xbjl Privacy Policy — Your Data, Protected

1. Data Controller

xbjl operates as an offshore online gaming platform. For the purposes of this Privacy Policy, xbjl is the data controller in respect of all personal data collected through the xbjl platform at xbjl.io. Questions relating to this Policy or to how xbjl handles your personal data should be directed to our Data Protection contact at [email protected].

This Policy applies to all data processing activities carried out by xbjl in connection with the operation of its online casino, sports betting, and associated services. It does not apply to third-party websites, applications, or services that may be linked to or integrated with the xbjl platform, each of which operates under its own privacy terms.

2. Data We Collect

xbjl collects personal data across the following categories. We collect only what is necessary for the stated purpose and do not retain data beyond its applicable retention period.

2.1 Identity and Registration Data

• Full legal name as it appears on your official identity document
• Date of birth (used for age verification — xbjl requires Members to be 21 years or older)
• Residential address, city, and country
• National identity card (NID) number or passport number, collected during KYC verification
• Username and encrypted account password

2.2 Contact Data

• Email address registered to your xbjl account
• Mobile phone number, including the number associated with your bKash, Nagad, or Rocket mobile banking account where applicable

2.3 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers
• Mobile money account identifiers (partial numbers only — full account credentials are never stored by xbjl)
• Bank account or card details where bank transfer is used, retained in encrypted form
• Bonus and promotional activity records, including wagering history associated with bonus fulfilment

2.4 Gaming and Behavioural Data

• Game session records, including games played, stakes placed, and outcomes
• Sports betting records, including markets wagered on, stake amounts, and settlement results
• Platform navigation data, including pages visited, features used, and session duration
• Responsible gaming tool usage, including any deposit limits, loss limits, or self-exclusion requests you have submitted

2.5 Technical and Device Data

• IP address at the time of registration, login, and key account actions
• Device type, operating system, and browser version
• Cookies and session tokens (see Section 7)
• Geolocation data at a country and city level, derived from your IP address

2.6 Communication Data

• Records of communications between you and the xbjl customer support team, including live chat transcripts, email correspondence, and any complaint records
• Survey responses and feedback submitted voluntarily through the platform

3. How We Collect Data

xbjl collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or voluntarily submit information through any platform feature.
• Automatically — through cookies, server logs, and similar technologies as you interact with the xbjl platform (see Section 7 for details).
• From payment providers — transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners upon processing of deposits or withdrawals.
• From identity verification partners — where a third-party KYC service is used to verify the authenticity of your identity documents, that partner may return a verification result and confidence score to xbjl.
• From fraud and risk monitoring systems — automated systems may flag unusual account activity, which may result in additional data being associated with your account record during an investigation.

4. Legal Basis for Processing

xbjl processes your personal data on one or more of the following legal bases, depending on the nature of the processing activity:

Processing Activity	Legal Basis
Account registration and management	Performance of contract with the Member
Processing deposits and withdrawals	Performance of contract; compliance with financial regulations
Identity verification (KYC)	Legal obligation; prevention of fraud and money laundering
Responsible gaming monitoring	Legitimate interest in player welfare; legal obligation
Customer support communications	Performance of contract; legitimate interest
Fraud detection and prevention	Legitimate interest; legal obligation
Marketing communications (where opted in)	Consent
Platform analytics and improvement	Legitimate interest (anonymised or aggregated data)
Regulatory reporting and record-keeping	Legal obligation

5. How We Use Your Data

xbjl uses the personal data it collects for the following defined purposes:

• Account provision: To create, maintain, and administer your xbjl Member account, including processing logins, managing balances, and recording gaming activity.
• Transaction processing: To accept and process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other Supported Payment Methods, and to maintain accurate financial records for each account.
• Identity verification: To verify that you meet the minimum age requirement of 21 years, that the identity information you have provided is accurate, and that your account is not being used for money laundering or fraud.
• Responsible gaming: To monitor gaming behaviour and identify patterns that may indicate problem gambling, to apply and enforce responsible gaming tools you have requested, and to contact you where xbjl has welfare-related concerns about your account activity.
• Customer support: To respond to your enquiries, complaints, and account-related requests, and to maintain records of those interactions for quality and compliance purposes.
• Legal compliance: To meet xbjl's obligations under applicable anti-money-laundering, counter-terrorism financing, and data protection regulations, and to respond to lawful requests from regulatory or law enforcement authorities.
• Fraud prevention: To detect, investigate, and prevent fraudulent account activity, bonus abuse, multi-accounting, and other prohibited conduct as defined in the xbjl Terms and Conditions.
• Platform improvement: To analyse aggregated and anonymised usage data to identify and resolve technical issues, improve the user experience, and develop new platform features.
• Marketing (where consented): To send you promotional communications about xbjl bonuses, new games, tournaments, and seasonal offers, where you have given your explicit prior consent. You may withdraw this consent at any time by contacting [email protected] or by using the unsubscribe option in any marketing email.

6. Data Sharing & Disclosure

xbjl does not sell, rent, or trade your personal data. We share your data only in the following circumstances and only to the minimum extent necessary:

6.1 Payment Processors

To process your deposits and withdrawals, xbjl transmits the minimum necessary transaction data to the relevant payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, or BRAC Bank). Each payment provider operates under its own privacy policy and security standards. xbjl does not store your complete mobile banking credentials or full bank account numbers.

6.2 Identity Verification Partners

Where xbjl uses a third-party KYC or identity verification service, your identity document data and personal details may be shared with that provider solely for the purpose of completing the verification. KYC partners are contractually required to process your data only for the specified verification purpose and are prohibited from retaining or using it for any other purpose.

6.3 Game Providers

To facilitate gameplay on integrated third-party game platforms (including but not limited to Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Play'n GO, and Spribe), a session token and anonymised player identifier may be passed to the game provider. No directly identifiable personal data such as your full name, address, or payment details is shared with game providers.

6.4 Regulatory and Legal Authorities

xbjl may disclose personal data to government bodies, regulators, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory instruction. In such cases, xbjl will disclose only the minimum information required to comply with the legal obligation and will notify the affected Member where permitted to do so by law.

6.5 Business Transfers

In the event that xbjl undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via the email address registered on your account and given the opportunity to request account deletion before the transfer takes effect.

7. Cookies & Tracking Technologies

xbjl uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you visit the xbjl website. They enable us to recognise your device, maintain your login session, and understand how the platform is used.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without affecting platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations.
• Analytics Cookies: Collect anonymised data about how Members navigate the platform, which pages are most visited, and where technical errors occur. This data is used solely to improve platform performance and user experience.
• Marketing Cookies: Used only where you have given explicit consent to receive personalised promotional communications. These cookies record your interaction with promotional content on the xbjl platform.

7.2 Cookie Control

You may manage cookie preferences through your browser settings at any time. Most modern browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to or using the xbjl platform. For analytics and marketing cookies, you may withdraw your consent at any time by contacting [email protected].

8. Data Security

xbjl employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data exchanged between your device and the xbjl platform is encrypted using TLS 1.3, the current industry standard for secure web communications.
• Encryption at rest: Sensitive personal data, including identity document data and financial records, is encrypted in xbjl's database infrastructure using AES-256 encryption.
• Access controls: Internal access to Member personal data is restricted to authorised xbjl personnel on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Password security: Account passwords are stored as salted cryptographic hashes. xbjl does not have the ability to retrieve your plain-text password. If you forget your password, a reset must be initiated through the standard account recovery process.
• Vulnerability management: xbjl conducts regular security assessments of its platform infrastructure. Known vulnerabilities are remediated on a risk-prioritised basis.
• Incident response: xbjl maintains a data breach response procedure. In the event of a breach that poses a material risk to Member data, affected Members will be notified without undue delay.

While xbjl takes all reasonable steps to secure your data, no internet-based system can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for promptly reporting any suspected unauthorised access to [email protected].

9. Data Retention

xbjl retains personal data for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention guidelines apply:

• Active account data: Retained for the full duration of your account's active period and for a minimum of five years following account closure, in accordance with anti-money-laundering record-keeping standards.
• KYC documentation: Retained for a minimum of five years following account closure or the last transaction associated with the account, whichever is later.
• Transaction records: Retained for a minimum of five years for financial audit and regulatory compliance purposes.
• Customer support communications: Retained for up to three years following the resolution of the relevant support interaction, unless the record relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained for as long as your consent remains active, plus one year following withdrawal of consent as evidence of the prior consent status.
• Anonymised analytics data: May be retained indefinitely in aggregated, non-identifiable form for platform performance analysis.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Deletion requests submitted before the end of a mandatory retention period will be actioned to the maximum extent permitted by law, with any retained data being restricted to purposes required by legal obligation only.

10. Your Rights

As an xbjl Member, you have the following rights in respect of your personal data. To exercise any of these rights, please contact [email protected] with sufficient information to identify your account. xbjl will respond to all valid requests within 30 calendar days.

• Right of Access: You may request a copy of the personal data that xbjl holds about you, along with information about how that data is being used.
• Right to Rectification: You may request that inaccurate or incomplete personal data held about you be corrected or updated. For certain account data such as name and date of birth, correction requests may require supporting documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to overriding retention obligations under applicable law.
• Right to Restriction: You may request that xbjl restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to xbjl, which can be transferred to another service provider of your choosing.
• Right to Object: You may object to the processing of your personal data where that processing is based on xbjl's legitimate interests, including direct marketing. Upon receipt of a valid objection, xbjl will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Children's Privacy

The xbjl platform is strictly intended for adults aged 21 years and over. xbjl does not knowingly collect or process personal data relating to individuals under the age of 21. If xbjl becomes aware that personal data has been collected from an individual under the minimum age, that data will be deleted immediately and the associated account will be permanently closed.

If you believe that a minor may have registered an account on the xbjl platform or may be accessing our services, please contact [email protected] immediately so that we can investigate and take appropriate action without delay.

12. International Data Transfers

xbjl operates as an offshore platform, and some processing of your personal data may involve transfers to infrastructure or service providers located outside Bangladesh. Where such transfers occur, xbjl takes reasonable steps to ensure that appropriate safeguards are in place to protect the security and confidentiality of your data, including contractual data processing agreements with all third-party providers that impose obligations equivalent to those set out in this Policy.

By registering an account and using the xbjl platform, you acknowledge and consent to the transfer of your personal data to xbjl's infrastructure and authorised third-party processors, which may be located in jurisdictions outside Bangladesh.

13. Third-Party Links

The xbjl platform may contain references to third-party services, including payment providers and game studios, that operate under their own separate privacy policies. xbjl is not responsible for the data practices of any third party. We encourage you to review the privacy policies of any third-party service you engage with in connection with your use of the xbjl platform.

14. Amendments to This Policy

xbjl reserves the right to update or amend this Privacy Policy at any time. Where a material change is made to the Policy, xbjl will notify affected Members via the email address registered on their account and/or via a prominent notice on the platform. The updated Policy will take effect on the date specified in the notification, which will be no fewer than seven calendar days after the notification is issued, except where an immediate amendment is required by law.

Your continued use of the xbjl platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must discontinue use of the platform and contact support to close your account.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how xbjl handles your personal data, please reach out to the xbjl data protection contact:

• Email: [email protected] (plain text — not a clickable link)
• Response Time: All privacy-related requests are acknowledged within 2 business days and actioned within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week
• Languages: English and Bengali

All formal privacy or data protection notices to xbjl must be submitted in writing via the email address above. xbjl will treat all such communications with strict confidentiality and will respond only to the verified account holder.