Privacy Policy — arbaji

Effective Date: 1 July 2026

1. Introduction & Scope

1.1 This Privacy Policy ("Policy") describes how arbaji ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects personal information relating to individuals ("you", "your", "the Player") who access or use the arbaji website at arbaji.app and any related services, mobile interfaces, or applications.

1.2 This Policy applies to all users of the arbaji Platform, including visitors who browse without registering, registered account holders, and individuals who contact arbaji's customer support team. It applies regardless of the device or method through which the Platform is accessed.

1.3 By registering an account on arbaji, making a deposit, placing a bet, or otherwise using any feature of the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree, you should discontinue use of the Platform immediately.

1.4 This Policy should be read alongside the arbaji Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. Where this Policy conflicts with the Terms & Conditions on a data-related matter, this Policy shall take precedence.

2. Data Controller Information

2.1 For the purposes of data protection, arbaji acts as the data controller in respect of the personal information collected through the Platform. As data controller, arbaji determines the purposes for which and the means by which your personal data is processed.

2.2 If you have any questions, concerns, or requests relating to your personal data or the contents of this Policy, you may contact the arbaji Data Privacy team using the following details:

3. Information We Collect

3.1 arbaji collects personal information in the following categories:

3.1 Identity & Contact Information

• Full legal name as it appears on your government-issued identification;
• Date of birth (to verify you are 18 years of age or older);
• Nationality and country of residence;
• Residential address (street, city, district — e.g., Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, Cox's Bazar);
• Email address and mobile phone number;
• National ID number or passport number (for KYC verification purposes only).

3.2 Financial Information

• Mobile Money account identifiers (bKash, Nagad, Rocket, Upay account numbers associated with your profile);
• Bank account details where bank transfer is selected as a payment method;
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used;
• Source of funds information for high-value accounts as required by our compliance obligations.

3.3 arbaji does not store your full bKash PIN, Nagad PIN, Rocket PIN, card number, CVV, or banking login credentials. These remain entirely within your payment provider's secure environment.

3.3 Account & Gaming Activity Data

• Username and encrypted password hash;
• Betting history, game session logs, wager amounts, and outcomes;
• Bonus and promotion claim history;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status);
• Customer support communication records (chat logs, email threads).

3.4 Technical & Device Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system version, and browser type;
• Session timestamps, page navigation paths, and feature interaction data;
• Cookie identifiers and similar tracking technology data (see Section 8).

4. How We Collect Your Data

4.1 Directly from you — when you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, or interact with any feature of the Platform that requires you to submit information.

4.2 Automatically — through cookies, server logs, and similar technologies that record your interactions with the Platform as you browse and play. This data is collected whether or not you have a registered account.

4.3 From third parties — including identity verification service providers who confirm the authenticity of the documents you submit during KYC, payment processors who confirm transaction statuses, and fraud prevention partners who provide risk signals associated with device or IP data.

5. Legal Basis for Processing

5.1 arbaji processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to register your account, process deposits and withdrawals, resolve disputes, and deliver the core Platform services you have contracted for.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, fraud prevention duties, and any other legal or regulatory requirement applicable to arbaji's operations.
• Legitimate Interests: Processing necessary for arbaji's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, product improvement, and internal analytics — provided those interests are not overridden by your fundamental rights.
• Consent: Where arbaji processes your data for direct marketing purposes (including promotional emails about bonuses, tournaments, and seasonal offers), it does so on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time.

6. How We Use Your Information

6.1 arbaji uses the personal data it collects for the following purposes:

• To create, maintain, and administer your arbaji account;
• To verify your identity and age (18+) as part of KYC compliance;
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer;
• To detect and prevent fraud, money laundering, and other financial crimes;
• To provide customer support and resolve account disputes;
• To enforce the arbaji Terms & Conditions and Responsible Gaming Policy;
• To send transactional notifications (deposit confirmations, withdrawal approvals, security alerts);
• To send marketing communications where you have provided explicit consent;
• To improve the Platform through anonymised usage analytics and A/B testing;
• To comply with applicable legal and regulatory obligations.

6.2 arbaji does not use your personal data for fully automated decision-making that produces legal or similarly significant effects on you without human review. Where automated systems flag your account for investigation (e.g., fraud detection triggers), a member of arbaji's compliance team reviews the flag before any account action is taken.

7. Sharing Your Information

7.1 arbaji does not sell, rent, or trade your personal data to third parties. Your data may be shared with the following categories of recipients only to the extent strictly necessary:

7.1 Service Providers

Third-party companies that assist arbaji in operating the Platform, including:

• Identity verification and KYC service providers;
• Payment processing partners (bKash, Nagad, Rocket, Upay integration APIs, banking partners);
• Fraud detection and anti-money laundering screening services;
• Cloud hosting and data storage providers;
• Customer support platform providers;
• Game content studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) — limited to session identifiers required to load and authenticate game sessions.

All service providers are bound by contractual data processing agreements requiring them to handle your data solely for the specified purpose and in accordance with applicable data protection standards.

7.2 Legal & Regulatory Authorities

arbaji may disclose your personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by law, court order, or to protect the rights, property, or safety of arbaji, its players, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving arbaji, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to the data controller's identity.

8. Cookies & Tracking Technologies

8.1 arbaji uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language setting, responsible gaming tool configurations, and game display preferences to personalise your experience.
• Analytics Cookies: Collect anonymised data about how players navigate the Platform (pages visited, session duration, click paths) to help arbaji improve usability and performance. No personally identifiable information is included in analytics data.
• Fraud Prevention Cookies: Device fingerprinting and behavioural analytics cookies used to detect and prevent account takeover, bot activity, and multi-accounting.

8.2 You may manage non-essential cookies through your browser settings. Please note that disabling functional or analytics cookies may affect your experience on the Platform. Strictly necessary and fraud prevention cookies cannot be disabled as they are essential for security.

8.3 arbaji does not use third-party advertising or retargeting cookies. No data collected through cookies on the arbaji Platform is shared with advertising networks.

9. Data Retention

9.1 arbaji retains your personal data for as long as your account remains active and for a defined period thereafter, as follows:

• Active Accounts: Personal data is retained for the full duration of your account's active status.
• Closed Accounts: Following voluntary account closure, arbaji retains your identity, transaction, and KYC records for a minimum of five (5) years from the date of closure, in compliance with anti-money laundering and financial record-keeping obligations.
• Suspended or Banned Accounts: Data is retained indefinitely for accounts closed due to fraud, AML concerns, or Terms & Conditions violations, to prevent re-registration and assist with any ongoing or future legal proceedings.
• Marketing Data: Where you have consented to receive marketing communications, your marketing preferences and contact details are retained until you withdraw consent. Upon withdrawal, you will be removed from all marketing lists within 10 business days.
• Support Records: Customer support interaction records are retained for three (3) years from the date of the last interaction.

9.2 When personal data is no longer required, arbaji securely destroys or anonymises it in accordance with its internal data disposal procedures.

10. Your Data Rights

10.1 As a player registered on the arbaji Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact the arbaji Data Privacy Team at [email protected] with the subject line "Privacy Request".

10.2 arbaji will respond to all valid data rights requests within 30 calendar days of receipt. Where a request is complex or arbaji receives a high volume of requests simultaneously, this period may be extended by a further 60 days, in which case you will be notified of the extension and the reason for the delay.

10.3 arbaji will not charge a fee for processing a data rights request unless the request is manifestly unfounded, repetitive, or excessive. In such cases, a reasonable administrative fee may apply, and arbaji will notify you of this before proceeding.

10.4 Please note that certain rights — particularly the right to erasure — cannot be fulfilled in full where arbaji is required by law to retain records for AML, KYC, or dispute resolution purposes. In such cases, arbaji will explain which data must be retained and why.

11. Data Security

11.1 arbaji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the arbaji Platform;
• AES-256 encryption for sensitive data at rest in arbaji's database infrastructure;
• Password hashing using bcrypt with salt, ensuring plaintext passwords are never stored;
• Role-based access controls ensuring only authorised arbaji personnel can access player data, on a strict need-to-know basis;
• Multi-factor authentication for all internal arbaji systems that interact with player data;
• Regular third-party penetration testing and security audits of the Platform infrastructure;
• Automated intrusion detection and anomaly monitoring systems running continuously;
• Formal data breach response procedures with defined escalation and notification timelines.

11.2 Despite arbaji's robust security measures, no internet-based system can guarantee absolute security. You play an important role in keeping your account secure by choosing a strong, unique password, keeping your login credentials confidential, and contacting arbaji support immediately if you suspect unauthorised access to your account.

11.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, arbaji will notify affected players without undue delay and will take all reasonable steps to contain the breach and mitigate its impact.

12. Children's Privacy

12.1 The arbaji Platform is strictly intended for adults aged 18 years and over. arbaji does not knowingly collect personal data from individuals under the age of 18. If arbaji becomes aware that it has inadvertently collected personal data from a minor, it will immediately delete that data and close the associated account.

12.2 If you are a parent or guardian and believe that your child has registered on the arbaji Platform or submitted personal data without your knowledge, please contact the arbaji support team immediately at [email protected] so that appropriate action can be taken without delay.

12.3 arbaji encourages parents and guardians to make use of device-level parental control tools to prevent underage access to online gaming platforms. The Platform does not bear responsibility for underage access that occurs as a result of a minor circumventing household device controls.

13. Changes to This Policy

13.1 arbaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, Platform features, or applicable legal and regulatory requirements. Where changes are material, arbaji will notify registered players by email to their registered address and/or by displaying a prominent notice on the Platform prior to the changes taking effect.

13.2 The "Effective Date" shown at the top of this Policy will be updated each time a new version is published. The most current version of this Policy is always available at arbaji.app/privacy-policy. We encourage you to review this page periodically.

13.3 Your continued use of the arbaji Platform following the effective date of any revised Policy constitutes your acceptance of the updated data practices described therein. If you do not accept the revised Policy, you should discontinue use of the Platform and contact the arbaji support team to request account closure.