bjji Privacy Policy

Section 1

Information We Collect

bjji collects personal data from players in order to operate a secure, fair, and legally compliant online gaming platform. We collect only the minimum data necessary to fulfil each specific purpose outlined in this Privacy Policy. The categories of personal data we collect are set out below, grouped by how they are obtained.

Data You Provide Directly: When you register a bjji account, complete identity verification (KYC), make a deposit or withdrawal, or contact our support team, you voluntarily provide us with personal information. This includes but is not limited to:

Data Category	Specific Fields Collected	Collection Point
Identity Data	Full legal name, date of birth, NID / passport number, photograph	Registration & KYC
Contact Data	Email address, mobile phone number, residential address (city, district)	Registration
Financial Data	bKash / Nagad / Rocket / Upay number, bank account details, transaction history	Deposit & Withdrawal
Communications Data	Support chat transcripts, email correspondence, complaint records	Customer Support
Verification Documents	Scanned NID, utility bills, payment method screenshots	KYC Verification

Data Collected Automatically: When you browse or use the bjji platform — whether via browser or mobile — our systems automatically collect certain technical and behavioural data. This is standard practice across online platforms and is necessary for security monitoring, fraud prevention, and service optimisation.

IP address, approximate geographic location (city/district level), device type, operating system, and browser version.
Session start and end times, pages visited within bjji, games launched, bets placed, and in-platform navigation patterns.
Cookies, local storage identifiers, and similar tracking technologies as described in the Cookies section of this policy.
Device fingerprint data used for fraud detection and multi-account identification.
Referral source — the URL or channel from which you arrived at bjji (e.g., organic search, a referring link).

Sensitive Data Policy

bjji does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric identifiers, except where a copy of a government-issued identity document is required for age and identity verification (KYC). Such documents are stored in encrypted form and accessed only by authorised compliance personnel.

Identity & KYC Data

Collected once at registration and KYC stage. Used exclusively for age verification, fraud prevention, and compliance with anti-money laundering obligations.

bKash & Nagad Details

Your mobile wallet numbers are collected to process deposits and withdrawals in BDT. They are never shared with third parties for marketing purposes.

Behavioural & Session Data

Automatically collected during platform use to detect fraud, improve responsible gaming tools, and personalise your experience on bjji.

Section 2

How We Use Your Data

bjji processes your personal data only where we have a valid legal basis for doing so. The primary legal bases we rely on are: performance of a contract (processing necessary to provide you with bjji services you have requested), legal obligation (processing required to comply with anti-money laundering, age verification, and fraud prevention requirements), legitimate interests (processing for security monitoring, fraud detection, and platform improvement where those interests do not override your rights), and consent (for optional marketing communications, which you may withdraw at any time).

The table below maps each processing purpose to its legal basis and the data categories involved:

Processing Purpose	Legal Basis	Data Used
Account creation & management	Contract performance	Identity, contact
Age & identity verification (KYC)	Legal obligation	Identity, verification documents
Deposit & withdrawal processing	Contract performance	Financial, identity
Fraud prevention & security monitoring	Legitimate interests	Technical, behavioural, financial
Responsible gaming tool delivery	Legal obligation & legitimate interests	Behavioural, session, contact
Customer support & complaint handling	Contract performance	Identity, contact, communications
Bonus & promotion administration	Contract performance	Identity, financial, behavioural
Marketing communications (opt-in only)	Consent	Contact, behavioural
Platform analytics & improvement	Legitimate interests	Technical, behavioural (aggregated)

Marketing Communications

bjji will only send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, and seasonal offers (such as BPL season promotions or Eid specials) if you have explicitly opted in to receive marketing communications during registration or in your account settings. You may withdraw your marketing consent at any time by updating your notification preferences or by contacting [email protected]. Withdrawal of consent does not affect service communications (e.g., transaction confirmations, account security alerts), which are sent regardless of marketing preference.

Purpose Limitation

bjji processes your data only for the specific purposes listed in this policy. We do not repurpose your data for unrelated uses without obtaining fresh consent or establishing a new legal basis.

You Control Marketing

Promotional communications are strictly opt-in. You can turn them off at any time from your account settings panel without affecting your ability to use bjji services.

Analytics Are Aggregated

Platform analytics used for product improvement are aggregated and anonymised wherever possible. Individual player behaviour is not sold to third-party data brokers.

Section 3

Data Sharing & Disclosure

bjji does not sell your personal data to third parties. We do not trade, rent, or exchange player data for commercial gain. However, in order to operate a functioning gaming platform, bjji necessarily shares limited personal data with a defined set of trusted service partners and, in specific circumstances, with authorities. Every data-sharing arrangement is governed by a data processing agreement that requires the recipient to apply security and confidentiality standards equivalent to those maintained by bjji.

The categories of third parties with whom bjji may share your data, and the strict purpose limitation that governs each, are as follows:

International Data Transfers

As an offshore gaming platform, bjji's servers and some of its service partners may be located outside Bangladesh. Where your personal data is transferred internationally, bjji ensures that the recipient applies appropriate technical and organisational security measures. bjji does not transfer player data to jurisdictions that do not provide an adequate level of data protection without implementing contractual safeguards to compensate for that gap.

We Never Sell Your Data

bjji does not and will not sell player personal data to data brokers, advertising networks, or any commercial third party. Your data is used to run bjji — nothing else.

DPA-Governed Sharing

Every third party that receives bjji player data is bound by a data processing agreement. They may not use your data beyond the specific purpose for which it was shared.

Game Providers Get Tokens Only

When you play Pragmatic Play, Evolution, or Spribe titles on bjji, the game provider receives only an anonymised session token — not your name, NID, or payment details.

Section 4

Cookies & Tracking Technologies

bjji uses cookies and similar client-side storage technologies to make the platform function correctly, to keep you securely logged in, and to understand how players navigate and use the site. A cookie is a small text file placed on your device by the bjji web server. Cookies do not contain executable code and cannot access other files on your device.

bjji uses the following categories of cookies:

Cookie Category	Purpose	Can Be Disabled?
Strictly Necessary	Session management, login authentication, security tokens (CSRF), platform core functions	No — required for the platform to operate
Functional	Remembering your language preference, game lobby layout, and responsible gaming settings	Yes — disabling may reduce platform comfort
Analytics	Aggregated, anonymised page-view and session data used to improve bjji's user experience	Yes — via account preferences
Fraud Prevention	Device fingerprint storage used by our fraud detection layer to identify suspicious login attempts	No — essential for account security

bjji does not use third-party advertising cookies or retargeting pixels. We do not share cookie data with social media platforms or advertising networks. Your on-site behaviour on bjji is not used to serve you targeted ads on other websites.

Most browsers allow you to view, manage, and delete cookies via their privacy or developer settings. Disabling strictly necessary cookies will prevent you from logging in to your bjji account. You can manage functional and analytics cookies from within your bjji account settings panel without affecting your access to the platform.

No Advertising Cookies

bjji does not deploy advertising or retargeting cookies of any kind. We do not participate in cross-site tracking networks. The only cookies placed on your device by bjji are those described in the table above — all directly operated by bjji itself or by its core infrastructure and fraud prevention partners.

Session Security Cookies

Authentication and CSRF protection cookies are strictly necessary. They expire when you log out or close your browser session and cannot be opted out of without losing access to your account.

Analytics Are Anonymised

bjji's internal analytics cookies track page views and session duration in aggregate. Individual player records are not constructed from analytics data and cannot be used to identify you.

Zero Ad Tracking

No retargeting pixels. No Facebook Pixel. No Google Ads remarketing tags. Your browsing on bjji stays on bjji — it does not follow you around the wider web.

Section 5

Data Retention & Security

bjji retains your personal data for as long as is necessary to fulfil the purpose for which it was collected, or for as long as is required by applicable anti-money laundering, financial record-keeping, and responsible gaming compliance obligations. The specific retention periods bjji applies to each data category are set out below.

Data Category	Retention Period	Reason
Account & identity data	Duration of account + 5 years post-closure	AML record-keeping obligation
Transaction records	Duration of account + 5 years post-closure	Financial compliance & dispute resolution
KYC documents	Duration of account + 5 years post-closure	Regulatory verification record
Support communications	3 years from last interaction	Complaint resolution & legal claims
Session & behavioural logs	13 months from collection	Fraud analysis & responsible gaming review
Marketing consent records	Until consent is withdrawn + 1 year	Proof of consent for compliance
Anonymised analytics data	Indefinitely (no personal identifier)	Platform improvement (no privacy risk)

Security Measures: bjji implements multiple layers of technical and organisational security to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Our core security measures include:

SSL / TLS Encryption

All data transmitted between your device and bjji's servers is encrypted using industry-standard TLS 1.2 or higher. You can verify this via the padlock symbol in your browser's address bar.

Encrypted Data Storage

Sensitive fields — including NID numbers, payment method identifiers, and KYC document files — are stored in encrypted form at rest using AES-256 grade encryption.

Access Controls

Access to player personal data is restricted to bjji staff on a strict need-to-know basis. All internal access is logged, monitored, and subject to regular review by our security team.

OTP Authentication

Two-factor authentication via one-time passwords (OTP) is required for new device logins and sensitive account actions, adding a second layer of identity verification beyond your password.

AES-256 Storage Encryption

All sensitive player data stored on bjji's servers is encrypted at rest using AES-256 — the same standard used by major international financial institutions.

5-Year Post-Closure Retention

bjji retains account records for five years after closure to satisfy AML and financial record-keeping obligations. After this period, personal identifiers are securely deleted.

Regular Security Reviews

bjji's security posture is reviewed on a regular cycle. Access logs are audited, encryption keys are rotated, and third-party partner security assessments are conducted annually.

Section 6

Your Privacy Rights

bjji respects your rights over your own personal data. As a bjji account holder, you may exercise any of the following rights at any time by submitting a request to our support team at [email protected]. bjji will acknowledge your request within 5 business days and complete the action — or provide a reasoned explanation if the right cannot be fully exercised — within 30 days of receiving a valid, verified request.

To protect the security of your account, bjji may request identity verification before processing any privacy rights request. This step is necessary to prevent a third party from fraudulently exercising your rights on your behalf.

Right of Access

Request a copy of the personal data bjji holds about you, including the categories collected, the purposes of processing, and any third parties it has been shared with.

Right to Rectification

Request correction of any inaccurate or incomplete personal data bjji holds about you. You may also update many details directly from your account settings panel.

Right to Erasure

Request deletion of your personal data where it is no longer necessary for the original purpose, or where you withdraw consent and no overriding legal basis exists. Note: AML retention obligations may limit full erasure of financial records.

Right to Restrict Processing

Request that bjji temporarily halts processing of your personal data — for example, while you contest the accuracy of the data or while a complaint is being investigated.

Right to Data Portability

Request a structured, machine-readable export of the personal data you have provided to bjji, where processing is based on consent or contract performance.

Right to Object

Object to processing of your personal data where bjji relies on legitimate interests as its legal basis. bjji will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where bjji processes your data based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Right to Lodge a Complaint

If you believe bjji has processed your personal data unlawfully, you have the right to lodge a complaint with the relevant data protection authority or to seek judicial remedy.

How to Submit a Privacy Request

Email your request to [email protected] with the subject line "Privacy Rights Request — [Your Request Type]". Include your registered email address and a brief description of your request. bjji's data protection team will acknowledge your request within 5 business days and respond in full within 30 days. Complex or multi-part requests may take up to 60 days, in which case bjji will notify you of the extension within the initial 30-day window.

30-Day Response Commitment

bjji commits to responding to all valid privacy rights requests within 30 calendar days of receiving identity verification. No request will be ignored or left unanswered.

Identity Verification Required

To protect your account from fraudulent privacy requests, bjji verifies your identity before acting on any request. This step is a security measure for your benefit.

Free of Charge

Exercising your privacy rights with bjji is free of charge. bjji will only levy a reasonable administrative fee if a request is manifestly unfounded or excessively repetitive.

Section 7

Third-Party Services

The bjji platform integrates with a carefully selected set of third-party services in order to deliver gameplay, process payments, and maintain platform security. This section describes each category of third-party service, the data they receive, and the safeguards bjji applies to those relationships.

Game Content Providers: bjji hosts titles from leading game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game, your browser or app connects directly to that provider's game server. The provider receives an anonymised session token generated by bjji — they do not receive your full name, National ID number, or payment credentials. Game providers have their own privacy policies governing the session data they collect on their servers.

Payment Partners: bjji integrates with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and international card networks to process deposits and withdrawals in Bangladeshi Taka. When you initiate a transaction, the payment partner receives your wallet number or card details and the transaction amount. bjji does not store full card numbers. Payment partners are subject to their own data protection obligations under applicable financial services regulation.

Platform Infrastructure: bjji's platform runs on hosted server infrastructure. The infrastructure provider has physical and logical access to server environments but is contractually prohibited from accessing player data for any purpose outside of infrastructure maintenance and security incident response. All server-level access by the infrastructure provider is logged and auditable by bjji.

External Website Links

bjji's platform does not contain links to external third-party websites for commercial or advertising purposes. If bjji's communications ever reference an external resource, that resource operates under its own independent privacy policy and bjji accepts no responsibility for its data practices. We recommend reviewing the privacy policy of any third-party site before providing your personal information.

Game Providers

Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive only anonymised session tokens during gameplay — never your identity or payment data.

Payment Partners

bKash, Nagad, Rocket, and Upay receive transaction data necessary to process your BDT transfers. They are regulated financial services entities with their own data protection obligations.

Infrastructure Providers

bjji's hosting infrastructure partner maintains server environments but is contractually barred from accessing or processing player personal data for any independent purpose.

Section 8

Policy Updates & Contact

bjji reviews this Privacy Policy on a quarterly basis and following any material change to platform operations, payment partnerships, data processing arrangements, or applicable offshore gaming and data protection frameworks. When we make a material change to this policy, we will notify registered players by email to their account email address and display a prominent notice on the bjji platform for at least 30 days following the update.

Minor clarifications — such as correcting typographical errors, adding explanatory language, or updating contact details — may be made without prior notice. The effective date displayed at the top of this page always reflects the date of the most recent substantive review.

Continued use of the bjji platform after a notified policy update constitutes acceptance of the revised Privacy Policy. If you do not accept the updated policy, you should cease using the bjji platform and contact our support team to close your account and request erasure of your personal data in accordance with your rights described in Section 6.

If you have any questions about this Privacy Policy, wish to exercise a privacy right, or want to raise a concern about bjji's data practices, please contact our data protection team using the details below. All privacy-related communications should be directed to our dedicated support channel to ensure they are routed to the correct team and responded to within our 30-day commitment window.

Data Protection Enquiries

Email: [email protected]
Subject line: "Privacy Policy Enquiry"
Response within 5 business days (BST, UTC+6).

Support Hours

Customer and privacy support is available 24 hours a day, 7 days a week. Our team operates on Bangladesh Standard Time (BST, UTC+6).

Review Schedule

This policy is reviewed quarterly. The next scheduled review is April 2026. Material changes are communicated by email with at least 30 days' notice.

Security Incidents

In the event of a data breach that poses a risk to your rights, bjji will notify affected players as soon as practicable and within 72 hours of becoming aware of the incident.

Document Version & Review Schedule

This Privacy Policy was last reviewed and updated in January 2026. bjji reviews all legal documents on a quarterly basis and following any material change to platform operations, payment partnerships, or data processing arrangements.

Last Updated: January 2026

Material Change Notifications

When bjji makes a material change to this policy, registered players are notified by email at least 30 days before the updated version takes effect.

72-Hour Breach Notification

In the event of a security incident affecting your personal data, bjji commits to notifying affected players within 72 hours of becoming aware — giving you time to take protective action.

24/7 Privacy Support

Our privacy and data protection support team is available around the clock via email. All enquiries directed to [email protected] with a clear privacy subject line are prioritised.