rabajie Privacy
Policy

Section 1

Information We Collect

1.1 Information You Provide Directly

When you register a rabajie account or use our services, you may provide the following categories of personal data:

• Identity information: Full name, date of birth, gender, and National Identity Card (NID) number or passport number (required for age and identity verification).
• Contact information: Mobile phone number (Bangladesh format), email address, and — optionally — a residential address in Bangladesh (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar).
• Payment information: Mobile wallet numbers (bKash, Nagad, Rocket, Upay), bank account details (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and transaction reference numbers. Full payment credentials are never stored on our servers — see Section 6 for details.
• Account preferences: Language preference (English), notification settings, responsible gaming limits (deposit caps, session time limits, self-exclusion requests), and betting history.
• Support communications: Records of conversations with the 24/7 live chat support team, including timestamps and issue descriptions, retained for quality assurance and dispute resolution.

1.2 Information Collected Automatically

When you access the rabajie platform — whether via desktop browser or mobile device — the following technical data is collected automatically:

1.3 Information from Third Parties

rabajie may receive limited personal data from trusted third-party partners in the following contexts: payment processors (bKash, Nagad, Rocket, Upay) confirming transaction status; identity verification providers confirming whether submitted NID or passport details match government records; and fraud intelligence services flagging device fingerprints or IP addresses associated with known fraudulent activity. In every case, such data is received under strict data-sharing agreements and used only for the stated purpose.

Section 3

Data Sharing & Third Parties

3.1 Service Providers

rabajie shares limited personal data with carefully selected service providers who assist in operating the platform. These partners are bound by contractual data-processing obligations and may only use your data for the specific purpose for which it was shared. Categories of service providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank — to process deposits and withdrawals on your behalf.
• Identity verification providers: Third-party KYC (Know Your Customer) services used to verify NID and passport documents submitted during account verification.
• Game providers: Studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming receive the minimum data required to run their games within the rabajie platform environment. These providers operate under their own data protection frameworks.
• Platform infrastructure providers: Cloud hosting, content delivery, and cybersecurity providers who support the technical operation of the rabajie platform.
• Analytics providers: Aggregated, anonymised session and performance data may be shared with analytics tools to help us improve platform usability. No individually identifiable data is shared for analytics purposes.

3.2 Legal Disclosures

rabajie may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by applicable law, a valid court order, or an official request from a Bangladeshi government authority. In such cases, we will disclose only the minimum data required to satisfy the legal obligation and will, where legally permitted, notify the affected account holder that a disclosure has been made.

3.3 Business Transfers

In the event of a merger, acquisition, or transfer of the rabajie platform to a successor operator, your personal data may be transferred as part of that transaction. In such circumstances, the successor operator will be contractually obligated to honour the privacy commitments set out in this policy. You will be notified of any such transfer at least 30 days before it takes effect, giving you the opportunity to request account closure and data deletion if you do not wish your data to be transferred.

Section 5

Data Security & Retention

5.1 Technical Security Measures

rabajie employs a layered security architecture to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key technical measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and rabajie servers.
• Encrypted storage for all sensitive personal data fields, including identity document numbers and contact details, at rest in our database infrastructure.
• Access controls that restrict internal access to personal data on a strict need-to-know basis. No rabajie team member can access your account password — passwords are stored using one-way cryptographic hashing.
• Continuous intrusion detection and automated anomaly alerts that flag unusual access patterns in real time.
• Regular penetration testing and security audits conducted by independent specialists.
• Two-factor authentication (2FA) available for all player accounts and mandatory for all internal staff accounts with access to personal data.

5.2 Data Breach Response

In the event of a confirmed data security breach that poses a risk to your personal data, rabajie will notify affected players without undue delay — and in any event within 72 hours of becoming aware of the breach — via email to the registered address and an in-platform notification. The notification will describe the nature of the breach, the categories of data affected, the steps rabajie has taken to contain the breach, and the recommended actions you should take to protect yourself.

5.3 Data Retention Periods

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, subject to the minimum retention periods set out below:

• Active account data: Retained for the duration of your active account plus 5 years after account closure, to comply with financial record-keeping and anti-money-laundering obligations.
• Transaction records: Retained for 7 years from the date of the transaction, in line with standard financial audit requirements.
• Identity verification documents: Retained for 5 years after account closure. Copies are stored in encrypted form and access is strictly logged.
• Support chat records: Retained for 2 years from the date of the conversation, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the lifetime of the account plus 3 years, to demonstrate consent compliance.
• Session and analytics data: Anonymised after 90 days and retained in aggregate form indefinitely for platform improvement purposes.

When a retention period expires, personal data is securely deleted or irreversibly anonymised. No data is retained beyond the periods above without a specific legal justification.

Section 7

Your Privacy Rights

Every registered rabajie player has the following rights with respect to their personal data. To exercise any of these rights, contact the 24/7 live chat support team or email support@rabajie (displayed as plain text — not a clickable link). We will respond to all valid requests within five business days.

• Right of Access: You may request a full copy of the personal data that rabajie holds about you, including your account information, transaction history, game records, and support communications. Data exports are provided in a readable format within five business days of a verified request.
• Right to Rectification: If any personal data held on your account is inaccurate or incomplete, you have the right to request that it be corrected. Identity corrections may require re-verification via NID or passport document.
• Right to Erasure: You may request deletion of your personal data. Erasure requests will be fulfilled except where retention is required by law (e.g., transaction records subject to financial record-keeping obligations) or where the data is necessary to prevent fraud. Where full erasure is not possible, we will delete all data that can lawfully be deleted and anonymise the remainder.
• Right to Restriction of Processing: You may request that we restrict processing of your personal data — for example, while the accuracy of data you have disputed is being investigated — without requiring full erasure.
• Right to Data Portability: You may request a structured, machine-readable export of the personal data you have provided to rabajie, suitable for transfer to another platform or service.
• Right to Object: You may object to processing carried out on the basis of legitimate interest — including profiling for responsible gaming purposes or platform analytics. Where your objection is upheld, we will cease the relevant processing unless there are compelling legitimate grounds that override your interests.
• Right to Withdraw Marketing Consent: Where processing is based on your consent — including marketing communications — you may withdraw that consent at any time via your account notification settings or by contacting the live chat support team. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to Human Review of Automated Decisions: Where an automated decision has materially affected your account — such as a fraud-triggered suspension — you have the right to request a manual review by a member of our compliance team.