ibaji Privacy Policy
How We Collect, Use, and Protect Your Personal Data
Your privacy matters to ibaji. This Privacy Policy explains in plain English exactly what personal information ibaji collects from Bangladeshi players, why we collect it, how we use and protect it, and what rights you have over your own data. Please read this document carefully before registering an ibaji account or using any ibaji service.
Scope of This Policy: This Privacy Policy applies to all personal data processed by ibaji in connection with the ibaji.club platform, including the website, any mobile-optimised version, and all associated services such as casino gaming, sports betting, payment processing, and customer support. By creating an ibaji account or continuing to use the platform, you acknowledge that you have read and understood this policy. If you do not accept the practices described here, you should discontinue use of ibaji and may contact [email protected] to request account closure and data deletion.
Information We Collect
ibaji collects personal information about you in the following ways: directly from you when you register an account, make a deposit or withdrawal, contact customer support, or participate in a promotion; automatically when you use the ibaji platform (through cookies, log files, and device identifiers); and occasionally from third parties such as payment processors and identity verification providers when required for KYC purposes.
1. Registration and Account Information
When you create an ibaji account, we collect the following mandatory information:
- Full legal name — as it appears on your national identification document (NID card) or passport.
- Date of birth — to verify that you are 18 years of age or older, in compliance with ibaji's age verification requirement.
- Registered mobile number — used as your primary login identifier and for one-time password (OTP) authentication. This must be a valid Bangladeshi mobile number.
- Email address (optional, but recommended) — used for account notifications and recovery.
- Preferred payment method — which mobile wallet or bank account you intend to use for deposits and withdrawals (e.g., bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank).
2. Identity Verification (KYC) Documents
ibaji may request additional documentation to verify your identity before processing a withdrawal or increasing your account limits. This may include:
- A scanned copy or clear photograph of your Bangladesh National ID card (NID), passport, or birth certificate.
- A recent utility bill, bank statement, or official correspondence showing your registered address, dated within 90 days.
- A selfie or short video alongside your identity document, to confirm that the document belongs to the account holder.
- A screenshot or statement from your bKash, Nagad, or bank account confirming that the payment method used for deposits is registered in your own name.
KYC documents are stored in encrypted form on ibaji's secure servers and are accessible only to authorised ibaji compliance staff. They are used exclusively for identity verification purposes and are not shared with third parties except as required by law.
3. Financial Transaction Data
For every deposit and withdrawal you make on ibaji, we record the transaction amount in BDT, the date and time in Bangladesh Standard Time (BST, UTC+6), the payment method used, the payment provider's transaction reference number, and the resulting account balance. ibaji does not store full card numbers, bKash PINs, Nagad PINs, or banking passwords. All sensitive payment credentials are processed exclusively by our licensed payment partners.
4. Gaming and Betting Activity
ibaji records your gaming and betting history on the platform, including:
- Games played, bet amounts, outcomes, and winnings or losses on all casino games, slots, crash games, and live dealer tables.
- Sports betting selections, odds accepted, stake amounts, and settlement outcomes.
- Bonus credits received, wagering progress toward bonus completion, and bonus expiry events.
This data is used to settle bets accurately, resolve disputes, detect problem gambling patterns (in support of our responsible gaming obligations), and generate the account statement available in your ibaji dashboard.
5. Technical and Usage Data
When you visit ibaji.club or use the mobile-optimised version of the platform, our servers automatically collect certain technical data, including:
| Data Type | What Is Collected | Purpose |
|---|---|---|
| IP Address | Your device's internet protocol address at the time of each session | Fraud detection, security monitoring, approximate geolocation for responsible gaming |
| Device Identifier | Device type, operating system, browser name and version | Platform optimisation, multi-account detection, security |
| Session Data | Login timestamp, session duration, pages visited, features used | Platform analytics, responsible gaming time-monitoring, support |
| Referral Source | The URL or marketing channel that directed you to ibaji.club (if applicable) | Marketing attribution, promotion eligibility verification |
| Cookie Data | Session tokens, preference settings, analytics identifiers | Authentication, user experience, platform performance — see Cookies section |
6. Customer Support Communications
When you contact ibaji support at [email protected], we retain a record of the communication, including your name, account details, the subject matter of your query, and ibaji's response. These records are used to resolve disputes, improve our support service, and maintain an audit trail of player interactions. Support emails are retained for a minimum of two years.
How ibaji Uses Your Data
ibaji processes your personal data only for specific, legitimate purposes that are directly connected to operating the ibaji platform and delivering the gaming and betting services you have signed up for. We do not process your data for purposes that are incompatible with those for which it was originally collected, and we do not use your data for general advertising profiling or sell it to third-party marketing companies.
The primary purposes for which ibaji uses your personal data are as follows:
- Account Creation and Management: To register your ibaji account, authenticate your identity at each login via OTP, maintain your account settings and preferences, and keep your balance and transaction history accurate.
- Payment Processing: To process deposits from and withdrawals to your registered bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, or BRAC Bank account, in Bangladeshi Taka (BDT). Your financial data is shared with our payment partners only to the extent necessary to complete each transaction.
- Age and Identity Verification: To confirm that you are at least 18 years of age and that the account is held in your own name, in compliance with ibaji's responsible gaming obligations and anti-money-laundering (AML) requirements.
- Game and Bet Settlement: To record, calculate, and settle the outcome of all casino games, slots, live dealer sessions, and sports bets you participate in on ibaji, and to credit or debit your wallet accordingly.
- Bonus and Promotion Administration: To credit bonuses to your account, track your wagering progress toward completing bonus conditions, enforce maximum bet rules while a bonus is active, and identify and prevent bonus abuse.
- Responsible Gaming: To monitor your gaming patterns for indicators of problem gambling behaviour — such as rapidly increasing bet sizes, long continuous gaming sessions, or repeated deposit attempts following recent losses — and to enforce self-exclusion, cooling-off, and deposit-limit arrangements you have requested.
- Fraud Prevention and Security: To detect and prevent fraudulent activity on your account and the wider ibaji platform, including multi-accounting, use of automated betting bots, payment fraud, and collusion between players.
- Customer Support: To respond to your queries, resolve disputes, and maintain records of communications for quality assurance and audit purposes.
- Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, design, and feature set of the ibaji platform. Individual player data used for this purpose is anonymised before analysis and cannot be linked back to a specific account.
- Legal and Regulatory Compliance: To meet ibaji's obligations under applicable laws and regulations, including anti-money-laundering rules, to respond to lawful requests from regulatory authorities or law enforcement bodies, and to establish, exercise, or defend legal claims.
- Service Communications: To send you transactional notifications — such as deposit confirmations, withdrawal approvals, and account security alerts — via your registered mobile number or email address. These are essential service messages, not marketing communications, and cannot be opted out of while your account is active.
- Promotional Communications (with consent): If you have opted in to receiving promotional messages, ibaji may contact you with information about new bonuses, seasonal promotions (such as Eid, BPL season, or Pohela Boishakh offers), and new game launches. You may opt out of promotional communications at any time by contacting [email protected].
Legal Basis for Processing: ibaji processes your personal data on the following legal grounds: (a) Contractual necessity — processing required to perform the ibaji player agreement, including account operation, payment processing, and bet settlement; (b) Legal obligation — processing required to comply with AML, KYC, and responsible gaming obligations; (c) Legitimate interests — processing for fraud prevention, platform security, and anonymised analytics; (d) Consent — for optional promotional communications, which you may withdraw at any time.
Data Sharing and Third Parties
ibaji does not sell, rent, or otherwise disclose your personal data to third parties for their own independent commercial purposes. Your data is shared externally only in the circumstances described below, and only to the minimum extent necessary for the specified purpose.
Payment Processors
To process deposits and withdrawals in Bangladeshi Taka (BDT), ibaji shares your name, registered mobile number, and transaction details with our licensed payment partners, including bKash, Nagad, Rocket, Upay, and any bank transfer intermediaries. These partners process your payment data under their own privacy policies and are bound by Bangladesh Bank regulations governing mobile financial services. ibaji shares only the information that each payment partner requires to complete the specific transaction — no additional data is transferred.
Game and Technology Providers
The games available on ibaji are supplied by certified third-party game studios and technology providers, including Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, and Ezugi. When you play a game provided by one of these studios, your account identifier, bet history, and game session data are necessarily shared with that provider's platform in order to operate the game. Game providers process this data as data processors acting under ibaji's instructions and are contractually prohibited from using your data for their own marketing or analytics purposes.
Identity Verification Partners
Where ibaji requires documentary KYC verification, your identity documents and personal details may be shared with a third-party identity verification service provider. All such providers are contractually bound to process your data solely for the verification purpose, to maintain strict data security standards, and to delete your documents once the verification process is complete.
Regulatory and Legal Authorities
ibaji may be required by law, court order, or a request from a competent regulatory or law enforcement authority to disclose personal data about specific players. In such cases, ibaji will comply with the lawful request and will, where legally permitted to do so, notify the affected player of the disclosure. ibaji will not disclose more data than is required by the specific legal obligation.
Business Transfers
In the event that ibaji undergoes a restructuring, merger, acquisition, or sale of assets, player personal data held by ibaji may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and the privacy practices of the new entity via a notice on ibaji.club or directly via their registered contact details, with a reasonable period to exercise their data rights before the transfer takes effect.
No Third-Party Marketing: ibaji does not share your personal data with advertising networks, data brokers, social media platforms, or any other third party for the purpose of building marketing profiles or targeting you with advertisements on other websites or apps. If you receive communications that purport to be from ibaji but were sent by a third party, these are not authorised by ibaji and should be reported to [email protected] immediately.
Cookies and Tracking Technologies
ibaji uses cookies and similar tracking technologies (collectively referred to as "cookies" in this section) on the ibaji.club website and mobile platform. Cookies are small text files placed on your device by your web browser when you visit a website. They allow the website to remember information about your visit and are essential to the functioning of many modern web services.
The table below describes the categories of cookies ibaji uses and the purpose of each:
| Cookie Category | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Maintain your login session, remember your authentication state between pages, and prevent cross-site request forgery (CSRF) attacks. Without these cookies, the ibaji platform cannot function. | No — essential for platform operation |
| Functional / Preference | Remember your language and display preferences, the last game category you visited, and notification settings you have configured in your ibaji dashboard. | Yes — disabling affects user experience |
| Analytics / Performance | Collect anonymised data about how players navigate and use the ibaji platform — such as which pages are visited most frequently and where users encounter errors — to help ibaji improve the platform. No personally identifiable information is included in analytics data. | Yes — opt out via [email protected] |
| Security / Fraud Detection | Identify your device across sessions to detect multi-accounting, automated bot activity, and unusual login patterns. These cookies work alongside ibaji's server-side fraud detection systems. | No — essential for platform security |
| Marketing / Attribution | Record which marketing channel or promotional link directed you to ibaji.club, to verify promotion eligibility and measure campaign effectiveness. ibaji does not use these cookies to build third-party advertising profiles. | Yes — opt out via [email protected] |
Managing Cookies: You can control and delete cookies through your browser settings. Most modern browsers (Chrome, Firefox, Safari, Samsung Internet) allow you to view, block, and delete cookies under the Privacy or Security section of the browser's settings menu. Please note that disabling strictly necessary or security cookies will prevent you from logging in to ibaji and using core platform features. Disabling functional cookies will cause your preferences to reset on each visit.
Local Storage and Session Storage: In addition to cookies, ibaji may use browser local storage and session storage to save temporary data such as game state and UI preferences. This data is stored on your device only and is not transmitted to ibaji's servers independently of your regular platform interactions.
No Cross-Site Advertising Cookies: ibaji does not embed third-party advertising tags, Facebook Pixel, Google Ads remarketing tags, or any similar cross-site tracking technology that would allow ad networks to follow your browsing activity across the internet. The only third-party scripts that may set cookies on ibaji.club are those belonging to ibaji's game providers (required to load game content) and ibaji's analytics provider (anonymised, opt-outable).
Data Security and Storage
ibaji takes the security of your personal data seriously and maintains a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or disclosure. No data transmission over the internet or storage system can be guaranteed to be 100% secure; however, ibaji applies industry-standard best practices to minimise risk.
Encryption in Transit: All data transmitted between your device and ibaji's servers is encrypted using TLS (Transport Layer Security) protocol, version 1.2 or higher. The ibaji.club domain is served exclusively over HTTPS. Any attempt to access ibaji via an unencrypted HTTP connection is automatically redirected to the secure HTTPS version.
Encryption at Rest: Sensitive personal data stored on ibaji's servers — including KYC documents, identity information, and payment references — is encrypted at rest using AES-256 encryption. Database access is restricted to authorised personnel only, with role-based access controls ensuring that each staff member can access only the data required for their specific function.
Authentication Security: ibaji uses OTP (one-time password) authentication via your registered Bangladeshi mobile number as the primary second-factor for account access. ibaji strongly encourages players to use a strong, unique password for their account and not to share it with anyone. ibaji staff will never ask for your password.
Intrusion Detection and Monitoring: ibaji's platform infrastructure is continuously monitored for unusual activity, including unauthorised login attempts, abnormal data access patterns, and potential security breaches. Any suspected security incident is escalated to ibaji's security team for immediate investigation and containment.
Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, ibaji will notify affected players via their registered contact details within a reasonable timeframe of discovering the breach, describing the nature of the incident, the categories of data affected, the likely consequences, and the measures ibaji has taken or is taking to address it.
Server Location: ibaji's player data is stored on servers located in secure data centres with physical access controls, environmental protection, and redundant power and network connectivity. ibaji takes reasonable steps to ensure that any international transfer of data (for example, to game provider servers located outside Bangladesh) is subject to appropriate contractual safeguards.
Your Role in Data Security: While ibaji maintains strong technical defences, the security of your ibaji account also depends on actions you take. You should use a strong and unique password, never share your OTP with anyone (ibaji will never ask for it), log out of ibaji when using a shared device, and report any suspicious account activity immediately to [email protected]. ibaji cannot be held responsible for unauthorised account access that results from your failure to take reasonable precautions with your own credentials.
Your Privacy Rights
As an ibaji player, you have the following rights with respect to the personal data ibaji holds about you. ibaji is committed to honouring these rights promptly and transparently. All requests should be submitted to [email protected] with the subject line "Data Privacy Request" and should include your registered mobile number for account verification purposes.
ibaji will respond to all verified data rights requests within 30 calendar days. In complex cases where a 30-day response is not feasible, ibaji will notify you within the initial 30-day period and provide an estimated completion date. ibaji will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive, in which case a reasonable administrative charge may apply.
Data Retention Policy
ibaji retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to establish, exercise, or defend legal claims. The following retention periods apply to the main categories of data ibaji holds:
| Data Category | Retention Period | Reason for Retention |
|---|---|---|
| Account Registration Data | Duration of active account + 5 years after closure | AML compliance, dispute resolution, regulatory audit requirements |
| KYC / Identity Documents | 5 years after submission or account closure (whichever is later) | Anti-money-laundering regulations, identity fraud prevention |
| Financial Transaction Records | 7 years after each transaction | Financial record-keeping obligations, chargeback dispute resolution |
| Gaming and Betting History | Duration of active account + 3 years after closure | Bet settlement disputes, responsible gaming monitoring, regulatory audit |
| Customer Support Communications | 2 years after each communication | Quality assurance, dispute resolution, staff training |
| Security and Fraud Logs | 3 years from the date of logging | Fraud investigation, multi-account detection, legal proceedings |
| Cookie and Analytics Data | Up to 13 months from placement | Platform performance analysis (anonymised after 30 days) |
| Promotional Communication Preferences | Until consent is withdrawn or account is closed | Honouring opt-in/opt-out choices, demonstrating consent records |
When the applicable retention period expires and ibaji has no remaining legal basis to hold your data, ibaji will securely delete or permanently anonymise the data so that it can no longer be linked to you as an individual. Anonymised aggregate data (for example, statistical reports on platform usage) may be retained indefinitely as it no longer constitutes personal data.
Account Closure and Data: Closing your ibaji account does not result in the immediate deletion of all your personal data. ibaji is legally required to retain certain records for the periods outlined in the table above. If you wish to request deletion of data that is no longer subject to a legal retention obligation, you may do so by submitting a data erasure request to [email protected] after your account closure has been confirmed.
Updates to This Policy
ibaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, ibaji's data processing practices, or the features and services available on the ibaji platform. All updates to this Privacy Policy will be published on this page at ibaji.club/privacy-policy with a revised effective date shown at the top of the document.
Material Changes: Where ibaji makes a material change to this Privacy Policy — meaning a change that significantly affects your rights or ibaji's data processing activities in a way that is not merely administrative — ibaji will notify registered players via their registered mobile number or email address at least 14 days before the change takes effect. Your continued use of the ibaji platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated terms.
Minor Changes: Minor updates such as corrections to typographical errors, clarifications that do not alter the substance of the policy, or additions of new sections that do not reduce your existing rights may be made without prior individual notice. The updated effective date on the policy page will reflect any such revision.
Reviewing the Policy: ibaji encourages all players to review this Privacy Policy periodically, particularly following any notification of an update. If you have questions about any change to this Privacy Policy, or if you do not accept a material change, you should contact ibaji at [email protected] before the new version takes effect. You also have the right to close your ibaji account if you do not accept the revised terms, subject to ibaji's data retention obligations described in the section above.
Contact for Privacy Matters: If you have any questions, concerns, or complaints about this Privacy Policy or about how ibaji handles your personal data, please contact the ibaji privacy team directly at: . ibaji aims to respond to all privacy-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6).
Privacy Contact: For all data rights requests, privacy complaints, or questions about this policy, write to [email protected] with the subject line "Privacy Policy Enquiry". Please include your registered mobile number so ibaji can verify your identity before processing your request. ibaji does not accept privacy requests made via social media or third-party channels.
Ready to Play at ibaji?
Now that you understand how ibaji protects your privacy, explore our full range of casino games, cricket betting, and slots — all secured with SSL encryption and built for Bangladeshi players.