23baj Privacy Policy

This Privacy Policy ("Policy") describes how 23baj ("we", "us", "our", "the Platform") collects, processes, stores, and protects personal data belonging to users ("you", "Player", "User") who access or register on the 23baj website at https://23baj.io. This Policy applies to all services offered by the 23baj platform, including sports betting, live casino, slot games, and payment services accessed via bKash, Nagad, Rocket, or Upay.

We are committed to handling your personal data with the highest standards of privacy, transparency, and security. This Policy is intended to give you a clear and complete picture of your data rights and our data practices before you provide any information to us.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement between you and 23baj.

For the purposes of this Privacy Policy, 23baj acts as the data controller in respect of personal data collected from players who access the platform at https://23baj.io. As data controller, 23baj determines the purposes and means by which your personal data is processed.

All data-related enquiries, requests, and complaints should be directed to our support team using the contact details provided in Section 14 of this Policy. We will acknowledge receipt of all formal data requests within 5 business days and aim to resolve them within 30 calendar days of receipt.

23baj collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises the main categories of data we collect and a description of each:

We collect only the data that is necessary for the purposes described in this Policy. We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (except where a facial photograph is submitted as part of identity verification), or health data beyond what is voluntarily disclosed in the context of responsible gaming self-assessment tools.

23baj collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide directly when you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, update account settings, or respond to a survey or promotion.
• Payment Provider Integration: When you initiate a transaction via bKash, Nagad, Rocket, or Upay, those providers share your mobile account number and transaction reference with 23baj to confirm and settle the payment. This data sharing is governed by both this Policy and the respective payment provider's own privacy terms.
• Automated Technologies: We automatically collect technical and usage data when you interact with our platform through cookies, server log files, and session tracking technologies. This includes your IP address, device identifiers, and navigation behaviour within the platform.
• Third-Party Game Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may transmit session and game-result data to 23baj for the purpose of settlement, dispute resolution, and responsible gaming monitoring.
• Identity Verification Services: Where we use third-party KYC (Know Your Customer) verification services to authenticate the identity documents you submit, those services may return verification result data (pass/fail/flag) to 23baj.

23baj processes personal data for the following purposes:

• Account Management: To create, maintain, verify, and administer your 23baj account, including processing registration, confirming your eligibility (21+ age requirement), and managing your account settings and preferences.
• Service Delivery: To provide the core betting, casino, and payment services of the 23baj platform, including processing wagers, settling game results, crediting winnings, and facilitating deposits and withdrawals via bKash, Nagad, Rocket, and Upay.
• Identity and Age Verification: To verify that all players are who they claim to be and are at least 21 years of age, in fulfilment of our responsible gaming obligations and anti-money-laundering compliance requirements.
• Anti-Fraud and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeover, bonus abuse, and other illegal or prohibited activities on the platform.
• Legal and Regulatory Compliance: To comply with applicable laws and regulations, including anti-money-laundering obligations, data retention requirements, and responses to lawful requests from competent authorities.
• Customer Support: To respond to your enquiries, complaints, and dispute submissions in an accurate and timely manner, using your account history and communication records where relevant.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, to enforce deposit limits and self-exclusion requests you have set, and to provide appropriate intervention messaging where warranted.
• Platform Improvement: To analyse aggregated and anonymised usage data for the purposes of improving platform performance, user experience, and product development.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform news where you have opted in to receive such communications. You may withdraw this consent at any time through your account settings.

23baj processes personal data on the basis of the following legal grounds:

• Contractual Necessity: Processing that is necessary to perform the contract between you and 23baj — including account registration, service delivery, and payment processing — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing that is required to comply with applicable anti-money-laundering laws, age verification requirements, data retention mandates, and lawful authority requests is carried out on the basis of legal obligation.
• Legitimate Interests: Processing carried out to prevent fraud, protect platform security, conduct internal analytics, and improve our services is based on 23baj's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of your data for marketing communications and optional platform features is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the legality of prior processing.

23baj does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: bKash, Nagad, Rocket, and Upay receive the minimum data required to authenticate and process your deposit or withdrawal transactions. Each provider operates under its own privacy policy and applicable Bangladesh Bank regulations.
• Game Studio Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other integrated game studios receive session data necessary to run games, settle results, and investigate disputes. These providers are contractually obligated to handle data in accordance with applicable privacy standards.
• Identity Verification Partners: Where third-party KYC services are engaged to verify identity documents, they receive only the documentation and personal details necessary to complete the verification check. Results are returned to 23baj and the underlying data is not retained by the KYC provider beyond their contractual obligation period.
• Legal and Regulatory Authorities: 23baj may disclose personal data to competent government authorities, law enforcement bodies, or courts where required to do so by law or by a valid legal order. We will notify you of any such disclosure where legally permitted to do so.
• Business Successors: In the event of a merger, acquisition, or sale of all or a substantial portion of 23baj's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to how your data is processed as a result.

All third parties with whom 23baj shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the purposes specified in their agreements with 23baj.

23baj retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised and aggregated data may be retained indefinitely for statistical and analytical purposes.

23baj uses cookies and similar web technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. The following types of cookies are used on the 23baj platform:

• Strictly Necessary Cookies: These cookies are essential to the operation of the 23baj platform. They manage your login session, maintain your authentication state, and protect against cross-site request forgery (CSRF). The platform cannot function correctly without these cookies and they cannot be disabled.
• Analytics Cookies: We use first-party analytics cookies to understand how players navigate and use the 23baj platform. This data is collected in aggregated, anonymised form and is used solely to improve platform performance and user experience. No individual player profiles are built from analytics data.
• Preference Cookies: These cookies remember your platform preferences, such as your chosen display settings, so that they are preserved across sessions.

23baj does not deploy third-party advertising cookies, cross-site tracking cookies, or social media tracking pixels on the platform. You may control cookie settings through your browser's privacy controls. Disabling strictly necessary cookies will impair your ability to log in and use the platform.

As a registered player on the 23baj platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data that 23baj holds about you, along with information about how and why it is being processed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held about you is corrected or completed without undue delay.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis for processing applies. Note that data subject to mandatory retention periods (e.g., AML records) cannot be deleted ahead of schedule.
• Right to Restrict Processing: You have the right to request that 23baj restricts the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, and machine-readable format so that you can transfer it to another service provider, where technically feasible.
• Right to Object: You have the right to object to processing of your data carried out on the basis of legitimate interests, and to opt out of direct marketing communications at any time through your account settings or by contacting support.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

23baj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 23baj platform.
• Encryption at rest for all stored personal data and identity documents.
• Role-based access controls ensuring that staff members can access only the personal data they need to perform their specific job functions.
• Regular internal security audits and vulnerability assessments of platform infrastructure.
• Multi-factor authentication requirements for administrative platform access.
• Automatic session timeouts for inactive player sessions to prevent unauthorised account access on shared devices.

Despite these measures, no internet transmission or electronic storage system is completely secure. In the event of a data security incident that is likely to result in a risk to your rights and freedoms, 23baj will notify affected players without undue delay and will implement containment and remediation measures as a priority.

Players are responsible for keeping their own account credentials secure. 23baj will never ask you to share your password through any communication channel. If you suspect that your 23baj account has been accessed without your authorisation, contact [email protected] immediately.

The 23baj platform is strictly for adults aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in our account registration and first-withdrawal process.

If 23baj becomes aware that personal data has been collected from an individual who is under 21 years of age, that data will be deleted promptly, the associated account will be permanently closed, and any deposits made by that individual will be returned to the originating payment method subject to verification.

If you are a parent or guardian and you believe that a minor has registered on the 23baj platform using false age information, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

23baj reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. Material changes to this Policy will be communicated to registered players via their registered contact method no less than 7 days before the revised Policy takes effect, except where immediate changes are required to address an urgent security concern or comply with a legal obligation.

The current version of this Privacy Policy, together with its effective date, will always be published at https://23baj.io/privacy-policy. Your continued use of the 23baj platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should close your account before the changes take effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your personal data by 23baj, please contact our support team. We are available 24 hours a day, 7 days a week, and aim to respond to all data-related enquiries within one business day (Bangladesh Standard Time, UTC+6).

General Privacy Enquiries: [email protected]

Data Rights Requests: [email protected] (Subject: "Data Rights Request")

Security Incident Reports: [email protected] (Subject: "Security Incident")