xdaji Privacy Policy

01 Introduction

xdaji ("we", "us", "our") is an online betting and casino platform accessible at https://xdaji.io and operated primarily for users in Bangladesh. We take your privacy seriously and are committed to protecting the personal information you share with us when you access or use the xdaji platform.

This Privacy Policy describes the types of personal data we collect, the purposes for which we use it, the parties with whom we may share it, the safeguards we apply to keep it secure, and the rights you hold in relation to your data. It applies to all users of the xdaji platform, including visitors who browse the site without registering an account, as well as fully registered and verified account holders.

By accessing the xdaji platform, registering an account, making a deposit, or placing a wager, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the platform immediately.

02 Data Controller

For the purposes of this Privacy Policy, xdaji acts as the data controller in respect of the personal data collected from users of the xdaji platform. As data controller, xdaji determines the purposes and means of processing your personal information.

All data-related enquiries, access requests, correction requests, and erasure requests should be directed to the xdaji data team via the contact details provided in Section 14 of this Policy. We aim to acknowledge all data-related requests within five (5) business days of receipt and to resolve them within thirty (30) calendar days.

Where xdaji engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, and platform analytics services — those providers act as data processors under contracts that bind them to xdaji's data protection standards. xdaji remains responsible for the lawful processing of your data regardless of which processor handles it.

03 Data We Collect

xdaji collects only the personal data that is necessary and proportionate to the services we provide. The categories of personal data we collect are set out below.

3.1 Identity and Registration Data

When you register an xdaji account, we collect your full legal name, date of birth, gender (where provided), nationality, and a government-issued identification number or document reference. This data is required to verify your identity, confirm that you meet the minimum age requirement of 21 years, and comply with our Know Your Customer (KYC) obligations.

3.2 Contact Data

We collect your email address, mobile telephone number, and residential address (including city, district, and postal code within Bangladesh). This information is used for account communications, transaction notifications, support correspondence, and, where you have consented, promotional messaging.

3.3 Financial Data

To facilitate deposits and withdrawals in Bangladeshi Taka (BDT), we collect information about the payment methods you use — including bKash mobile wallet numbers, Nagad account references, Rocket numbers, Upay account identifiers, and bank account details for Dutch-Bangla Bank, City Bank, and BRAC Bank transfers. We do not store full card numbers or mobile banking PINs. Payment data is tokenised and handled by our payment processing partners under strict security standards.

3.4 Transaction and Gaming Data

We maintain records of all transactions associated with your account, including deposit amounts, withdrawal requests, bet histories, game session logs, bonus credits awarded, and wagering activity. This data is used for account management, responsible gaming monitoring, dispute resolution, and fraud prevention purposes.

3.5 Technical and Device Data

When you access the xdaji platform, we automatically collect certain technical data, including your IP address, browser type and version, device type and operating system, screen resolution, referring URL, session duration, and pages visited. This data helps us maintain platform security, optimise performance, and detect suspicious access patterns.

3.6 Communications Data

If you contact xdaji support via email or live chat, we retain records of those communications, including the content of messages, timestamps, and any attachments submitted. These records are kept for dispute resolution, training, and quality assurance purposes.

04 How We Collect Data

xdaji collects personal data through the following channels:

• Direct Submission: Data you provide when completing the xdaji registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Technical and device data collected automatically by our servers and analytics tools each time you access the xdaji platform, including data transmitted by your browser via standard HTTP headers.
• Payment Providers: Confirmation and reference data received from bKash, Nagad, Rocket, Upay, and our banking partners when a transaction is initiated or completed.
• KYC and Verification Partners: Identity verification results and risk scores returned by third-party KYC service providers following document review.
• Cookies and Tracking Technologies: Session data, preference settings, and behavioural analytics gathered through cookies placed on your device during platform use. See Section 9 for full details.

05 How We Use Your Data

xdaji processes your personal data for the following purposes, each of which is supported by a lawful basis:

• Account Creation and Management: To register your xdaji account, maintain your account profile, and provide you with access to all platform features.
• Identity Verification: To verify that you are who you claim to be, that you meet the minimum age of 21 years, and that your account complies with our one-account-per-person policy.
• Payment Processing: To facilitate deposits and withdrawals in BDT via your chosen payment method, and to maintain accurate transaction records for your account.
• Responsible Gaming: To monitor your gaming activity for signs of problem gambling, to enforce any self-imposed deposit limits or exclusion requests, and to proactively reach out where concerning patterns are identified.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, money laundering, and other prohibited activity on the platform.
• Customer Support: To respond to your support enquiries, resolve disputes, and maintain records of our communications with you.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the xdaji platform's performance, user interface, and game catalogue.
• Promotional Communications: Where you have provided explicit consent, to send you information about xdaji promotions, seasonal offers (including BPL free bets, Eid reload bonuses, and Pohela Boishakh specials), and platform updates. You may withdraw consent at any time.
• Legal Compliance: To meet our obligations under applicable law, including responding to lawful requests from competent authorities.

06 Data Sharing

xdaji does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. We share personal data only in the following limited and controlled circumstances:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers to support platform operations. These include KYC identity verification providers, payment processing partners (including mobile money operators such as bKash and Nagad), cloud hosting and infrastructure providers, fraud detection and risk management services, and platform analytics tools. All such providers are contractually bound to process your data only on xdaji's instructions and to maintain confidentiality and security standards equivalent to our own.

6.2 Game Providers

To facilitate gameplay, limited technical session data (such as session tokens and game round identifiers) is shared with our game studio partners — including Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe — solely for the purpose of delivering game content to your device. These providers do not receive your full identity or financial data.

6.3 Legal and Regulatory Disclosure

xdaji may disclose personal data to law enforcement agencies, regulatory authorities, or other competent bodies where we are required to do so by applicable law, court order, or valid legal process. In such cases, we disclose only the minimum data necessary to satisfy the legal requirement.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of xdaji's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified by email prior to any such transfer, and the receiving entity will be bound by privacy obligations no less protective than those set out in this Policy.

07 Data Retention

xdaji retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The general retention periods we apply are as follows:

• Active Account Data: Retained for the full duration of your account's active status plus a minimum of five (5) years following account closure, to support dispute resolution and legal compliance.
• KYC and Identity Documents: Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Transaction and Betting Records: Retained for a minimum of five (5) years from the date of each transaction, consistent with standard financial record-keeping obligations.
• Support Communications: Retained for three (3) years from the date of each interaction unless a longer retention period is required in connection with an active dispute.
• Marketing Consent Records: Retained for the duration of your marketing consent plus two (2) years following withdrawal of consent, as evidence of your opt-in status.
• Technical and Device Logs: Retained for up to twelve (12) months for security and performance monitoring purposes, then anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data — from which no individual can be identified — may be retained indefinitely for statistical and analytical purposes.

08 Data Security

xdaji employs a layered, defence-in-depth approach to data security. The technical and organisational measures we maintain include:

• Encryption in Transit: All data exchanged between your device and the xdaji platform is protected by TLS 1.2 or higher, ensuring that your credentials, payment references, and personal details cannot be intercepted in transit.
• Encryption at Rest: Sensitive data stored on xdaji servers, including identity documents and financial references, is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted to xdaji staff and authorised processors who have a genuine operational need for it. All internal access is logged, audited, and subject to role-based permission controls.
• Penetration Testing: xdaji's platform infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Fraud Detection: Automated fraud detection systems monitor transaction patterns, login behaviour, and device fingerprints in real time to identify and respond to suspicious activity.
• Staff Training: All xdaji personnel who handle personal data receive regular data protection and security awareness training.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, xdaji will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach.

09 Cookies & Tracking Technologies

xdaji uses cookies and similar technologies — including local storage objects and session tokens — to deliver a functional, secure, and personalised experience on the platform. The categories of cookies we use are as follows:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They maintain your login session, remember your account preferences during a single visit, and enable secure payment flows. Without these cookies, core platform features would not operate correctly. These cookies cannot be disabled.

9.2 Performance and Analytics Cookies

These cookies collect anonymised data about how users interact with the xdaji platform — such as which pages are visited most frequently, how long users spend on specific game sections, and which features generate the most engagement. This data is used exclusively to improve the platform experience. No personally identifiable information is included in analytics reports.

9.3 Functional Cookies

These cookies remember choices you make on the platform — such as your preferred language setting (English) or your last-visited game category — so that these preferences are applied automatically on your next visit. Disabling functional cookies may result in a less personalised experience.

9.4 Managing Cookies

Most modern browsers allow you to view, block, or delete cookies through their settings menus. Please note that blocking strictly necessary cookies will prevent you from logging in to your xdaji account or completing transactions. xdaji does not use third-party advertising cookies or cross-site tracking technologies.

10 Your Privacy Rights

As a user of the xdaji platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Request". We will acknowledge your request within five (5) business days and respond in full within thirty (30) calendar days.

• Right of Access: You may request a copy of all personal data xdaji holds about you, together with information about how it is used, where it is stored, and with whom it is shared.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (see Section 7).
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. Upon receipt of a valid objection, we will cease all marketing communications immediately.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where xdaji relies on your consent as the lawful basis for processing — such as for promotional communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11 Minors & Age Policy

The xdaji platform is strictly for adults aged 21 years and above. xdaji does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account, deposit funds, or participate in any gaming activity on the xdaji platform.

If xdaji discovers or has reason to believe that a registered account is held by an individual under 21 years of age, we will immediately suspend the account, conduct a full investigation, void all associated bets and transactions, and permanently close the account. Any balance associated with an underage account will be returned to the payment method used for deposits, net of any bonuses already consumed.

If you are a parent or guardian and believe that your child under the age of 21 has registered an xdaji account, please contact us immediately at [email protected] with the subject line "Underage Account". We will investigate and act promptly.

12 International Data Transfers

The xdaji platform is primarily operated for users in Bangladesh, and we aim to process and store personal data within secure data centre environments. However, some of our third-party service providers — including certain game studios and cloud infrastructure providers — may be located outside Bangladesh. Where personal data is transferred to a recipient in another country, xdaji takes appropriate safeguards to ensure that the transfer is conducted securely and that the recipient provides a level of data protection equivalent to the standards described in this Policy.

Such safeguards include contractual data processing agreements that incorporate standard data protection clauses, binding the receiving party to obligations of confidentiality, security, and limited use of the data. xdaji does not transfer personal data to recipients in countries that do not offer adequate data protection without first implementing these contractual safeguards.

13 Changes to This Privacy Policy

xdaji reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. When material changes are made, we will notify registered users by email at least fourteen (14) calendar days before the revised Policy takes effect. The updated Policy will also be published at https://xdaji.io/privacy-policy with the revised effective date clearly indicated at the top of the document.

We encourage you to review this Privacy Policy periodically. Your continued use of the xdaji platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with the changes, you must close your account before the revised Policy takes effect.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xdaji handles your personal data, please reach out to our support team using the contact details below. All privacy-related communications are handled in English by our team operating on Bangladesh Standard Time (BST, UTC+6), available 24 hours a day, 7 days a week.

• General Privacy Enquiries: [email protected] (subject line: "Privacy Enquiry")
• Data Access or Erasure Requests: [email protected] (subject line: "Privacy Request")
• Underage Account Reports: [email protected] (subject line: "Underage Account")
• Data Breach Reports: [email protected] (subject line: "Security Concern")

All email addresses listed above are plain text references only. They are not clickable links. Please copy the address and paste it into your email client to compose a message.

This Privacy Policy was last updated and is effective as of 1 January 2026. It supersedes all previous versions of the xdaji Privacy Policy.