Privacy Policy
for s baji Players

Data We Collect

s baji collects personal data only where it is necessary to provide you with a safe, functional, and legally compliant online gaming experience. We collect data through your direct interactions with the platform, automatically through your use of the site, and occasionally from trusted third-party sources where required for identity verification or fraud prevention.

The categories of personal data we may collect are described in the table below. Not all categories apply to every player — the data collected at any given time depends on the actions you take on the platform and the services you access.

Where you choose not to provide data that is marked as mandatory during registration or KYC, s baji may be unable to open your account, process your transactions, or provide certain services. Optional data fields are clearly labelled on the relevant forms within the platform.

Data Sharing & Disclosure

s baji does not sell your personal data to third parties. We share personal data only where it is strictly necessary to deliver the services you have requested, to comply with legal obligations, or to protect the security and integrity of our platform. All third parties with whom we share data are required to handle it in a manner consistent with this Privacy Policy and applicable data protection standards.

The categories of third parties with whom s baji may share your personal data, and the reasons for doing so, are set out below:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank receive the minimum necessary financial data to process your deposit and withdrawal transactions. These providers operate under their own regulatory frameworks and privacy policies.
• Identity verification providers: Where required for KYC compliance, we may share your identity data with trusted document verification service providers to confirm your age and identity. These providers process your data only for the purpose of verification and are contractually prohibited from using it for any other purpose.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming may receive technical session data (such as an anonymised player session token) to deliver their games via the s baji platform. These studios do not receive your personal identity or financial data.
• Technology infrastructure providers: Cloud hosting providers, content delivery networks, and cybersecurity service providers may process technical data on our behalf as part of their service delivery. These providers act as data processors under contractual agreements that restrict their use of your data.
• Legal and regulatory authorities: s baji may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity.
• Business successors: In the event of a merger, acquisition, or transfer of all or part of s baji's business assets, your personal data may be transferred to the acquiring entity. In such circumstances, we will endeavour to notify registered players of the change in data controller in advance.

Data Retention

s baji retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, or for as long as is required by applicable legal, regulatory, or internal compliance obligations. Once data is no longer needed for any of these purposes, it is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual player.

The retention periods applicable to the main categories of personal data held by s baji are as follows:

• Active account data: Retained for the full duration of your account being open on the s baji platform, plus a post-closure period as described below.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction. This retention period is driven by internal financial record-keeping obligations and anti-money-laundering compliance requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of submission or the date of account closure, whichever is later. These records may be required in connection with regulatory inquiries or fraud investigations.
• Customer support communications: Retained for 3 years from the date of the last interaction in the relevant support thread, or until any associated dispute is fully resolved, whichever is later.
• Marketing and communication preferences: Retained for as long as your account is active, and for 1 year following account closure, to ensure that opt-out preferences are honoured throughout the post-closure period.
• Technical and usage logs: Typically retained for 90 days for operational troubleshooting purposes, after which they are deleted or anonymised. Security-related logs may be retained for up to 12 months where an active investigation is ongoing.
• Self-exclusion records: Retained for the full duration of the self-exclusion period plus 5 years post-exclusion to prevent inadvertent re-registration in violation of the self-exclusion commitment.

Your Privacy Rights

As a registered player on s baji, you have a number of rights in relation to the personal data we hold about you. s baji is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights described below, please submit a written request to [email protected] with the subject line "Data Subject Request" and your registered account name or mobile number for identification purposes.

s baji will respond to all valid data subject requests within 30 days of receipt. In cases of complexity or high volume, we may extend this period by a further 30 days, in which case we will notify you of the extension before the initial 30-day period expires. There is no charge for submitting a data subject request.

• Right of access: You have the right to request a copy of all personal data that s baji holds about you, along with information about how it is used, where it was obtained, and with whom it has been shared. This is commonly referred to as a Subject Access Request (SAR).
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. Where correction requires identity re-verification, we may ask you to provide supporting documentation.
• Right to erasure: You have the right to request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Please note that this right is subject to our legal obligations to retain certain categories of data — in particular, financial transaction records and KYC documents — for the periods described in Section 05.
• Right to restriction of processing: You may request that we restrict our processing of your data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or where you have objected to processing pending determination of that objection.
• Right to data portability: Where your data is processed on the basis of consent or a contractual relationship, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transferred to another data controller where technically feasible.
• Right to object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though s baji may be entitled to continue processing where it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.