fbaja Privacy Policy — How We Handle Your Personal Data

1 Introduction

This Privacy Policy sets out how fbaja ("we", "us", "our") collects, processes, stores, and protects the personal information of individuals ("you", "your", "User") who access or use the fbaja online betting and casino platform available at https://fbaja.io (the "Platform"). fbaja is committed to handling all personal data with care, transparency, and in accordance with applicable data protection principles.

By registering an Account on the fbaja Platform, making a deposit, placing a bet, or otherwise using any feature of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Privacy Policy, you should not create an Account or continue to use the Platform.

This Privacy Policy should be read together with the fbaja Terms & Conditions and any additional promotional or product-specific terms published on the Platform. In the event of any conflict between this Privacy Policy and another document, the more specific document shall prevail in relation to the specific subject matter it covers.

2 Data Controller

For the purposes of this Privacy Policy, fbaja acts as the data controller in respect of all personal information collected through the Platform. As the data controller, fbaja is responsible for determining the purposes and means by which your personal data is processed.

All enquiries relating to the use of your personal data — including requests to access, correct, port, restrict, or delete your data — should be directed to the fbaja Data Support team using the contact details provided in Section 14 of this Privacy Policy. fbaja will acknowledge all data-related requests within 72 hours and provide a substantive response within 30 calendar days of receipt of a valid, verified request.

3 Information We Collect

fbaja collects personal information from Users through several channels, including account registration, platform usage, payment processing, KYC verification, and voluntary communications with our support team. The categories of personal data we collect are described below.

3.1 Registration Data

When you create an fbaja Account, we collect the following information:

• Full legal name (as it appears on your government-issued identification)
• Date of birth (used to verify that you meet the 21+ minimum age requirement)
• Residential address, including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, etc.) and postcode
• Email address (used for account notifications and support communications)
• Bangladesh mobile number (used for OTP verification and WhatsApp support)
• Username and encrypted password
• Preferred currency (BDT / Bangladeshi Taka)

3.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, we may request and retain copies of:

• Government-issued photo identification (National ID Card, Passport, or Driving Licence)
• Proof of residential address (utility bill, bank statement, or official government correspondence issued within the last three months)
• Proof of payment method ownership (screenshot or confirmation of bKash, Nagad, Rocket, or Upay account registered in your name)
• Source of funds documentation where required for high-value transactions or withdrawal requests above defined thresholds

KYC documents are treated with the highest level of data security and are reviewed only by authorised fbaja compliance personnel.

3.3 Financial and Transaction Data

When you make deposits or withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, or Mastercard, we collect transaction reference numbers, partial payment identifiers, transaction amounts (in BDT), timestamps, and transaction status records. fbaja does not store full payment card numbers or full mobile banking PINs — these remain solely with your payment provider.

3.4 Betting and Gaming Activity Data

fbaja records all betting and gaming activity associated with your Account, including sports bets placed (markets, odds, stake amounts, results), casino game sessions (game titles, session duration, wager amounts, wins and losses), bonus claims and wagering progress, and login/logout timestamps. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance purposes.

3.5 Technical and Device Data

When you access the fbaja Platform, we automatically collect certain technical information, including:

• IP address (used for geolocation and fraud detection)
• Device type, operating system, and browser version
• Session duration and pages visited within the Platform
• Referring URL (if you accessed fbaja via a link from another website)
• Cookie identifiers (see Section 7 for full cookie details)

3.6 Communications Data

We retain records of all communications between you and the fbaja support team, including live chat transcripts, email correspondence, and WhatsApp messages. These records are used for quality assurance, dispute resolution, and to provide a consistent support experience across interactions.

4 How We Use Your Data

fbaja uses the personal information collected from Users for the following purposes:

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, KYC data	Contract performance
Processing deposits and withdrawals	Financial and transaction data	Contract performance
Identity and age verification	KYC data, registration data	Legal obligation
Fraud prevention and security monitoring	Technical data, transaction data, betting data	Legitimate interest
Responsible gaming monitoring	Betting/gaming data, session data	Legal obligation / legitimate interest
Customer support and dispute resolution	Communications data, account data	Contract performance
Platform analytics and improvement	Technical data, anonymised usage data	Legitimate interest
Promotional communications (where consented)	Email, mobile number, preferences	Consent
Compliance with legal and regulatory obligations	All categories as required	Legal obligation

fbaja does not use your personal data for automated decision-making that produces significant legal effects without human review. Where automated tools are used (for example, in fraud screening or responsible gaming monitoring), any significant action taken against an Account as a result of automated analysis is reviewed by an authorised fbaja compliance officer before being implemented.

5 Legal Basis for Processing

fbaja processes your personal data on the following legal bases, depending on the specific purpose of processing:

• Contract Performance: Processing is necessary to fulfil our contractual obligations to you as a registered fbaja User — including operating your Account, processing payments, and providing access to betting and casino games.
• Legal Obligation: Processing is required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, KYC requirements, and responsible gaming obligations.
• Legitimate Interest: Processing is necessary for fbaja's legitimate business interests — including fraud prevention, platform security, internal analytics, and improving the quality of our services — where those interests do not override your fundamental privacy rights.
• Consent: Where fbaja seeks to send you promotional communications or use non-essential cookies, we will ask for your explicit consent beforehand. You may withdraw consent at any time by contacting our support team or adjusting your Account notification preferences.

6 Sharing Your Data

fbaja does not sell, rent, or trade your personal data to third parties for their own commercial use. We may share your personal information with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

6.1 Payment Service Providers

To process your deposits and withdrawals, fbaja shares the minimum necessary transaction data with payment providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. These providers are subject to their own data protection obligations and are not authorised to use your data for any purpose beyond processing the specific transaction.

6.2 Game Content Providers

fbaja's casino games are supplied by certified third-party providers including Pragmatic Play, Microgaming, NetEnt, Evolution Gaming, Ezugi, and Spribe. These providers may receive anonymised session data (such as game round IDs and stake/win amounts) for game integrity, auditing, and technical support purposes. They do not receive your name, contact details, or payment information.

6.3 KYC and Identity Verification Partners

fbaja may engage regulated third-party KYC and identity verification service providers to assist in verifying User identities and ages. These providers process identification documents on fbaja's behalf under strict data processing agreements and are prohibited from using KYC data for any independent purpose.

6.4 Fraud Prevention and Security Services

fbaja uses third-party fraud detection and cybersecurity services to monitor for suspicious activity, detect multi-accounting, and protect the integrity of the Platform. Technical data (IP addresses, device fingerprints, session patterns) may be shared with these services for analysis. No personally identifiable data beyond what is strictly necessary is shared for this purpose.

6.5 Legal and Regulatory Authorities

fbaja may disclose personal data to law enforcement agencies, regulatory authorities, or judicial bodies where required to do so by applicable law, court order, or regulatory direction. fbaja will notify the User of any such disclosure to the extent permitted by law, unless doing so would prejudice a law enforcement investigation or is prohibited by the relevant authority.

6.6 Professional Advisors

fbaja may share limited personal data with legal counsel, auditors, and other professional advisors engaged by fbaja in the course of normal business operations. All such advisors are bound by confidentiality obligations and may only use the data shared with them for the specific professional purpose for which it was disclosed.

7 Cookies and Tracking Technologies

fbaja uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by a web server. Cookies allow the Platform to recognise your device on subsequent visits and to maintain session continuity. The following categories of cookies are used by fbaja:

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Session management, login state, security tokens, fraud prevention	No — required for Platform to function
Performance / Analytics	Anonymised usage statistics, page load performance, error tracking	Yes — via browser settings
Functionality	Remembering your language and display preferences	Yes — via browser settings
Responsible Gaming	Session duration tracking, reality check timers, cooling-off status	No — required for responsible gaming compliance

fbaja does not use third-party advertising cookies or cross-site tracking technologies. You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. For detailed instructions on managing cookies in your specific browser, please consult your browser's help documentation.

8 Data Retention

fbaja retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the principal categories of personal data held by fbaja:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years post-closure	Legal and regulatory obligation
KYC / identity verification documents	Duration of account + 5 years post-closure	AML compliance requirement
Financial and transaction records	7 years from transaction date	Financial record-keeping obligations
Betting and gaming activity logs	5 years from date of activity	Dispute resolution and audit trail
Support communications (live chat, email)	3 years from date of communication	Dispute resolution and quality assurance
Technical / device data (IP logs)	12 months from collection date	Security monitoring and fraud investigation
Marketing consent records	Until consent is withdrawn + 2 years	Evidence of consent basis

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is not technically feasible, the data is placed in a restricted archive with strictly controlled access pending secure deletion. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

9 Data Security

fbaja takes data security seriously and implements a range of technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the fbaja Platform.
• Encrypted storage of all sensitive personal data, including passwords (stored using industry-standard one-way hashing with salting) and KYC documents.
• Role-based access controls ensuring that only authorised fbaja personnel with a documented operational need can access personal data, with all access events logged.
• Multi-factor authentication required for all fbaja staff accessing systems that hold personal data.
• Regular third-party security audits and penetration testing of the Platform infrastructure.
• Continuous fraud and intrusion monitoring with automated alerts for anomalous access patterns.
• Incident response procedures ensuring that in the event of a data breach, affected Users and relevant authorities are notified in accordance with applicable requirements.

While fbaja employs robust security practices, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your Account password and for ensuring that your device is not accessible to unauthorised persons. fbaja recommends enabling the optional SMS OTP two-factor authentication on your Account for enhanced login security.

10 Your Data Rights

As a registered fbaja User, you have the following rights in relation to your personal data. To exercise any of these rights, please contact the fbaja support team via live chat or at [email protected] with your Account username and a description of your request. fbaja will verify your identity before processing any data request.