lbaje Privacy Policy

lbaje collects personal data from you in several ways: directly when you register an account or contact our support team, automatically when you use the Platform, and in some cases from third-party sources such as payment processors and identity verification services. We collect only the minimum data necessary to deliver our services safely and in compliance with responsible gaming and anti-money-laundering obligations.

1.1 Registration Data

When you create a lbaje account, you provide the following information:

• Full legal name (as it appears on your National Identity Card or passport);
• Date of birth (for mandatory age verification — players must be 18 or older);
• Residential address in Bangladesh (city, district, and full postal address);
• Mobile phone number, which must be linked to your preferred MFS payment account (bKash, Nagad, Rocket, or Upay);
• Email address (used for account notifications and formal communications);
• A username and password of your choosing (password is stored in hashed form — never in plain text).

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, which is required before any withdrawal is approved, you may be asked to submit:

• A scanned copy or photograph of your Bangladesh National Identity Card (NID);
• A valid Bangladesh passport (biographical data page);
• A recent utility bill or bank statement confirming your residential address;
• A screenshot confirming your registered MFS account (bKash, Nagad, Rocket, or Upay) matching the mobile number on file;
• A selfie photograph for liveness verification where required.

KYC documents are handled with the highest level of confidentiality and are stored in an encrypted environment with access restricted to authorised compliance personnel only.

1.3 Financial Transaction Data

When you make a deposit or request a withdrawal on lbaje, we record:

• The payment method used (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard);
• The mobile number or partial card number associated with the transaction;
• Transaction amounts in Bangladeshi Taka (৳);
• Timestamps of all deposit and withdrawal requests and their processing outcomes.

lbaje does not store full payment card numbers. Card transactions are processed by PCI-DSS compliant third-party payment processors who handle card data directly.

1.4 Technical and Usage Data

When you access the lbaje Platform, our servers automatically record:

• Your IP address and approximate geographic location (city/region level);
• Device type, operating system, and browser version;
• Pages visited, time spent on each page, and navigation path through the Platform;
• Game sessions, bet amounts, game outcomes, and session duration;
• Login timestamps and logout events;
• Error logs and crash reports generated by the Platform on your device.

1.5 Communications Data

When you contact lbaje's customer support team via live chat or email, we retain records of the conversation, including the content of your messages, your contact details, and the outcome of any support request. These records are used for quality assurance, dispute resolution, and training purposes.

lbaje processes your personal data only for lawful, specified, and legitimate purposes. The table below summarises each processing activity, the data categories involved, and the legal basis on which lbaje relies to carry out that processing.

2.1 Marketing Communications

lbaje may send you promotional emails or in-platform notifications about bonuses, new games, cricket betting markets, and seasonal offers (including Eid, Pohela Boishakh, BPL season, and IPL promotions) where you have explicitly opted in to receive such communications during registration or at a later date via your account settings. You may withdraw your consent to marketing communications at any time by updating your notification preferences in your account settings or by emailing [email protected] with the subject line "Unsubscribe". Withdrawal of marketing consent does not affect your ability to use the Platform or receive transactional account communications.

2.2 Automated Decision-Making

lbaje uses automated systems for certain fraud detection and responsible gaming monitoring tasks. These systems analyse patterns in deposit behaviour, gameplay, and account activity to identify potential issues. Where an automated process results in a restriction on your account (such as a temporary hold or a request for additional KYC documentation), you have the right to request human review of that decision by contacting our support team at [email protected].

lbaje does not sell, rent, or trade your personal data to any third party. We share your data only in the specific, limited circumstances described in this section, and only to the extent necessary for each stated purpose.

3.1 Payment Processors

To process your deposits and withdrawals, lbaje shares the minimum necessary financial and identity data with our payment processing partners, including the operators of bKash, Nagad, Rocket, Upay, and our card payment gateway for Visa and Mastercard transactions. These partners are contractually obligated to handle your data only for the purpose of completing the relevant transaction and are not permitted to use your data for any other purpose.

3.2 Game Studios and Content Providers

Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi operate their game engines on the lbaje Platform. These studios may receive a pseudonymous player session identifier and stake/outcome data for the purpose of operating the game, processing game outcomes, and calculating RTP. They do not receive your full name, email address, physical address, or KYC documentation.

3.3 Identity Verification Services

Where lbaje uses a third-party KYC or identity verification service to assist in processing your NID, passport, or other identity documents, that service provider will receive the documents you submit. Such providers are bound by strict data processing agreements and are not permitted to retain or use your identity documents beyond the scope of the verification task.

3.4 Legal and Regulatory Disclosure

lbaje may disclose your personal data to law enforcement agencies, government authorities, or regulatory bodies where we are legally required to do so — for example, in response to a court order, a formal law enforcement request, or an anti-money-laundering investigation. In such cases, lbaje will disclose only the minimum data required to satisfy the legal obligation and will notify you of the disclosure where permitted by law to do so.

3.5 Business Continuity

In the event of a corporate restructuring, merger, acquisition, or sale of all or part of lbaje's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and ensure that the acquiring entity is bound by data protection obligations at least as protective as those set out in this Privacy Policy before any transfer takes place.

lbaje uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to understand how players use the site so we can improve the experience. This section explains what cookies we use and what controls you have over them.

4.1 What Are Cookies?

Cookies are small text files that are stored on your device when you visit a website. They allow the website to recognise your device on subsequent visits, remember your settings, and collect usage analytics. Cookies do not contain executable code and cannot carry viruses or malware. They can be viewed, managed, or deleted using your browser settings.

4.2 Categories of Cookies Used by lbaje

4.3 Managing Your Cookie Preferences

Essential cookies cannot be disabled as they are strictly necessary for the Platform to function. You may opt out of analytics cookies at any time by adjusting the cookie settings in your lbaje account preferences, or by configuring your browser to block or delete cookies. Please note that disabling analytics cookies does not affect your ability to play games or make transactions on lbaje — it only limits our ability to analyse and improve the Platform experience.

Most modern browsers (Chrome, Firefox, Safari, Edge, and others) provide built-in tools to view and manage cookies stored by any website. Refer to your browser's help documentation for instructions specific to your browser version.

lbaje retains your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law and regulatory obligations. The following retention schedule applies to the main categories of data we hold.

5.1 Data Storage Location

lbaje stores personal data on secure servers protected by industry-standard physical and technical security measures. All data is encrypted at rest using AES-256 encryption. Access to production data systems is restricted to authorised personnel only, with access logs maintained and reviewed regularly.

5.2 Data Deletion Requests

If you request deletion of your personal data following account closure, lbaje will fulfil that request subject to the retention obligations described above. Data that we are legally required to retain (such as KYC documents and financial transaction records) cannot be deleted before the mandatory retention period expires, even where a deletion request has been submitted. lbaje will confirm in writing which data has been deleted and which data is being retained, along with the legal basis for retention and the date on which retained data will be scheduled for deletion.

As a player on lbaje, you have a number of rights in relation to the personal data we hold about you. These rights are outlined below. To exercise any of these rights, contact our data team at [email protected] with the subject line "Privacy Rights Request". lbaje will acknowledge your request within 5 business days and will respond in full within 30 days, free of charge.

lbaje takes the security of your personal data seriously and has implemented a multi-layered security framework to protect against unauthorised access, disclosure, alteration, or destruction of the data we hold. The following measures are in place at all times.

7.1 Technical Security Controls

• TLS/SSL encryption on all data transmitted between your device and lbaje's servers, preventing interception of data in transit;
• AES-256 encryption for all personal data stored in lbaje's databases;
• Bcrypt password hashing — your password is never stored in recoverable plain text;
• Two-factor authentication (2FA) available to all players and mandatory for all lbaje staff accounts;
• Web Application Firewall (WAF) to block common attack vectors including SQL injection, cross-site scripting (XSS), and brute-force login attempts;
• Rate limiting on login endpoints to prevent credential-stuffing attacks;
• Intrusion detection systems (IDS) that monitor server traffic in real time and alert the security team to anomalous activity.

7.2 Organisational Security Controls

• Role-based access control (RBAC) — lbaje staff are granted access only to the data systems they require to perform their specific job functions;
• All staff with access to personal data complete data protection and security awareness training before being granted system access;
• Access to production data systems is logged, and those logs are reviewed regularly by the security team;
• lbaje conducts periodic internal security audits and engages third-party penetration testing firms to assess the Platform's security posture;
• A formal data breach response procedure is in place, with defined escalation steps and notification timelines.

7.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, lbaje will notify affected players without undue delay — and in any case within 72 hours of becoming aware of the breach — by email to the address registered on your account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps lbaje is taking to address the breach and mitigate its effects.

lbaje reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our Platform. When we make material changes to this Policy, we will notify you by email to your registered address and by displaying a prominent notice on the lbaje Platform for at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Policy will always reflect the date on which the most recent version was published. We encourage you to review this Privacy Policy periodically to stay informed about how lbaje protects your personal data. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy.

8.1 Previous Versions

If you would like to review a previous version of this Privacy Policy, you may request it by contacting our support team. lbaje maintains an archive of all previous policy versions with their effective dates.

8.2 Contact Our Data Team

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about how lbaje handles your personal data, please contact our data team using the details below. All data-related enquiries are handled separately from general customer support to ensure they receive appropriate specialist attention.