cbajo Privacy Policy — Your Data, Your Rights

1Information We Collect

cbajo collects personal data through multiple channels: directly from you when you register or interact with the Platform, automatically through technical systems when you browse or play, and occasionally from third-party payment processors as part of transaction processing. The categories of data we collect are summarised in the table below.

2How We Use Your Information

cbajo uses your personal data only for specific, legitimate purposes directly related to the provision of our services and the safe operation of the Platform. We do not use your data in ways that would be incompatible with these stated purposes. The primary uses are set out below.

• To create and manage your cbajo account, verify your identity, and confirm that you meet our eligibility criteria including the 21+ age requirement.
• To process your deposits and withdrawals via bKash, Nagad, Rocket, and Upay in BDT, and to maintain accurate transaction records.
• To deliver our core gaming and betting services, including calculating odds, processing bet results, crediting winnings, and providing access to live casino tables and slot games.
• To detect and prevent fraud, money laundering, account takeover attempts, and other prohibited activities that could harm you or other users of the Platform.
• To send you account-related communications, including deposit confirmations, withdrawal notifications, security alerts, and responses to your support enquiries. We do not send unsolicited marketing messages.
• To support responsible gaming initiatives, including monitoring for signs of problem gambling, applying self-exclusion orders, and enforcing deposit limits set by the player.

3Legal Basis for Processing

cbajo processes your personal data under one or more of the following legal grounds, depending on the nature of the processing activity.

• Contractual necessity: processing required to fulfil our obligations to you under the cbajo Terms and Conditions, including account management, payment processing, and game delivery.
• Legitimate interests: processing necessary for fraud prevention, security monitoring, platform improvement, and responsible gaming enforcement, where these interests are not overridden by your privacy rights.
• Legal obligation: processing required to comply with applicable anti-money laundering requirements, tax regulations, or instructions from competent authorities.
• Consent: where you have given specific, freely-given consent for a particular processing activity (for example, opting in to receive promotional communications). You may withdraw consent at any time without affecting prior processing.

4Payment Data and Financial Information

Because cbajo processes real-money transactions in BDT through mobile wallet providers, financial data receives the highest level of protection within our systems. The following specific rules apply to payment-related data.

• cbajo does not store full bKash, Nagad, or Rocket wallet credentials on its own servers. Payment channel interactions are handled directly by the respective payment provider using tokenised references only.
• Transaction records (amounts, timestamps, wallet reference codes, and outcomes) are retained for a minimum of five years in accordance with standard financial record-keeping requirements.
• cbajo monitors transaction patterns for signs of unusual activity, including potential fraud or money laundering. This monitoring is conducted by automated systems and does not constitute manual review of individual transactions in the ordinary course.

5Sharing Your Information

cbajo does not sell, rent, or licence your personal data to third parties. We share data only in the limited circumstances described below, and only to the minimum extent necessary.

• Payment service providers (bKash, Nagad, Rocket, Upay): we share the minimum transaction data necessary for processing your deposits and withdrawals. These providers operate under their own privacy policies and are independently responsible for their data handling.
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi and others): your player session data is shared to the extent required to deliver certified game outcomes. Provider access is limited to session-level data and does not include your full identity or financial profile.
• Regulatory and law enforcement authorities: cbajo will disclose personal data to competent authorities where required by law, court order, or regulatory instruction. We will notify you of such disclosure where legally permitted to do so.
• Technology and security service providers: cbajo may engage third-party service providers for infrastructure hosting, fraud detection, and security monitoring. These providers are contractually bound to process data only on cbajo's instructions and may not use your data for their own purposes.

6Cookies and Tracking Technologies

cbajo uses cookies and similar tracking technologies to support essential Platform functionality, improve the player experience, and detect fraudulent or abusive activity. The types of cookies we use are described below.

• Strictly necessary cookies: required for the Platform to function. These include session authentication tokens, language preference cookies, and security cookies. These cannot be disabled without breaking core functionality.
• Analytics cookies: used to understand how players use the Platform, which pages are visited most frequently, and where technical errors occur. This data is aggregated and does not identify individual users.
• Fraud detection cookies: cbajo uses session fingerprinting and behavioural signals to detect automated bots, account takeover attempts, and coordinated abuse patterns. This processing is conducted in cbajo's legitimate interest in maintaining a safe platform.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from logging in or using core Platform features. cbajo does not use advertising or cross-site tracking cookies.

7Data Retention

cbajo retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide.

• Active account data (identity, contact, financial records) is retained for the full duration of your account's active life, plus a minimum of five years following account closure to satisfy anti-money laundering record-keeping obligations.
• Technical and session logs are retained for a maximum of 12 months unless a security investigation requires extended retention. Aggregated and anonymised analytics data may be retained indefinitely as it cannot be used to identify individuals.
• Where you have exercised your right to erasure and cbajo is not required by law to retain the data, we will securely delete or anonymise your personal data within 30 days of confirming the erasure request.

8Security of Your Data

cbajo implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our key security measures are described below.

• All data transmitted between your device and the cbajo Platform is encrypted using SSL (Secure Sockets Layer) technology. This prevents interception of your login credentials, session data, and payment information in transit.
• Access to player personal data within cbajo's internal systems is restricted on a strict need-to-know basis. Staff with access to personal data are trained in data protection obligations and are subject to confidentiality agreements.
• In the event of a personal data breach that is likely to result in risk to your rights and freedoms, cbajo will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

9Your Rights

As a cbajo player based in Bangladesh, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team using the email address shown in the footer of this page.

• Right of access: you may request a copy of the personal data cbajo holds about you. We will provide this within 30 days of a verified request.
• Right to rectification: if any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed.
• Right to erasure: you may request deletion of your personal data where cbajo no longer has a legitimate purpose or legal obligation to retain it. This right is subject to our minimum retention obligations under financial record-keeping requirements.
• Right to restrict processing: in certain circumstances you may request that cbajo limits the processing of your data while a dispute is being resolved, rather than deleting it.
• Right to data portability: where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a structured, commonly-used, machine-readable copy of the data you have provided to cbajo.

cbajo will respond to all privacy rights requests within 30 days. Where a request is complex or numerous, we may extend this by a further 30 days and will notify you accordingly. We do not charge a fee for handling privacy rights requests in ordinary circumstances.

10Children's Privacy

cbajo is strictly an adults-only platform. We do not knowingly collect or process personal data relating to any individual under the age of 21. Our registration process includes age declaration and cbajo reserves the right to request documentary proof of age at any time. If cbajo becomes aware that personal data has been collected from a person under 21, that account will be closed immediately and all associated data will be deleted, subject only to any minimum legal retention obligations.

11Changes to This Policy

cbajo reserves the right to update or revise this Privacy Policy at any time. When material changes are made, we will publish the updated Policy on this page with a revised "Last Updated" date. Where the changes significantly affect how we process your personal data, we will notify you via the Platform or by direct communication where practicable.

Your continued use of cbajo following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the Platform and may request account closure by contacting our support team.

12Contact and Data Requests

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how cbajo has handled your personal data, please contact our support team by email using the address shown in the footer of this page. Please include your registered mobile number and a clear description of your request so we can process it promptly.

We aim to respond to all data-related enquiries within 30 days. For urgent account security matters, please state "URGENT" in the subject line of your email. All requests are handled in strict confidence. cbajo does not charge a fee for processing privacy rights requests in ordinary circumstances.