Privacy Policy — cbajo Bangladesh Online Casino

Privacy at a Glance

Our Core Data Commitments

The cards below summarise the most important aspects of how cbajo handles your personal information. They are provided for convenience only — the full policy below governs all data practices.

SSL-Encrypted Storage

All personal data collected by cbajo is stored in encrypted form using 256-bit SSL technology. Payment credentials processed via bKash, Nagad, Rocket, and Upay are never stored on cbajo's own servers — they are handled by the respective payment provider's secure infrastructure.

No Sale of Personal Data

cbajo does not sell, rent, or trade your personal information to any third party for commercial purposes. Data shared with third parties is limited strictly to what is necessary for platform operations — such as KYC verification providers, payment processors, and game software providers.

Minimal Data Collection

cbajo follows a principle of data minimisation — we collect only the information that is genuinely necessary to provide the platform, verify your identity, process transactions, and fulfil our compliance obligations. We do not collect data speculatively or beyond what the platform requires.

Your Right to Access

Registered cbajo players have the right to request a copy of the personal data held on their account at any time. Requests can be submitted to [email protected] and will be fulfilled within 10 business days. You may also request correction of inaccurate data at any time.

Transparent Cookie Use

cbajo uses cookies and similar tracking technologies to maintain session state, remember your preferences, and analyse platform performance. Essential cookies required for the platform to function cannot be disabled; optional analytics cookies can be managed via your browser settings at any time.

Right to Deletion

Subject to our legal retention obligations — including anti-money laundering record-keeping requirements — you may request deletion of your personal data following permanent account closure. cbajo will process eligible deletion requests within 30 days and confirm completion via your registered contact details.

Section 1

Information We Collect

When you interact with the cbajo platform — whether by browsing as a guest, registering an account, making a deposit, placing a bet, or contacting customer support — certain categories of information are collected. The scope of data collected depends on the nature and depth of your interaction with the platform.

Registration and Account Data

When you create a cbajo account, we collect the following information directly from you:

Your full legal name as it appears on your National ID Card (NID) or passport.
Your date of birth, used for age verification to enforce our strict 18+ policy.
Your registered Bangladeshi mobile number.
Your preferred payment method and associated account details (bKash number, Nagad number, Rocket number, Upay number, or bank account details).
A self-selected username and password (passwords are stored in hashed form and are never accessible in plaintext by cbajo staff).

Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process — which is mandatory before your first withdrawal and may be requested at other points during your account lifetime — cbajo may collect scanned or photographed copies of:

Your National ID Card (NID), both front and back.
Your passport biographical data page.
A screenshot or confirmation document from your mobile banking provider (bKash, Nagad, Rocket, or Upay) confirming the account is registered in your name.
Proof of address or source of funds documentation, where requested by our compliance team in connection with large transactions or account reviews.

Transaction Data

Every deposit and withdrawal processed through your cbajo account generates a transaction record. This includes the transaction amount in Bangladeshi Taka (BDT), the payment method used, the date and time of the transaction, and the transaction reference number issued by the payment provider. These records are maintained in accordance with our data retention obligations and cannot be deleted on request.

Gameplay and Betting Data

cbajo logs all gameplay and sports betting activity associated with your account. This includes game titles played, bet amounts placed, outcomes, session start and end times, and any bonus funds applied. This data is used for account integrity checks, responsible gaming monitoring, dispute resolution, and platform analytics.

Technical and Device Data

When you access the cbajo platform, our servers automatically collect certain technical information including your IP address, browser type and version, operating system, device type (mobile or desktop), and pages visited within the platform. This data is collected passively and is used for security monitoring, fraud detection, and platform performance optimisation.

Communications Data

When you contact cbajo's support team via email at [email protected] or through any other communication channel provided on the platform, the content of your communication and any attachments you provide are retained as part of your account record. This allows cbajo to maintain a complete and accurate history of support interactions for quality assurance and dispute resolution purposes.

Data Categories Summary

Identity data (name, DOB)
Contact data (mobile number)
KYC documents (NID, passport)
Payment & transaction data
Gameplay & betting records
Device & IP address data
Support communications

Sensitive Data

cbajo does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data. If such information appears incidentally in a document submitted for KYC, it is not processed or recorded beyond what is necessary for identity verification.

Section 2

How We Use Your Data

cbajo processes personal data only for specific, legitimate purposes directly related to the operation of the platform and the fulfilment of our legal obligations. The following table sets out the primary purposes for which data is used and the legal basis for each processing activity.

Processing Purpose	Data Categories Used	Legal Basis
Account creation and management	Identity, contact, password data	Contract performance
Age and identity verification (KYC)	Identity, KYC documents	Legal obligation; contract performance
Processing deposits and withdrawals	Payment account details, transaction data	Contract performance
Fraud prevention and security monitoring	IP address, device data, transaction data	Legitimate interest; legal obligation
Responsible gaming monitoring	Gameplay data, session data, transaction data	Legitimate interest; legal obligation
Customer support	Identity, communications, transaction data	Contract performance; legitimate interest
Platform performance and analytics	Device data, gameplay data, session data	Legitimate interest
Promotional communications (opted-in players only)	Contact data, gameplay preferences	Consent
Anti-money laundering (AML) compliance	Identity, KYC documents, transaction data	Legal obligation

cbajo does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Where automated systems flag an account for review — for example, due to unusual transaction patterns or suspected bonus abuse — the matter is reviewed by a member of cbajo's compliance or support team before any action is taken on the account.

If you have opted in to receive promotional communications from cbajo, you may withdraw that consent at any time by contacting support at [email protected] with the subject line "Unsubscribe". Withdrawal of consent for marketing does not affect the lawfulness of any processing that took place before you withdrew consent, and it does not affect cbajo's ability to continue processing your data for other legitimate purposes listed in the table above.

Marketing Opt-Out

To stop receiving promotional emails or notifications from cbajo, contact [email protected] with the subject "Unsubscribe". Your request will be processed within two business days.

Section 3

Data Sharing and Disclosure

cbajo does not sell, rent, or otherwise commercially transfer your personal data to any third party. However, to operate the platform effectively and meet our legal obligations, certain categories of data are shared with trusted third-party service providers. All third parties with whom cbajo shares data are contractually bound to process that data only for the specified purpose and to maintain appropriate security standards.

The following categories of third parties may receive your data in the course of normal platform operations:

1

Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Visa, and Mastercard receive the transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy and security framework. cbajo does not store full payment credentials on its own servers.
2

KYC and Identity Verification Providers: cbajo may use third-party KYC service providers to assist in verifying identity documents submitted during account registration or compliance reviews. These providers process your identity and document data solely for verification purposes.
3

Game Software Providers: Providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised or pseudonymised session data necessary to deliver their game content within the cbajo platform. These providers do not receive your full identity data.
4

Regulatory and Law Enforcement Authorities: cbajo may be required by applicable law or regulatory order to disclose personal data to competent authorities. In such cases, cbajo will comply with its legal obligations. Where permitted by law, cbajo will notify the affected account holder of any such disclosure request.
5

Platform Infrastructure Providers: cbajo uses third-party cloud hosting and infrastructure services to operate its platform. These providers may process data as part of hosting, backup, and security operations. All infrastructure providers are subject to data processing agreements with cbajo.

What We Never Do

Sell your data to advertisers
Share your data with unrelated third parties
Transfer full payment credentials to game providers
Allow third parties to use your data for their own marketing

Data Processing Agreements

Every third party that handles personal data on cbajo's behalf is bound by a formal data processing agreement that restricts their use of the data to the specific purpose for which it was shared and requires them to maintain equivalent security standards.

Section 4

Cookies and Tracking Technologies

cbajo uses cookies and similar technologies (including local storage and session storage) to provide a functional, personalised, and secure platform experience. A cookie is a small data file placed on your device by a web server when you visit a website. Cookies allow the platform to recognise your device across sessions, maintain your login state, and remember your preferences.

Categories of Cookies Used by cbajo

cbajo employs the following categories of cookies, each serving a distinct and documented purpose:

Cookie Type	Purpose	Can Be Disabled?
Essential / Session	Maintains your login session, keeps your account authenticated while you navigate the platform, and enables core security features such as CSRF protection.	No — required for platform to function
Preference	Remembers your language settings, notification preferences, and interface customisations so you do not have to reconfigure them on each visit.	Yes — via browser settings
Analytics	Collects anonymised data about how players navigate the platform — pages visited, time on page, click paths — to help cbajo improve usability and performance.	Yes — via browser settings
Security / Fraud Detection	Identifies unusual access patterns, detects potential account takeover attempts, and helps cbajo distinguish genuine player sessions from automated or fraudulent access.	No — required for account security

cbajo does not use third-party advertising or retargeting cookies. No cookie data collected on the cbajo platform is shared with advertising networks, social media platforms, or any other commercial data aggregators. The analytics cookies cbajo uses collect aggregated, anonymised data that cannot be used to identify you as an individual.

To manage or delete cookies set by cbajo, you can adjust your browser settings. Instructions for managing cookies vary by browser — consult your browser's help documentation for guidance. Please note that disabling essential cookies will prevent you from logging into your cbajo account and using the platform's core features.

Managing Cookies

Most browsers allow you to view, block, or delete cookies via the privacy or security settings menu. Blocking essential cookies will prevent cbajo from functioning correctly. Analytics and preference cookies can be safely disabled without affecting your ability to play.

Section 5

Data Security Measures

cbajo takes the security of your personal data seriously and implements a layered set of technical and organisational measures designed to protect your information from unauthorised access, disclosure, alteration, or destruction. The following security controls are in place across the cbajo platform:

256-bit SSL Encryption: All data transmitted between your device and the cbajo platform is encrypted in transit using industry-standard 256-bit Secure Socket Layer (SSL) technology. The padlock icon displayed in your browser address bar confirms that an encrypted connection is active.
Hashed Password Storage: User passwords are stored using a one-way cryptographic hashing algorithm. cbajo staff cannot view your password in plaintext form. If you forget your password, a reset flow is initiated — your original password cannot be retrieved or disclosed.
Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Only cbajo team members whose role requires access to specific data categories are granted access. All internal data access is logged and subject to periodic review.
Infrastructure Security: The cbajo platform is hosted on secured infrastructure with firewall protection, intrusion detection systems, and regular security patching to address known vulnerabilities. Security assessments are conducted on a periodic basis.
Session Security: cbajo account sessions are time-limited. After a period of inactivity, your session is automatically terminated and you will be required to log in again to continue. This reduces the risk of unauthorised access via an unattended device.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights and interests, cbajo will notify affected players without undue delay and will take immediate steps to contain and investigate the incident. If you suspect any unauthorised access to your cbajo account, contact support immediately at [email protected].

Security Highlights

256-bit SSL in transit
One-way password hashing
Role-based internal access
Automatic session timeout
Intrusion detection systems
Periodic security assessments

Suspected Breach?

If you believe your account has been accessed without your authorisation, contact [email protected] immediately. cbajo support operates 24 hours a day, 7 days a week, including Bangladeshi public holidays.

Section 6

Data Retention and Deletion

cbajo retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and compliance obligations. The following general retention periods apply:

Active Account Data: Data associated with an active cbajo account is retained for the lifetime of the account and for a period of five years following permanent account closure, in line with standard anti-money laundering (AML) record-keeping obligations.
Transaction Records: All deposit and withdrawal records are retained for a minimum of five years from the date of the transaction. These records cannot be deleted on request as they form part of cbajo's financial compliance obligations.
KYC Documents: Identity documents submitted for KYC verification are retained for five years following the closure of the associated account. Copies of KYC documents are stored in encrypted form and accessible only to cbajo's compliance team.
Support Communications: Records of support interactions are retained for three years from the date of the last communication in a given thread, after which they are securely deleted unless they form part of an ongoing dispute or compliance matter.
Analytics and Session Data: Anonymised analytics data is retained for up to 24 months for platform improvement purposes. Device and IP address logs used for security and fraud detection are retained for 12 months.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with cbajo's data destruction procedures. Where data cannot be immediately deleted due to technical constraints, it is restricted from further processing until deletion can be completed.

Players who have permanently closed their cbajo account and wish to request deletion of their personal data ahead of the standard five-year retention period may submit a request to [email protected]. cbajo will assess each request individually and will delete data that is not subject to mandatory retention obligations, confirming the outcome within 30 days.

Retention Periods at a Glance

Active account data: lifetime of account + 5 years
Transaction records: 5 years minimum
KYC documents: 5 years post-closure
Support records: 3 years
Analytics data: up to 24 months
Security / IP logs: 12 months

Section 7

Your Privacy Rights

As a cbajo player, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". cbajo will acknowledge your request within three business days and fulfil it within the timeframes stated below.

1

Right of Access: You may request a copy of all personal data cbajo holds on your account. This includes your registration information, transaction history, KYC submission records, and support communications. Requests are fulfilled within 10 business days at no charge.
2

Right to Rectification: If any personal data held by cbajo is inaccurate or incomplete, you may request that it be corrected. Name and date of birth corrections require supporting documentation. Contact information changes (mobile number, payment method) may be updated via your account settings or by contacting support.
3

Right to Erasure: Subject to our legal retention obligations, you may request deletion of your personal data following permanent account closure. Transaction records and KYC documents cannot be deleted ahead of their mandatory retention period. All other eligible data will be deleted within 30 days of a confirmed request.
4

Right to Restrict Processing: You may request that cbajo restricts the processing of your data — for example, while the accuracy of data you have disputed is being verified. During a processing restriction, cbajo will retain the data but will not actively use it for non-essential purposes.
5

Right to Data Portability: You may request a copy of the personal data you provided to cbajo in a structured, machine-readable format. This right applies to data processed on the basis of your consent or for contract performance purposes.
6

Right to Object to Marketing: You may withdraw your consent to receive promotional communications from cbajo at any time. This does not affect cbajo's ability to send you service-related communications regarding your account, transactions, or security notices.

cbajo will not charge a fee for processing data rights requests unless the request is manifestly unfounded or excessive — for example, if the same request is submitted multiple times in a short period without new grounds. In such cases, cbajo reserves the right to apply a reasonable administrative fee or to decline the request, with a written explanation provided to the requester.

To protect your account security, cbajo may require you to verify your identity before fulfilling a data rights request. This verification step ensures that personal data is not disclosed or altered in response to requests from unauthorised parties.

Submit a Data Rights Request

Email [email protected] with the subject line "Data Rights Request". Include your registered mobile number and a brief description of the right you wish to exercise. cbajo will respond within 3 business days.

Section 8

Policy Updates and Contact

cbajo reserves the right to update or amend this Privacy Policy at any time. Updates may be made to reflect changes in applicable law, developments in our data processing practices, the introduction of new platform features, or changes in the identity or scope of third-party service providers used by cbajo.

When material changes are made to this Privacy Policy — meaning changes that significantly affect how your personal data is collected, used, or shared — cbajo will make reasonable efforts to notify registered players via their registered mobile number or email address, or by displaying a prominent notice on the platform, prior to the changes taking effect.

For non-material updates (such as clarifications, formatting corrections, or minor rewording that does not affect the substance of the policy), cbajo will update this page without individual notification. The effective date displayed at the top of this page will reflect the date of the most recent revision.

Your continued use of the cbajo platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any update to this Privacy Policy, you should discontinue use of the platform and contact support to request account closure and data handling in accordance with Section 7 of this policy.

For all privacy-related queries, data rights requests, or concerns about how cbajo handles your personal information, please contact the cbajo support team. Support is available 24 hours a day, seven days a week, including all Bangladeshi public holidays such as Eid, Victory Day (December 16), and Independence Day (March 26). All privacy-related correspondence should be directed to [email protected] with the relevant subject line clearly stated.

Current Version

This Privacy Policy was last reviewed and updated in January 2026. The version published at cbajo.app/privacy-policy at the time of your visit is always the operative version.

Privacy Contact

All privacy queries: [email protected]
Subject line: "Privacy Query" or "Data Rights Request"
Response time: within 3 business days.

cbajo Privacy Policy