xdaji Privacy Policy
Your Data, Our Responsibility

01 Information We Collect

When you register and use xdaji, we collect a range of personal data necessary to operate a safe, compliant, and high-quality online gaming platform. The categories of data we collect depend on how you interact with xdaji and fall into the following groups:

1.1 Registration & Identity Data

When you create an account on xdaji, we collect your full name, date of birth, email address, phone number, and the username and password you select. This information is required to establish your identity, verify your eligibility to use the platform (including confirming you are 18 years of age or older), and to administer your account throughout its lifecycle.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process — required under anti-money-laundering standards — we may collect copies of government-issued identity documents such as your National ID card (NID), passport, or driving licence. We may also collect proof of address documents and proof of ownership of the payment method you use, such as a screenshot of your bKash or Nagad wallet registration. These documents are collected securely and retained only for as long as legally required.

1.3 Financial Data

We collect transaction data related to your deposits and withdrawals, including the payment method used (for example, bKash, Nagad, Rocket, Upay, or a Bangladeshi bank), transaction amounts in Bangladeshi Taka (৳), transaction timestamps, and transaction reference numbers. We do not store full payment card numbers or mobile banking PINs on our servers.

1.4 Gaming Activity Data

We collect records of your gaming activity on xdaji, including the games you play (slots, live casino, crash games, sports betting markets), the amounts wagered, the outcomes of wagers, bonus claims and wagering progress, and your session durations. This data is used for account management, responsible gaming monitoring, and fraud detection.

1.5 Technical & Device Data

When you access xdaji via a web browser or mobile device, we automatically collect certain technical data including your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, time zone (Bangladesh Standard Time, UTC+6), and the URL path of pages visited within xdaji.com. This data is used for security monitoring, platform optimisation, and fraud prevention.

1.6 Communications Data

If you contact our support team via live chat or email, we retain records of those communications — including the content of your messages and the timestamps — for quality assurance, dispute resolution, and compliance purposes.

02 How We Use Your Data

xdaji uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the original reason it was collected. The primary purposes for which we process your personal data are:

• Account administration: Creating, maintaining, and managing your xdaji account, including processing your registration, verifying your identity, and handling account closure requests.
• Service delivery: Enabling you to access and use all xdaji products and services, including placing bets, playing casino games, making deposits, and receiving withdrawals in Bangladeshi Taka.
• Payment processing: Processing deposits and withdrawals through your chosen payment method, including bKash, Nagad, Rocket, Upay, and Bangladeshi banks such as Dutch-Bangla Bank, BRAC Bank, and City Bank.
• Identity verification and KYC compliance: Verifying your age (18+ requirement) and identity in accordance with anti-money-laundering obligations and responsible gaming commitments.
• Responsible gaming: Monitoring gaming patterns to identify signs of problem gambling behaviour and to enable or enforce responsible gaming tools such as deposit limits, self-exclusion, and reality checks.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, account takeover attempts, collusion, bonus abuse, and other prohibited conduct.
• Customer support: Responding to your support queries, resolving disputes, and improving the quality of our support services based on interaction records.
• Marketing communications: Sending you promotional offers, bonus notifications, and seasonal promotions (such as Eid, Pohela Boishakh, BPL season offers, and Victory Day specials) by email or SMS — but only where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Platform improvement: Analysing aggregated usage data to improve the xdaji platform, optimise game loading times, identify and fix technical issues, and enhance the user experience for players across Bangladesh.
• Legal compliance: Meeting our obligations under applicable laws, responding to lawful requests from regulatory authorities, and maintaining records as required by law.

03 Legal Basis for Processing

xdaji processes your personal data on the basis of one or more of the following legal grounds, depending on the specific purpose of the processing activity:

04 Data Sharing & Disclosure

xdaji does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for each specific purpose:

4.1 Payment Service Providers

To process your deposits and withdrawals, we share the minimum necessary transaction data with the payment service providers you use, including bKash, Nagad, Rocket, Upay, and Bangladeshi banking partners. These providers operate under their own privacy policies and are independently responsible for the personal data they collect in the course of processing your transactions.

4.2 Game Software Providers

The games available on xdaji are powered by licensed third-party game studios, including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game powered by one of these studios, limited technical data (such as a pseudonymous player identifier and session data) may be transmitted to the game provider's servers for the purpose of delivering the game. These providers do not receive your full name, NID, or financial account details.

4.3 Identity Verification Partners

To fulfil our KYC obligations, we may use third-party identity verification services to assist in authenticating the documents you submit. These partners process identity data solely on our instructions and are contractually prohibited from using it for any other purpose.

4.4 Fraud Prevention and Security Services

We may share device data, IP addresses, and behavioural signals with third-party fraud detection and cybersecurity services to protect the xdaji platform and its users from fraudulent activity, account takeover attempts, and other security threats.

4.5 Legal and Regulatory Disclosure

xdaji may disclose your personal data to law enforcement agencies, regulatory authorities, or courts if we are required to do so by applicable law, or if we reasonably believe that disclosure is necessary to protect the rights, property, or safety of xdaji, its users, or the public.

05 Cookies & Tracking

xdaji uses cookies and similar tracking technologies on the xdaji.com website to ensure the platform functions correctly, to remember your preferences, and to analyse how users interact with our pages. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary or security cookies may prevent you from logging in or using certain features of the xdaji platform.

06 Data Retention

xdaji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply as a general guide:

When data is no longer required under the applicable retention period, it is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identifiable individual. Anonymised aggregate data (for example, platform-wide betting statistics) may be retained indefinitely for analytical purposes.

07 Your Rights

As a user of the xdaji platform, you have the following rights with respect to your personal data. To exercise any of these rights, contact our support team at support at xdaji.com. We aim to respond to all rights requests within 30 days.

• Right of access: You have the right to request a copy of the personal data xdaji holds about you, along with information about how it is used and with whom it is shared.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For basic account details (name, phone number, email), you may be able to update these directly via your account settings.
• Right to erasure: In certain circumstances, you may request that xdaji delete your personal data. This right applies where the data is no longer necessary for the purpose for which it was collected and there is no legal obligation requiring us to retain it. Note that we cannot delete data we are legally required to retain, such as KYC records and financial transaction logs.
• Right to restrict processing: You may request that xdaji temporarily restrict the processing of your personal data in certain situations — for example, while you contest the accuracy of data we hold or while a rights request is under review.
• Right to data portability: Where processing is based on your consent or on a contractual basis, you may request that xdaji provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You have the right to object to the processing of your personal data where it is based on legitimate interests, including direct marketing. If you object to marketing, we will stop sending you promotional communications immediately.
• Right to withdraw consent: Where xdaji's processing is based on your consent (for example, consent to receive marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

08 Data Security

xdaji takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• SSL/TLS encryption: All data transmitted between your browser or device and xdaji.com is encrypted using industry-standard Transport Layer Security (TLS). The padlock icon in your browser's address bar confirms this encryption is active.
• Encrypted data storage: Sensitive personal data — including identity document files and financial records — is stored in encrypted form on our servers. Encryption keys are managed using established key management practices.
• Access controls: Access to personal data within xdaji's internal systems is restricted on a strict need-to-know basis. Staff members are only granted access to the categories of data required to perform their specific role. All access is logged and audited.
• Password hashing: User account passwords are never stored in plain text. They are processed using a strong, industry-standard one-way hashing algorithm with salt, ensuring that even in the unlikely event of a data breach, raw passwords cannot be recovered.
• Fraud and anomaly detection: xdaji employs automated monitoring systems that flag unusual account activity — such as login attempts from unfamiliar IP addresses, atypical transaction patterns, or suspicious betting behaviour — for human review.
• Staff training: All xdaji staff who handle personal data receive training on data protection obligations and security best practices as part of their onboarding and on an ongoing basis.

While xdaji maintains strong security standards, no online platform can guarantee absolute security. You play an important role in protecting your own data by keeping your account password confidential, not sharing login credentials with others, and logging out of your account when using shared devices.

09 Third-Party Services

The xdaji platform integrates with a number of third-party services required to deliver our products, including game software providers, payment processors, and analytics tools. While we carefully evaluate all third-party partners before engaging them, xdaji is not responsible for the privacy practices of external services.

Each third-party service provider operates under its own privacy policy and data protection framework. Users who interact directly with third-party services — for example, by opening a bKash wallet, installing the Nagad app, or contacting a bank via its own website — are subject to the terms and policies of those services directly.

Game content provided by studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi is delivered via secure, isolated iframes or API integrations. These providers receive only the technical session data necessary to deliver gameplay and settle results. They do not receive your full KYC documents or payment account details.

10 Updates to This Policy

xdaji reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or improvements to our platform. When we make material changes to this policy — meaning changes that significantly affect how we collect, use, or share your personal data — we will notify you by sending an email to the address registered on your xdaji account and by displaying a prominent notice on xdaji.com.

The revised policy will be published on this page with an updated "Last Updated" date. We encourage you to review this page periodically so that you remain informed about how xdaji handles your personal data. Your continued use of the xdaji platform after a revised policy takes effect constitutes your acceptance of the updated terms.

For minor changes — such as typographical corrections or updates to contact details — we may update the policy without sending individual notifications, provided that the substantive rights and obligations described in the policy are not affected.