nebaje Privacy Policy — Your Data & Your Rights

nebaje collects personal data that is necessary for the lawful and efficient operation of our online casino and sports betting platform. We collect information in three primary ways: directly from you when you register and use the platform, automatically through your use of the website, and from trusted third-party partners such as payment processors and identity verification providers.

1.1 Information You Provide Directly

When you register a nebaje account or interact with our Services, you may provide us with the following categories of personal information:

• Identity data: Full legal name, date of birth, gender, and a copy of a government-issued identity document such as a National Identity Card (NID) or passport (required during verification).
• Contact data: Email address, mobile phone number, and residential address in Bangladesh (city, district, postal code).
• Account credentials: Your chosen username and an encrypted version of your password (we never store plain-text passwords).
• Financial data: Payment method details such as your registered bKash or Nagad mobile number, bank account details, or masked card information (Visa/Mastercard) as required to process deposits and withdrawals. We do not store full card numbers on our servers — card processing is handled by PCI-DSS-compliant payment partners.
• Support communications: Any messages, complaints, or queries you submit to our support team via live chat, email, or WhatsApp, along with any attachments or screenshots you provide.
• Responsible gaming data: Self-exclusion requests, deposit limit settings, session time preferences, and any other responsible gaming inputs you configure in your account dashboard.

1.2 Information Collected Automatically

When you access nebaje.net, our systems automatically record certain technical information about your visit, including:

• Device and browser data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and device identifiers.
• Usage data: Pages visited, time and duration of visits, games launched, betting history, bonus redemptions, click-path data, and session duration.
• Location data: Approximate geolocation inferred from your IP address (country and city level). We do not collect precise GPS location data.
• Cookies and similar technologies: Session cookies, persistent cookies, and similar tracking technologies as described in Section 4 of this policy.

1.3 Information Received from Third Parties

We may receive supplementary personal data about you from the following categories of third-party sources:

• Payment processors: Transaction confirmation data, payment status updates, and fraud-screening signals from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and our card payment partners.
• Identity verification providers: Document authenticity checks and age verification results from third-party KYC (Know Your Customer) service providers.
• Fraud and security partners: Risk scores, device fingerprints, and behavioural anomaly flags from anti-fraud platform partners used to protect player accounts.
• Analytics providers: Aggregated and anonymised behavioural data used to improve platform performance and user experience.

nebaje uses the personal data we collect for specific, clearly defined purposes. The table below summarises the primary processing activities, the categories of data involved, and the purpose each activity serves:

Marketing Communications

If you have opted in to receive marketing communications from nebaje, we may contact you with information about new games, seasonal promotions (such as BPL cricket season offers, Eid bonuses, or Pohela Boishakh specials), deposit bonus offers, and platform updates. You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your account dashboard or by contacting the support team. Opting out of marketing communications does not affect your ability to use the platform or receive essential transactional communications such as deposit confirmations and withdrawal notifications.

nebaje processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions agreement with you — including account creation, game provision, payment processing, and customer support.
• Legal obligation: Processing required for nebaje to comply with applicable legal requirements, including anti-money-laundering (AML) checks, age verification obligations, and record retention requirements.
• Legitimate interests: Processing necessary for the legitimate interests of nebaje, including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided these interests are not overridden by your rights and interests.
• Consent: Where you have given explicit, informed, and freely revocable consent — specifically for receiving optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

nebaje uses cookies and similar tracking technologies to operate the platform effectively, personalise your experience, and analyse how the site is used. A cookie is a small text file placed on your device when you visit a website. Cookies do not contain executable code and cannot access other data stored on your device.

Types of Cookies We Use

Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies at any time. Please note that disabling strictly necessary cookies will impair or entirely prevent your ability to log in and use the nebaje platform. Disabling functional or analytics cookies may reduce the quality of your experience but will not prevent you from using core platform features.

For detailed instructions on managing cookies in your specific browser (Chrome, Firefox, Safari, Edge, or Samsung Internet on Android), please refer to your browser's help documentation. Changes to cookie preferences take effect on your next visit to nebaje.net.

nebaje does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only with carefully selected third parties who provide services that are essential to the operation of the platform, and only to the extent necessary for those services to be delivered.

Categories of Recipients

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and our card processing partners receive the minimum financial and identity data necessary to process your transactions securely.
• Identity verification (KYC) providers: Third-party KYC partners receive copies of identity documents and personal details solely to verify your age and identity in compliance with our verification obligations.
• Game technology providers: Game suppliers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and player identifiers (never full personal profiles) in order to serve games and maintain fair play records.
• Fraud prevention and security partners: Specialised anti-fraud platforms receive device data, IP addresses, and behavioural signals to detect account takeover attempts, multi-accounting, and financial fraud.
• IT infrastructure and hosting providers: Cloud infrastructure providers who host the nebaje platform under strict data processing agreements with appropriate security and confidentiality obligations.
• Customer support platforms: Live chat and ticketing system providers who process support communications on behalf of nebaje under data processing agreements.
• Legal and regulatory authorities: Where nebaje is required by applicable law, court order, or formal regulatory request to disclose personal data, we will comply with such requirements. Where legally permitted, we will notify the affected player of such a disclosure.

International Data Transfers

Some of nebaje's third-party service providers may process data on servers located outside Bangladesh. Where such international data transfers occur, nebaje ensures that appropriate safeguards are in place — including standard contractual clauses, data processing agreements, and assessments of the recipient country's data protection framework — to maintain a level of protection consistent with this Privacy Policy.

nebaje retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, audit, or compliance obligations. The following retention periods apply under our standard data retention schedule:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any individual. Where data is anonymised rather than deleted, the anonymised dataset may be retained indefinitely for statistical and analytical purposes.

If you request deletion of your account before the end of a mandatory retention period, we will close your account and cease active processing of your data, but we will retain the minimum records required by law for the remainder of the applicable retention period. We will inform you of this at the time of your deletion request.

As a player on the nebaje platform, you have a number of rights with respect to your personal data. These rights are described below, along with guidance on how to exercise them:

• Right of access: You have the right to request a copy of the personal data that nebaje holds about you, along with information about how it is processed. We will respond to access requests within a reasonable timeframe, typically within 30 days of receipt.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many of your account details directly through your account settings panel; for others, please contact the support team.
• Right to erasure ("right to be forgotten"): In certain circumstances, you have the right to request the deletion of your personal data. This right applies where the data is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where the data has been processed unlawfully. Note that this right is subject to overriding legal retention obligations as described in Section 6.
• Right to restriction of processing: You have the right to request that nebaje restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved, or where you have objected to processing and a determination is pending.
• Right to data portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format so that you may transfer it to another service provider.
• Right to object: You have the right to object to the processing of your personal data where nebaje relies on legitimate interests as the legal basis, including profiling for responsible gaming monitoring. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

How to Exercise Your Rights

To exercise any of the rights listed above, please contact nebaje's support team via live chat from your account dashboard, or by emailing [email protected] with the subject line "Privacy Rights Request". Please include your full name, registered email address, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing your request to protect against unauthorised access to your data.

nebaje takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, alteration, disclosure, loss, or destruction. The security measures in place include, but are not limited to:

• SSL/TLS encryption: All data transmitted between your browser or device and nebaje.net is protected using industry-standard TLS encryption (HTTPS), preventing interception in transit.
• Password hashing: Account passwords are never stored in plain text. They are hashed using a strong, salted cryptographic algorithm so that even in the unlikely event of a data breach, passwords cannot be recovered from stored hashes.
• Two-factor authentication (2FA/OTP): Optional but strongly recommended two-factor authentication is available for all nebaje accounts, adding a second layer of login security via one-time passwords sent to your registered mobile number.
• Access controls: Access to personal data within nebaje's internal systems is restricted on a strict need-to-know basis. Only authorised personnel with a legitimate operational need may access player data, and all access is logged and audited.
• Payment data security: nebaje does not store full payment card numbers on its own servers. Card transactions are processed by PCI-DSS-compliant payment partners. Mobile financial service (bKash, Nagad, Rocket, Upay) transactions are processed directly by those providers' own secure infrastructure.
• Regular security assessments: The nebaje platform undergoes regular security reviews, vulnerability assessments, and penetration testing by qualified security professionals to identify and remediate potential weaknesses.
• Incident response: nebaje maintains a data breach response procedure. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify affected players without undue delay and take immediate steps to contain the breach and mitigate its impact.

While nebaje employs robust security measures, no online platform can guarantee absolute security. You also play an important role in keeping your account secure by maintaining a strong, unique password, enabling 2FA, and not sharing your login credentials with any other person. If you believe your account has been compromised, contact our support team immediately via live chat.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way nebaje handles your personal data, please reach out to our support team using any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly from your nebaje account dashboard
• WhatsApp: Contact number listed within your account dashboard (for registered players only)

When contacting us about a privacy matter, please include your full registered name, the email address associated with your nebaje account, and a clear description of your query or concern. This will help us locate your records and respond as efficiently as possible. All privacy-related enquiries are handled by our dedicated support team operating on Bangladesh Standard Time (BST, UTC+6), and we aim to provide an initial acknowledgement within 5 business days.

Complaints

If you are not satisfied with how nebaje has handled your personal data or responded to a privacy rights request, you have the right to escalate your complaint. We strongly encourage you to contact us directly in the first instance so that we have the opportunity to address your concern. However, if you remain dissatisfied after engaging with our support team, you may escalate the matter through any applicable data protection or consumer protection authority in Bangladesh.

Updates to This Privacy Policy

nebaje reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will notify registered players by email and/or by posting a prominent notice on the nebaje.net platform at least 14 days before the changes take effect. The effective date at the top of this policy will be updated accordingly. Continued use of the platform after the effective date of any revised policy constitutes your acceptance of the updated terms. We recommend reviewing this page periodically to stay informed of how nebaje protects your data.