xbaii Privacy Policy

This Privacy Policy ("Policy") describes the data practices of xbaii ("xbaii", "we", "us", "our") in connection with the xbaii online gaming platform accessible at xbaii.net and all associated mobile web interfaces, game services, and payment integrations. xbaii is committed to handling the personal data of its registered players — primarily located across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh — with transparency, integrity, and strict technical security measures.

By registering an account on the xbaii platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, please do not use the xbaii platform.

Section 1

Data We Collect

xbaii collects personal data through several channels: directly from you when you register, verify, or contact us; automatically through your use of the platform; and in limited cases from trusted third-party verification or payment service providers. The categories of personal data we collect include:

Identity & Contact Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify the 18+ age requirement).
• Email address used for account registration and communications.
• Mobile phone number, particularly the number registered to your bKash, Nagad, Rocket, or Upay mobile wallet.
• Residential address (city/district within Bangladesh) where required for enhanced verification.

Financial & Payment Data

• Transaction records including deposit amounts, withdrawal requests, dates, and associated payment method identifiers (e.g., the last 4 digits of a mobile wallet number).
• Payment method type (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, Mastercard).
• Bonus redemption history and wagering activity records.

Technical & Usage Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser version.
• Session duration, pages visited, games launched, and betting patterns within the xbaii platform.
• Cookies and similar tracking technologies (see the Cookies section for full details).

Verification Documents

• Government-issued photo identification (National ID card, passport, or driving licence).
• Proof of payment method ownership (e.g., screenshot showing your name and mobile wallet number).
• Selfie or live photo for liveness verification where required.

Section 2

How We Use Your Data

xbaii uses the personal data we collect for specific, legitimate purposes directly related to the operation of our gaming platform and our obligations as a responsible operator serving Bangladesh players. We do not use your data for purposes incompatible with those listed below, and we do not sell your personal data to any third party.

Where xbaii relies on your consent as the legal basis for processing (for example, sending promotional emails or SMS notifications about new games, seasonal bonuses tied to Eid, Pohela Boishakh, BPL, or T20 tournaments), you have the right to withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Section 3

Legal Basis for Processing

xbaii processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contract Performance: Processing is necessary to fulfil the contractual relationship between you and xbaii — for example, creating and maintaining your account, processing your transactions, and delivering the game services you have registered to use.
• Legal Obligation: Processing is required to comply with applicable legal requirements, including age verification, identity verification (KYC), anti-money laundering (AML) obligations, and fraud prevention requirements applicable to online gaming operators.
• Legitimate Interests: Processing is necessary for xbaii's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Examples include platform security monitoring, responsible gaming behavioural analysis, and platform improvement analytics.
• Consent: For optional marketing communications and non-essential cookies, processing is based on your explicit, freely given, and informed consent. You may withdraw consent at any time without penalty.

Section 4

Data Sharing & Disclosure

xbaii does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data only with carefully selected categories of recipients where such sharing is necessary for the legitimate operation of the xbaii platform or required by applicable law:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and international card networks (Visa, Mastercard) receive the minimum personal data necessary to process your deposit and withdrawal transactions.
• Game Content Providers: Certified game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and session token necessary to deliver their games within the xbaii platform. These providers do not receive your full identity data.
• Identity Verification Partners: Where enhanced KYC checks are required, a specialist identity verification provider receives your identity document images and biometric liveness data solely for the purpose of verifying your identity. This data is not retained by xbaii beyond the verification event.
• Fraud & AML Screening Services: Transaction data and identity data may be shared with automated fraud detection and anti-money laundering screening services to protect the integrity of the xbaii platform and comply with applicable legal obligations.
• Law Enforcement & Regulatory Authorities: Where required by applicable law or a valid legal order, xbaii will disclose personal data to relevant authorities. xbaii will notify affected users of such disclosure where legally permitted to do so.
• Cloud Infrastructure & Hosting Providers: xbaii uses reputable cloud infrastructure providers to host the platform. These providers operate as data processors under strict contractual data processing agreements and may not use your data for their own purposes.

Section 5

Cookies & Tracking

The xbaii platform uses cookies and similar browser-based tracking technologies to deliver a functional, personalised, and secure gaming experience. A cookie is a small text file placed on your device by a website. The following categories of cookies are used on xbaii.net:

You may manage cookies through your browser settings. Note that disabling strictly necessary or functional cookies may impair the performance of the xbaii platform, including your ability to log in, place bets, or access responsible gaming tools. To opt out of analytics or marketing cookies, contact [email protected] with the subject line "Cookie Opt-Out".

Section 6

Data Retention

xbaii retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the full duration of your active account registration on the xbaii platform, plus a minimum of 5 years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction Records: All deposit, withdrawal, bonus, and wagering records are retained for a minimum of 5 years from the date of the transaction for AML compliance and dispute resolution purposes.
• Identity Verification Documents: KYC documents (ID copies, selfies) are retained for a minimum of 5 years following account closure. Where a suspicious activity report has been filed, documents may be retained for longer as required by applicable regulations.
• Customer Support Records: Support tickets and communication logs are retained for 2 years from the date of the interaction, unless the subject matter relates to an ongoing dispute or compliance matter.
• Analytics Data: Anonymised and aggregated analytics data may be retained indefinitely as it no longer constitutes personal data once anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with xbaii's data destruction procedures. You may request early deletion of specific data categories by contacting us at [email protected], subject to any overriding legal retention obligations.

Section 7

Your Privacy Rights

As a player on the xbaii platform, you hold a number of rights in relation to your personal data. xbaii is committed to facilitating the exercise of these rights promptly and without undue obstacle. Your rights include:

• Right of Access: You may request a copy of the personal data xbaii holds about you, together with information about how it is being processed.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details directly through your xbaii account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations (such as AML record-keeping requirements).
• Right to Restrict Processing: You may request that xbaii limit its use of your personal data in certain circumstances, for example while a dispute regarding accuracy is being resolved.
• Right to Data Portability: You may request that xbaii provide your personal data in a structured, machine-readable format, where technically feasible and where processing is based on consent or contract performance.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes or direct marketing. xbaii will cease such processing unless compelling legitimate grounds override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails, SMS notifications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". Please include your registered email address and, where identity verification is required, a copy of your government-issued ID. xbaii will respond to all valid requests within 30 calendar days. Complex or high-volume requests may require an extension of up to an additional 60 days, in which case you will be notified.

Section 8

Contact & Data Enquiries

xbaii takes data privacy seriously and has designated a responsible team to handle all privacy-related correspondence. If you have any questions, concerns, or requests relating to this Privacy Policy or the way xbaii handles your personal data, please contact us using the details below:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request".
• Response Time: xbaii aims to acknowledge all privacy enquiries within 2 business hours and resolve them fully within 30 calendar days.
• Operating Hours: Our support team is available 24 hours a day, 7 days a week, on Bangladesh Standard Time (BST, UTC+6).
• Service Region: xbaii primarily serves players located across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh.

xbaii reserves the right to update this Privacy Policy at any time. Where changes are material, registered users will be notified via the email address associated with their account. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the xbaii platform after any such update constitutes acceptance of the revised Policy.