xbeje Privacy Policy

Introduction & Scope

xbeje ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the xbeje.io platform ("the Platform"). This Privacy Policy ("Policy") sets out in clear and formal terms the categories of personal data we collect, the purposes for which it is processed, the legal bases on which that processing rests, the circumstances in which data may be shared, and the rights available to you as a data subject.

This Policy applies to all visitors to the xbeje.io website, all registered Player Account holders, and all individuals who interact with xbeje through any channel connected to the Platform, including live chat, email, and WhatsApp support. It applies regardless of the device used to access the Platform — desktop, mobile browser, or any future application.

This Policy is written in English and is directed primarily at players physically located in Bangladesh. Where a player accesses the Platform from outside Bangladesh, this Policy continues to apply to the personal data collected during that session, but xbeje assumes no responsibility for compliance with any foreign jurisdiction's data protection laws that may apply to the player independently.

xbeje is a platform strictly for adults aged 21 and above. Processing of personal data in connection with account registration is conditional on the player confirming they meet the minimum age requirement. Any personal data collected from an individual subsequently found to be under 21 will be deleted as part of the account closure process.

Data Controller

For the purposes of this Privacy Policy, xbeje operates as the data controller in respect of all personal data collected directly from players through the xbeje.io Platform. As data controller, xbeje determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

Where xbeje engages third-party service providers to carry out processing activities on its behalf — such as payment processors (bKash, Nagad, Rocket), identity verification providers, or Game Providers (Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, Ezugi) — those providers act as data processors, processing data only on xbeje's instructions and subject to written data processing agreements that impose confidentiality and security obligations equivalent to those set out in this Policy.

If you have any questions about how xbeje processes your personal data, or if you wish to exercise any of the rights described in Section 10, you may contact the xbeje data team via the support channels listed in Section 14.

Data We Collect

xbeje collects the following categories of personal data in connection with the operation of the Platform:

xbeje does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) and requests that players refrain from volunteering such information through support channels. Where sensitive data is inadvertently received, it will be deleted as soon as practicably possible.

How We Collect Data

4.1 Data You Provide Directly

The majority of personal data xbeje holds about you is provided directly by you at registration, during the KYC verification process, when you make a deposit or withdrawal, when you contact support, or when you update your account settings. This is information you knowingly and voluntarily supply to us as part of your use of the Platform.

4.2 Data Collected Automatically

When you access xbeje.io, certain technical data is collected automatically by our servers and analytics systems. This includes your IP address, the type of device and browser you are using, the pages you visit within the Platform, the time and duration of your sessions, and — at an aggregate, non-precise level — your approximate geographic location based on IP geolocation. This data is used primarily for security monitoring, fraud detection, and platform performance optimisation.

4.3 Data From Third Parties

xbeje may receive limited personal data about you from third-party sources in the following circumstances: identity verification providers may return a verified or unverified status alongside document authenticity flags; payment processors such as bKash and Nagad may confirm transaction status and the registered name associated with a payment account; and fraud prevention databases may flag a player's identifiers against known high-risk patterns. Data received from third parties is used only for the purposes stated in Section 5 and is subject to the same security standards as directly collected data.

Purpose & Legal Basis for Processing

xbeje processes personal data only where a clear and lawful purpose exists. The following table summarises the primary processing activities, the purpose behind each, and the legal basis on which that processing rests:

xbeje will not process your personal data for any purpose that is materially incompatible with the purposes listed above without first notifying you and, where required, obtaining your fresh consent.

Sharing Your Data

6.1 Service Providers (Data Processors)

xbeje shares personal data with carefully vetted third-party service providers who assist in delivering the Platform's services. These include payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), identity verification providers, IT infrastructure and hosting providers, fraud detection services, and customer support tooling providers. All such providers receive only the minimum data necessary for their specific function and are contractually prohibited from using xbeje player data for any other purpose.

6.2 Game Providers

Third-party Game Providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive session identifiers and limited technical data to facilitate game loading, round recording, and RNG certification. Game Providers do not receive your full identity or financial data; they receive only the session-level data necessary for game operation and audit trail purposes.

6.3 Legal Disclosure

xbeje may disclose personal data to relevant authorities if required to do so by applicable law, court order, or lawful request from a competent governmental or regulatory body. In such cases, xbeje will disclose only the minimum data required to comply with the legal obligation and will, where permitted by law, notify the affected player of the disclosure.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial part of xbeje's business assets, player personal data may be transferred to the successor entity as part of that transaction. Players will be notified in advance of any such transfer and given an opportunity to close their account if they do not wish their data to be transferred.

6.5 No Sale of Data

xbeje does not sell, rent, lease, or otherwise commercially exploit your personal data to any third party for that party's own marketing or commercial purposes. This prohibition applies absolutely and without exception.

Cookies & Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. xbeje uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to make the Platform function correctly, to remember your session across page loads, to maintain your login state, and to gather aggregate analytics data about how the Platform is used.

7.2 Types of Cookies Used

• Strictly Necessary Cookies: These are essential for the Platform to function. They enable session management, login state persistence, and security token validation. They cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: These collect anonymised, aggregate data about how players navigate the Platform — which pages are visited most frequently, how long sessions last, and where technical errors occur. This data is used solely to improve Platform performance and user experience.
• Functional Cookies: These remember your preferences within the Platform, such as your preferred language, notification settings, and responsible gaming reminder intervals.
• Security Cookies: These are used to detect and prevent fraudulent activity, including duplicate account creation and automated bot access attempts.

7.3 Cookie Management

You can manage or delete non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform — for example, disabling session cookies will prevent you from remaining logged in between page loads. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

7.4 No Third-Party Advertising Cookies

xbeje does not currently deploy third-party advertising cookies or tracking pixels that share your browsing behaviour with external advertising networks. If this changes in the future, this Policy will be updated and players will be notified in accordance with Section 13.

Data Retention

xbeje retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable financial record-keeping guidelines. The following retention periods apply:

• Active Player Account Data: Retained for the full duration of the account's active life plus a minimum of five (5) years following account closure or last transaction date.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC Verification Documents: Retained for five (5) years from the date of account closure. After this period, documents are securely deleted and not archived in any retrievable format.
• Support Communication Records: Retained for three (3) years from the date of the most recent interaction in a given support thread.
• Responsible Gaming Records: Self-exclusion and cooling-off records are retained for seven (7) years to prevent re-registration during or immediately after an exclusion period.
• Technical & Log Data: Server logs and IP records are retained for twelve (12) months for security and fraud investigation purposes, then purged.
• Marketing Consent Records: Records of consent to receive marketing communications are retained for three (3) years from the date consent was given or withdrawn, whichever is later.

After the applicable retention period, personal data is either permanently and securely deleted or anonymised such that it can no longer be associated with any identifiable individual. Anonymised, aggregate data may be retained indefinitely for statistical and platform improvement purposes.

Data Security

xbeje employs a multi-layered approach to data security designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the xbeje.io servers is encrypted using industry-standard TLS 1.2 or higher, preventing interception during transit.
• AES-256 Encryption at Rest: Sensitive personal data and financial records stored on xbeje servers are encrypted at rest using AES-256 encryption, ensuring data is unreadable without the correct decryption key.
• Access Controls: Access to player personal data is restricted to authorised xbeje personnel on a strict need-to-know basis. All internal access to the player data management system is logged, and logs are reviewed regularly for anomalies.
• Two-Factor Authentication (2FA): Internal system access for xbeje staff requires 2FA on all data-sensitive administrative tools.
• Regular Security Audits: xbeje conducts periodic security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Protocol: xbeje maintains a documented data breach response plan. In the event of a breach that is likely to result in harm to affected players, xbeje will notify impacted individuals as promptly as possible and take all reasonable steps to contain the breach and prevent recurrence.

While xbeje takes all reasonable and practicable steps to protect your personal data, no online platform can guarantee absolute security. Players are also responsible for maintaining the security of their own account credentials and for reporting any suspected unauthorised access to the xbeje support team immediately.

Your Rights

As a data subject, you have the following rights in respect of the personal data xbeje holds about you. To exercise any of these rights, please contact the xbeje support team using the details provided in Section 14. xbeje will respond to all valid rights requests within 30 calendar days of receipt.

Please note that some rights are subject to conditions and exceptions. For example, the right to erasure does not apply where xbeje is required to retain data to comply with a legal obligation. Where xbeje is unable to fulfil a rights request in full, we will explain the reason in our response.

Children & Minors

The xbeje platform is strictly for individuals aged 21 and above. xbeje does not knowingly collect, store, or process personal data relating to any individual under the age of 21. If a player is found to be under 21 following KYC verification or at any other point during the player relationship, their account will be closed immediately and any personal data collected will be deleted in accordance with xbeje's data deletion procedures, subject only to any mandatory retention requirements relating to the detection and investigation of underage gambling.

If you are a parent or guardian and believe that a minor has registered on the xbeje platform using false age information, please contact the xbeje support team immediately. xbeje will investigate and take appropriate action, including account closure and data deletion, as quickly as possible.

xbeje supports responsible gaming initiatives and encourages parents and guardians to use internet filtering tools to prevent minors from accessing online gambling platforms. Tools such as parental control software can be effective in blocking access to betting sites at the device or network level.

Third-Party Links

The xbeje platform does not contain outbound links to external third-party websites for commercial or navigational purposes. However, certain Game Providers may display brand materials or promotional assets within their game interfaces that reference their own corporate websites. xbeje is not responsible for the privacy practices or content of any third-party websites that may be accessed outside of the xbeje.io domain.

This Privacy Policy applies exclusively to data collected and processed by xbeje through the xbeje.io Platform. If you navigate to any external site — including the websites of Game Providers, payment processors, or any other third party — the privacy policy of that external site will govern the processing of any data you provide there. xbeje recommends that you review the privacy policy of any third-party site you visit independently.

Policy Amendments

xbeje reserves the right to update or amend this Privacy Policy at any time. When material changes are made — for example, changes to the categories of data collected, new processing purposes, or changes to data sharing arrangements — xbeje will publish the updated Policy on this page with a revised "Last updated" date and will notify active players via a prominent notice on the Platform or by direct communication to the contact details held on their Player Account.

The "Last updated" date at the top of this page reflects the date on which the most recent version of the Policy came into effect. Players are encouraged to review this Policy periodically to stay informed of how xbeje handles their personal data. Continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms, to the extent permitted by applicable law.

Where a proposed amendment would materially reduce your privacy rights or introduce new processing purposes that require your consent, xbeje will seek fresh consent before the new processing begins. In such cases, continued use of the Platform will not be treated as implied consent — an explicit opt-in action will be required.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights as described in Section 10, or wish to raise a complaint about the way xbeje has handled your personal data, please contact the xbeje support team using the following details:

• Email (plain text — not a link): support at xbeje.io
• Live Chat: Available 24/7 via the xbeje.io Platform
• WhatsApp Support: Available 8 AM – 12 AM BST (Bangladesh Standard Time, UTC+6)

xbeje aims to resolve all privacy-related queries and complaints promptly, thoroughly, and fairly. Upon receipt of a complaint, we will acknowledge it within 3 business days and provide a substantive response within 30 calendar days. Where a complaint is complex or requires investigation, we will keep you informed of progress throughout the process.

If you are not satisfied with xbeje's response to your complaint, or if you consider that xbeje has not handled your personal data in accordance with this Policy, you may seek further recourse through any appropriate dispute resolution mechanism available to you in Bangladesh.