Privacy Policy for abaji

1. About This Policy

This Privacy Policy applies to all personal data collected by abaji through the abaji.io website, its mobile-optimised interface, and all associated services including sports betting, live casino, slots, arcade games, the VIP rewards programme, and customer support interactions. It applies to all players regardless of their location, though abaji primarily serves the Bangladesh market.

abaji acts as the data controller for all personal data processed in connection with your account and use of the platform. This means abaji determines the purposes and means by which your personal data is processed. Where abaji engages third-party processors — such as KYC verification providers or payment gateway operators — those parties act solely on abaji's documented instructions and are bound by contractual data-processing obligations.

This Policy should be read alongside the abaji Terms & Conditions and Responsible Gaming Policy, both of which are available on this website. Together, these documents constitute the full contractual and compliance framework governing your relationship with abaji.

2. Data We Collect

abaji collects personal data across several categories. The table below summarises what we collect, why, and the legal basis under which it is processed.

Category	Data Points	Purpose
Identity Data	Full legal name, date of birth, gender, National ID / Passport number	Account registration, age verification (21+), KYC compliance
Contact Data	Email address, mobile phone number, residential address	Account communication, support, withdrawal notifications
Financial Data	bKash / Nagad / Rocket account number, bank account details, transaction history	Deposit processing, withdrawal verification, AML compliance
Technical Data	IP address, device type, browser type, operating system, session timestamps	Security, fraud detection, platform optimisation
Usage Data	Pages visited, games played, bet history, session duration, click patterns	Platform improvement, responsible gaming monitoring, personalisation
Communications Data	Support chat transcripts, email correspondence, complaint records	Customer service, dispute resolution, quality assurance
Verification Documents	Scanned ID documents, selfies, proof of address, payment method screenshots	KYC identity verification, fraud prevention

3. How We Collect Data

3.1 Directly From You

The majority of personal data abaji holds about you is provided directly by you during the account registration process, through the KYC document submission portal, when contacting customer support, when completing responsible gaming self-assessment forms, and when entering promotions or VIP programme activities.

3.2 Automatically Through Platform Use

When you access and use the abaji platform, technical and usage data is collected automatically through server logs, session management cookies, and device fingerprinting technologies. This includes your IP address, device identifiers, browser settings, pages visited, and in-session betting behaviour. This automated collection is necessary for the operation, security, and optimisation of the platform.

3.3 From Third Parties

abaji may receive personal data about you from third-party sources in limited, defined circumstances:

• KYC and Identity Verification Providers: Third-party identity verification services may provide abaji with the result of a document authenticity check or a database-matching result. abaji does not receive raw data from national identity databases directly.
• Payment Processors: Payment gateway operators such as bKash, Nagad, and Rocket confirm transaction status and may share the payment account identifier associated with a deposit or withdrawal for reconciliation purposes.
• Fraud Prevention Services: abaji subscribes to industry fraud-intelligence sharing services that may flag IP addresses, device fingerprints, or account patterns associated with known fraudulent activity.

4. Legal Basis for Processing

abaji processes your personal data on the following legal bases:

• Contractual Necessity: Processing that is necessary to provide you with the services you have requested under the Terms & Conditions — including account management, betting settlement, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering (AML) obligations, age verification requirements, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out to pursue abaji's legitimate business interests, including platform security, fraud detection, responsible gaming monitoring, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where abaji relies on your consent as the legal basis for processing — for example, sending you promotional communications — you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. How We Use Your Data

abaji uses the personal data it collects for the following purposes:

• To register and maintain your player account and authenticate your identity on login
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels
• To verify your age (minimum 21 years) and identity in compliance with KYC obligations
• To settle bets, apply bonuses, calculate VIP loyalty points, and manage your account balance
• To deliver customer support across all channels including live chat and email
• To monitor your gaming patterns for responsible gaming purposes, including identifying signs of problem gambling and applying protective tools where appropriate
• To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct
• To send you transactional communications relating to your account (deposit confirmations, withdrawal notifications, security alerts)
• To send you promotional communications about abaji offers, VIP programme updates, and seasonal promotions — where you have consented to receive such communications
• To improve the platform through aggregated, anonymised analytics on player behaviour and feature usage
• To comply with abaji's legal and regulatory obligations

6. Data Sharing

6.1 Service Providers

abaji shares personal data with carefully selected third-party service providers who assist in the operation of the platform. These include identity verification (KYC) providers, payment processing partners, cloud infrastructure providers, fraud detection services, and customer support platform vendors. All service providers are subject to written data-processing agreements that restrict their use of your data to the specific services they provide to abaji.

6.2 Legal and Regulatory Disclosures

abaji may disclose your personal data to regulatory bodies, law enforcement agencies, courts, or other public authorities where required or permitted by applicable law. This includes disclosures made in connection with anti-money-laundering investigations, court orders, or national security requirements. abaji will notify you of any such disclosure to the extent permitted by law.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of abaji's assets, your personal data may be transferred to the acquiring entity as part of that transaction. abaji will provide reasonable notice of any such transfer and ensure that the acquiring entity is bound by privacy obligations no less protective than those set out in this Policy.

6.4 What We Do Not Do

abaji does not sell, rent, trade, or otherwise commercially exploit your personal data. We do not share your data with advertisers, data brokers, or marketing analytics firms. We do not transfer your personal data to countries that do not provide an adequate level of data protection without implementing appropriate safeguards.

7. Cookies & Tracking Technologies

7.1 Types of Cookies Used

abaji uses the following categories of cookies on the platform:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing identifiers. These cannot be disabled without preventing you from using the platform.
• Functional Cookies: Store your preferences such as language settings, display preferences, and remembered login state (where applicable). These improve your experience but are not essential to platform operation.
• Analytics Cookies: abaji uses privacy-preserving, first-party analytics to understand how players navigate the platform — which pages are visited most frequently, where sessions begin and end, and which features are used. These analytics are aggregated and anonymised. No third-party analytics providers with cross-site tracking capabilities are used.

7.2 No Advertising Cookies

abaji does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. Your browsing behaviour on abaji.io is not shared with any advertising network or social media platform.

7.3 Managing Cookies

You may control cookie behaviour through your browser settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use the platform. For guidance on managing cookies in your specific browser, refer to the browser's official help documentation.

8. Data Security

abaji implements a multi-layered security architecture to protect your personal data against unauthorised access, loss, destruction, or disclosure. Our security measures include:

• Encryption in Transit: All data transmitted between your device and abaji's servers is encrypted using TLS 1.2 or TLS 1.3 protocols with 256-bit AES encryption.
• Encryption at Rest: Sensitive data fields — including identity document images, payment account numbers, and passwords — are encrypted at the database level using AES-256 encryption.
• Access Controls: Access to personal data within abaji's systems is restricted on a strictly need-to-know basis. Staff access is controlled through role-based permissions, multi-factor authentication, and detailed access logs.
• Security Audits: abaji conducts regular internal security reviews and engages independent security professionals to perform periodic penetration testing of the platform infrastructure.
• Incident Response: abaji maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, abaji will notify affected players without undue delay.

While abaji takes all reasonable precautions to safeguard your data, no internet transmission or electronic storage system is 100% secure. You are encouraged to use a strong, unique password for your abaji account and to enable any available two-factor authentication features.

9. Data Retention

abaji retains personal data for the minimum period necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. The following retention periods apply:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years post-closure	AML and regulatory compliance
KYC / identity documents	Duration of account + 5 years post-closure	Identity verification audit trail
Financial transaction records	7 years from transaction date	Financial record-keeping obligations
Betting history	Duration of account + 3 years post-closure	Dispute resolution, responsible gaming review
Customer support records	3 years from last interaction	Quality assurance, complaint handling
Technical / log data	90 days	Security monitoring, fraud detection
Marketing consent records	Until consent withdrawn + 1 year	Proof of consent compliance

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting anonymised dataset may be retained indefinitely for statistical and analytics purposes without further restriction.

10. Your Rights

As a player on the abaji platform, you have the following rights in respect of your personal data:

• Right of Access: You have the right to request a copy of all personal data abaji holds about you. abaji will respond to verified access requests within 30 calendar days.
• Right to Rectification: If any personal data abaji holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. Note that abaji may be required to retain certain data for legal compliance reasons notwithstanding an erasure request.
• Right to Restrict Processing: You have the right to request that abaji restricts the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of abaji's legitimate interests. abaji will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11. Children's Privacy

The abaji platform is strictly intended for adults aged 21 and above. abaji does not knowingly collect personal data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has registered an account or provided personal data to abaji, please contact us immediately at [email protected]. abaji will take prompt action to delete the relevant account and all associated personal data upon verification of the request.

abaji employs age verification controls at the point of registration and during the KYC process to prevent minors from accessing the platform. These controls are supplemented by ongoing responsible gaming monitoring that flags account behaviour inconsistent with an adult player profile.

12. Third-Party Links

The abaji platform does not contain outbound links to third-party websites. Should any reference to an external service provider be displayed on the platform for informational purposes, abaji has no control over the privacy practices of those third-party entities and accepts no liability for the manner in which they collect or process personal data. You are encouraged to read the privacy policy of any third-party service before providing them with personal information.

13. Changes to This Policy

abaji reserves the right to update or amend this Privacy Policy at any time. When material changes are made, abaji will notify registered players via the email address associated with their account and will update the "Last Updated" date at the top of this document. We encourage you to review this Policy periodically to stay informed of how abaji handles your personal data.

Continued use of the abaji platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes to this Policy, you should cease using the platform and contact the support team to initiate account closure.

14. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or abaji's data-processing practices, please contact us using the details below. All contact information is provided as plain text — email addresses are not clickable links.

• Data Enquiries Email: [email protected]
• Subject Line for Data Requests: "Data Rights Request" or "Privacy Enquiry"
• Support Availability: 24 hours a day, 7 days a week
• Response Commitment: All privacy-related enquiries will receive an initial acknowledgement within 24 hours and a full response within 30 calendar days.