fbaj Privacy Policy — Your Data, Your Rights

fbaj is an internationally licensed online casino and sports betting platform operated for Bangladeshi players at fbaj.io. For the purposes of this Privacy Policy, fbaj (referred to as "fbaj", "we", "us", or "our") acts as the data controller in respect of personal data collected through the fbaj website, its associated subdomains, and any mobile applications or services provided under the fbaj brand.

As data controller, fbaj determines the purposes and means by which your personal data is processed. We take this responsibility seriously and are committed to processing your data lawfully, fairly, and transparently in accordance with applicable data protection principles.

If you have any questions about this Privacy Policy or the way fbaj handles your personal data, you may contact our data team at [email protected]. All data-related enquiries will receive a substantive response within 30 calendar days.

This Privacy Policy applies to all personal data collected, processed, and stored by fbaj in connection with:

• Visiting and browsing the fbaj website at fbaj.io, whether or not you are a registered user.
• Creating and maintaining a registered player account on the fbaj platform.
• Making deposits or withdrawals via bKash, Nagad, Rocket, Upay, or any other supported payment method.
• Placing bets, participating in casino games, or engaging with any other feature of the platform.
• Participating in promotions, bonus offers, tournaments, or any other fbaj-run campaign.
• Contacting fbaj customer support via email, live chat, or any other communication channel.
• Receiving marketing communications from fbaj where you have provided consent.

This Policy does not apply to third-party websites, applications, or services that may be accessible via links on the fbaj platform. fbaj is not responsible for the privacy practices of any third party, and we encourage you to review the privacy notices of any third-party services you access.

The following table summarises the categories of personal data that fbaj collects from or about you, along with examples of specific data points within each category:

fbaj does not collect special category (sensitive) personal data such as health information, racial or ethnic origin, political opinions, religious beliefs, or biometric data unless specifically required to satisfy a responsible gaming obligation (for example, processing a self-exclusion request linked to a medical professional's recommendation). In such cases, the data is processed only with your explicit consent.

fbaj collects personal data through the following means:

• Direct collection: Data you provide voluntarily when registering, completing identity verification, making transactions, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, server logs, and similar tracking technologies as you browse and use the platform.
• Third-party sources: Identity verification data may be cross-referenced with third-party KYC and anti-fraud databases. Payment data is confirmed via your mobile financial service provider (bKash, Nagad, Rocket, Upay). Fraud signals may be received from industry-shared fraud prevention networks.

Where data is collected from third-party sources, fbaj ensures that those sources have the appropriate legal basis to share the data with us, and that the data is used only for the purpose for which it was shared.

fbaj processes your personal data only where a valid legal basis exists. The legal bases we rely on are as follows:

• Performance of a contract: Processing that is necessary to provide you with the fbaj service — including account management, payment processing, and bet settlement — is carried out on the basis that it is required to perform the contract between you and fbaj.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and responses to lawful authority requests.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where those interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing communications and the use of non-essential cookies, carried out only where you have provided a clear, freely given, and withdrawable consent.

Where fbaj relies on legitimate interests as a legal basis, a legitimate interests assessment has been conducted to ensure the processing is proportionate and does not unduly prejudice your rights.

fbaj uses your personal data for the following purposes:

• Creating, verifying, and managing your player account, including password resets and security alerts.
• Processing deposits and withdrawals through your nominated bKash, Nagad, Rocket, or Upay wallet.
• Verifying your identity and age (21+) in compliance with KYC obligations before processing withdrawals or upon request from our compliance team.
• Settling bets and resolving disputes related to bet outcomes, including cricket BPL and T20 events, football, and live casino games.
• Detecting, investigating, and preventing fraud, money laundering, account abuse, and other prohibited activities.
• Monitoring gaming activity to identify problem gambling patterns and fulfilling our responsible gaming obligations.
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) to your registered mobile number or email address.
• Sending promotional communications (bonus offers, seasonal promotions such as Eid or Pohela Boishakh specials, new game announcements) where you have opted in to receive them.
• Conducting internal analytics to understand platform usage patterns and improve the fbaj user experience.
• Complying with legal, regulatory, and licensing obligations applicable to fbaj's international operation.

fbaj does not use your personal data to make automated decisions that produce legal or similarly significant effects without human review. Where automated systems flag an account for fraud or AML review, a qualified compliance officer reviews the case before any action is taken on the account.

fbaj does not sell, rent, or trade your personal data to any third party for commercial gain. We share personal data only in the following strictly defined circumstances:

• Payment processors: Your payment wallet identifiers and transaction amounts are shared with bKash, Nagad, Rocket, and Upay solely for the purpose of processing your deposits and withdrawals.
• Game content providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and game session data required to operate the game and settle results. These providers do not receive your full identity data.
• KYC and identity verification services: Your identity documents may be shared with third-party identity verification platforms solely for the purpose of confirming your eligibility to use the fbaj platform.
• Fraud and AML screening services: Anonymised or pseudonymised data may be shared with industry fraud prevention networks to identify and prevent fraudulent activity.
• Legal and regulatory authorities: fbaj will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by a valid legal order, warrant, or regulatory instruction. fbaj will notify you of such disclosures where it is legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the fbaj business, player account data may be transferred to the successor entity. Players will be notified before any such transfer takes place and before their data becomes subject to a different privacy policy.

All third-party service providers who process personal data on fbaj's behalf are required to enter into a data processing agreement with fbaj, under which they are contractually bound to process data only in accordance with fbaj's instructions and to implement appropriate security measures.

fbaj uses cookies and similar technologies (web beacons, pixel tags, local storage) to operate the platform, remember your preferences, maintain your session, and collect analytics data about how the platform is used.

The categories of cookies used on the fbaj platform are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional cookies: Used to remember your language preference, display settings, and region. These improve your experience but are not essential to platform operation.
• Analytics cookies: Used to collect anonymised data about how players navigate the site, which pages are visited most frequently, and where errors occur. This data is used to improve the platform. Analytics cookies are only placed with your consent.
• Marketing cookies: Used to deliver promotional content that is relevant to your interests and to measure the effectiveness of fbaj's promotional campaigns. Marketing cookies are only placed with your explicit consent.

You may manage your cookie preferences at any time through your browser settings. Disabling analytics or marketing cookies will not affect your ability to use the core fbaj platform, though some personalisation features may be reduced.

fbaj retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to legal and regulatory minimum retention requirements. The following retention periods apply:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years following account closure. This period is required to satisfy AML record-keeping obligations.
• Transaction records: All deposit and withdrawal records are retained for a minimum of 7 years from the date of the transaction, in compliance with financial record-keeping standards.
• Communications data (support tickets, emails): Retained for 3 years from the date of the communication, or for the duration of any related dispute resolution process if longer.
• Marketing preference records: Retained for the duration of your account plus 2 years. This allows fbaj to demonstrate compliance with consent obligations in the event of a regulatory query.
• Technical and analytics data: Retained in anonymised or aggregated form for up to 2 years from collection. Raw IP address logs are retained for no more than 12 months.

At the end of the applicable retention period, personal data is securely deleted from fbaj's systems or irreversibly anonymised such that it can no longer be associated with an identifiable individual. Where anonymised data is retained for statistical purposes, it does not constitute personal data and is not subject to this Policy.

fbaj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in transit: All data transmitted between your browser or device and fbaj's servers is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon visible in your browser's address bar confirms this encryption is active.
• Encryption at rest: Personal and financial data stored on fbaj's servers is encrypted using AES-256 encryption. Database backups are encrypted using the same standard.
• Access controls: Access to personal data within fbaj is restricted to authorised personnel on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and receive regular data protection training.
• Two-factor authentication: Player accounts can be secured with two-factor authentication (2FA). We strongly recommend enabling 2FA from your account settings.
• Intrusion detection: fbaj's infrastructure is monitored 24/7 by automated intrusion detection and anomaly alerting systems. Security incidents are reviewed by a dedicated team.
• Penetration testing: fbaj's systems undergo periodic independent security assessments to identify and remediate vulnerabilities before they can be exploited.

Despite these measures, no online platform can guarantee absolute security. In the unlikely event of a data breach that poses a risk to your rights, fbaj will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

Subject to applicable law, you have the following rights in respect of the personal data fbaj holds about you:

• Right of access: You may request a copy of all personal data fbaj holds about you. We will provide this in a structured, commonly used format within 30 calendar days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. Corrections to identity data may require submission of updated documentation.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing and there is no overriding legitimate interest. This right is subject to legal retention requirements — we cannot delete transaction records we are legally required to hold.
• Right to restriction of processing: You may request that fbaj limits how it uses your data while a rectification or objection request is being assessed.
• Right to data portability: Where processing is based on contract or consent, you may request that we provide your data in a machine-readable format so that it can be transferred to another service provider.
• Right to object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes, where your particular circumstances justify it. fbaj will assess the objection and discontinue processing unless compelling legitimate grounds exist.
• Right to withdraw consent: Where processing is based on your consent (such as marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact [email protected] with the subject line "Data Subject Request". We will verify your identity before processing any request, to ensure your data is not disclosed to an unauthorised party. There is no charge for exercising your rights unless requests are manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply.

fbaj will send you marketing communications — including promotional offers, bonus announcements, and seasonal campaigns (such as BPL season offers, Eid promotions, and Pohela Boishakh specials) — only where you have provided your explicit consent to receive them at the time of registration or subsequently through your account settings.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by fbaj.
• Updating your communication preferences in your fbaj account settings under "Notifications".
• Contacting [email protected] with the request "Unsubscribe from marketing".

Opting out of marketing communications does not affect the delivery of transactional messages that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, and security alerts. These transactional messages are sent on the basis of contract performance rather than consent and will continue regardless of your marketing preference.

fbaj does not engage in unsolicited bulk marketing (spam) and does not share your contact details with third parties for their independent marketing purposes.

The fbaj platform is strictly intended for adults aged 21 and above. fbaj does not knowingly collect personal data from any individual under the age of 21. If fbaj becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed.

If you believe that a person under 21 has registered on the fbaj platform or that their data has been submitted to fbaj without appropriate consent, please contact [email protected] immediately so that the matter can be investigated and resolved promptly.

fbaj's platform infrastructure and some of its third-party service providers may be located in jurisdictions outside Bangladesh. Where personal data is transferred internationally, fbaj ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required in the jurisdiction of collection.

Safeguards employed for international transfers include:

• Standard contractual clauses incorporated into data processing agreements with third-party service providers.
• Transfer impact assessments conducted for transfers to jurisdictions without equivalent data protection frameworks.
• End-to-end encryption for all data transmitted across international network boundaries.

fbaj will not transfer personal data to a third country unless the appropriate safeguards described above are in place, or unless an exemption applies (such as where the transfer is necessary for the performance of your contract, for example processing a withdrawal via an internationally operated payment network).

fbaj may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the structure of the platform. When we make material changes to this Policy, we will:

• Update the "Last updated" date at the top of this document.
• Publish the revised Policy on this page with the new effective date.
• Notify registered players of material changes via the email address or mobile number associated with their account, where the change significantly affects their rights or the way their data is used.

Your continued use of the fbaj platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with the revised terms, you must discontinue use of the platform and may request account closure by contacting [email protected].

We encourage you to review this page periodically so that you remain informed about how fbaj handles your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way fbaj processes your personal data, please contact us using the details below. All data-related correspondence is handled by fbaj's compliance and data team.

• Email: [email protected] — please use the subject line "Privacy Query" or "Data Subject Request" so your message is routed to the appropriate team.
• Response time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full substantive response within 30 calendar days.
• Live chat: Available from within your logged-in fbaj account for general support, including guidance on exercising your data rights.

For matters relating to responsible gaming, self-exclusion, or deposit limit management, please visit our Responsible Gaming page, which provides dedicated guidance and direct links to our responsible gaming tools.

For a full overview of your rights and obligations as a player on the fbaj platform, please also review our Terms & Conditions.