Your Privacy Matters at
lbaje — Here Is How We Protect It

This Privacy Policy ("Policy") describes how lbaje ("lbaje", "we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("you", "Player", "User") who access or use the lbaje online betting and gaming platform at lbaje.io and all associated services (collectively, the "Platform").

lbaje is committed to protecting your privacy and handling your personal data in an open and transparent manner. This Policy has been drafted to reflect sound data protection practices and to ensure that Players in Bangladesh can understand exactly how their information is being used at every stage of their relationship with lbaje.

By creating an account on lbaje, depositing funds, placing a bet, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

lbaje collects personal data through multiple channels — directly from you when you register or interact with the Platform, automatically as you use our services, and from trusted third-party sources where permitted. The categories of data we collect are as follows:

lbaje does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for the purpose of unique identification, or data concerning health or sexual orientation, except where strictly required by law or with your explicit consent.

lbaje processes your personal data for specific, legitimate purposes only. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The primary purposes for which we use your data are:

• Account creation and management: To register your account, verify your identity, maintain your account profile, and manage your relationship with lbaje throughout the lifecycle of your account.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to reconcile transactions and resolve payment disputes.
• KYC and fraud prevention: To verify your identity and age in accordance with our responsible gaming obligations, to detect and prevent fraud, money laundering, and other financial crime, and to comply with anti-money laundering (AML) requirements.
• Service delivery: To provide access to sports betting markets, casino games, crash games, and all other Platform features; to personalise your experience based on your gaming preferences and history.
• Customer support: To respond to enquiries, resolve disputes, investigate complaints, and provide technical assistance.
• Marketing communications: To send you promotional offers, bonus notifications, and tournament alerts by email or SMS, but only where you have opted in to receive such communications. You may opt out at any time.
• Platform improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall performance and security of the lbaje Platform.
• Legal and regulatory compliance: To fulfil our obligations under applicable law, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms and Conditions.

lbaje processes your personal data only where we have a valid legal basis for doing so. The legal bases we rely on are:

• Contractual necessity: Processing that is necessary to perform our contract with you — including account registration, payment processing, and service delivery — is carried out on the basis that it is required to fulfil the agreement between you and lbaje.
• Legal obligation: Certain processing activities — including KYC identity verification, AML transaction monitoring, and data retention for regulatory purposes — are required by applicable law. lbaje processes data for these purposes regardless of consent.
• Legitimate interests: lbaje processes some data on the basis of legitimate business interests, including fraud prevention, platform security, and improving service quality. We carry out a balancing test to ensure our legitimate interests do not override your fundamental rights and freedoms.
• Consent: Where processing is not required by contract or law — such as sending marketing communications or using non-essential cookies — lbaje relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

lbaje does not sell, rent, or broker your personal data to any third party. We share your data only in the limited circumstances described below, and always with appropriate contractual or legal safeguards in place:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card networks (Visa, Mastercard) receive the minimum data necessary to process transactions on your behalf. These providers operate under their own privacy policies and are independently regulated.
• Identity verification providers: lbaje engages third-party KYC services to verify the identity and age of players. These providers receive identity document images and comparison data solely for verification purposes.
• Game content providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive your session token and game activity data to deliver game content and resolve game disputes. They do not receive your full identity or payment data.
• IT and infrastructure providers: Cloud hosting, server management, and cybersecurity providers supporting the operation of the lbaje Platform receive access to data only as required to maintain platform availability and security.
• Regulatory and law enforcement authorities: lbaje will disclose personal data to competent authorities, including financial intelligence units and law enforcement agencies, where required to do so by applicable law or a valid legal order.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of lbaje's business, player data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change in how your data will be used.

lbaje uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and understand how players interact with our services. Cookies are small text files placed on your device when you visit the Platform.

The types of cookies lbaje uses are:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, chosen deposit method, and game history display options. Disabling these will not prevent you from using the Platform but may affect your experience.
• Analytics cookies: Used to collect aggregated, anonymised data on how players navigate the Platform — pages visited, session length, error encounters — to help lbaje improve performance and user experience. No individual profiling takes place through analytics cookies.
• Marketing cookies: Used only where you have consented, to track which promotional content you engage with and to avoid showing you repetitive or irrelevant offers. You may withdraw consent for marketing cookies at any time via your account settings.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use core Platform features. Clearing cookies will log you out of your current session.

lbaje retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or regulation. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, lbaje will securely delete or anonymise your personal data. Anonymised, aggregated data that cannot be linked back to any individual may be retained indefinitely for statistical and research purposes.

lbaje implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and lbaje servers, including all login sessions, payment flows, and account management pages.
• Encryption at rest for all sensitive data stored on lbaje infrastructure, including identity documents, payment details, and account credentials.
• Bcrypt password hashing — lbaje never stores your password in plain text. Passwords are hashed using a strong one-way algorithm before storage.
• Role-based access controls ensuring that lbaje personnel can only access player data that is necessary for their specific operational function. Access is logged and audited regularly.
• Intrusion detection and monitoring systems that continuously monitor Platform infrastructure for anomalous activity and potential security threats.
• Regular security assessments including vulnerability scans and penetration testing conducted by independent security professionals.
• Incident response procedures — in the event of a data breach that affects your personal data, lbaje will notify affected players and relevant authorities within the timeframes required by applicable law.

As a player on the lbaje Platform, you have a number of rights in relation to the personal data we hold about you. lbaje respects these rights and has processes in place to handle requests promptly and fairly. Your rights include:

• Right of access: You may request a copy of all personal data lbaje holds about you, along with information about how it is being used. We will provide this in a structured, commonly used, machine-readable format where possible.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented. You can update certain account information directly within your profile settings.
• Right to erasure: You may request deletion of your personal data where there is no lawful basis for its continued retention. Note that certain data must be retained for regulatory compliance purposes and cannot be deleted prior to the expiry of the applicable legal retention period.
• Right to restriction of processing: You may ask lbaje to restrict the processing of your data in certain circumstances — for example, while a dispute about accuracy is being resolved, or while an objection to legitimate-interest processing is assessed.
• Right to data portability: Where processing is based on your consent or on a contract with you, you have the right to receive your data in a structured, commonly used format and to transmit it to another data controller.
• Right to object: You have the right to object to processing based on legitimate interests, including direct marketing. Upon receipt of a valid objection to direct marketing, lbaje will stop processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place prior to withdrawal.

To exercise any of the above rights, please contact our Data Protection team at [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within 5 business days and provide a full response within 30 days of receipt.

The lbaje Platform is strictly intended for adults aged 21 and above. lbaje does not knowingly collect personal data from any person under the age of 21. Our registration process includes age verification steps specifically designed to prevent minors from accessing the Platform.

If lbaje discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age, we will:

• Immediately suspend the associated account pending investigation.
• Delete all personal data associated with the underage individual as soon as technically practicable.
• Return any deposited funds to the originating payment method after identity confirmation.
• Void any bets placed or winnings generated through the account.

lbaje's primary operations serve players in Bangladesh and our data infrastructure is designed with that market in mind. However, certain service providers and technology partners that lbaje engages — including cloud infrastructure providers and game content studios — may be based in or process data from locations outside Bangladesh.

Where personal data is transferred outside Bangladesh or beyond the region in which it was collected, lbaje ensures that appropriate safeguards are in place to maintain the protection of that data at a standard equivalent to the commitments set out in this Privacy Policy. These safeguards include:

• Contractual data processing agreements with all third-party recipients, including standard contractual clauses that impose data protection obligations equivalent to those applied by lbaje.
• Transfer only to countries or organisations that provide an adequate level of data protection or have demonstrated sufficient safeguards through binding corporate rules or equivalent mechanisms.
• Regular review of third-party data processing arrangements to ensure ongoing compliance with lbaje's privacy standards.

lbaje reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or service offerings. All changes will be published on this page with the "Last Updated" date revised accordingly.

Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — lbaje will provide advance notice to registered players via email to the address associated with your account and via a prominent notice displayed on the Platform for a minimum of 14 days prior to the change taking effect.

Your continued use of the lbaje Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with a revised Policy, you should contact us to discuss your options, including account closure.

If you have any questions about this Privacy Policy, wish to exercise a data privacy right, or have a concern about how lbaje has handled your personal data, please contact our Data Protection team using the details below. All privacy-related communications should be sent from your registered email address to allow us to verify your identity before processing your request.

• Email: [email protected]
• Subject Line: Privacy Rights Request / Privacy Complaint
• Response Time: Acknowledgement within 5 business days; full response within 30 days
• Support Hours: 24 hours a day, 7 days a week — Bangladesh Standard Time (UTC+6)

lbaje takes all privacy complaints seriously and will investigate each one thoroughly and impartially. If you are not satisfied with our response, you may escalate the matter through applicable dispute resolution channels available in your jurisdiction.