Mbaji Privacy Policy

1 Who We Are

Mbaji is an online gaming platform operated for players in Bangladesh. When this Privacy Policy refers to "mbaji", "we", "us", or "our", it means the entity responsible for operating the mbaji platform at mbaji.app.

Mbaji acts as the data controller for all personal information collected through the platform. This means we are responsible for deciding how and why your personal data is processed, and we are accountable for ensuring that processing is carried out lawfully and transparently.

If you have any questions about how mbaji handles your personal data, you can contact us at any time at [email protected]. We aim to respond to all privacy-related enquiries within five business days.

2 Data We Collect

Mbaji collects personal data in three ways: information you provide directly when registering or using the platform, information generated automatically through your use of the platform, and information provided by third-party payment processors as part of transaction verification.

3 How We Use Your Data

Every piece of data mbaji collects has a specific, documented purpose. We do not use your data for anything beyond what is described in this policy. The table below sets out the main purposes for which mbaji processes personal data.

• Account management — to create, maintain, and secure your mbaji account, including verifying your identity and age at registration.
• Transaction processing — to process deposits, withdrawals, and any bonus credits or deductions applied to your account.
• Customer support — to respond to your queries, resolve disputes, and provide assistance with account issues.
• Platform security — to detect and prevent fraud, money laundering, account takeover attempts, and other prohibited activity.
• Responsible gaming — to monitor for signs of problem gambling and to enforce any limits, cooling-off periods, or self-exclusions you have set on your account.
• Legal compliance — to meet any obligations imposed by applicable law, including record-keeping requirements and responses to lawful requests from authorities.
• Platform improvement — to analyse usage patterns and improve the mbaji experience, including fixing bugs and optimising game performance.
• Communications — to send you account-related notifications, including deposit confirmations, withdrawal updates, and security alerts. We may also send promotional messages where you have opted in to receive them.

4 Legal Basis for Processing

Mbaji processes your personal data on one or more of the following legal grounds, depending on the specific purpose:

• Contract performance — processing that is necessary to provide the mbaji service you have signed up for, including account management and transaction processing.
• Legal obligation — processing required to comply with applicable laws, including anti-money laundering regulations and age verification requirements.
• Legitimate interests — processing carried out for mbaji's legitimate business interests, such as fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights.
• Consent — processing based on your explicit consent, such as sending promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5 Data Sharing

Mbaji does not sell your personal data. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment processors — bKash, Nagad, and Rocket receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently responsible for the data they hold.
• Identity verification providers — where mbaji uses a third-party service to verify your identity or age, your identity data will be shared with that provider for verification purposes only.
• Technology providers — mbaji uses third-party services for hosting, analytics, and customer support tooling. These providers act as data processors on mbaji's behalf and are contractually required to handle your data securely and only as instructed by mbaji.
• Legal and regulatory authorities — mbaji will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by law or in response to a valid legal request.
• Business transfers — in the event of a merger, acquisition, or sale of mbaji's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy implications before it takes effect.

6 Cookies and Tracking

Mbaji uses cookies and similar tracking technologies to operate the platform, remember your preferences, and understand how players use the site. A cookie is a small text file stored on your device when you visit mbaji.

The types of cookies mbaji uses are:

• Essential cookies — required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. You cannot opt out of essential cookies without stopping use of the platform.
• Analytics cookies — used to understand how players navigate mbaji, which games are most popular, and where technical issues occur. This data is aggregated and anonymised where possible.
• Preference cookies — used to remember your settings, such as your preferred language or notification preferences, so you don't have to re-enter them each visit.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using mbaji, but some features may not work as smoothly.

7 Data Retention

Mbaji retains your personal data for as long as your account is active and for a period after account closure as required by applicable law or legitimate business need. The general retention periods that apply are:

• Account and identity data — retained for the duration of your account and for five years after account closure, in line with standard record-keeping requirements.
• Transaction records — retained for five years from the date of each transaction to comply with financial record-keeping obligations.
• Support communications — retained for two years from the date of the last communication, unless the communication relates to an ongoing dispute or legal matter.
• Technical and usage data — retained for up to 12 months from collection, after which it is aggregated or deleted.

When data is no longer required, mbaji deletes or anonymises it securely. If you request deletion of your account, we will action that request promptly, subject to any retention obligations that prevent immediate deletion.

8 Security

Mbaji takes the security of your personal data seriously. We implement a range of technical and organisational measures to protect your information against unauthorised access, loss, alteration, or disclosure.

• All data in transit between your device and mbaji's servers is encrypted using TLS (Transport Layer Security).
• Account passwords are stored in hashed form — mbaji staff cannot see your password in plain text.
• Access to personal data within mbaji's systems is restricted to staff who need it to perform their role, and is logged for audit purposes.
• Mbaji conducts regular security reviews and vulnerability assessments of its platform infrastructure.
• In the event of a data breach that poses a risk to your rights, mbaji will notify affected users promptly and take immediate steps to contain the breach.

9 Your Rights

You have the following rights in relation to the personal data mbaji holds about you. To exercise any of these rights, contact us at [email protected] with your request and we will respond within a reasonable timeframe.

10 Children

Mbaji is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that a minor has registered an mbaji account or provided personal data to the platform, please contact us immediately at [email protected].

Upon receiving a verified report of underage registration, mbaji will close the account immediately, delete all associated personal data, and return any deposited funds to the payment source from which they originated.

11 Changes to This Policy

Mbaji may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. When we make changes, the updated policy will be published on this page with a revised "last updated" date at the top.

For significant changes — particularly those that affect how we use your personal data or your rights — mbaji will notify registered users via the contact details held on their account before the changes take effect. This gives you the opportunity to review the updated policy and, if you do not agree with the changes, to close your account before they apply.

We recommend checking this page periodically. The version of this policy published on this page is always the current version that applies to your use of mbaji.

12 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mbaji handles your personal data, please get in touch. Our support team handles all privacy-related enquiries and will respond within five business days.

You can reach us by email at [email protected] or via the live chat feature available within your mbaji account. When contacting us about a privacy matter, please include your registered mobile number so we can locate your account and respond accurately.