nabaj Privacy Policy

nabaj uses the personal information it collects solely for the purposes described below. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The table below maps each data category to its specific purpose of use on the nabaj platform.

nabaj does not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

4.1 Service Providers

nabaj engages carefully selected third-party service providers to assist in delivering platform functionality. These providers act as data processors under written agreements that bind them to confidentiality and data protection obligations. Categories of service providers with whom data is shared include:

• Payment processing partners (bKash, Nagad, Rocket, Upay, Visa/Mastercard acquirers, Dutch-Bangla Bank) — for processing deposits and withdrawals.
• Identity verification and KYC vendors — for document authentication, biometric checks, and age verification.
• Fraud prevention and AML screening providers — for risk scoring, PEP screening, and sanctions checking.
• Cloud hosting and infrastructure providers — for secure data storage, server operations, and content delivery.
• Customer support platform providers — for managing support tickets and live chat sessions.
• Game providers (Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt, Microgaming) — for delivering live dealer and RNG game sessions. Game providers receive only your Player ID and session token, not your full personal profile.

4.2 Legal and Regulatory Disclosure

nabaj may disclose personal information to law enforcement agencies, regulatory bodies, courts, or other public authorities when required to do so by applicable law, court order, or regulatory directive. In such cases, nabaj will disclose only the information specifically requested and will, where legally permissible, notify you of any such disclosure request.

4.3 Business Transfers

In the event that nabaj undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. In such circumstances, nabaj will notify affected Players in advance of any transfer and ensure that the receiving entity is bound by data protection obligations no less protective than those described in this Privacy Policy.

4.4 What We Never Share

• We never share your full NID number, passport number, or biometric data with advertisers or marketing partners.
• We never share your bKash, Nagad, or bank account credentials with any party other than the relevant payment processor for the sole purpose of executing your transaction.
• We never share your responsible gaming records (self-exclusion history, limit settings) with any external commercial party.
• We never disclose your personal data to other players on the nabaj platform.

nabaj retains personal data only for as long as is necessary for the specific purpose for which it was collected, or for as long as is required to meet applicable legal and regulatory obligations. The following retention guidelines apply to the main categories of personal data processed on the nabaj platform:

• Account and registration data: Retained for the duration of your active Account, plus a minimum of five years following Account closure, to satisfy AML record-keeping requirements and to handle any post-closure disputes or regulatory inquiries.
• KYC and identity documents: Retained for a minimum of five years from the date of verification, or longer where required by applicable law. Copies of identity documents are stored in encrypted form on access-controlled servers.
• Transaction records (deposits and withdrawals): Retained for a minimum of five years from the date of the transaction. This includes bKash, Nagad, Rocket, Upay, bank transfer, and card transaction records.
• Game session and betting records: Retained for a minimum of three years for sports betting records and five years for casino game records, to allow for dispute resolution and audit trail purposes.
• Support and communications data: Retained for three years from the date of the final communication in a support thread, unless the communication forms part of an active dispute or legal proceeding, in which case it is retained until the matter is fully resolved.
• Marketing consent records: Retained for three years from the date the consent was given or last renewed, even if you have since withdrawn marketing consent. This allows nabaj to demonstrate a valid consent record if required.
• Analytics and platform usage data: Anonymised and aggregated after 13 months; the anonymised aggregate form may be retained indefinitely for platform improvement purposes.

When a retention period expires, nabaj will securely delete or irreversibly anonymise the relevant personal data. Deletion of data from backups follows the standard backup rotation cycle, which means data may persist in encrypted backup storage for up to an additional 90 days beyond the active deletion date before being permanently overwritten.

nabaj takes the security of your personal data seriously and implements a multi-layered approach to protecting information stored on and transmitted through the platform. The following technical and organisational security measures are in place at all times:

8.1 Technical Safeguards

• TLS/SSL encryption: All data in transit between your device and the nabaj platform is encrypted using TLS 1.2 or higher. Our SSL certificate is issued by a recognised certificate authority and is renewed before expiry.
• Password hashing: Account passwords are never stored in plain text. nabaj uses an industry-standard one-way cryptographic hashing algorithm with salt to store password credentials.
• Database encryption: Sensitive data fields — including identity document data, payment account references, and KYC records — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access controls: Access to production systems and personal data is restricted on a strict need-to-know basis. Staff access rights are reviewed quarterly. All administrative access is authenticated via multi-factor authentication (MFA).
• Intrusion detection: nabaj operates automated intrusion detection and anomaly alerting systems that monitor for unusual access patterns, brute-force login attempts, and suspicious transaction behaviour around the clock.

8.2 Organisational Safeguards

• All nabaj staff with access to personal data are required to undergo data protection and security awareness training as part of their onboarding process and on an annual refresh basis.
• nabaj maintains a documented incident response procedure. In the event of a confirmed personal data breach that is likely to result in a risk to affected individuals, nabaj will notify affected Players within 72 hours of becoming aware of the breach, by email to the registered address on their Account.
• Third-party service providers are assessed for security compliance before engagement and are contractually required to maintain security standards consistent with those applied by nabaj.

8.3 Your Responsibilities

While nabaj implements robust measures to protect your data, account security is a shared responsibility. You are responsible for maintaining the confidentiality of your Account password, for logging out of your Account when using a shared or public device, and for notifying nabaj immediately at [email protected] if you suspect that your Account has been accessed without your authorisation. nabaj will never request your password via email, SMS, or any other channel.