rabaje Privacy Policy

rabaje processes personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to create and manage your account, process transactions, and deliver the services you have requested.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform analytics, and responsible gaming enforcement, where these interests are not overridden by your data protection rights.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering obligations and responses to lawful regulatory requests.
• Consent: Processing for optional marketing communications, where you have given explicit opt-in consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

rabaje does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and their respective partner banks (including City Bank, BRAC Bank, Islami Bank, Dutch-Bangla Bank) — solely to execute deposit and withdrawal transactions.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified studios — limited session data required to deliver game functionality within the Platform.
• Identity verification services: Third-party KYC providers used to confirm player identity and age as required by our responsible gaming framework.
• Legal and regulatory authorities: Competent authorities where disclosure is required by applicable law, court order, or lawful regulatory demand. rabaje will notify affected players of such disclosure where legally permitted to do so.

All third-party partners who receive personal data from rabaje are contractually required to maintain appropriate data security standards and to use the data only for the purpose for which it was disclosed.

rabaje implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• SSL/TLS encryption: All data transmitted between your device and the rabaje Platform is encrypted using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser's address bar when accessing rabaje.app.
• Password hashing: Account passwords are stored using a one-way cryptographic hashing algorithm. rabaje staff cannot view your password in plain text, and we will never ask you to share it.
• Access controls: Access to player data within our internal systems is restricted to authorised personnel on a strict need-to-know basis, governed by role-based access controls.
• Intrusion detection: Automated monitoring systems scan for unusual access patterns, multiple failed login attempts, and other indicators of unauthorised activity, triggering account-level security alerts.
• Secure infrastructure: The Platform is hosted on servers with physical and network-level security controls. Regular security audits and penetration tests are conducted to identify and address vulnerabilities.

Despite these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying rabaje immediately if you suspect unauthorised access to your account.

rabaje retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations:

• Active account data: Retained for the duration of your account being open and active on the Platform.
• Transaction records: Financial transaction data is retained for a minimum of five years following the date of the transaction to satisfy anti-money laundering record-keeping requirements.
• KYC documents: Identity verification documents are retained for a minimum of five years from the date of account closure or the date of the last transaction, whichever is later.
• Support communications: Live chat and email correspondence with the Player Support team is retained for three years from the date of the interaction.
• Self-exclusion records: Records of self-exclusion requests are retained indefinitely to prevent re-registration during active exclusion periods and to maintain a historical record of responsible gaming interventions.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

rabaje uses first-party cookies and similar tracking technologies to operate and improve the Platform. We do not use third-party advertising cookies or cross-site tracking technologies.

• Session cookies: Essential cookies that maintain your login state during a browsing session. These are deleted when you close your browser or log out of your account.
• Preference cookies: Store non-sensitive preferences such as your chosen game category, language settings, and notification preferences to personalise your experience on return visits.
• Analytics cookies: First-party analytics cookies collect aggregated, anonymised data on page views, feature usage, and session duration to help us understand how the Platform is used and where improvements can be made.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and other security threats by assigning a unique session identifier to each authenticated session.

You may disable non-essential cookies via your browser settings. Disabling session or security cookies may prevent you from logging in or using certain features of the Platform.

As a player on the rabaje Platform, you have the following rights with respect to your personal data:

• Right of access: You may request a copy of the personal data we hold about you at any time by contacting Player Support.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Some data fields (such as your registered name) may require identity re-verification before changes are applied.
• Right to erasure: Subject to legal retention obligations, you may request deletion of your personal data. Note that we cannot erase data we are legally required to retain (such as transaction records).
• Right to object to marketing: You may opt out of promotional communications at any time via your account settings or by contacting Player Support. Opting out of marketing does not affect essential service communications.
• Right to data portability: You may request a structured, machine-readable export of the personal data you have provided to us.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, contact our Player Support team via live chat on the Platform or by email at [email protected] (plain text — not a clickable link). We aim to respond to all data rights requests within 30 calendar days.

rabaje is strictly an adults-only platform. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes age verification steps specifically to prevent underage access.

• If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete the data, and reverse any transactions where possible.
• Parents and guardians who believe a minor may have accessed the Platform should contact Player Support immediately at [email protected].
• We recommend that adults sharing devices with minors use device-level parental controls to restrict access to online gambling websites.

rabaje may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform functionality. When we make material changes, we will:

• Update the effective date shown at the top of this page;
• Display an in-app notification to registered players upon their next login, summarising the key changes;
• Retain the previous version of the Policy in our records for reference.

Your continued use of the Platform after the updated Policy has been published constitutes your acceptance of the revised terms. If you do not agree to the revised Policy, you must stop using the Platform and may request account closure by contacting Player Support.