Privacy Policy — khelo baji

Data We Collect

When you register for or use the khelo baji platform, we collect personal data that is necessary to provide our services, verify your identity, process payments, and comply with our legal obligations. We collect only what is genuinely required — no more.

Information You Provide Directly

The following data is collected when you register an account, complete KYC verification, or contact our support team:

Information Collected Automatically

When you visit and use the khelo baji platform, our systems automatically collect certain technical and behavioural data:

• Device Information: Device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and language settings.
• Network Information: IP address, approximate geographic location (derived from IP, not GPS), internet service provider.
• Usage Data: Pages visited, games played, bet amounts and outcomes, session duration, click patterns, and navigation paths within the platform.
• Performance Data: Page load times, error logs, crash reports, and platform stability metrics used for service improvement.

Information from Third Parties

In certain circumstances, we may receive personal data about you from third-party sources, including:

• Payment Processors: bKash, Nagad, Rocket, Upay, and our banking partners may share transaction confirmation and fraud-screening data with us.
• Identity Verification Services: We use third-party KYC providers to verify the authenticity of identity documents submitted during account verification.
• Fraud Prevention Agencies: We may receive risk-scoring data from industry fraud-prevention networks to protect the platform and its users.

How We Use Your Data

khelo baji processes your personal data only for clearly defined, lawful purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected. The following table sets out our processing activities and their legal bases.

Marketing Communications

If you have opted in to receive promotional communications from khelo baji, we may send you emails or SMS messages about new games, upcoming cricket events (such as BPL or IPL fixtures), seasonal promotions, and bonus offers. You may withdraw your consent and unsubscribe from marketing communications at any time by updating your notification preferences in your account settings or by contacting our support team.

Data Sharing & Disclosure

khelo baji does not sell, rent, or commercially share your personal data with third parties for their own marketing purposes. Data is shared only in the limited circumstances described below, and always subject to strict confidentiality and security obligations.

Service Providers and Data Processors

We engage carefully selected third-party service providers who process personal data on our behalf and under our documented instructions. These include:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive transaction-specific data necessary to execute deposits and withdrawals.
• KYC and Identity Verification Providers: Specialist third-party providers verify the authenticity of your identity documents. They receive only the specific data required for verification and are contractually prohibited from using it for any other purpose.
• Game Studios and Content Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and anonymised player identifiers necessary to deliver their game content and report RTP data. They do not receive your full identity or financial data.
• Fraud Prevention and Security Services: We share IP addresses, device fingerprints, and anonymised transaction patterns with industry fraud-prevention networks to protect the platform from financial crime.
• Customer Support Infrastructure: Our live chat and ticketing system providers process contact data and support transcripts on our behalf under strict data processing agreements.

Legal and Regulatory Disclosures

khelo baji may disclose personal data to law enforcement agencies, regulatory authorities, or judicial bodies in the following circumstances:

• Where required by a valid court order, subpoena, or statutory demand.
• Where disclosure is necessary to prevent, detect, or prosecute financial crime, fraud, or money laundering.
• Where required to protect the safety of our users or the general public.
• Where required to enforce our Terms & Conditions or protect the legal rights of the Company.

In all such cases, khelo baji discloses only the minimum data necessary to satisfy the legal obligation and notifies the affected user wherever we are legally permitted to do so.

Business Transfers

In the event that khelo baji undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of the transaction. In such circumstances, we will notify affected users in advance and ensure that the receiving entity is bound by privacy commitments at least as protective as those set out in this Privacy Policy.

Cookies & Tracking

khelo baji uses cookies and similar tracking technologies (such as local storage and session tokens) to ensure the platform functions correctly and to deliver a personalised, secure experience to every user. This section explains what cookies we use, why we use them, and how you can manage your preferences.

What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They allow the website to recognise your device on subsequent visits, remember your preferences, and maintain session continuity. Cookies do not contain executable code and cannot access other files or data stored on your device.

Types of Cookies We Use

Third-Party Cookies

Game content delivered by third-party studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others) may set their own session cookies within their game frames in order to maintain game state and calculate RTP outcomes. These cookies are scoped to the game provider's domain and are governed by the respective studio's own privacy practices. khelo baji does not control these third-party cookies and does not receive personally identifiable data from them.

Managing Your Cookie Preferences

You can manage or delete cookies through your browser settings at any time. Most modern browsers allow you to block all cookies, accept only first-party cookies, or clear cookies after each session. Please be aware that disabling strictly necessary cookies will impair your ability to use the khelo baji platform, as session management and security features depend on them.

Data Retention

khelo baji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve any disputes or enforce our agreements. We operate a formal data retention schedule that is reviewed annually.

Retention Periods by Data Category

• Account and Identity Data: Retained for the duration of your account relationship with khelo baji, plus a minimum of five (5) years following account closure, in accordance with AML and record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by applicable financial regulations.
• KYC Verification Documents: Retained for five (5) years following the completion of verification or account closure, whichever is later.
• Customer Support Records: Live chat transcripts and email correspondence are retained for three (3) years from the date of the last communication.
• Marketing Consent Records: Retained for three (3) years from the date of consent, or until consent is withdrawn, whichever comes first.
• Technical and Analytics Data: Anonymised analytics data is retained for up to twelve (12) months. Raw server logs are retained for up to ninety (90) days before being purged or anonymised.

Deletion Following Account Closure

When you close your khelo baji account, we will initiate the deletion or anonymisation of your personal data that is no longer required for legal or regulatory purposes within sixty (60) days of the closure date. Data subject to mandatory retention periods (such as financial transaction records) will be securely archived and isolated from operational systems for the duration of the required retention period, after which it will be permanently deleted.

Data Security

Protecting the security of your personal data is a core operational priority for khelo baji. We implement a layered, defence-in-depth security architecture that encompasses technical controls, physical safeguards, and organisational policies.

Technical Security Measures

• TLS/SSL Encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher. Our SSL certificate ensures that the padlock indicator is always visible in your browser when using khelo baji.
• Password Hashing: Account passwords are never stored in plaintext. They are processed through a strong one-way cryptographic hashing algorithm with a unique per-user salt before storage.
• Database Encryption: Sensitive fields within our databases — including financial account numbers and identity document data — are encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): We offer 2FA for all player accounts as an optional but strongly recommended security layer. Players in Bangladesh can use SMS-based verification via their registered mobile number.
• Intrusion Detection: Our security infrastructure includes real-time intrusion detection systems (IDS) and automated anomaly alerting to detect and respond to potential threats proactively.
• Regular Security Audits: We conduct periodic penetration testing and vulnerability assessments, carried out by qualified independent security professionals, to identify and remediate weaknesses before they can be exploited.

Organisational Security Measures

• Access to personal data is granted on a strict need-to-know basis. Only authorised staff with a verified operational need may access user data, and all access is logged.
• All staff who handle personal data receive mandatory data protection and information security training on joining the Company and at regular intervals thereafter.
• Third-party service providers are contractually required to maintain security standards equivalent to our own and are subject to due-diligence review before engagement.

Data Breach Response

In the unlikely event of a data breach that poses a risk to your rights and freedoms, khelo baji has an incident response plan that includes prompt internal escalation, containment measures, and notification to affected users and relevant authorities within the timeframes required by applicable law. We will communicate with you clearly and honestly about what happened, what data was affected, and what steps we are taking to protect you.

Your Rights & Choices

As a user of khelo baji, you have a number of rights with respect to your personal data. We are committed to respecting and facilitating these rights in a timely and transparent manner. You may exercise any of the rights listed below by contacting our support team via live chat or by email at [email protected] (plain text — not a clickable link).

Right of Access

You have the right to request a copy of the personal data that khelo baji holds about you. We will respond to verified access requests within thirty (30) days. Your first request in any twelve-month period is provided free of charge; subsequent requests may be subject to a reasonable administrative fee.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. For account-critical data such as your legal name or date of birth, we may require supporting documentation before making changes, to ensure the integrity of our KYC records.

Right to Erasure

You may request that we delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Please note that this right is subject to legal and regulatory retention obligations; we cannot delete data that we are required by law to retain.

Right to Restrict Processing

You have the right to request that we limit how we use your data in certain circumstances — for instance, while a disputed accuracy claim is being investigated, or where you have objected to processing based on legitimate interests pending verification of our grounds.

Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to request that we transmit this data directly to another controller where technically feasible.

Right to Object

You have the right to object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on our legitimate interests, in which case we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Right to Withdraw Consent

Where we process your data based on your consent (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. You can update your marketing preferences in your account settings or contact our support team.

Policy Updates & Contact

khelo baji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, the introduction of new services, changes in applicable law, or improvements in our privacy standards. The effective date displayed at the top of this page will be updated each time a material change is made.

How We Notify You of Changes

When we make material changes to this Privacy Policy, we will notify registered users by email to the address associated with their account and by displaying a prominent notice on the khelo baji platform for a minimum of fourteen (14) days following the update. For minor, non-material changes — such as typographical corrections or clarifications that do not alter our actual data practices — we will update the page without a formal notification, though the effective date will reflect the revision.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of the khelo baji platform following notification of a material change constitutes your acceptance of the revised Privacy Policy.

Children's Privacy

khelo baji is strictly an adult platform for users aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete the data and permanently close the associated account. If you believe a minor has created an account on khelo baji, please contact our support team immediately.

Links to Third-Party Content

The khelo baji platform may include references to third-party game studios and payment providers in the normal course of delivering our service. This Privacy Policy applies solely to personal data processed by khelo baji. Each third-party service provider operates under its own privacy policy, and we encourage you to review those policies where relevant.

Contact Our Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or the way khelo baji handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly on the khelo baji platform — the fastest way to reach our support team.
• Email: [email protected] (plain text — not a clickable link). We aim to respond to all privacy-related enquiries within five (5) business days.

We take all privacy concerns seriously and will work with you to resolve any issues promptly and fairly. If you are not satisfied with our response, you may escalate your complaint to the relevant data protection authority in your jurisdiction.