xbaii Privacy Policy — Your Data, Protected

📋1. Introduction

This Privacy Policy ("Policy") describes how xbaii ("we", "us", "our") collects, uses, stores, and shares personal data when you access or use the xbaii website, mobile platform, gaming services, and related features (collectively, the "Services"). This Policy applies to all registered players and visitors to xbaii, regardless of the device or connection method used to access the platform.

By creating an xbaii account or using any xbaii Service, you confirm that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you must not use xbaii. This Policy should be read alongside xbaii's Terms and Conditions, which are available at xbaii.org/terms-conditions.

📥2. Information We Collect

xbaii collects personal data in the following categories when you register for, access, or use xbaii Services.

⚙️3. How We Use Your Information

xbaii uses personal data collected from players in Bangladesh for the following purposes.

• 3.1Account creation, management, and authentication — including processing your xbaii Login, verifying your identity at registration, and enabling you to deposit and withdraw funds via bKash, Nagad, or Rocket.
• 3.2Processing financial transactions — verifying deposits, processing withdrawal requests, applying bonus credits, and maintaining accurate account balance records for every player.
• 3.3Fraud prevention and security — detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, money laundering, and other prohibited activities. Technical and device data plays a key role in xbaii's fraud prevention systems.
• 3.4Regulatory and legal compliance — fulfilling xbaii's obligations under applicable anti-money laundering (AML) regulations, KYC requirements, and any other applicable laws. This may include reporting obligations to relevant authorities where required by law.
• 3.5Responsible gaming — monitoring account activity for signs of problem gambling, applying protective tools (deposit limits, self-exclusion) at player request or proactively where account patterns indicate potential harm, and sending responsible gaming communications where appropriate.
• 3.6Service improvement and personalisation — analysing aggregated, anonymised usage data to improve xbaii's platform performance, game library, user interface, and customer support quality. xbaii does not use individual player data for third-party advertising purposes.

⚖️4. Legal Basis for Processing

xbaii processes personal data on the following legal bases.

• 4.1Contractual necessity — processing that is necessary to provide the xbaii Services you have requested, including account creation, transaction processing, and game access. Without this processing, xbaii cannot provide its Services to you.
• 4.2Legal obligation — processing necessary to comply with applicable laws and regulations, including AML obligations, KYC requirements, age verification mandates, and lawful requests from regulatory or law enforcement authorities.
• 4.3Legitimate interests — processing necessary for xbaii's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service quality improvement, where these interests are not overridden by your rights and freedoms.
• 4.4Consent — where xbaii relies on your consent as the legal basis for processing (for example, for optional promotional communications), you may withdraw your consent at any time by contacting xbaii's customer support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

🤝5. Sharing Your Information

xbaii does not sell your personal data to third parties. xbaii shares personal data only in the circumstances described below.

• 5.1Payment processors — bKash, Nagad, and Rocket receive transaction data (transaction reference, amount, and your registered mobile number) necessary to process deposits and withdrawals. These providers handle your payment data under their own privacy policies and are required to maintain appropriate data security standards.
• 5.2Game providers — Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and other certified game providers receive your account identifier (an anonymised player ID, not your full personal details) and session data necessary to deliver the games you play on xbaii. Game providers do not receive your name, mobile number, or payment details.
• 5.3Regulatory and law enforcement authorities — xbaii is required by applicable law to report certain transaction types and player activity to relevant authorities. xbaii cooperates fully with lawful requests from law enforcement, anti-money laundering regulators, and other competent authorities. In such cases, xbaii will share only the data specifically requested and legally required.
• 5.4Technology and infrastructure service providers — cloud hosting providers, cybersecurity partners, and analytics services used by xbaii to operate its platform may process technical and device data as part of their service delivery. xbaii ensures that all such providers are contractually bound to maintain appropriate data security standards and to process data only as instructed by xbaii.

💳6. Payment Data & Financial Information

xbaii does not store your bKash PIN, Nagad PIN, Rocket PIN, or any other mobile money account credentials. When you make a deposit via bKash, Nagad, or Rocket, the payment transaction is completed entirely within the respective mobile money provider's secure environment. xbaii receives only a transaction confirmation reference, the amount transferred, and the mobile number associated with the payment — sufficient to credit your xbaii account but not sufficient to initiate any future payment without your active participation.

All financial transaction records held by xbaii are encrypted at rest and in transit using industry-standard SSL encryption. Access to financial records within xbaii's internal systems is restricted to authorised personnel only, on a strict need-to-know basis. xbaii conducts regular internal security reviews of its data handling practices to ensure that financial data remains protected at all times.

🛡️7. Data Security

xbaii takes data security seriously and implements multiple layers of technical and organisational measures to protect your personal data.

• 7.1SSL (Secure Socket Layer) encryption is applied to all data transmitted between your device and xbaii's servers. This means that your login credentials, personal data, and financial information are encrypted in transit and cannot be intercepted in readable form by third parties.
• 7.2All personal data stored by xbaii is encrypted at rest. Database access is restricted to authorised xbaii staff only, with role-based access controls limiting which categories of data each team member can access based on their job function.
• 7.3xbaii maintains an internal information security policy that governs how personal data is accessed, stored, transmitted, and disposed of. All xbaii staff who handle personal data receive data protection training as part of their onboarding and ongoing compliance obligations.
• 7.4In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, xbaii will notify affected players without undue delay. Notification will be sent to the mobile number registered on the affected account. xbaii will also take immediate steps to contain the breach and prevent further unauthorised access.

🗄️8. Data Retention

xbaii retains personal data for as long as your account is active and for a period thereafter as required by applicable law or necessary for xbaii's legitimate business purposes. For financial transaction records and KYC documents, xbaii retains data for a minimum of five (5) years following account closure, in accordance with anti-money laundering and record-keeping obligations. After the mandatory retention period has elapsed, personal data is securely deleted or anonymised.

Account data not subject to mandatory retention periods (such as voluntary communications records and non-essential platform usage logs) is reviewed periodically and deleted when it is no longer needed for the purpose for which it was collected. Players may request information about the specific retention period applicable to their personal data by contacting xbaii's support team at [email protected].

✅9. Your Rights

As an xbaii player, you have the following rights in relation to your personal data. To exercise any of these rights, contact xbaii's support team at [email protected].

xbaii aims to respond to all data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notification to you. xbaii will not charge a fee for exercising your rights under this Policy unless a request is manifestly unfounded or excessive.

🍪10. Cookies & Tracking

xbaii uses cookies and similar tracking technologies on its platform to maintain your login session, remember your preferences, and collect anonymised usage statistics that help xbaii improve its services. A cookie is a small text file placed on your device by xbaii's platform when you access it. Cookies do not contain your full personal data; they contain a session identifier that allows xbaii's servers to recognise your browser across page loads.

xbaii does not use third-party advertising cookies or behavioral tracking cookies that share your data with external advertising networks. The cookies used by xbaii are either strictly necessary (required for the platform to function, such as session cookies) or analytical (used in anonymised form to understand how players navigate xbaii). You may manage cookie preferences through your device's browser settings; however, disabling strictly necessary cookies may prevent xbaii from functioning correctly on your device.

🔗11. Third-Party Services

xbaii's platform integrates with third-party services including game providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and others), payment processors (bKash, Nagad, Rocket), and infrastructure providers (cloud hosting, security services). These third-party services operate under their own privacy policies and data handling practices. xbaii is not responsible for the privacy practices of third-party services, except to the extent that such practices involve personal data passed from xbaii to those services under a data processing agreement.

xbaii does not embed third-party social media widgets, advertising pixels, or external analytics platforms (such as Google Analytics or Facebook Pixel) on its platform. All usage analytics collected by xbaii are first-party and anonymised. xbaii encourages players to review the privacy policies of third-party services they interact with directly, particularly the mobile money providers used for deposits and withdrawals.

🔞12. Children & Minors

xbaii's Services are strictly intended for adults aged 21 years and above. xbaii does not knowingly collect personal data from persons under the age of 21. If xbaii becomes aware that personal data has been collected from a person under 21 years of age, xbaii will take immediate steps to delete that data and close the associated account. All funds deposited to the account by an underage person will be returned to the originating payment instrument following identity verification.

✏️13. Changes to This Privacy Policy

xbaii reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, xbaii's data handling practices, or the services xbaii offers. When material changes are made to this Policy, xbaii will notify registered players via their registered mobile number or by displaying a prominent notice on the xbaii platform upon their next login. The revised Policy will clearly state the date on which the changes take effect.

Your continued use of xbaii after any updated Privacy Policy takes effect constitutes your acceptance of the revised Policy. The most current version of this Privacy Policy is always available at xbaii.org/privacy-policy. If you have any concerns about changes to this Policy, you are encouraged to contact xbaii's support team before continuing to use xbaii's Services.

📧14. Contact & Data Enquiries

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please contact xbaii's support team using the email address below. xbaii's support team is available 24 hours a day, 7 days a week on Bangladesh Standard Time (UTC+6) and will respond to all privacy-related enquiries within thirty (30) calendar days.