zbaji Privacy Policy

About This Policy

This Privacy Policy ("Policy") is published by zbaji ("zbaji", "we", "us", "our"), the operator of the online gambling platform accessible at https://zbaji.vu ("Platform"). It describes how we collect, use, store, share, and protect personal data relating to individuals who access or use the zbaji Platform, including registered players, account applicants, and website visitors.

By registering an account on zbaji, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not consent, please discontinue use of the Platform and contact support@zbaji.vu to request account closure.

This Policy should be read alongside the zbaji Terms & Conditions, which together form the complete agreement governing your use of the Platform. Defined terms used but not defined in this Policy carry the meanings given to them in the Terms & Conditions.

Data We Collect

zbaji collects personal data from you directly when you register, interact with the Platform, or contact our support team, and indirectly through automated technical means during your use of the website. The categories of personal data we collect are set out below.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information. If any such data is incidentally included in documents submitted for KYC purposes, it is not extracted, stored separately, or used for any processing purpose.

How We Use Your Data

zbaji uses personal data collected from you for the following specific, documented purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent.

• Account management: Creating, maintaining, and administering your zbaji player account, including processing login authentication and account security verifications.
• Identity verification (KYC): Verifying your identity, age, and eligibility to use the Platform in compliance with applicable anti-money laundering and responsible gaming requirements.
• Transaction processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, and Upay, and maintaining an accurate record of all financial activity on your account.
• Customer support: Responding to enquiries, resolving disputes, and providing technical assistance through our support channels.
• Responsible gaming monitoring: Monitoring your gaming activity to identify patterns that may indicate problem gambling, and enabling the application of limits, cooling-off periods, or self-exclusion where appropriate.
• Fraud prevention and security: Detecting and investigating suspected fraud, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Legal and regulatory compliance: Fulfilling our obligations under applicable law, responding to lawful requests from authorities, and maintaining records required for audit purposes.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players interact with the Platform and to improve features, navigation, and game offerings.
• Marketing communications (where consented): Sending you information about promotions, bonuses, and Platform updates where you have opted in to receive such communications. You may withdraw marketing consent at any time.

Legal Basis for Processing

zbaji processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which zbaji relies are as follows:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary to enter into and perform the contract established by the zbaji Terms & Conditions. Without this processing, we cannot operate your account or process your transactions.
• Legal obligation: Certain processing activities — including KYC verification, AML monitoring, and record-keeping — are required by applicable law and regulatory frameworks. zbaji must conduct this processing regardless of your individual preferences.
• Legitimate interests: zbaji processes technical data, gaming activity data, and communication data on the basis of its legitimate interests in fraud prevention, platform security, responsible gaming oversight, and service improvement. These interests are balanced against your privacy rights and do not override them.
• Consent: Marketing communications and the placement of non-essential cookies are conducted on the basis of your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to that withdrawal.

Data Sharing & Third Parties

zbaji does not sell, rent, or otherwise disclose your personal data to unaffiliated third parties for their own commercial or marketing purposes. Personal data may be shared with the following categories of regulated third-party partners, strictly for the purposes described:

• Payment processors: bKash, Nagad, Rocket, and Upay receive your mobile wallet number and transaction details solely for the purpose of processing your deposit and withdrawal instructions.
• Game providers: Providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and session data required to deliver their games through the zbaji Platform. They do not receive your full identity or financial data.
• KYC and identity verification partners: Third-party verification service providers may process your identity documents to assist zbaji in fulfilling its KYC obligations. These partners operate under strict contractual data protection terms.
• Technology and infrastructure providers: Hosting, content delivery, and cybersecurity vendors who support the operation of the zbaji Platform may have access to certain technical data in the course of providing their services.
• Legal and regulatory authorities: zbaji will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by law, court order, or regulatory instruction.

Cookies & Tracking

The zbaji website uses cookies and similar tracking technologies to deliver a functional, secure, and personalised browsing experience. Cookies are small text files placed on your device when you visit a website; they allow the site to recognise your device on return visits and remember certain preferences.

zbaji uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as language settings, remembered username (if enabled), and session time-out thresholds to personalise your experience on return visits.
• Analytical cookies: Collect anonymised data about how visitors navigate the site — which pages are most visited, how long sessions last, and where users exit. This data is used in aggregate form only, to improve Platform performance and layout.
• Marketing cookies (consent-based): Used to deliver relevant promotional content and to measure the effectiveness of zbaji's advertising campaigns. These cookies are only placed with your explicit consent and can be withdrawn at any time.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will affect the functionality of the zbaji Platform and may prevent you from logging in or completing transactions.

Data Retention

zbaji retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The general retention periods applied by zbaji are as follows:

• Active account data: Retained for the full duration of your account being active on the zbaji Platform plus a minimum period of five (5) years following account closure, to satisfy legal and regulatory record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of the last transaction on your account, in accordance with applicable anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of seven (7) years from the date of each transaction for accounting, tax, and regulatory audit purposes.
• Customer support communications: Retained for three (3) years from the date of the last interaction, to assist in resolving future disputes and to improve support quality.
• Marketing consent records: Retained for the period during which consent is active and for three (3) years following withdrawal of consent, as evidence of consent management.
• Technical and log data: Retained for up to twelve (12) months, after which it is anonymised or deleted unless required for an ongoing security investigation.

When personal data is no longer required for any retention purpose, zbaji will securely delete or anonymise it so that it can no longer be associated with an identifiable individual.

Your Rights

As a user of the zbaji Platform, you hold the following rights in respect of your personal data. zbaji is committed to facilitating the exercise of these rights promptly and without undue friction. Requests can be submitted by email to support@zbaji.vu.

• Right of access: You may request a copy of the personal data zbaji holds about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to overriding legal retention obligations.
• Right to restriction of processing: You may request that zbaji restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that zbaji provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object at any time to processing of your personal data carried out on the basis of zbaji's legitimate interests, including profiling for fraud prevention purposes. zbaji will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

zbaji aims to respond to all data rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by up to a further 60 days, in which case zbaji will notify you of the extension and the reason for it.

Children & Minors

The zbaji Platform is strictly intended for adults aged 21 years and above. zbaji does not knowingly collect personal data from any individual under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately close the associated account, delete all personal data connected to it, and return any funds deposited to the originating payment method where technically possible.

Data Security

zbaji implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes, but is not limited to:

• Encryption in transit: All data exchanged between your device and the zbaji Platform is encrypted using TLS (Transport Layer Security) protocols. The zbaji website operates exclusively over HTTPS.
• Encryption at rest: Sensitive data fields — including identity document scans, financial details, and authentication credentials — are encrypted at rest using industry-standard algorithms.
• Access controls: Access to production systems and personal data is restricted to a small number of authorised personnel. Access rights are reviewed regularly and revoked promptly when no longer required.
• Multi-factor authentication: Administrative access to zbaji's backend systems requires multi-factor authentication. Players are encouraged to enable all available account security features on their own accounts.
• Intrusion detection and monitoring: zbaji operates continuous monitoring of its infrastructure to detect and respond to suspicious activity, attempted intrusions, and anomalous data access patterns.
• Incident response: zbaji maintains a documented data breach response procedure. In the event of a security incident that affects your personal data, we will notify you and the relevant authorities in accordance with applicable legal obligations.

While zbaji takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own login credentials and for notifying zbaji immediately if you suspect any unauthorised access to your account.

International Transfers

zbaji's primary player base is located in Bangladesh, and our core data processing activities are managed with Bangladesh-resident players in mind. However, certain third-party service partners — including game providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi, as well as technology infrastructure providers — may process data in server locations outside Bangladesh.

Where personal data is transferred to a third party operating outside Bangladesh, zbaji ensures that appropriate safeguards are in place to protect the transferred data to a standard equivalent to that applied within Bangladesh. These safeguards include contractual data processing agreements that impose binding privacy and security obligations on the recipient.

zbaji does not transfer personal data to jurisdictions that lack adequate data protection frameworks without first implementing the appropriate contractual and technical safeguards described above.

Changes to This Policy

zbaji reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify registered players by email to the address on file and by displaying a prominent notice on the Platform for a reasonable period prior to the changes taking effect.

The effective date shown at the top of this Policy will be updated each time a new version is published. We encourage you to review this Policy periodically so that you remain informed about how zbaji protects your personal data. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms.

If you disagree with any changes made to this Policy, you may discontinue use of the Platform and request account closure by contacting support@zbaji.vu.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how zbaji has handled your personal data, please contact our support team using the details below. All privacy-related correspondence is treated with strict confidentiality.

• Email (plain text — not a clickable link): support@zbaji.vu
• Response commitment: zbaji aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days of receipt.
• Data rights requests: Please include your full registered name, registered email address, and a clear description of your request so that we can locate your data and process your request efficiently.

If you are not satisfied with zbaji's response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. zbaji will cooperate fully with any such authority in the investigation of a complaint.

For questions about responsible gaming data, self-exclusion records, or deposit limit settings, please also refer to the zbaji Responsible Gaming page, where dedicated guidance is available.