cebaji Privacy
Policy

1 Information We Collect

cebaji collects personal information from you in several ways — directly when you register an account or contact us, automatically as you use the platform, and occasionally from third-party verification partners. The categories of personal data we collect are described below.

1.1 Registration & Identity Data

When you open a cebaji account, we collect the following information to create and verify your account:

• Full legal name as it appears on your government-issued identification document.
• Date of birth — required to confirm that you meet the minimum age requirement of 18 years.
• Residential address, including district, division, and postal code within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).
• Email address — used for account notifications, security alerts, and support correspondence.
• Mobile number — used for two-factor authentication and payment method linkage (bKash, Nagad, Rocket, Upay).
• Username and encrypted password — your chosen login credentials. Passwords are stored in a one-way hashed format; cebaji staff cannot read your password.

1.2 Identity Verification Documents

To comply with Know Your Customer (KYC) and anti-money laundering obligations, cebaji may request copies of the following documents at registration or prior to processing a withdrawal:

• National Identity Card (NID) or Smart NID issued by the Bangladesh Election Commission.
• Passport (photo page).
• Proof of address — a recent utility bill, bank statement, or official correspondence addressed to you at your registered address.
• Proof of payment method — a screenshot or confirmation of your bKash, Nagad, or Rocket account registration in your name.

1.3 Financial & Transaction Data

Every deposit, withdrawal, bonus redemption, and wager placed on the cebaji platform generates a transaction record. We retain the following financial data:

• Deposit and withdrawal amounts in Bangladeshi Taka (৳), timestamps, and payment method used.
• Transaction reference numbers issued by bKash, Nagad, Rocket, Upay, or the relevant bank.
• Betting and game history — game name, stake, outcome, and balance movement.
• Bonus activity — bonuses claimed, wagering progress, and bonus expiry events.

1.4 Technical & Usage Data

When you access the cebaji platform, our servers and analytics tools automatically collect certain technical data, including:

• IP address and approximate geolocation (country and city level).
• Device type, operating system, and browser version.
• Pages visited, features used, session duration, and navigation paths.
• Referring URL (the website or link that directed you to cebaji).
• Error logs and crash reports used to diagnose and resolve platform issues.

1.5 Communications Data

If you contact cebaji via email, live chat, or our support ticketing system, we retain a record of those communications, including the content of messages, attachments, and the date and time of each interaction. This data is used to resolve your query and to improve the quality of our customer support.

2 How We Use Your Data

cebaji uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with the reasons listed below without first seeking your explicit consent.

Purpose	Data Used
Account creation and management	Registration data, identity documents, contact details
Age and identity verification (KYC)	Full name, date of birth, NID/passport, proof of address
Processing deposits and withdrawals	Payment method details, transaction records, mobile number
Delivering gaming services	Account data, game history, session data
Fraud prevention and AML compliance	Transaction data, IP address, device data, ID documents
Customer support	Communications data, account data, transaction history
Responsible gaming monitoring	Betting history, session frequency, deposit patterns
Platform analytics and improvement	Aggregated usage data, technical logs (anonymised where possible)
Sending account and security notifications	Email address, mobile number
Marketing communications (opt-in only)	Email address, mobile number, game preferences

Marketing communications are sent only to players who have explicitly opted in to receive them. You may withdraw your marketing consent at any time by updating your notification preferences in your cebaji account dashboard or by emailing [email protected].

3 Legal Basis for Processing

cebaji processes your personal data only where a valid legal basis exists to do so. The legal bases we rely on are set out below, matched to the purposes described in Section 2.

• Contractual necessity: Processing your registration data, verifying your identity, handling deposits and withdrawals, and maintaining your account are all necessary to perform the contract between you and cebaji (i.e., providing the gaming services you signed up for).
• Legal obligation: KYC verification, anti-money laundering screening, transaction record-keeping, and responsible gaming monitoring are required by applicable international offshore licensing standards and financial compliance frameworks. cebaji must carry out this processing to remain compliant with its regulatory obligations.
• Legitimate interests: Fraud detection, security monitoring, platform analytics, and the improvement of our services are carried out on the basis of cebaji's legitimate interests, provided those interests are not overridden by your rights and freedoms. We conduct proportionality assessments before relying on this basis.
• Consent: Marketing communications and the use of non-essential cookies are carried out only where you have given us your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing that took place before withdrawal.

4 Data Sharing & Disclosure

cebaji does not sell, rent, or trade your personal data. We share your information only in the limited circumstances described below, and only to the extent necessary for the specific purpose stated.

4.1 Payment Service Providers

To process your deposits and withdrawals, cebaji shares relevant transaction data with the payment service providers you select, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. These providers receive only the data required to execute and confirm the transaction. Their use of your data is governed by their own privacy policies.

4.2 Identity Verification Partners

cebaji may use third-party KYC and identity verification services to validate the documents you submit during account verification. These partners process your identity data solely for the purpose of verification and are contractually prohibited from using it for any other purpose.

4.3 Technology and Infrastructure Providers

cebaji's platform is hosted on secure cloud infrastructure. Our hosting, database, and content delivery providers may process your data as part of platform operations. All such providers are bound by data processing agreements that require them to maintain appropriate security standards and to process data only on cebaji's instructions.

4.4 Game Software Providers

The games available on the cebaji platform are provided by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, the relevant provider's software processes your gameplay data to determine game outcomes and to return results to your session. Providers do not receive your identity or financial data except where strictly required for game integrity purposes.

4.5 Legal and Regulatory Disclosure

cebaji may be required to disclose your personal data to law enforcement agencies, regulatory authorities, or courts in response to a lawful request, court order, or legal obligation. cebaji will notify you of any such disclosure request where it is legally permitted to do so.

5 Cookies & Tracking Technologies

cebaji uses cookies and similar technologies (such as local storage and session tokens) to operate the platform, maintain your login session, remember your preferences, and gather aggregated analytics data. The types of cookies we use are as follows:

Cookie Type	Purpose	Duration
Essential cookies	Maintain your authenticated session, store CSRF tokens, enable core platform functions. These cannot be disabled without breaking the platform.	Session / up to 30 days
Preference cookies	Remember your language, game display, and notification settings so you do not need to reconfigure them on each visit.	Up to 12 months
Analytics cookies	Collect aggregated, anonymised data on page views, feature usage, and navigation patterns to help us improve the platform.	Up to 12 months
Security cookies	Detect and prevent fraudulent login attempts, bot activity, and suspicious session behaviour.	Session / up to 7 days

cebaji does not deploy third-party advertising cookies or cross-site tracking cookies. Analytics data collected via cookies is aggregated and does not identify you as an individual.

You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging into your cebaji account and using core platform features. Disabling analytics or preference cookies will not affect your ability to play games or make transactions, but may result in a less personalised experience.

6 Data Retention

cebaji retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The retention periods below reflect our standard practices.

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 5 years after closure	KYC compliance and AML record-keeping
Financial transaction records	7 years from transaction date	Financial compliance and audit requirements
Betting and game history	5 years from account closure	Dispute resolution, responsible gaming review
Customer support communications	3 years from last contact	Quality assurance and dispute resolution
Technical and usage logs	Up to 12 months	Security monitoring and platform diagnostics
Marketing consent records	Until consent is withdrawn + 3 years	Demonstration of lawful processing basis

When the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where an account is subject to an ongoing investigation, legal proceedings, or a regulatory request, data may be retained beyond the standard period until the matter is resolved.

7 Your Privacy Rights

As a cebaji player, you have the following rights in relation to your personal data. These rights may be subject to certain conditions and exceptions where required by law or where cebaji has an overriding legitimate interest or legal obligation.

• Right of access: You have the right to request a copy of the personal data cebaji holds about you, along with information about how it is being used. We will provide this information free of charge within a reasonable timeframe following identity verification.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information directly in your cebaji account dashboard. Changes to identity documents must be submitted to our support team.
• Right to erasure: You may request that cebaji delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. This right does not apply where cebaji is required to retain data by law or to defend against legal claims.
• Right to restriction: You may ask cebaji to restrict the processing of your personal data in specific situations, such as while you contest the accuracy of the data or while an objection is being considered.
• Right to object: You have the right to object to processing carried out on the basis of cebaji's legitimate interests. cebaji will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights, or where the processing is necessary for legal claims.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to data portability: Where technically feasible and where processing is based on consent or contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format.

To exercise any of the above rights, please contact our data protection team by emailing [email protected] with the subject line "Privacy Rights Request". Please include sufficient information to allow us to verify your identity before fulfilling your request. We aim to respond to all valid requests promptly and will not charge a fee for standard requests.

8 Data Security

cebaji takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure.

Our key security measures include:

• SSL/TLS encryption: All data in transit between your device and the cebaji platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. Connections over unencrypted HTTP are redirected to HTTPS automatically.
• Encrypted data storage: Sensitive data at rest, including identity documents and payment information, is stored using strong encryption algorithms. Passwords are stored exclusively as salted, one-way cryptographic hashes.
• Access controls: Access to personal data within cebaji's systems is restricted to authorised personnel who require it to perform their job functions. Access is granted on a least-privilege basis and is logged for audit purposes.
• Two-factor authentication: cebaji offers two-factor authentication (2FA) for player accounts. We strongly recommend that all players enable 2FA to protect their account from unauthorised access.
• Security monitoring: cebaji's infrastructure is monitored continuously for anomalous activity, intrusion attempts, and data exfiltration signals. Automated alerting and incident response procedures are in place.
• Third-party security assessments: cebaji periodically engages independent security professionals to conduct vulnerability assessments and penetration tests of our platform.

Despite the measures described above, no system connected to the internet can guarantee absolute security. In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, cebaji will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.

You can help protect your cebaji account by choosing a strong, unique password, enabling two-factor authentication, never sharing your login credentials with anyone, and logging out of your account after each session, particularly when using a shared or public device.