cx baji Privacy Policy

Section 1

Data We Collect

cx baji collects personal data only to the extent necessary to provide a secure, compliant, and high-quality gaming experience for players based in Bangladesh and other permitted markets. We collect data through three primary channels: information you provide directly, data generated automatically through your use of the platform, and information received from third-party identity and payment verification partners.

The categories of personal data cx baji may collect are set out in the table below. Not all categories apply to every user; the data collected depends on the features you use and the stage of your account lifecycle (e.g., a visitor who has not registered an account will generate a more limited data profile than a fully verified player).

cx baji does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or health data unless legally required to do so for responsible gaming or anti-money laundering compliance purposes. Where such data is collected under a legal obligation, it will be processed only for that specific statutory purpose and will not be used for marketing or profiling.

Section 2

How We Use Your Data

Every use of your personal data by cx baji is grounded in one of the following lawful bases: fulfilment of the contractual relationship between you and cx baji; compliance with a legal or regulatory obligation; our legitimate interests in operating a safe and commercially viable platform; or, where required, your explicit consent.

The primary purposes for which cx baji processes your personal data are as follows:

• Account creation and management: Your identity and contact data are used to establish, maintain, and administer your cx baji account, including processing login requests, password resets, and account security alerts.
• Payment processing: Financial data is used to process deposits via bKash, Nagad, Rocket, Upay, and bank transfer partners, and to fulfil approved withdrawal requests to your registered BDT payment method.
• Identity verification (KYC): Identity and verification data are processed to confirm that you meet cx baji's eligibility criteria, including the 18+ age requirement, and to comply with anti-money laundering obligations.
• Platform personalisation: Usage and technical data are used to tailor your cx baji experience, including recommending relevant games, displaying localised content for Bangladeshi players, and pre-filling account preferences.
• Security and fraud prevention: Technical and usage data are continuously analysed to detect and prevent fraudulent activity, unauthorised account access, bonus abuse, and collusion between players.
• Customer support: Communication data is used to respond to your support queries, investigate complaints, and maintain records of interactions for quality and training purposes.
• Responsible gaming: Usage data — including betting frequency, session duration, and deposit patterns — may be used to identify indicators of problem gambling and to apply responsible gaming interventions such as cooling-off periods or account limits, in accordance with cx baji's Responsible Gaming commitments.
• Marketing communications: Where you have opted in to receive promotional communications, your contact data and usage history will be used to send you relevant offers, promotions, and platform updates by email or SMS. You may withdraw this consent at any time by contacting [email protected].
• Legal compliance: cx baji may be required by applicable law, court order, or regulatory instruction to process and disclose personal data. In such cases, processing is carried out strictly to the extent required by the relevant legal obligation.

cx baji does not use automated decision-making processes that produce legal or similarly significant effects on individual players without human review. Where automated systems flag an account for review — for example, as part of fraud detection — a member of the cx baji compliance team will conduct a manual assessment before any material action is taken against the account.

Section 3

Data Sharing and Disclosure

cx baji does not sell your personal data. We share personal data with third parties only where it is necessary to deliver our services, comply with legal obligations, or protect the integrity of the platform. All third-party recipients of cx baji player data are bound by contractual data protection obligations consistent with this policy.

The categories of third parties with whom cx baji may share your personal data are described below:

• Payment service providers: Financial data is shared with bKash, Nagad, Rocket, Upay, and banking partners solely for the purpose of processing deposits and withdrawals. These providers operate under their own data protection frameworks and are regulated financial entities.
• Identity verification partners: KYC documentation may be shared with third-party identity verification service providers engaged by cx baji to conduct document authentication and age verification checks. These providers process data on cx baji's behalf and are contractually prohibited from using it for any other purpose.
• Game software providers: Technical data such as your account identifier, game session ID, and wager amounts may be shared with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to enable game functionality, calculate outcomes, and resolve game-related disputes. These providers do not receive your full identity profile.
• Platform technology providers: cx baji uses third-party infrastructure providers for hosting, content delivery, analytics, and customer support tooling. These providers act as data processors and handle personal data only as directed by cx baji.
• Legal and regulatory authorities: cx baji may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required by applicable law, a valid court order, or a legitimate governmental request. cx baji will notify the affected player of any such disclosure where legally permitted to do so.
• Business transfer: In the event of a merger, acquisition, or asset sale involving cx baji, player personal data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

Section 4

Cookies and Tracking Technologies

cx baji uses cookies and similar tracking technologies — including pixel tags and local storage objects — to ensure the platform functions correctly, to measure performance, and to deliver a personalised experience. This section explains the types of cookies we use and how you can manage them.

Cookies are small text files stored on your device when you visit cx-baji.com. They allow the platform to remember your preferences, maintain your session between pages, and collect aggregated data about how players navigate the site. cx baji uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account state between pages, enforce security controls, and remember items you have added to a cart or form. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: These cookies collect aggregated, anonymised data about how players use cx-baji.com — including which pages are visited most frequently, how long sessions last, and where players encounter errors. This data helps cx baji improve the platform over time. No personally identifiable information is collected by analytics cookies.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and last-used payment method — so you do not need to re-enter them on every visit. Disabling functional cookies will mean these preferences are not remembered between sessions.
• Responsible gaming cookies: cx baji uses first-party cookies to enforce deposit limits, session time reminders, and self-exclusion periods that you have set via the responsible gaming tools in your account. These cookies are treated as strictly necessary for player protection purposes.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site or global basis. Please note that disabling strictly necessary cookies will prevent you from logging in to your cx baji account and using core platform features. Instructions for managing cookies are available in the help documentation of all major browsers including Chrome, Firefox, Safari, and Edge.

cx baji does not use third-party advertising cookies or behavioural tracking cookies that monitor your activity across websites other than cx-baji.com. Any tracking carried out by cx baji is limited to activity within our own platform domain.

Section 5

Data Security Measures

cx baji implements a layered approach to data security, combining technical controls, organisational policies, and staff training to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

The technical security measures in place at cx baji include the following:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or app and cx baji servers is encrypted using TLS 1.2 or higher. This ensures that your login credentials, financial details, and personal information cannot be intercepted in transit.
• Encrypted data storage: Sensitive personal data — including identity documents, payment details, and account credentials — is stored in encrypted form in cx baji's secure data environment. Encryption keys are managed separately from the data they protect.
• Access controls: Access to personal data within cx baji's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of access required to perform their job function, and all access is logged for audit purposes.
• Two-factor authentication: cx baji offers two-factor authentication (2FA) for player accounts. We strongly recommend enabling 2FA via your account security settings to add an additional layer of protection beyond your password.
• Continuous monitoring: cx baji's platform infrastructure is subject to continuous security monitoring. Anomalous activity — including unusual login locations, abnormal transaction patterns, and potential data exfiltration attempts — triggers automated alerts reviewed by the security team.
• Third-party security assessments: cx baji engages external security professionals to conduct periodic assessments of platform security controls. Findings are remediated according to a risk-prioritised schedule.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. In the unlikely event of a data breach that affects your personal data, cx baji will notify affected players as promptly as practicable, providing details of the nature of the breach, the data categories affected, and the steps cx baji is taking to contain and remediate the incident.

Section 6

Data Retention

cx baji retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including the satisfaction of any legal, accounting, or reporting obligations. The specific retention periods applied to different categories of data are described below.

For active player accounts, personal data is retained for the duration of the account relationship plus a post-closure retention period to satisfy applicable legal obligations. The standard post-closure retention period for core identity, financial, and transaction data is five years, reflecting common anti-money laundering record-keeping requirements. Communication and support records are retained for three years following account closure. Technical and usage data is anonymised or deleted on a rolling basis, typically within 13 months of collection.

Where you have provided consent as the lawful basis for a specific processing activity — such as receiving promotional communications — your data will be processed for that purpose only until you withdraw your consent. Withdrawal of consent for marketing does not affect the processing of your data for other purposes (such as account management or legal compliance) which are based on separate lawful grounds.

Following the expiry of the applicable retention period, cx baji will securely delete or anonymise personal data such that it can no longer be associated with an identifiable individual. Where technical constraints prevent immediate deletion, data will be placed in a restricted state and isolated from active processing systems until secure deletion is carried out.

• Active account data: Retained for the lifetime of the account plus 5 years post-closure.
• KYC verification documents: Retained for 5 years following account closure or the last verified transaction, whichever is later.
• Transaction and financial records: Retained for 5 years in accordance with standard financial record-keeping requirements.
• Support and communication records: Retained for 3 years following the last interaction or account closure, whichever is later.
• Marketing consent records: Retained for the duration of your consent plus 2 years as evidence of the consent given.
• Technical and usage data: Anonymised on a rolling 13-month cycle; anonymised aggregates may be retained indefinitely for platform analytics.

Section 7

Your Privacy Rights

As a cx baji player, you hold a number of rights in relation to the personal data we hold about you. cx baji is committed to upholding these rights and to responding to valid requests within a reasonable timeframe, typically within 30 days of receipt.

The privacy rights available to you in connection with your cx baji account are as follows:

• Right of access: You have the right to request a copy of the personal data cx baji holds about you, together with information about the purposes for which it is processed, the categories of data held, and the third parties with whom it has been shared.
• Right to rectification: If any personal data cx baji holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account information (such as your email address or contact number) directly via your account settings; for changes to core identity data, please contact support.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other lawful basis applies, or where you object to processing and no overriding legitimate interest exists. Please note that cx baji may be required to retain certain data to comply with legal obligations, which may limit the scope of erasure in specific cases.
• Right to restriction of processing: You may request that cx baji restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is verified, or where you have objected to processing pending the outcome of a legitimate interest assessment.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on cx baji's legitimate interests. You also have an absolute right to object to the use of your personal data for direct marketing purposes at any time.
• Right to data portability: Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you have the right to receive the personal data you provided to cx baji in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where cx baji processes your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the rights described above, please submit a written request to [email protected] with the subject line "Privacy Rights Request". Include your full name, registered email address, and a description of the right you wish to exercise. cx baji may need to verify your identity before processing your request to ensure that personal data is not disclosed to an unauthorised party.

Section 8

Policy Updates and Contact

cx baji reviews this Privacy Policy periodically and updates it as necessary to reflect changes in data processing practices, applicable law, or platform features. The effective date displayed at the top of this policy indicates when the most recent revision was made.

Where a revision to this Privacy Policy materially affects the rights of existing players or introduces a new purpose for which personal data is processed, cx baji will provide advance notice of the change via the email address registered to your account, typically at least 14 days before the revised policy takes effect. For minor or clarificatory updates that do not affect player rights, the policy may be updated without individual notification, though the revised version will always be accessible at cx-baji.com/privacy-policy.

Continued use of the cx baji platform following the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with any revision to this policy, you should cease using the platform and contact support to discuss account closure options.

If you have any questions about this Privacy Policy, wish to exercise a privacy right, or have a concern about the way in which cx baji handles your personal data, please contact the cx baji privacy team using the details below. We aim to respond to all privacy-related enquiries within 5 business days and to resolve substantive requests within 30 calendar days.

• Privacy enquiries: [email protected] (subject line: "Privacy Policy Enquiry")
• Data rights requests: [email protected] (subject line: "Privacy Rights Request")
• Data breach reports: [email protected] (subject line: "Data Security Concern")
• Response time: 5 business days for acknowledgement; 30 calendar days for resolution of substantive requests
• Platform: cx-baji.com
• Effective date: January 2026