xbej Privacy Policy — How We Collect, Use and Protect Your Data

xbej is an online betting and casino platform operating at xbej.io, offering sports betting, live casino, slots, arcade games and other gaming services primarily to players based in Bangladesh. Throughout this Privacy Policy, references to "xbej", "we", "us" or "our" refer to the xbej platform and its operating entity.

xbej acts as the data controller in respect of the personal data collected from registered users and visitors to xbej.io. As data controller, xbej determines the purposes and means by which personal data is processed, and is responsible for ensuring that such processing complies with applicable data protection standards.

If you have any questions about this Privacy Policy or about how xbej handles your personal data, please contact our support team using the details provided in Section 14 of this policy.

xbej collects personal data across several categories depending on the nature of your interaction with the platform. The categories of personal data collected are set out in the table below.

xbej does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health information unless directly relevant to a responsible gaming self-exclusion request or required by law. Where such data is provided voluntarily by a user (for example, in the context of a responsible gaming consultation), it will be handled with additional care and used only for the stated purpose.

xbej collects personal data through the following channels:

• Direct submission: Data you provide when creating an account, completing identity verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically as you navigate and interact with xbej.io, including through cookies, server logs, and session-tracking technologies (see Section 7 for full cookie details).
• Payment providers: Transaction confirmation data returned by mobile financial service providers (bKash, Nagad, Rocket, Upay) and card networks (Visa, Mastercard) when you make deposits or request withdrawals.
• Identity verification partners: Where xbej uses a third-party KYC (Know Your Customer) or document verification service, that service may return a verification status and associated identity summary to xbej.
• Anti-fraud and risk systems: Automated systems may cross-reference data points to detect patterns associated with fraudulent activity, multi-accounting, or money laundering.
• Public sources: In limited circumstances related to fraud prevention or legal compliance, xbej may consult publicly available information such as sanctions lists or court records.

xbej does not purchase or receive personal data from marketing data brokers or unaffiliated third-party list providers.

xbej processes personal data only where a valid legal basis exists. The applicable legal bases for the principal processing activities carried out by xbej are as follows:

• Contract performance: Processing necessary to register your account, authenticate your identity, process deposits and withdrawals, settle bets, deliver gaming services, and provide customer support. Without this processing, xbej cannot provide the services you have requested.
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, Know Your Customer (KYC) obligations, fraud prevention duties, and any other applicable legal or regulatory requirements including cooperation with law enforcement authorities.
• Legitimate interests: Processing carried out in pursuit of xbej's legitimate business interests, including platform security monitoring, fraud detection, responsible gaming compliance, product improvement, and internal analytics — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes where you have given explicit, informed consent — principally the sending of personalised promotional communications by email or SMS. You may withdraw consent at any time by contacting support or updating your account communication preferences.

Where xbej relies on legitimate interests as a legal basis, a balancing assessment is conducted to ensure that the processing is proportionate and does not unjustifiably override the interests or rights of the data subjects concerned.

xbej uses the personal data it collects for the following purposes:

• Account creation and management: To register your account, authenticate your identity at login, maintain your account profile, and process any account changes you request.
• Service delivery: To process your bets, credit winnings, apply bonuses, run game sessions, and provide you with access to all features of the xbej platform.
• Financial transactions: To process deposits via bKash, Nagad, Rocket, Upay, Visa, Mastercard and supported bank transfers, and to process withdrawal requests to your verified payment method.
• Identity and age verification: To confirm that you meet the 21+ age requirement and that your identity matches the registration information provided, as required for KYC compliance.
• Fraud prevention and security: To detect and investigate suspected fraud, multi-accounting, money laundering, collusion, and other prohibited conduct as defined in the xbej Terms & Conditions.
• Responsible gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, to apply self-exclusions and deposit limits requested by users, and to comply with responsible gaming obligations.
• Customer support: To respond to your enquiries, resolve complaints, and maintain records of support interactions for quality assurance and dispute resolution purposes.
• Promotional communications: Where you have consented, to send you personalised offers, bonus notifications, and promotions relating to cricket betting, live casino, slots, and seasonal events such as BPL, Eid, Pohela Boishakh and T20 World Cup.
• Platform improvement: To analyse aggregated usage data in order to improve the design, performance and content of the xbej platform, and to inform decisions about new features and product categories.
• Legal compliance: To fulfil xbej's obligations under applicable law, including responding to requests from regulatory or law enforcement authorities.

xbej does not use your personal data to make fully automated decisions that produce legal or similarly significant effects without human oversight, except in cases of automated fraud detection where immediate account restriction is required to prevent harm — in such cases, you have the right to request human review.

xbej does not sell, rent or trade your personal data to third parties for their own commercial purposes. xbej may share your personal data with third parties only in the following circumstances, and only to the extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa network processors, Mastercard network processors, and supported Bangladeshi banks (including Dutch-Bangla Bank, BRAC Bank) — to facilitate deposits and withdrawals.
• Identity verification services: Third-party KYC/AML verification providers used to confirm user identity, age and document authenticity.
• Game content providers: Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe, and other gaming studios whose content is integrated into the xbej platform — these providers may receive session-level technical data required to operate their games.
• Fraud prevention and security vendors: Specialist providers of fraud scoring, device fingerprinting, and risk assessment services engaged to protect the integrity of the platform.
• IT infrastructure providers: Cloud hosting, content delivery network, and database service providers who store and process data on behalf of xbej under appropriate data processing agreements.
• Legal and regulatory authorities: Government agencies, law enforcement authorities, regulatory bodies, or courts, where xbej is required by applicable law to disclose personal data, or where disclosure is necessary to establish, exercise or defend a legal claim.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of all or part of xbej's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third-party service providers with whom xbej shares personal data are required to process such data only on xbej's documented instructions and to maintain appropriate technical and organisational security measures. xbej does not permit third-party service providers to use personal data for their own unrelated purposes.

xbej uses cookies and similar tracking technologies on the xbej.io website to support platform functionality, improve user experience, and gather analytical information about how the platform is used. The categories of cookies used by xbej are as follows:

Most web browsers are configured to accept cookies by default. You may configure your browser to refuse cookies or to alert you when cookies are being set; however, disabling strictly necessary or security cookies will impair your ability to log in and use the xbej platform.

xbej does not use cross-site tracking cookies or third-party advertising cookies to track your activity across unrelated websites.

xbej retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of the account relationship, plus a minimum of five (5) years following account closure, to comply with AML record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, or longer where required by applicable financial regulations.
• Identity verification documents: Retained for a minimum of five (5) years following account closure. Where a user is identified as presenting a money laundering or fraud risk, documents may be retained for a longer period as permitted by law.
• Customer support records: Retained for three (3) years from the date of the relevant interaction, or longer where the interaction relates to an open dispute or legal claim.
• Marketing consent records: Retained for the duration of the consent, plus three (3) years following withdrawal of consent, to demonstrate compliance with consent obligations.
• Technical and usage logs: Retained for a maximum of thirteen (13) months from collection, after which they are aggregated and anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Where anonymisation is applied, the resulting aggregated data may be retained indefinitely for statistical purposes.

Users who request deletion of their personal data prior to the expiry of a mandatory retention period will be informed of the specific legal basis that prevents immediate deletion, and the data will be restricted from active use pending the expiry of that retention obligation.

xbej implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser and xbej.io is encrypted using TLS 1.2 or higher (SSL encryption). This applies to all pages, account management functions, and financial transaction flows.
• Encryption at rest: Sensitive personal data fields stored in xbej's databases — including identity data, financial account references, and verification documents — are encrypted at rest using AES-256 encryption or equivalent.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Platform staff are granted only the minimum level of access necessary to perform their job functions. All access is logged and subject to regular audit review.
• Two-factor authentication: xbej's internal administration systems require multi-factor authentication. Users are also encouraged to enable SMS-based two-step verification on their own accounts.
• Intrusion detection: Network and application-level monitoring systems are in place to detect and respond to potential security incidents in real time.
• Penetration testing: xbej conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Staff training: All xbej personnel with access to personal data receive regular data protection and information security training.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected users, xbej will take appropriate remedial action and will notify affected users without undue delay where required by applicable law.

While xbej employs robust security measures, no system is completely immune to security incidents. Users play an important role in account security by using a strong, unique password and enabling two-step verification. If you suspect your account has been compromised, contact support immediately at [email protected].

As a user of the xbej platform, you hold the following rights in relation to your personal data. xbej will respond to requests to exercise these rights within a reasonable timeframe and in any event within 30 calendar days of receipt, unless an extension is required due to the complexity or volume of the request, in which case you will be notified.

• Right of access: You have the right to request a copy of the personal data that xbej holds about you, together with information about how it is being processed.
• Right to rectification: If any personal data held by xbej is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account details directly through your account dashboard at any time.
• Right to erasure: In certain circumstances, you have the right to request that xbej delete your personal data. This right is subject to overriding legal retention obligations, particularly in respect of AML and financial record-keeping requirements as described in Section 8.
• Right to restriction of processing: You may request that xbej restrict the active processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or pending the outcome of an objection.
• Right to data portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you may request that xbej provide your personal data in a structured, commonly used and machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of xbej's legitimate interests. xbej will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where xbej processes your data on the basis of your consent (principally for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact xbej support at [email protected], clearly stating the right you wish to exercise and providing sufficient detail to allow xbej to identify your account and process your request. xbej may request evidence of identity before actioning a rights request.

The xbej platform is strictly for individuals aged 21 years and above. xbej does not knowingly collect personal data from anyone under the age of 21.

Age verification is a mandatory step in the xbej registration process. Users are required to confirm their date of birth at registration, and xbej conducts document-based age verification before any withdrawal is processed. Where xbej has reasonable grounds to suspect that a registered user may be under the age of 21, the account will be suspended pending verification. If it is confirmed that the account holder is under 21, the account will be permanently closed, any deposited funds will be returned to the original payment source, and no winnings will be paid.

If you are a parent or guardian and believe that a person under the age of 21 has accessed or registered on the xbej platform using your device or payment details, please contact xbej support immediately at [email protected]. xbej will investigate and take appropriate action without delay.

For parents and guardians seeking to prevent access to online gambling platforms, xbej recommends the use of third-party parental control and internet filtering software. xbej support can provide information on commonly used tools upon request.

The xbej platform integrates game content and technical services from a number of third-party providers. These include game studios such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming and Spribe, as well as payment processors, identity verification services, and infrastructure providers.

When you interact with third-party game content embedded within the xbej platform, a limited set of technical data (such as your session identifier, game round ID, and bet amount) may be transmitted to the relevant game provider in order to operate the game correctly. This data sharing is governed by data processing agreements between xbej and each provider.

xbej.io may contain informational links to other pages within the xbej platform. xbej is not responsible for the privacy practices of any external websites that you may navigate to independently. This Privacy Policy applies exclusively to the xbej.io platform.

Payment method providers — including bKash, Nagad, Rocket, Upay, Visa and Mastercard — operate under their own privacy policies in respect of transaction data processed through their systems. xbej recommends that users review the privacy policies of their chosen payment providers for full details of how those providers handle financial data.

xbej reserves the right to update or revise this Privacy Policy at any time. When material changes are made — that is, changes that meaningfully affect how your personal data is collected, used or shared — xbej will notify registered users by email and/or by displaying a prominent notice on the platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. For non-material or administrative changes (such as corrections to formatting, clarifications that do not alter the substance of any provision, or updates to contact details), xbej may update this policy without providing advance notice beyond the updated date at the top of the document.

Your continued use of the xbej platform following the publication of a revised Privacy Policy constitutes your acknowledgement that you have reviewed the updated terms. If you do not agree to the revised policy, you must discontinue use of the platform and may request account closure by contacting support.

Previous versions of this Privacy Policy are available upon request by contacting [email protected].

If you have any questions, concerns or requests relating to this Privacy Policy or to xbej's handling of your personal data, please contact the xbej data protection team using the following details:

• Support Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the xbej platform
• Average Response Time: 2–5 minutes via live chat; email responses within 48 hours
• Support Hours: 24/7 including Bangladesh public holidays

When contacting xbej regarding a data privacy matter, please include your registered account username or email address, a clear description of your query or request, and — where applicable — the specific right you wish to exercise. This will help xbej process your request accurately and promptly.

All privacy-related communications between xbej and its users will be conducted in English. xbej aims to provide a substantive response to all privacy requests within 14 calendar days, and in any event within 30 calendar days.