Privacy Policy — How nabaje Protects Your Data

Introduction

nabaje is committed to protecting the privacy and personal data of everyone who interacts with its platform. This Privacy Policy has been prepared in accordance with recognised data protection principles and is intended to give you a clear, honest account of our data practices — without the impenetrable legal language that makes most privacy documents unreadable.

We collect personal data because it is operationally necessary to deliver a safe, compliant, and personalised gaming experience to players across Bangladesh. We do not collect data out of habit or for speculative future use. Every data category described in this policy exists because it serves a specific, defined purpose that we could not fulfil without it.

If you have questions about any aspect of this Privacy Policy that is not answered below, or if you wish to exercise your data rights, please contact our dedicated privacy support address at [email protected]. We will respond to all privacy-related queries within five business days of receipt.

Data We Collect

nabaje collects the following categories of personal data in connection with the registration, operation, and maintenance of Player Accounts:

We do not intentionally collect sensitive personal data categories such as health information, biometric data, political opinions, or religious beliefs. If you voluntarily disclose any such information in the course of a support interaction, it will be used solely to address your query and will not be retained beyond the resolution of that query.

How We Collect Data

nabaje collects personal data through the following channels:

• Direct provision by you: Information you enter during account registration, identity verification, deposit or withdrawal requests, support communications, or when completing any form or survey on the Platform.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, server logs, and similar tracking technologies as described in Section 7.
• Third-party sources: Identity verification data returned by our KYC service providers following document checks; fraud risk signals supplied by payment processing partners; and device reputation data from security intelligence services used to protect the Platform against fraudulent access.
• Payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard, and other supported payment partners following deposit or withdrawal processing.

In all cases, the data collected is proportionate to the purpose for which it is collected. nabaje does not purchase personal data from data brokers or aggregate consumer profiling services.

Legal Basis for Processing

Every instance of personal data processing carried out by nabaje rests on one of the following legal bases:

• Contractual necessity: Processing required to register your account, verify your identity, process deposits and withdrawals, and deliver the core services described in the nabaje Terms & Conditions. Without this processing, nabaje could not provide its services to you.
• Legal obligation: Processing required to comply with applicable anti-money-laundering obligations, know-your-customer requirements, age verification mandates, fraud investigation requirements, and any lawful regulatory or law enforcement request.
• Legitimate interests: Processing carried out in the legitimate interests of nabaje or of third parties, provided those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, platform security monitoring, service quality improvement, and internal analytics used to optimise the Player experience.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in the context of optional marketing communications. Where consent is the legal basis, you may withdraw it at any time by contacting [email protected] or by updating your communication preferences within your Account settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

How We Use Your Data

nabaje uses the personal data it collects for the following specific purposes:

• Account management: Creating, maintaining, and closing Player Accounts; authenticating logins; processing password resets; and delivering account notifications.
• Identity and age verification: Confirming that you meet the minimum age requirement of 18 years and that your identity matches the information provided at registration, in accordance with our KYC obligations.
• Transaction processing: Handling deposits, withdrawals, bonus credits, and all other financial transactions associated with your Account in Bangladeshi Taka (BDT, ৳).
• Fraud prevention and security: Monitoring Account activity for signs of unauthorised access, suspicious transaction patterns, multi-accounting, bonus abuse, money laundering, and other fraudulent or criminal conduct.
• Responsible gaming: Monitoring your gaming activity over time to identify patterns that may indicate problem gambling behaviour, and applying deposit limits, cooling-off periods, or self-exclusion restrictions where appropriate or requested.
• Customer support: Investigating and resolving Account queries, complaints, disputes, and technical issues reported to our support team.
• Service improvement: Analysing anonymised usage data in aggregate to understand how Players navigate the Platform and to prioritise improvements to game selection, interface usability, and payment processing speed.
• Marketing communications: Sending you information about nabaje promotions, seasonal offers (such as Eid or Pohela Boishakh bonuses), and new game launches — but only where you have opted in to receive such communications.
• Legal compliance: Retaining records required by applicable law, responding to lawful regulatory and law enforcement requests, and maintaining audit trails for financial transactions.

Data Sharing & Disclosure

nabaje does not sell your personal data. We may share your personal data with third parties only in the following circumstances and only to the extent strictly necessary for the stated purpose:

• Identity verification providers: Third-party KYC and document verification services used to confirm identity and age. These providers process identity documents and biometric checks on our behalf under strict contractual data protection obligations.
• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard, and other payment partners receive the financial data necessary to process deposit and withdrawal transactions.
• Game studios: Licensed game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymised player identifier necessary to deliver game content and record game results. Game studios do not receive your full name, address, or payment details.
• Fraud prevention and security services: Third-party services that provide device fingerprinting, IP reputation analysis, and fraud risk scoring to help us protect the Platform and its Players from criminal activity.
• Legal and regulatory authorities: Where nabaje is required by applicable law, court order, or lawful regulatory instruction to disclose personal data, we will comply. Where legally permitted, we will notify you of such a disclosure request before complying.
• Business transfers: In the event of a merger, acquisition, or sale of all or a material part of nabaje's business assets, Player data may be transferred as part of that transaction. We will notify affected Players in advance of any such transfer and ensure that the receiving entity commits to privacy standards no less protective than those described in this policy.

All third-party service providers with whom nabaje shares personal data are required to maintain the confidentiality of that data and to process it only in accordance with our instructions and their contractual obligations to nabaje.

Cookies & Tracking Technologies

nabaje uses cookies and similar client-side technologies to maintain session continuity, deliver core Platform functionality, and collect anonymous usage analytics. The following categories of cookies are used on the Platform:

nabaje does not use advertising cookies, cross-site tracking pixels, or third-party behavioural profiling networks. You may configure your browser to block or delete cookies at any time; however, disabling strictly necessary cookies may impair the functionality of the Platform, including the ability to maintain a logged-in session.

Data Retention

nabaje retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account data: Retained for the duration of your relationship with nabaje and for a period of five years following permanent account closure, in order to satisfy anti-money-laundering record-keeping requirements and to resolve any post-closure disputes.
• Transaction records: Financial transaction logs are retained for a minimum of five years from the date of the transaction, consistent with standard financial record-keeping obligations.
• Identity verification documents: Copies of KYC documents are retained for five years from the date of verification or from the date of account closure, whichever is later.
• Support communications: Customer support tickets, email correspondence, and live chat transcripts are retained for three years from the date of the final communication in the thread.
• Marketing consent records: Records of your opt-in and opt-out decisions regarding marketing communications are retained for the lifetime of your Account and for two years following account closure, to demonstrate compliance with consent obligations.
• Technical and usage data: Server logs and anonymised analytics data are retained for up to twelve months, after which they are either deleted or permanently anonymised.

When personal data is no longer required for any lawful purpose, it is securely deleted or permanently anonymised so that it can no longer be attributed to an identifiable individual.

Data Security

nabaje takes the security of your personal data seriously and maintains a range of technical and organisational measures designed to protect it against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• SSL/TLS encryption for all data transmitted between your device and the nabaje Platform;
• Encryption at rest for stored personal data and financial records;
• Role-based access controls ensuring that internal access to personal data is limited to staff members with a documented operational need;
• Regular security assessments and vulnerability testing of Platform infrastructure;
• Two-factor authentication options available to Players for additional Account protection;
• Continuous monitoring for signs of unauthorised access or data exfiltration;
• Staff training on data protection obligations and secure data handling procedures.

While nabaje applies robust security measures, no internet-based platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, nabaje will notify you promptly and take all reasonable steps to mitigate the impact of the breach.

Your Rights

As a data subject, you hold the following rights in relation to the personal data that nabaje holds about you. These rights may be exercised at any time by submitting a written request to [email protected]:

• Right of access: You have the right to request a copy of the personal data that nabaje holds about you, together with information about how that data is used and with whom it has been shared.
• Right to rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. Where a correction affects the KYC status of your Account, additional verification may be required before the correction can be applied.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other lawful basis for processing, or where you have objected to processing and there are no overriding legitimate grounds. This right is subject to legal retention obligations that may require nabaje to retain certain data for a minimum period.
• Right to restrict processing: You have the right to request that processing of your personal data be restricted in certain circumstances — for example, while you contest the accuracy of data or while an objection is pending review.
• Right to data portability: You have the right to receive personal data you have provided to nabaje in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another data controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data on the basis of legitimate interests or for direct marketing purposes. Where you object to direct marketing, your preferences will be updated immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

nabaje will acknowledge all data rights requests within two business days and will respond substantively within thirty calendar days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by a further thirty days, and you will be notified of the extension in advance.

No fee is charged for exercising your data rights in normal circumstances. Where requests are manifestly unfounded or excessive, nabaje reserves the right to charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

Children's Privacy

The nabaje Platform is strictly intended for adults aged 18 years and above. 18+ nabaje does not knowingly collect personal data from individuals under the age of 18. If you are the parent or guardian of a minor and you believe that the minor has provided personal data to nabaje, please contact us immediately at [email protected]. Upon verification, we will delete any data relating to the minor and close the associated Account without delay.

nabaje operates robust age verification procedures at the point of registration and at the point of withdrawal to minimise the risk of underage access. Any Player found to be under the age of 18 will have their Account immediately suspended, their data processed solely for the purposes of the ongoing investigation, and all relevant records retained for legal compliance purposes before being deleted in accordance with the retention schedule set out in Section 8.

Third-Party Links

The nabaje Platform may contain references to third-party game studios and payment providers. While nabaje endeavours to partner only with reputable organisations, we do not control the privacy practices of third-party entities and this Privacy Policy does not extend to any third-party service, website, or platform that you may access in connection with using nabaje.

We encourage you to review the privacy policies of any third-party services you interact with — particularly the payment providers and game studios whose services are accessible through the Platform. nabaje bears no responsibility for the data practices of third parties operating independently of the nabaje Platform.

Policy Amendments

nabaje reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the structure of our services. Where amendments are material — for example, where they affect how your data is shared or introduce new processing purposes — we will notify you by email to your registered address and display a prominent notice on the Platform before the changes take effect.

The effective date at the top of this policy will be updated each time a revision is published. We encourage you to review this page periodically. Your continued use of the Platform following the effective date of an amendment constitutes your acknowledgement of the revised policy. If you do not agree with an amendment, you should contact [email protected] to discuss your options, including account closure.

Contact & Complaints

If you have any questions, concerns, or complaints relating to this Privacy Policy or to the way nabaje handles your personal data, please contact our privacy support team using the details below:

• Email: [email protected]
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)
• Website: https://nabaje.biz

Please include your registered username and a clear description of your query or complaint in all privacy-related correspondence. We aim to acknowledge all privacy queries within two business days and resolve them within thirty calendar days.