Your Privacy Matters
at jebaje

Information We Collect

jebaje collects personal data from you through several channels: directly through account registration and platform use, automatically through technical systems as you browse and play, and from third-party service providers involved in identity verification and payment processing. The categories of data we collect are set out below.

1.1 Registration & Account Data

• Full legal name — required for identity verification and account ownership confirmation.
• Date of birth — required to verify that you meet the 18+ age restriction applicable to all jebaje players.
• Residential address — including district, city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or other), and postcode where applicable.
• Email address — used for account communications, transactional notifications, and promotional messages where consent has been given.
• Mobile phone number — used for account security (two-factor authentication), and in some cases as your primary bKash, Nagad, or Rocket payment identifier.
• Username and encrypted password — your jebaje Login credentials. Passwords are never stored in plain text.

1.2 Identity Verification Documents

Where automated age and identity verification checks are inconclusive, jebaje may request copies of one or more of the following documents: National Identity Card (NID), Bangladesh passport, driving licence, or other government-issued photo identification. These documents are processed solely for the purpose of identity and age verification and are handled in accordance with Section 6 (Data Retention) of this Policy.

1.3 Financial Transaction Data

• bKash, Nagad, Rocket, or Upay mobile account numbers used for deposits and withdrawals.
• Bank account details (account number, bank name) for players using Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank transfers.
• Deposit and withdrawal amounts, dates, and transaction reference numbers.
• Source-of-funds documentation where requested for anti-money-laundering compliance purposes.

1.4 Gaming Activity Data

jebaje automatically records data about your gambling activity on the platform, including game sessions played, bets placed and their outcomes, sports betting markets accessed (such as BPL cricket, IPL, T20 World Cup, and football fixtures), bonus claims and wagering activity, and responsible gaming tool settings you have applied to your account.

1.5 Technical & Device Data

• IP address and approximate geographic location at the time of login and transaction.
• Device type, operating system, and browser version.
• Session timestamps, page views, navigation paths, and feature interactions on the jebaje platform.
• Cookie identifiers and similar tracking technologies as described in Section 4 of this Policy.

1.6 Communications Data

When you contact jebaje support via live chat, email (support at jebaje.com), or WhatsApp, the content of those communications is retained for customer service quality assurance, dispute resolution, and regulatory compliance purposes.

How We Use Your Data

jebaje uses the personal data it collects for the following specific, defined purposes. We do not use your data for any purpose beyond those listed below without first obtaining your explicit consent or being required to do so by applicable law.

Where jebaje relies on your consent as the legal basis for processing (for example, sending promotional emails about BPL cricket betting offers, Eid bonus campaigns, or Pohela Boishakh promotions), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To unsubscribe from promotional communications, use the unsubscribe link in any jebaje promotional email or contact support at jebaje.com.

Legal Basis for Processing

jebaje processes your personal data on the following legal bases, each of which is applied to specific processing activities as indicated in the table in Section 2 above.

• Contractual necessity: Processing is necessary to perform the contract between you and jebaje — that is, to provide you with the gambling and betting services you have registered to access. Without this processing, jebaje cannot create your account, accept deposits, or process withdrawals.
• Legal obligation: Processing is necessary for jebaje to comply with its legal obligations, including age verification, anti-money-laundering checks, responsible gaming requirements, and reporting obligations to relevant authorities.
• Legitimate interests: Processing is necessary for the purposes of jebaje's legitimate interests in operating a secure, fair, and commercially sustainable platform — for example, fraud prevention, platform security monitoring, and anonymised analytics to improve user experience. jebaje has assessed that in each case where legitimate interest is relied upon, the processing does not override your fundamental privacy rights.
• Consent: Processing is based on your freely given, informed consent — specifically for the sending of marketing and promotional communications. Consent is requested at registration and can be withdrawn at any time without affecting your ability to use the jebaje platform.

Cookies & Tracking Technologies

jebaje uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies allow jebaje to recognise returning users, maintain session state, prevent fraud, and analyse how the platform is being used.

Types of Cookies Used by jebaje

Strictly necessary cookies cannot be disabled because they are essential to the functioning of the jebaje platform. All other cookie categories can be managed through your browser settings. Most modern browsers allow you to block or delete cookies through their privacy or settings menus. Disabling functional or analytics cookies will not prevent you from using the jebaje platform, but some features (such as saved account preferences) may not work as expected.

jebaje does not use third-party advertising cookies or behavioural advertising tracking cookies. No data collected via jebaje cookies is shared with advertising networks or social media platforms for targeted advertising purposes.

Data Sharing & Third Parties

jebaje does not sell your personal data. We share your data with third parties only where it is necessary to provide the jebaje service, comply with legal obligations, or protect the security and integrity of the platform. The categories of third parties with whom jebaje may share your data are described below.

• Identity verification providers: jebaje works with specialist KYC (Know Your Customer) service providers to perform automated age and identity verification checks. These providers process your name, date of birth, and identity document data solely for verification purposes on jebaje's behalf and are bound by strict data processing agreements.
• Payment processors and MFS operators: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a Bangladeshi bank, the minimum necessary payment data is shared with the relevant payment processor to execute the transaction. jebaje does not retain full payment account credentials beyond what is required for transaction processing and AML records.
• Game software providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token or anonymised player identifier to initialise game sessions. They do not receive your full personal profile, financial data, or payment details.
• Fraud prevention and security providers: jebaje uses third-party security tools for device fingerprinting, IP analysis, and suspicious transaction detection. These tools process technical and behavioural data on jebaje's behalf under data processing agreements that prohibit independent use of your data.
• Legal and regulatory authorities: jebaje may be required to disclose personal data to law enforcement agencies, financial intelligence units, or other governmental bodies where required by applicable law. jebaje will comply with all legally valid disclosure requests and, where permitted to do so, will inform the affected account holder of any such disclosure.
• Professional advisers: jebaje's legal counsel, auditors, and compliance consultants may access account data on a strictly need-to-know basis where required to provide professional services to jebaje. All such advisers are bound by confidentiality obligations.

Data Retention & Storage

jebaje retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected or to comply with applicable legal obligations. The table below sets out jebaje's standard retention periods by data category.

At the end of the applicable retention period, personal data is securely deleted from jebaje's active systems or, where immediate deletion is not technically feasible (for example, data held in encrypted backup archives), the data is anonymised so that it can no longer be linked to any identifiable individual.

Personal data held on account closure is retained primarily to comply with anti-money-laundering regulations and to enable jebaje to respond to any legal claims arising from a player's use of the platform. jebaje does not use post-closure data for marketing purposes.

Your Rights & Choices

As a jebaje player, you have the following rights in relation to your personal data. jebaje is committed to honouring all valid data rights requests promptly and without creating unnecessary barriers to exercising those rights.

• Right of access: You have the right to request a copy of all personal data that jebaje holds about you, along with information about the purposes for which it is processed, the categories involved, and who it has been shared with. jebaje will respond to access requests within 30 days.
• Right to rectification: If any personal data jebaje holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update most account data directly from within your jebaje account profile. For data that cannot be self-corrected (such as identity verification records), contact support at jebaje.com.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where jebaje has no legitimate overriding interest in retaining it. This right is subject to jebaje's legal data retention obligations — data that must be retained for AML, KYC, or financial records purposes cannot be deleted prior to the applicable retention period expiring.
• Right to restriction of processing: You may request that jebaje restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where processing is unlawful but you prefer restriction over deletion. During a restriction period, jebaje may store your data but will not actively process it beyond what is legally required.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another service provider. To request a portable data export, contact support at jebaje.com.
• Right to object: You have the right to object at any time to the processing of your personal data where jebaje relies on legitimate interest as the legal basis for that processing. You also have the right to object to processing for direct marketing purposes at any time, with no need to provide justification.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. See Section 3 for withdrawal instructions.

How to Submit a Data Rights Request

To exercise any of the rights listed above, contact the jebaje privacy team at support at jebaje.com. Please include your registered account username and a clear description of your request. jebaje will acknowledge your request within 5 Bangladesh business days (Bangladesh Standard Time, UTC+6) and will provide a substantive response within 30 calendar days. In cases of complex or multiple requests, jebaje may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it.

jebaje may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to or altered by an unauthorised party. Identity verification for data rights requests will not require you to submit more information than is reasonably necessary.

Security Measures

jebaje implements a multi-layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. The following technical and organisational measures are applied across the jebaje platform and its supporting infrastructure.

• TLS/SSL encryption: All data transmitted between your browser or device and the jebaje platform is encrypted using Transport Layer Security (TLS 1.2 or higher). This ensures that your jebaje Login credentials, payment data, and personal information cannot be intercepted in transit.
• Password hashing: Account passwords are never stored in plain text. jebaje uses industry-standard cryptographic hashing (bcrypt) with per-account salting to ensure that even in the event of a data breach, your password cannot be recovered from stored data.
• Two-factor authentication: jebaje supports two-factor authentication (2FA) for account login. Players are strongly encouraged to enable 2FA via their account security settings to provide an additional layer of protection beyond the jebaje Login password alone.
• Access controls: Internal access to jebaje player data is restricted on a strict need-to-know basis. jebaje staff and third-party service providers are granted only the minimum level of access required to perform their specific function. All internal data access is logged and audited.
• Secure server infrastructure: jebaje's platform and player data are hosted on dedicated secure servers with physical access controls, network firewalls, intrusion detection systems, and regular independent security audits.
• Session management: jebaje enforces automatic session timeouts after periods of inactivity and limits the number of concurrent active sessions per account. Suspicious login events (for example, logins from unrecognised devices or locations) trigger additional verification steps.
• Fraud and anomaly detection: Automated systems monitor account activity in real time for patterns indicative of account compromise, payment fraud, or multi-accounting. Flagged activity triggers an immediate security review and, where appropriate, temporary account suspension pending investigation.

Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, jebaje will take immediate steps to contain the breach, assess its scope and impact, and notify affected players as quickly as practicable. Notifications will be sent to the email address registered on your jebaje account and will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures jebaje is taking to address it.

While jebaje applies robust security measures across the platform, no digital system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own jebaje Login credentials and for using strong, unique passwords. If you suspect that your account has been compromised, contact jebaje support immediately at support at jebaje.com.

Children & Minors

jebaje is an 18+ platform. The jebaje platform is strictly intended for adults aged 18 years and above. jebaje does not knowingly collect personal data from individuals under the age of 18. Age verification is a mandatory step in the jebaje account registration process, and jebaje reserves the right to request documentary proof of age at any point during a player's use of the platform.

If you are the parent or guardian of a minor and believe that your child has registered a jebaje account or provided personal data to jebaje, please contact us immediately at support at jebaje.com. jebaje will investigate the matter promptly and take all necessary steps to close the account, return any funds, and delete the minor's personal data in accordance with this Policy.

jebaje recommends that parents and guardians use parental control software and device-level access restrictions to prevent underage individuals from accessing online gambling platforms. Bangladesh-based filtering tools and network-level parental controls provided by local internet service providers can be effective in preventing unauthorised access by minors.

Policy Updates & Contact

Updates to This Privacy Policy

jebaje reviews this Privacy Policy periodically and updates it when required — for example, in response to changes in applicable law, changes to jebaje's data processing practices, or the introduction of new platform features that involve the collection or use of personal data in a new way.

When material changes are made to this Policy — meaning changes that affect your privacy rights or the way jebaje processes your personal data in a substantively different manner — jebaje will notify registered players by email at least 14 days before the updated Policy takes effect. The updated Policy will also be published at jebaje.com/privacy-policy with an updated effective date displayed at the top of the page.

Minor changes such as typographical corrections, formatting updates, and clarifications that do not alter the substance of this Policy may be published without advance notice. Continued use of the jebaje platform after a revised Privacy Policy takes effect constitutes your acceptance of the updated Policy.

The version of this Policy that was in effect at the time any particular data processing activity took place governs that activity. jebaje maintains an archive of prior Policy versions which can be provided on request.

How to Contact jebaje About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or jebaje's data processing practices, please contact the jebaje privacy and data protection team using any of the following channels:

• Email: support at jebaje.com — please include "Privacy Request" or "Data Rights" in the subject line so your message is routed to the appropriate team member.
• Live Chat: Available 24/7 directly on the jebaje platform. Access live chat after completing jebaje Login on the platform dashboard.
• WhatsApp: Available via the account dashboard. WhatsApp contact details are provided to registered players after account verification.

jebaje aims to respond to all privacy-related enquiries within one Bangladesh business day (BST, UTC+6). For formal data rights requests (access, deletion, portability), the 30-day response window described in Section 7 applies.