zbaj Privacy Policy —
How We Collect, Use, and Protect Your Data

1 Introduction

This Privacy Policy ("Policy") describes how zbaj ("zbaj", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the zbaj online casino and sports betting platform at https://zbaj.io (the "Platform"). This Policy forms part of the overall agreement between you and zbaj, alongside our Terms and Conditions and Responsible Gaming Policy.

zbaj is committed to handling your personal data with care, transparency, and respect. We design our data practices around the principle that your information belongs to you — we are its custodians, not its owners. By registering an account or using any feature of the zbaj Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

2 Who We Are

zbaj is an online entertainment platform offering casino games and sports betting services, with a primary focus on the Bangladesh market. The zbaj Platform is accessible at https://zbaj.io and is operated by the zbaj platform team. For all privacy-related enquiries, players may contact us directly at the email address provided in Section 16 of this Policy.

zbaj acts as the data controller in respect of all personal data collected through the Platform. As data controller, zbaj determines the purposes and means by which your personal data is processed. Where we engage third-party service providers to process data on our behalf, those parties act as data processors under contractual obligations that restrict their use of your data to the specific purposes for which it was shared.

3 Data We Collect

zbaj collects several categories of personal data in the course of providing its services. The specific data we collect depends on how you interact with the Platform. The principal categories are described below:

zbaj does not intentionally collect sensitive personal data such as health information, racial or ethnic origin, political opinions, or religious beliefs. If you voluntarily disclose such information in a support communication, it will be used only to resolve your enquiry and will not be retained for any other purpose.

4 How We Collect Data

zbaj collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or responding to a promotion.
• Automated collection: Technical data gathered automatically when you access the Platform, including your IP address, browser details, device identifiers, and clickstream data via cookies and similar tracking technologies.
• Third-party sources: Identity and fraud verification data received from KYC service providers; payment status data from bKash, Nagad, Rocket, Upay, and banking partners; fraud risk signals from anti-fraud network partners.
• Game Providers: Aggregated gameplay data (e.g., game rounds played, bet amounts, RTP outcomes) provided by third-party Game Providers such as Evolution Gaming, Pragmatic Play, and Spribe, for the purposes of account management and responsible gaming monitoring.

5 Legal Basis for Processing

zbaj processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our obligations under the Terms and Conditions you accepted when registering your zbaj account — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, age verification requirements, and financial record-keeping obligations.
• Legitimate interests: Processing that zbaj undertakes in pursuit of legitimate business interests, including fraud prevention, platform security, improving our services, and responsible gaming monitoring — provided these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given and specific consent, such as sending promotional emails or SMS marketing messages. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 How We Use Your Data

zbaj uses the personal data it collects for the following purposes:

• Creating and maintaining your zbaj account, including verifying your identity and age in compliance with our 21+ policy.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and linked bank accounts.
• Delivering casino games, sports betting markets, and other Platform features to your device.
• Detecting and preventing fraud, money laundering, account abuse, and other prohibited activities.
• Monitoring your gaming behaviour to identify potential signs of problem gambling and to apply responsible gaming tools where appropriate.
• Sending transactional notifications — such as deposit confirmations, withdrawal updates, and account security alerts — that are necessary to operate your account.
• Sending promotional communications (bonuses, offers, seasonal campaigns) where you have given your explicit consent to receive them.
• Responding to your enquiries and complaints submitted to the zbaj support team.
• Improving the Platform's performance, usability, and game selection through aggregated, anonymised analytics.
• Complying with applicable legal and regulatory requirements, including the retention of financial records.

7 Data Sharing & Disclosure

zbaj does not sell your personal data to any third party. We share personal data only in the following limited circumstances, and only to the extent necessary for each specific purpose:

• Payment processors: bKash, Nagad, Dutch-Bangla Bank (Rocket), Upay, City Bank, BRAC Bank, and other payment partners receive the minimum financial data required to process your deposit or withdrawal transactions.
• Identity verification providers: KYC service providers receive identity document images and personal details to verify your age and identity as required by our responsible gaming and anti-fraud obligations.
• Game Providers: Third-party game studios (including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi) receive your account identifier and session data necessary to deliver their games within the zbaj Platform environment.
• Fraud and security partners: Anti-fraud and security technology providers receive technical data (IP addresses, device fingerprints, session data) to detect and prevent fraudulent activity on the Platform.
• Legal and regulatory authorities: zbaj may disclose personal data to law enforcement agencies, regulatory bodies, or other authorities where required by applicable law, a valid court order, or other lawful process.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of zbaj's assets, player data may be transferred to the acquiring entity, subject to equivalent data protection commitments. Affected players will be notified in advance where reasonably practicable.

All third-party service providers who receive personal data from zbaj are required by contract to process that data only for the specific purpose for which it was shared, to maintain appropriate security standards, and to delete or return the data when the purpose has been fulfilled.

8 Cookies & Tracking Technologies

zbaj uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session state, and gather analytics data. A cookie is a small text file placed on your device by the zbaj Platform when you visit the site. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in across page navigations and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as your chosen payment method, language setting, and responsible gaming limit configurations, so you do not need to re-enter them on every visit.
• Analytics cookies: Collect anonymised data about how players navigate and use the Platform, which games are most popular, and where technical errors occur. This data is used to improve Platform performance and user experience.
• Security and fraud-prevention cookies: Help zbaj's fraud detection systems identify unusual behaviour patterns, such as rapid account switching or suspicious betting sequences, that may indicate account compromise or fraudulent activity.

You may control cookie settings through your browser's privacy settings. Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. zbaj does not use third-party advertising cookies or behavioural profiling cookies for the purpose of serving targeted advertisements on external websites.

9 Data Security

zbaj implements a layered security architecture to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security measures include, but are not limited to:

• TLS 1.2 / 1.3 encryption for all data transmitted between your device and zbaj servers.
• Encryption of sensitive data fields (including payment method identifiers and identity document data) at rest using AES-256 or equivalent standards.
• Role-based access controls that restrict internal access to personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform infrastructure.
• Multi-factor authentication requirements for internal zbaj systems that process player data.
• Automated anomaly detection that flags unusual access patterns for immediate review by our security team.

While zbaj takes all reasonable technical and organisational precautions to protect your data, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a risk to your rights and freedoms, zbaj will notify affected players promptly and take all necessary steps to contain and remediate the incident.

10 Data Retention

zbaj retains personal data for the period necessary to fulfil the purpose for which it was collected, and thereafter only to the extent required by applicable law or legitimate business necessity. The following general retention guidelines apply:

Once a retention period expires, zbaj will securely delete or anonymise the relevant data in accordance with our internal data lifecycle procedures. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical analysis and Platform improvement purposes.

11 Your Rights

As a zbaj player, you hold a number of rights in relation to your personal data. zbaj is committed to facilitating the exercise of these rights promptly and without unnecessary barriers. Your rights include:

• Right of access: You may request a copy of all personal data zbaj holds about you, together with information about how it is being processed.
• Right to rectification: If any personal data zbaj holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: Subject to certain legal exceptions (including our AML record-keeping obligations), you may request that zbaj delete your personal data. Deletion requests will be assessed on a case-by-case basis.
• Right to restrict processing: You may request that zbaj restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that zbaj provides your data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing that is based on zbaj's legitimate interests. zbaj will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of the above rights, please contact the zbaj support team at support@zbaj.io with the subject line "Data Rights Request — [Your Request Type]". zbaj will acknowledge your request within 3 business days and aim to fulfil it within 30 calendar days. In complex cases, this period may be extended by up to a further 60 days, in which case you will be notified of the extension and the reason for it.

12 Children & Minors

The zbaj Platform is strictly for adults aged 21 and above. zbaj does not knowingly collect personal data from individuals under the age of 21. If zbaj becomes aware that personal data has been collected from a person under 21 years old, that account will be immediately suspended, all associated data will be deleted, and any deposited funds will be returned to the originating payment method following a brief verification process.

If you are a parent or guardian and believe that a person under 21 in your care has registered a zbaj account or provided personal data to the Platform, please contact us immediately at support@zbaj.io so we can take prompt corrective action.

13 Third-Party Links

The zbaj Platform may contain references to third-party services or Game Providers whose games are embedded within the Platform. These third-party services operate under their own privacy policies, which are separate from and independent of this Privacy Policy. zbaj is not responsible for the privacy practices of any third-party service, including those of Game Providers such as Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, or Microgaming.

We encourage you to review the privacy policies of any third-party services you interact with through the zbaj Platform. zbaj's responsibility is limited to its own data processing activities as described in this Policy.

14 International Data Transfers

In order to operate the zbaj Platform and deliver its services to players in Bangladesh, it may be necessary for zbaj to transfer certain personal data to service providers or systems located outside of Bangladesh. This includes Game Providers whose server infrastructure is located in other jurisdictions, and cloud service providers who operate internationally.

Where personal data is transferred internationally, zbaj ensures that adequate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. Such safeguards may include contractual data transfer agreements or reliance on the recognised data protection standards of the receiving jurisdiction.

Payment data shared with Bangladeshi payment partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and others) remains within Bangladesh's financial infrastructure and is subject to applicable Bangladeshi financial regulations.

15 Changes to This Policy

zbaj reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will notify active players via email or a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date at the top of this document will always reflect when the most recent revision was published.

Minor changes — such as corrections of typographical errors, clarifications that do not alter the substance of our data practices, or updates to reflect new zbaj product features that are processed under already-described legal bases — may be made without prior notification, though the updated date will still be revised.

We encourage you to review this Privacy Policy periodically to stay informed about how zbaj protects your data. Your continued use of the Platform following the publication of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to a revised Policy, you must stop using the Platform and may request account closure by contacting our support team.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or zbaj's data practices, please contact our support team using the details below. All privacy-related enquiries are handled with strict confidentiality and will be acknowledged within 3 business days.

For self-exclusion requests, deposit limit adjustments, or responsible gaming tool activations, please mark your message clearly with "Responsible Gaming Request" in the subject line so our team can prioritise your case. All responsible gaming requests are treated as urgent and handled with the highest level of care and discretion.

For formal legal correspondence relating to this Privacy Policy, please use the subject line "Legal Notice — zbaj Privacy Policy" to ensure your communication is directed to the appropriate team without delay.