xajee Privacy Policy

This Privacy Policy ("Policy") describes how xajee ("xajee", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the xajee Casino platform at xajee.club. It applies to all registered and guest users of the Platform, including visitors who browse without creating an account.

This Policy should be read alongside xajee's Terms & Conditions and Responsible Gaming Policy, both of which incorporate this Policy by reference. By registering an account or continuing to use the Platform after this Policy is published, you acknowledge that you have read and understood its contents and consent to the data practices described herein.

xajee collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your device and browser as you use the Platform, and (in limited circumstances) from third-party service providers. The categories of data we collect include:

• Identity data: full name, date of birth, national ID or passport number (collected during KYC verification), gender, and photograph where required for identity confirmation.
• Contact data: mobile phone number, email address (where provided), and city or district of residence within Bangladesh (e.g. Dhaka, Chittagong, Sylhet, Khulna, Rajshahi).
• Financial data: deposit and withdrawal transaction records, payment method type (e.g. bKash, Nagad, Rocket, Upay, Visa, Mastercard), transaction reference tokens, and account balance history. We do not store mobile banking PINs, card CVV numbers, or full card numbers.
• Gaming data: betting history, game session logs, wagering amounts, win and loss records, bonus usage, and responsible gaming tool settings (e.g. deposit limits, cooling-off periods, self-exclusion status).
• Technical data: IP address, device type and model, operating system, browser type and version, screen resolution, app version (if applicable), session timestamps, and general geographic location derived from IP.
• Communication data: records of your communications with xajee customer support, including the content of messages, timestamps, and outcomes of support interactions.

We collect only the minimum data necessary for the purposes identified in this Policy. We do not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health, unless required by a specific legal obligation.

xajee uses the personal data we collect for the following purposes, each of which is tied to a legitimate legal basis described in Clause 4:

• Account management and Platform delivery: to register your account, authenticate your identity at login, maintain your account balance, process deposits and withdrawals, and deliver all game and betting services.
• KYC and compliance: to verify your identity and age (21+ requirement), comply with applicable anti-money laundering obligations, and satisfy any regulatory or legal requests directed at xajee.
• Customer support: to respond to your enquiries, resolve complaints, and maintain records of support interactions in case of future disputes.
• Responsible gaming: to monitor gaming patterns and identify signs of problem gambling, to enforce deposit limits and self-exclusion orders you have set, and to contact you if your activity triggers our responsible gaming alert thresholds.
• Platform improvement and analytics: to analyse aggregated, anonymised usage data for the purpose of improving the Platform's performance, layout, game selection, and overall user experience. Individual-level data is not used for this purpose.
• Fraud prevention and security: to detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other prohibited conduct as defined in xajee's Terms & Conditions.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Where automated tools flag an account for review (e.g. fraud detection systems), a member of xajee's compliance team will conduct a human review before any account action is taken.

xajee processes personal data under one or more of the following legal bases, depending on the specific activity:

• Contractual necessity: processing required to fulfil xajee's obligations under the Player Agreement — including account creation, deposit processing, game delivery, and withdrawal payment.
• Legal obligation: processing required to comply with applicable laws, including identity verification, anti-money laundering checks, and responding to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — where those interests are not overridden by your data protection rights.
• Consent: where xajee sends you optional marketing communications (if you have opted in), or where processing requires explicit consent under applicable law. You may withdraw consent at any time by contacting [email protected] without affecting the lawfulness of processing carried out before withdrawal.

Because xajee serves the Bangladesh market and processes the majority of player deposits and withdrawals through mobile financial services — principally bKash, Nagad, Rocket, and Upay — we want to be especially transparent about how payment data flows between you, your wallet provider, and xajee.

When you initiate a deposit via bKash, Nagad, or Rocket, you are redirected to that provider's own secure payment interface. Your mobile banking PIN is entered directly into the provider's app or USSD environment — it is never transmitted to xajee's servers, seen by xajee staff, or logged by xajee's systems. xajee receives only a transaction confirmation token (a unique reference ID) that confirms a payment of a specified amount was successfully authorised. This token contains no sensitive credential information. The same principle applies to card payments: card numbers and CVV codes are processed by Visa's or Mastercard's own PCI-DSS compliant systems; xajee receives only a tokenised payment reference.

xajee does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data only in the following limited and controlled circumstances:

• Service providers: trusted third-party vendors who perform functions on xajee's behalf, including payment processors, KYC verification providers, cloud hosting providers, and customer support software platforms. These providers are contractually bound to process your data only for the specific purposes for which it was shared and in accordance with appropriate data protection standards.
• Game studios: licensed third-party game providers (such as Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt) receive session data necessary to deliver the game experience, including your Player ID and session token. They do not receive your full name, mobile number, or financial data.
• Legal and regulatory authorities: where xajee is required by applicable law, court order, or legitimate request from a competent regulatory or law enforcement authority to disclose personal data, we will comply with that obligation and, where legally permitted, notify you.
• Business transfers: in the event of a merger, acquisition, or sale of all or part of xajee's business, player data may be transferred to the acquiring entity, subject to the same or equivalent data protection commitments as those set out in this Policy. Affected players will be notified of any such transfer in advance.
• Fraud prevention networks: anonymised or pseudonymised fraud risk signals may be shared with industry-standard fraud prevention services to protect xajee and its player community against known fraudulent actors.

In every case where xajee shares data with a third party, we require that party to maintain at least equivalent data protection standards to those described in this Policy. We do not permit third parties to use your data for their own marketing or commercial purposes.

xajee uses cookies and similar tracking technologies on xajee.club to support Platform functionality, analyse usage, and detect fraud. The categories of cookies we use are:

• Essential cookies: strictly necessary for the Platform to function — including session authentication cookies that keep you logged in during an active session and security cookies that protect against cross-site request forgery. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: aggregated, anonymised data about how users interact with xajee.club — including which pages are visited most, average session duration, and common navigation paths. This data is used to improve the Platform and is not linked to your individual identity.
• Fraud detection cookies: short-lived cookies used to identify unusual patterns that may indicate automated bot activity, account takeover attempts, or coordinated fraud. These are essential for Platform security and cannot be disabled.
• Preference cookies: optional cookies that remember your Platform preferences, such as language setting and display configuration, so you do not need to reconfigure them on each visit. You may clear these at any time through your browser settings.

You can manage cookie preferences through your browser settings. Please note that disabling essential or fraud detection cookies will impair the Platform's ability to function securely and may prevent you from accessing your account. xajee does not use third-party advertising or retargeting cookies.

xajee retains personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with applicable legal obligations. The following retention periods apply:

• Active account data: retained for the duration of your account relationship with xajee and for a period of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements and to handle any post-closure disputes.
• KYC and identity documents: retained for a minimum of 5 years from the date of verification or from the date of account closure (whichever is later), in compliance with applicable financial crime prevention legislation.
• Support communications: retained for 3 years from the date of the interaction, to facilitate dispute resolution and quality assurance review.

When data is no longer required for any lawful purpose, xajee deletes or irreversibly anonymises it. Where deletion is not immediately technically feasible (e.g. data held in secure backup systems), we restrict access to that data until deletion can be completed.

xajee implements a layered security architecture designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction. The key security measures in place include:

• TLS/SSL encryption on all data in transit between your device and xajee's servers, ensuring that session data, login credentials, and transaction references cannot be intercepted by third parties.
• Encryption at rest for sensitive stored data, including KYC documents and financial records, using industry-standard encryption algorithms on access-controlled server infrastructure.
• Role-based access controls ensuring that xajee staff can only access personal data categories that are necessary for their specific job function. Access logs are maintained and reviewed regularly.
• Regular security assessments and penetration testing of xajee's Platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

Despite these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, xajee will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

You have the following rights in relation to the personal data xajee holds about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered mobile number. We will respond within 30 days.

• Right of access: you may request a copy of all personal data xajee holds about you, together with information about how it is used and with whom it is shared.
• Right to rectification: if any personal data xajee holds about you is inaccurate or incomplete, you may request that it be corrected or updated.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where it has been processed unlawfully. This right is subject to xajee's legal retention obligations.
• Right to restrict processing: you may request that xajee restricts the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data xajee holds, or where processing is unlawful but you prefer restriction to erasure.
• Right to data portability: where processing is based on your consent or on a contract, you may request that xajee provides your personal data in a structured, commonly used, machine-readable format so you can transfer it to another service provider.
• Right to object: you may object to processing based on xajee's legitimate interests. xajee will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

xajee will not discriminate against you for exercising any of these rights. We will not deny services, charge different prices, or provide a different level of service as a result of a data rights request. Identity verification may be required before fulfilling a request to ensure we are responding to the correct individual.

xajee's Platform is strictly for adults aged 21 and above. xajee does not knowingly collect, process, or store personal data from any individual under the age of 21. If you are under 21, you must not use the Platform or provide any personal data to xajee.

If xajee discovers that it has inadvertently collected personal data from a person under the age of 21, we will delete that data immediately and close the associated account. If you believe that a minor has registered on xajee, please contact us at [email protected] so we can investigate and take appropriate action promptly.

xajee.club does not contain links to external third-party websites for commercial or affiliate purposes. Game content is delivered via embedded iframes from licensed game studio providers. While those studios operate under their own data protection policies, xajee only permits studios that maintain appropriate data security standards to deliver content on the Platform.

xajee is not responsible for the privacy practices or content of any third-party studio or payment provider system. We recommend that you review the privacy policies of bKash, Nagad, Rocket, Upay, Visa, and Mastercard independently, as those policies govern how those providers handle your data within their own systems.

xajee may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. When we make a material change — one that substantively affects how we collect or use your personal data — we will provide at least 14 days' notice by posting a prominent notice on the xajee.club homepage and sending a notification to your registered mobile number or email address.

Non-material changes (such as typographical corrections or updated contact details) take effect immediately upon publication. The "Effective Date" at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the Platform following any update constitutes acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how xajee handles your personal data, please contact our support team. We aim to acknowledge all privacy enquiries within 2 business days and to provide a substantive response within 30 days.

Email: [email protected]