u baji Privacy Policy —
Your Data, Our Responsibility

u baji collects personal information in two primary ways: information you provide directly to us, and information collected automatically through your use of the platform. The categories of data we collect are described in detail below.

Information You Provide Directly

When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you may provide us with the following categories of personal information:

• Identity data: your full legal name, date of birth, gender, and nationality as stated on your official Bangladesh government-issued identification documents;
• Contact data: your email address, Bangladesh mobile phone number (used for account recovery and transaction notifications), and residential address in Bangladesh (city, district, and postcode);
• Identity verification (KYC) documents: copies of your National Identity Card (NID), passport, or birth certificate, and proof-of-address documents such as bank statements from BRAC Bank, Dutch-Bangla Bank, Islami Bank, Sonali Bank, or City Bank, or mobile financial services statements from bKash, Nagad, or Rocket;
• Financial data: your bKash, Nagad, Rocket, or Upay mobile wallet numbers; bank account details where bank transfer is used; deposit and withdrawal amounts in Bangladeshi Taka (৳ BDT); and transaction reference numbers;
• Account credentials: your chosen username and a hashed (never plain-text) version of your password;
• Communications data: the content of any messages you send to our support team via email at [email protected], including support ticket history and the nature of any complaints or queries raised.

Information Collected Automatically

When you access the u baji platform — whether as a logged-in user or an anonymous visitor — our systems automatically collect certain technical and behavioural data, including:

• Device and technical data: your IP address, device type (mobile, tablet, desktop), operating system and version, browser type and version, screen resolution, and device language settings;
• Usage data: pages visited, games launched, duration of game sessions, betting history (games played, wager amounts, win/loss outcomes), bonus offers viewed or claimed, and features interacted with;
• Log data: server-side access logs recording timestamps, request types, response codes, and referring URLs — retained for security monitoring and fraud prevention purposes;
• Cookie and tracking data: session identifiers, preference cookies, and analytics identifiers as further described in the Cookies & Tracking section of this Policy.

Information From Third Parties

In limited circumstances, u baji may receive personal information about you from third parties, including:

• Payment service providers (bKash, Nagad, Rocket, Upay, and partner banks) confirming deposit and withdrawal transaction statuses;
• Identity verification service providers assisting with KYC document authentication;
• Fraud prevention and anti-money-laundering screening services that may confirm or flag identity or transaction information against watch lists.

In all cases, u baji receives only the minimum data necessary from third-party providers to fulfil the relevant function and does not use third-party-sourced data for purposes beyond those stated in this Policy.

u baji does not sell, rent, or trade your personal data to any third party. We share your personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

Payment Service Providers

To process your deposits and withdrawals, u baji must share relevant financial and identity data with your chosen payment service provider (bKash, Nagad, Rocket, Upay, or your nominated bank). The data shared is limited to what is required to execute the transaction — typically your account reference, transaction amount in Bangladeshi Taka, and the mobile wallet number or bank account you have registered. These providers process your data under their own privacy policies and are independently responsible for their data handling practices.

Identity Verification Partners

To complete KYC verification, u baji may share copies of your identity documents and personal details with a third-party identity verification service. This service assists us in confirming the authenticity of your documents and cross-referencing your identity against anti-fraud and anti-money-laundering databases. All verification partners engaged by u baji are bound by strict data processing agreements that prohibit use of your data for any purpose other than identity verification on our behalf.

Game Studio Providers

Games on the u baji platform are supplied by third-party studios including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi, among others. These studios may receive anonymised session identifiers and game-play data to power the game functionality and RNG certification. They do not receive your full name, contact details, or financial data. Their data processing is governed by their own certified compliance frameworks.

Legal and Regulatory Disclosure

u baji may disclose your personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or regulatory instruction. In such cases, u baji will disclose only the minimum data required to satisfy the legal obligation and will, where legally permitted to do so, notify you of the disclosure.

Business Transfers

In the event that u baji undergoes a corporate restructure, merger, or acquisition, personal data held by u baji may be transferred to the successor entity as part of that transaction. Users will be notified of any such transfer via the email address registered to their account, and the successor entity will be required to honour the obligations set out in this Policy.

u baji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework is reviewed and updated regularly to reflect evolving best practices in the online gaming and financial services sectors.

Technical Security Measures

The following technical controls are in place across the u baji platform at all times:

• TLS/SSL encryption: all data transmitted between your device and u baji servers is encrypted in transit using industry-standard TLS 1.2 or higher. This applies to account login, game sessions, deposit and withdrawal requests, and all other platform interactions;
• Encryption at rest: sensitive personal data including KYC documents, financial records, and password hashes are stored in encrypted form on our servers. Plain-text storage of sensitive data is strictly prohibited within our infrastructure;
• Password hashing: your account password is never stored in plain text. u baji applies a robust one-way hashing algorithm with salting to ensure that even in the unlikely event of a data breach, your actual password cannot be recovered;
• Access controls: access to personal data within the u baji organisation is granted on a strict need-to-know basis. Only team members who require access to perform their defined role (such as KYC review officers or fraud analysts) are permitted to view personal records, and all access is logged and auditable;
• Firewall and intrusion detection: our server infrastructure is protected by enterprise-grade firewalls and continuous intrusion detection systems that monitor for anomalous traffic patterns, brute-force attempts, and known attack signatures;
• Regular security testing: u baji conducts periodic vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.

Organisational Security Measures

Beyond technical controls, u baji maintains the following organisational safeguards:

• All staff and contractors with access to personal data are required to complete data protection training and sign confidentiality agreements prior to receiving access;
• Third-party vendors and service providers who process data on our behalf are carefully vetted and must sign binding data processing agreements before integration;
• u baji maintains an incident response procedure for handling suspected data breaches, including notification protocols to affected users and relevant authorities where required.

Your Responsibilities

While u baji takes all reasonable steps to protect your data, you also play a role in keeping your account secure. You are responsible for maintaining the confidentiality of your u baji account credentials, choosing a strong and unique password, and logging out of your account when using shared or public devices. If you suspect that your account has been accessed without your authorisation, contact [email protected] immediately so we can take protective action.

Data Breach Notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, u baji will notify affected users without undue delay — and in any case within 72 hours of becoming aware of the breach — via the email address registered to your account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps u baji has taken or proposes to take to address the breach and mitigate its impact.

As a user of the u baji platform, you hold a number of important rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, contact our privacy team at [email protected] with the subject line "Data Subject Request" and include your registered username and a clear description of the right you wish to exercise. We will respond within 5 business days.

Right to Access

You have the right to request a copy of the personal data that u baji holds about you, along with information about how it is used, where it came from, who it has been shared with, and how long it will be retained. We will provide this information in a clear, structured format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. For account data such as your email address or phone number, you may also be able to update this directly through your account settings. For KYC identity data, corrections must be submitted via support with supporting documentation.

Right to Erasure

Subject to our legal retention obligations, you have the right to request that u baji delete your personal data. We will action valid erasure requests promptly, though as noted in the Data Retention section, some data must be retained for a defined period after account closure regardless of an erasure request.

Right to Restriction of Processing

In certain circumstances — for example, if you contest the accuracy of your data or have objected to its processing — you have the right to request that u baji restrict the processing of your data while the matter is resolved. During restriction, we will store your data but not actively use it for any other purpose.

Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and the processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request that it be transmitted to another controller where technically feasible.

Right to Object

You have the right to object to the processing of your personal data where that processing is based on legitimate interests. You also have an unconditional right to object to the use of your personal data for direct marketing purposes. On receipt of a valid objection to marketing processing, u baji will cease that processing immediately.

Right to Withdraw Consent

Where u baji processes your personal data based on your consent (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.