Privacy Policy — How bidi baji Protects Your Data

bidi baji collects personal data only where there is a clear and legitimate purpose for doing so. We do not collect data speculatively or beyond what is reasonably necessary to deliver a safe, compliant, and enjoyable platform experience. The categories of personal data we collect, and the primary purpose of each, are set out in the table below.

Data you provide directly. The majority of personal data bidi baji holds about you is provided by you directly — at registration, during KYC verification, when contacting support, or when updating your account profile. You are not obligated to provide personal data beyond what is required to create and operate your account, but failure to provide mandatory information (such as identity documents for KYC) may limit your ability to withdraw funds or access certain platform features.

Data collected automatically. When you use the bidi baji platform, we automatically collect certain technical and usage data via standard server logging and analytics tools. This includes your IP address, the device and browser you are using, the pages you visit, and the duration of your sessions. This data is used in aggregate form to monitor platform security and improve service quality, and is not used to build individual marketing profiles.

Data from third parties. In certain circumstances, bidi baji may receive data about you from third parties — for example, from payment providers confirming the status of a deposit or withdrawal transaction, or from identity verification partners during the KYC process. Such third-party data is used only for the purpose for which it was shared and is not combined with your account data for marketing purposes.

bidi baji processes your personal data only where a valid legal basis exists for doing so. Depending on the nature and purpose of the processing activity, we rely on one or more of the following legal grounds:

• Contractual necessity. Processing your identity data, contact data, and financial data is necessary for us to perform our obligations under the account agreement you enter into when you register on bidi baji — including operating your account, processing your deposits and withdrawals, and settling your bets.
• Legal obligation. Certain processing activities — including KYC identity verification, transaction monitoring, and the maintenance of records for anti-money-laundering (AML) compliance purposes — are required of bidi baji by applicable legal and regulatory obligations. We cannot operate a responsible online gaming platform without fulfilling these obligations.
• Legitimate interests. bidi baji processes technical and usage data on the basis of our legitimate interest in maintaining platform security, detecting and preventing fraud, improving our product, and ensuring that our services remain reliable and fair for all players. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms.
• Consent. Where we send you optional marketing communications — such as promotional emails or SMS notifications about new games, bonuses, or seasonal offers — we do so only on the basis of your explicit consent, which you may withdraw at any time via your account notification preferences or by contacting our support team. Withdrawing consent does not affect the lawfulness of any processing already carried out on the basis of that consent prior to its withdrawal.
• Vital interests. In rare circumstances where the health or safety of a player may be at risk — for example, in the context of a responsible gaming intervention — bidi baji may process relevant data to the extent necessary to protect that player's vital interests.

bidi baji does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

Payment processing partners. To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Islami Bank, we are required to share relevant financial and identity data with the respective payment network or banking institution. These partners operate under their own privacy policies and are subject to applicable financial regulations. bidi baji shares only the data that is strictly necessary to complete the transaction.

Identity verification providers. During KYC verification, we may share your identity documents and personal details with trusted third-party identity verification service providers who assist us in confirming the authenticity of the documents submitted. These providers are contractually bound to process your data only for verification purposes and are prohibited from using it for any other purpose.

Game software providers. The casino games, live dealer tables, crash games, and slot titles available on bidi baji are powered by certified third-party Game Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you participate in a game, certain session data — such as your player ID, bet amounts, and game outcome — is transmitted to the relevant Game Provider for game execution and result certification purposes. Game Providers do not receive your full identity profile or financial account details.

Legal and regulatory authorities. Where required by applicable law, court order, or regulatory direction, bidi baji may disclose personal data to relevant authorities — including financial intelligence units, law enforcement agencies, or regulatory bodies. We will always seek to limit such disclosures to the minimum data necessary to satisfy the legal requirement.

Internal group entities. Personal data may be shared within the bidi baji group of companies for the purposes of platform operation, compliance, and customer support. All group entities that receive personal data are bound by data protection obligations consistent with this Privacy Policy.

bidi baji uses cookies and similar browser-based storage technologies to operate the platform effectively, maintain your login session, and gather aggregate usage statistics. We do not use cookies to track your activity across third-party websites, and we do not place third-party advertising cookies on any page of our platform.

Essential cookies. These cookies are strictly necessary for the platform to function. They maintain your authenticated session, remember your language and display preferences, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without impairing your ability to use the platform. They do not track you across other websites and do not collect any personally identifiable information beyond what is required to keep your session active and secure.

Analytics cookies. bidi baji uses first-party analytics tools to collect aggregate, anonymised data about how players use the platform — including which pages are visited most frequently, typical session durations, and common navigation paths. This information helps us identify areas for improvement and ensure the platform performs reliably under varying load conditions. Analytics data is not linked to your personal identity and is retained only in aggregated form.

Functional cookies. These cookies remember preferences you have set within the platform — such as your preferred game view layout, notification settings, or table stakes defaults — so that you do not need to reconfigure them on every visit. They are tied to your account session and are cleared when you log out.

Managing cookies. You may manage or delete cookies via your browser's settings. Disabling essential cookies will prevent you from logging in to your bidi baji account. Disabling analytics or preference cookies will not affect your access to the platform but may result in a less personalised experience. For guidance on managing cookies in your specific browser, please refer to your browser's help documentation.

bidi baji retains personal data only for as long as necessary to fulfil the purpose for which it was collected, and in any event no longer than is required by applicable legal and regulatory obligations. The retention periods below reflect our standard practices, subject to any extended retention that may be required by law.

• Active account data (identity, contact, financial, and transaction records) is retained for the duration of your account's active status plus a minimum of five years following account closure, in order to satisfy anti-money-laundering record-keeping obligations.
• KYC documents (identity document images and verification records) are retained for a minimum of five years following the date of last verification, consistent with standard AML compliance requirements.
• Betting and game transaction records are retained for a minimum of three years from the date of each transaction, to support dispute resolution, regulatory reporting, and responsible gaming monitoring.
• Customer support communications (live chat logs, email correspondence, support tickets) are retained for a maximum of two years from the date of the interaction, after which they are securely deleted.
• Analytics and technical log data is retained in aggregate form for up to 12 months, after which it is anonymised or deleted. Raw server logs containing IP addresses are retained for a maximum of 90 days.
• Marketing consent records are retained for the period during which consent is active, plus three years following withdrawal of consent, to demonstrate compliance in the event of a complaint.

When the retention period for any category of personal data expires, bidi baji will either securely delete the data or anonymise it in a way that makes re-identification impossible. Anonymised data may be retained indefinitely for aggregate statistical purposes.

The security of your personal data is a core operational priority at bidi baji. We maintain a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

Encryption in transit and at rest. All data transmitted between your device and the bidi baji platform is encrypted using 256-bit TLS (Transport Layer Security). Sensitive data stored in our systems — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data and rotated on a regular schedule.

Access controls. Access to personal data within bidi baji's internal systems is granted on a strict need-to-know basis. Only personnel whose role explicitly requires access to a given category of data are authorised to view or process it. All internal access is logged and subject to regular audit. Administrative access to production systems requires multi-factor authentication.

Infrastructure security. bidi baji's platform is hosted on infrastructure that is protected by enterprise-grade firewalls, intrusion detection systems (IDS), and distributed denial-of-service (DDoS) mitigation. Security patches are applied promptly, and our systems undergo regular vulnerability assessments.

Data breach procedures. In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, bidi baji will notify affected players without undue delay and take all reasonable steps to contain the breach, assess its impact, and prevent recurrence. We maintain a documented incident response plan for this purpose.

Your role in account security. While bidi baji maintains robust platform-level security, the security of your account also depends on the strength and confidentiality of your login credentials. We strongly recommend using a unique, complex password for your bidi baji account and enabling any two-factor authentication options available to you. Do not share your login details with anyone, and contact our support team immediately if you suspect unauthorised access to your account.

As a player on the bidi baji platform, you hold a meaningful set of rights over the personal data we hold about you. bidi baji is committed to honouring these rights promptly and transparently. To exercise any of the rights listed below, please contact our support team at [email protected] with a clear description of your request. We will acknowledge your request within 3 business days and aim to fulfil valid requests within 30 calendar days.

Identity verification for data requests. To protect your privacy, bidi baji will verify your identity before processing any data rights request. This is to ensure that personal data is not disclosed to, or deleted at the request of, an unauthorised party. We will ask you to confirm certain account details and may request a copy of an identity document for high-sensitivity requests such as full data exports or deletion.

Response timeframes. We aim to respond to all valid data rights requests within 30 calendar days of receipt. Where a request is particularly complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

bidi baji reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the evolution of our platform and services. Any material changes to this Policy will be communicated to registered players via the email address associated with their account and will be prominently noted on this page with a revised effective date.

We encourage you to review this Privacy Policy periodically — particularly before making a deposit or engaging with any new platform feature — to stay informed of how your data is being managed. The effective date displayed at the top of this page indicates when this version of the Policy was last updated. Your continued use of the bidi baji platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

Minor updates. Not all changes to this Policy are material. We may make minor administrative or editorial updates — such as correcting typographical errors, updating contact details, or clarifying existing language — without issuing a formal notification. Such updates do not alter the substantive rights or obligations described in the Policy.

Contact our Privacy team. If you have any questions, concerns, or complaints about how bidi baji collects, uses, or protects your personal data — or if you wish to exercise any of the privacy rights described in Section 07 — please contact our dedicated privacy support team using the details below:

We take all privacy complaints seriously and will investigate every report thoroughly. If you are not satisfied with our response, you may escalate your concern to the relevant data protection authority in your jurisdiction.