address potential weaknesses.
• Employee access to personal data is governed by a least-privilege policy — staff members can only access data that is directly relevant to their job function.
• All third-party data processors engaged by xbji are required to demonstrate and maintain appropriate security standards as a condition of their engagement.
• In the event of a data breach that poses a risk to your rights and interests, xbji will notify affected players without undue delay and will take immediate steps to contain the breach.

While xbji takes every reasonable precaution to protect your data, no internet-based platform can guarantee absolute security. You are responsible for keeping your account credentials secure and for notifying xbji immediately if you suspect your account has been compromised.

11. Children's Privacy

The xbji platform is strictly intended for adults aged 21 years and above. xbji does not knowingly collect, store, or process personal data belonging to individuals under the age of 21. If xbji discovers or reasonably suspects that an account holder is under 21, the account will be immediately suspended, any balance will be withheld pending investigation, and all associated personal data will be deleted unless its retention is required by law.

If you believe that a minor has registered on the xbji platform, please contact [email protected] immediately so that appropriate action can be taken.

12. International Data Transfers

xbji's primary target market is Bangladesh. However, certain third-party service providers — including game software providers, cloud infrastructure operators, and fraud prevention tools — may be located in jurisdictions outside Bangladesh. Where personal data is transferred to a third party in another country, xbji takes steps to ensure that adequate protections are in place, including:

• Requiring data processing agreements with all international processors that include contractual obligations equivalent to those applicable in the primary jurisdiction.
• Transferring only the minimum data necessary for the third party to deliver the specific service for which they are engaged.
• Reviewing the security practices of international processors prior to engagement and periodically thereafter.

By using the xbji platform, you acknowledge that your personal data may be transferred to and processed in countries other than Bangladesh, subject to the protections described above.

13. Changes to This Policy

xbji reserves the right to update this Privacy Policy at any time to reflect changes in our practices, applicable law, or the services we offer. When material changes are made, we will publish the updated Policy on this page with a revised effective date. Where changes significantly affect your rights or how your data is used, we will also notify registered players by email at the address associated with their account.

Your continued use of the xbji platform after the updated Policy has been published constitutes your acknowledgment of the changes. If you do not agree with the updated Policy, you should discontinue use of the platform and may request account closure by contacting [email protected].

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xbji handles your personal data, please reach out using the details below:

• Email: [email protected]
• Subject line for privacy requests: "Privacy Rights Request"
• Live Chat: Available 24/7 on the xbji platform (average response under 1 hour)
• Email response time: Within 6 hours during standard operations; within 30 days for formal data rights requests

xbji takes all privacy enquiries seriously and will acknowledge receipt of any formal privacy request within 24 hours of submission. We are committed to resolving all concerns promptly, transparently, and in good faith.