winbaje
Privacy Policy

Information We Collect

winbaje collects personal data from players in order to operate a safe, compliant, and personalised gaming service. We collect only the data that is necessary for legitimate business and regulatory purposes. The categories of personal data we collect are described below.

When you create an account on winbaje, we collect the following information:

• Full legal name
• Date of birth (for age verification)
• Residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, and other Bangladesh locations)
• Email address
• Mobile phone number
• Username and encrypted password
• Nationality and country of residence

As part of our Know Your Customer (KYC) obligations, we collect copies of identity documents including your National Identity Card (NID), passport, or driving licence. We may also collect proof of address documents such as utility bills or bank statements. This data is collected at the point of first withdrawal and may be requested at any time by our compliance team.

When you make a deposit or withdrawal, we collect transaction-related data including your payment method identifiers (e.g., bKash or Nagad mobile number, bank account reference), transaction amounts, timestamps, and transaction status records. We do not store full card numbers or mobile banking PINs. Payment processing is handled by certified payment partners under their own security standards.

We automatically collect data about how you use the winbaje platform, including:

• Games played, bet amounts, session duration, and win/loss records
• Pages visited, features accessed, and navigation patterns
• Device type, operating system, browser type and version
• IP address and approximate geolocation
• Referring URL and exit page
• Time zone (Bangladesh Standard Time, UTC+6)

We retain records of communications between you and winbaje, including live chat transcripts, support emails, and any feedback or complaints you submit. This data is used to resolve disputes, improve our service quality, and maintain a record of interactions for regulatory audit purposes.

How We Use Your Data

winbaje uses the personal data it collects for specific, documented purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected. The primary purposes for which we process your data are as follows:

• Creating and maintaining your player account
• Authenticating your identity at login and at key security checkpoints
• Processing deposits and withdrawals in ৳ BDT via bKash, Nagad, Rocket, Upay, and bank transfer
• Delivering the gaming services you request, including casino games, sports betting, and live dealer tables
• Communicating account-related information such as transaction confirmations and security alerts

• Verifying your age and identity as required by our international gaming licence obligations
• Conducting anti-money laundering (AML) checks and monitoring transactions for suspicious activity
• Maintaining financial records as required by applicable law
• Responding to lawful requests from regulatory authorities or law enforcement agencies

We use behavioural and usage data to monitor player activity for signs of problem gambling. This includes analysing deposit frequency, session duration, betting patterns, and self-exclusion history. Where our responsible gaming systems identify a player who may be at risk, our team may make proactive contact to offer support tools including deposit limits, session reminders, and self-exclusion options.

winbaje uses IP address data, device fingerprinting, and behavioural analytics to detect and prevent fraudulent account activity, multi-accounting, bonus abuse, and unauthorised access attempts. This processing is necessary to protect both the platform and legitimate players from harm.

Aggregated and anonymised usage data is analysed to understand how players interact with winbaje, identify technical issues, improve platform performance, and develop new features. This analysis does not identify individual players and is used solely for internal product development purposes.

With your consent, we may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, cricket betting markets (BPL, T20 World Cup, IPL), and seasonal promotions (Eid, Pohela Boishakh, Victory Day). You may withdraw your consent and unsubscribe from marketing communications at any time by contacting our support team or using the unsubscribe link in any marketing email.

Legal Basis for Processing

winbaje processes personal data only where a valid legal basis exists. The following table summarises the legal bases we rely upon for each category of processing activity:

Data Sharing & Third Parties

winbaje does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share data only where necessary for the operation of our platform, compliance with legal obligations, or the protection of our players and business. The categories of third parties with whom we may share your data are described below.

To process deposits and withdrawals, we share relevant transaction data with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard. These providers receive only the data necessary to complete the specific transaction and are contractually prohibited from using it for any other purpose.

Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session and game-round data as part of the technical integration required to deliver their games. This data is used solely for game functionality, audit logging, and RTP verification — not for marketing or profiling.

We use accredited third-party KYC and identity verification providers to process document checks and AML screening. These providers operate under data processing agreements that comply with international data protection standards and are prohibited from retaining your documents beyond the period necessary for verification.

winbaje will disclose personal data to regulatory bodies, law enforcement agencies, or government authorities where required to do so by law, court order, or regulatory instruction. We will notify you of such disclosure where legally permitted to do so.

In the event of a merger, acquisition, or sale of all or substantially all of winbaje's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights under this Privacy Policy will continue to apply.

Cookies & Tracking Technologies

winbaje uses cookies and similar tracking technologies to operate core platform functionality, maintain session security, and analyse aggregate platform usage. This section explains what cookies we use, why we use them, and how you can manage your preferences.

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits, maintain your session state, and remember certain preferences. Cookies are not programs and cannot carry viruses or access files on your device.

winbaje does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on any page of our platform. We do not participate in cross-site advertising networks. Your browsing behaviour on winbaje is not shared with any external advertising platform.

You can control and delete cookies through your browser settings. Most browsers allow you to block all cookies, block only third-party cookies, or delete existing cookies. Please be aware that disabling strictly necessary or fraud prevention cookies will significantly impair your ability to use winbaje. For guidance on managing cookies in your specific browser, refer to the browser's official help documentation.

Data Retention & Deletion

winbaje retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, or for as long as required by applicable legal and regulatory obligations. The following retention periods apply:

You may request the deletion of your personal data at any time by contacting our support team. Please note that we are unable to delete data that we are legally required to retain (such as KYC and financial records). Where data cannot be deleted due to a legal hold, we will restrict its use to compliance purposes only and inform you of the specific obligation preventing deletion.

Your Privacy Rights

As a player on winbaje, you hold a set of rights regarding the personal data we hold about you. We are committed to honouring these rights promptly and transparently. The following rights are available to all registered players:

You have the right to request a copy of all personal data that winbaje holds about you. This is commonly referred to as a Subject Access Request (SAR). We will provide a structured, machine-readable export of your data within 30 days of receiving a verified request.

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account details (such as your contact email or phone number) directly within your account settings, or contact our support team for corrections to verified data fields.

You have the right to request that winbaje delete your personal data, subject to the retention obligations described in Section 6. This right applies particularly to data processed on the basis of consent (such as marketing data) and data that is no longer necessary for the purpose for which it was collected.

You have the right to request that winbaje restrict the processing of your personal data in certain circumstances — for example, while a correction request is being verified, or where you have objected to processing and that objection is under review.

Where we process your data on the basis of contract or consent, and where that processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to have it transmitted to another controller where technically feasible.

You have an absolute right to object to the use of your personal data for direct marketing purposes at any time. Upon receipt of an objection, winbaje will cease all marketing processing within 5 business days. This does not affect essential account communications.

Data Security & Protection

winbaje implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security posture is reviewed and updated regularly in line with industry best practices .

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment references
• Multi-factor authentication (MFA) available for all player accounts
• Automated intrusion detection and prevention systems (IDS/IPS) monitoring all network traffic
• Regular third-party penetration testing and vulnerability assessments
• Payment card data tokenisation — full card numbers are never stored on winbaje infrastructure
• Segregated network architecture with strict access controls between production and non-production environments

• Role-based access controls — staff access to player data is limited to job-specific necessity
• All staff with data access undergo background screening and mandatory data protection training
• Data access is logged and audited; anomalous access patterns trigger automatic security alerts
• A documented incident response plan is maintained and tested at least annually
• Data processors and third-party partners are assessed for security compliance before onboarding

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, winbaje will notify affected players without undue delay and, where required by applicable law, will report the breach to the relevant supervisory authority within 72 hours of becoming aware of it. Notification to players will be issued via the email address registered to your account and will include a clear description of the nature of the breach, the data categories affected, and the steps winbaje is taking in response.

International Data Transfers

winbaje operates as an international online gaming platform. This means that some of your personal data may be transferred to, stored in, or processed in countries outside Bangladesh. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that which it would receive if processed within Bangladesh.

For transfers of personal data to third parties located in other jurisdictions, winbaje relies on one or more of the following safeguards:

• Standard contractual clauses (SCCs) approved by the applicable data protection authority, incorporated into contracts with all third-party data processors
• Transfers to recipients located in jurisdictions that have been recognised as providing an adequate level of data protection
• Binding corporate rules where applicable within our group of companies
• Your explicit consent, where provided, for specific transfer scenarios

When you play a game supplied by a third-party provider such as Pragmatic Play, Evolution Gaming, or Spribe, certain session data (game round ID, bet amount, outcome, timestamp) is transmitted to the provider's servers as part of the technical game integration. This data is transmitted under the terms of our data processing agreements with each provider and is used exclusively for game operation, audit logging, and RTP compliance verification.

Payment transactions processed via bKash, Nagad, Rocket, or Upay are handled within Bangladesh-based payment infrastructure where possible. International card payments via Visa or Mastercard may involve data processing outside Bangladesh through the card network's own infrastructure. In all cases, payment data is handled under the respective provider's PCI-DSS compliant security standards.

Policy Updates & Contact

winbaje reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, platform features, applicable law, or regulatory guidance. The current version of this policy is always available on this page, and the effective date is displayed at the top of the document.

Where changes to this Privacy Policy are material — meaning they significantly affect how we process your data or the rights available to you — winbaje will notify registered players by email at least 14 days before the changes take effect. For minor or administrative updates, the revised policy will be published on this page without advance notice. Your continued use of winbaje after any update constitutes your acknowledgement of the revised Privacy Policy.

winbaje is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a player account has been registered by a person under 18, we will immediately suspend that account, delete all associated data, and reverse any financial transactions where possible. If you believe a minor has registered on winbaje, please notify us immediately at support@winbaje (plain text — not a link).

18+ All winbaje services are for adults aged 18 and above only. Age verification is mandatory at first withdrawal and may be requested at any time.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way winbaje handles your personal data, please contact our Data Protection team using the details below. All privacy-related correspondence will be acknowledged within 3 business days and responded to in full within 30 calendar days.

By continuing to use winbaje, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this policy, please discontinue use of the platform and contact our support team to arrange account closure.