mbajee Privacy Policy
How We Protect Your Data

mbajee operates as an online gaming and sports betting entertainment platform serving players primarily based in Bangladesh. This Policy applies to all personal data collected through any interaction with the mbajee platform, including the mbajee.biz website, any associated mobile-optimised interfaces, customer support communications, and promotional campaigns operated by mbajee.

This Policy should be read alongside the mbajee Terms & Conditions and the Responsible Gaming Policy, both of which incorporate this Privacy Policy by reference. In the event of any conflict between this Policy and any other mbajee document regarding the treatment of personal data, this Privacy Policy shall take precedence.

mbajee takes its obligations regarding personal data protection seriously. We apply industry-standard technical and organisational measures to protect player data against unauthorised access, accidental loss, destruction, or disclosure. We do not sell personal data to third parties for their own independent marketing purposes, and we collect only the data that is genuinely necessary to operate the platform safely and fairly.

mbajee collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and in limited circumstances from third-party verification and payment service providers. The categories of data we collect are described in the table below.

mbajee does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data (other than responsible gaming self-assessments submitted voluntarily by the player), or biometric identifiers. Where a responsible gaming self-assessment is submitted, it is treated with the highest level of confidentiality and used solely to provide appropriate player support.

mbajee uses the personal data it collects for specific, clearly defined purposes. We do not use personal data for any purpose that is incompatible with the purposes described in this Policy without first obtaining your explicit consent or being required to do so by applicable law. The primary purposes for which mbajee processes personal data are as follows:

• Account Creation and Management: To register your account, verify your identity, maintain your account settings, and provide you with access to the mbajee platform's features.
• Transaction Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard; to maintain accurate financial records; and to resolve any payment disputes.
• Identity Verification (KYC): To verify that you are who you claim to be, that you meet the 18+ age requirement, and that your payment methods are registered in your own name, as required by our anti-fraud and anti-money laundering obligations.
• Platform Operations: To deliver the gaming and sports betting services you have requested, to personalise your platform experience, and to ensure that game outcomes and wager settlements are processed accurately.
• Responsible Gaming: To monitor account activity for signs of problematic gambling behaviour, to enforce deposit limits and self-exclusion preferences you have set, and to contact you if our responsible gaming systems flag a concern.
• Fraud Prevention and Security: To detect and prevent fraud, money laundering, account sharing, bot activity, and other forms of misuse of the mbajee platform. Technical data including IP addresses and device fingerprints is used for this purpose.
• Legal and Regulatory Compliance: To meet any obligations imposed by applicable law, including responding to lawful requests from law enforcement or financial regulatory authorities.
• Customer Support: To respond to your queries, resolve complaints, and maintain a record of support interactions for quality assurance and training purposes.
• Marketing Communications (with consent): Where you have explicitly opted in, to send you promotional emails or SMS messages about mbajee bonuses, new games, and seasonal offers such as those tied to BPL, IPL, Eid, or Pohela Boishakh promotions. You may withdraw this consent at any time through your account settings or by contacting [email protected].

mbajee will not use your personal data to make solely automated decisions that produce significant legal or similarly significant effects on you without providing a mechanism for human review. Where automated systems flag a potential concern (for example, a fraud detection alert), a member of the mbajee compliance team will review the matter before any account action is taken.

mbajee processes personal data only where a valid legal basis exists for doing so. The legal bases on which mbajee relies are as follows:

1. Contractual Necessity: The majority of data processing described in this Policy is necessary to perform the contract between you and mbajee — namely, to operate your account, process your transactions, and deliver the gaming services you have requested. Without this processing, mbajee cannot provide the platform to you.
2. Legal Obligation: Certain processing activities — particularly identity verification (KYC), anti-money laundering monitoring, and record-keeping of financial transactions — are required by law. mbajee is obligated to perform these activities regardless of your preferences.
3. Legitimate Interests: mbajee processes some data on the basis of its legitimate business interests, where those interests are not overridden by your data protection rights. This includes fraud prevention, platform security, internal analytics to improve the service, and responsible gaming monitoring. mbajee conducts a balancing assessment before relying on this basis to ensure that the processing is proportionate and that your interests are adequately protected.
4. Consent: Where mbajee relies on consent as a legal basis — most notably for sending marketing communications — that consent is obtained through a clear, affirmative opt-in mechanism. You have the right to withdraw consent at any time, and withdrawal will not affect the lawfulness of processing that occurred before the withdrawal.

mbajee does not sell, rent, or trade your personal data to unaffiliated third parties for their own independent commercial purposes. However, mbajee does share personal data with carefully selected third-party service providers and, where legally required, with authorities. All third parties with whom mbajee shares personal data are contractually obligated to process that data only for the purposes specified by mbajee and to apply appropriate security standards.

The categories of third parties with whom mbajee may share personal data include:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and our bank and card processing partners receive the financial data necessary to process your deposits and withdrawals. These providers operate their own privacy policies and are subject to Bangladesh Bank regulations.
• Identity Verification Partners: Third-party KYC providers may receive identity documents and personal details to conduct verification checks on mbajee's behalf.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Hacksaw Gaming, and Ezugi receive certain technical and account data necessary to deliver their games within the mbajee platform. These providers are licensed gaming companies operating under their own regulatory frameworks.
• Hosting and Infrastructure Providers: Cloud hosting and CDN providers that store and deliver the mbajee platform receive technical data as a necessary part of platform operation.
• Analytics Providers: Aggregated, anonymised or pseudonymised usage data may be shared with analytics partners to help mbajee understand how players use the platform and to improve the service.
• Law Enforcement and Regulatory Authorities: mbajee will disclose personal data to police, financial intelligence units, courts, or other competent authorities where required to do so by law, or where mbajee reasonably believes disclosure is necessary to prevent fraud, financial crime, or harm to any person.

mbajee uses cookies and similar tracking technologies on the mbajee.biz website to provide a functional and personalised experience. A cookie is a small text file placed on your device by a website server. Cookies cannot execute code or deliver viruses; they are used solely to store small amounts of data that the website needs to function properly or to recognise returning visitors.

mbajee uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable you to remain logged in to your mbajee account, maintain your session state across pages, and use security features. These cookies cannot be disabled without preventing the platform from working correctly.
• Functional Cookies: These cookies remember your preferences — such as language settings, preferred deposit method, or responsible gaming limit configurations — so that you do not need to re-enter them on every visit.
• Analytics Cookies: These cookies collect anonymised or pseudonymised information about how players interact with the mbajee platform, including which pages are visited most frequently, how long sessions last, and where errors occur. This data is used exclusively to improve the platform.
• Security and Fraud Prevention Cookies: These cookies help mbajee identify and block suspicious or fraudulent activity, including bot traffic, credential stuffing attempts, and account takeover patterns.

mbajee does not use third-party advertising cookies or behavioural retargeting cookies that track your activity across websites outside of mbajee.biz. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the mbajee platform.

mbajee retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods applicable to the main categories of personal data are set out below.

Upon expiry of the applicable retention period, mbajee will securely delete or anonymise personal data so that it can no longer be associated with any identifiable individual. Where data is anonymised rather than deleted, the anonymised data set may be retained indefinitely for statistical and platform improvement purposes.

mbajee applies a layered approach to data security, combining technical controls, organisational procedures, and ongoing monitoring to protect personal data against unauthorised access, disclosure, alteration, or destruction. The key security measures mbajee employs include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the mbajee platform is encrypted using industry-standard SSL/TLS protocols. This protects your login credentials, personal details, and financial data from interception during transit.
• Hashed and Salted Password Storage: mbajee never stores passwords in plain text. All passwords are processed using a strong cryptographic hashing algorithm with individual salts, ensuring that even in the unlikely event of a data breach, passwords cannot be directly recovered from stored values.
• Two-Factor Authentication (2FA): Registered players are encouraged to enable 2FA on their mbajee accounts. 2FA adds a second verification step — typically a one-time code sent to your registered mobile number — before account login is completed, significantly reducing the risk of unauthorised account access.
• Access Controls: Personal data is accessible only to mbajee staff and authorised third-party processors who have a legitimate operational need. Access is granted on a least-privilege basis, and all access to sensitive data is logged for audit purposes.
• Automated Fraud Detection: mbajee's platform employs real-time automated systems that monitor for anomalous account activity, unusual login patterns, and suspicious transaction behaviour. Flagged activity is escalated to the mbajee compliance team for human review.
• Regular Security Reviews: mbajee conducts periodic security assessments of its platform infrastructure, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses before they can be exploited.

As a player whose personal data is processed by mbajee, you have the following rights in relation to your personal data. mbajee will respond to all valid rights requests within a reasonable timeframe, and in any event within 30 days of receipt of a valid request. If a request is complex or we have received a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension.

• Right of Access: You have the right to request a copy of the personal data that mbajee holds about you, together with information about how that data is being processed. This is sometimes referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data mbajee holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay. You may update many details directly through your account dashboard.
• Right to Erasure: In certain circumstances — for example, where data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies — you may request that mbajee delete your personal data. This right is subject to mbajee's legal obligations to retain certain data (see Section 7).
• Right to Restriction of Processing: You may request that mbajee restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing and a determination is pending.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on mbajee's legitimate interests, or to processing for direct marketing purposes. Where you object to direct marketing, mbajee will cease that processing immediately.
• Right to Withdraw Consent: Where mbajee relies on consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, please contact the mbajee support team at [email protected] with the subject line "Data Rights Request" and clearly describe the right you wish to exercise and the data to which your request relates. mbajee may need to verify your identity before processing the request to ensure that data is not disclosed to or amended by unauthorised persons.

Parents and guardians who believe that a person under their care has registered on the mbajee platform or provided personal data to mbajee without authorisation are urged to contact [email protected] immediately. mbajee will treat all such reports with urgency and complete confidentiality.

mbajee supports the use of parental control software to prevent minors from accessing online gambling platforms. We recommend that any household device used by children be protected with appropriate content filtering tools that restrict access to gambling websites.

mbajee reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of the mbajee platform. The "Last Updated" date at the top of this page and in the Table of Contents sidebar will reflect the date of the most recent revision.

Where changes to this Policy are material — meaning they significantly affect your rights or the way in which your data is processed — mbajee will notify registered players via email to the address on file, or by displaying a prominent notification within the platform, no less than 14 days before the changes take effect. For minor revisions such as typographical corrections or clarifications that do not affect the substance of the Policy, mbajee may update the document without advance notice.

We encourage all registered players to review this Privacy Policy periodically to remain informed about how mbajee protects their personal data. Continued use of the mbajee platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which mbajee processes your personal data, please contact the mbajee support team using the details below. All data protection inquiries will be acknowledged within 24 hours and handled with full confidentiality.

For formal legal notices or regulatory correspondence related to data protection matters, please send written communication to [email protected] with the subject line "Legal Notice — Data Protection". mbajee will acknowledge all formal legal correspondence within 2 business days.