cbagi Privacy Policy

1. Data We Collect

When you register for a cbagi account, deposit funds, place wagers, or contact our support team, we collect personal data that is necessary to provide our services securely and in compliance with our anti-money-laundering obligations. We collect only what we genuinely need — no more.

1.1 Registration Data

When you create a cbagi account you provide us with the following information directly:

• Full legal name — as it appears on your government-issued identity document.
• Date of birth — used to verify that you meet the 18+ age requirement.
• Email address — your primary communication channel with cbagi.
• Mobile number — linked to your preferred payment method (bKash, Nagad, Rocket, or Upay).
• Residential address — including district and division in Bangladesh, used for KYC and correspondence purposes.
• Username and password — credential pair used to authenticate your cbagi session.

1.2 Identity Verification (KYC) Data

As part of cbagi's Know Your Customer process, we may request the following documents before processing your first withdrawal:

• National Identity Card (NID), valid passport, or driving licence — front and back copies.
• Recent bank statement, mobile wallet statement, or utility bill (dated within 90 days) as proof of residential address.
• A selfie photograph held alongside your identity document.
• For large withdrawals exceeding ৳50,000 in a rolling 30-day period: a source-of-funds declaration.

1.3 Financial Transaction Data

Every deposit, withdrawal, and bonus transaction on your cbagi account is logged. Transaction records include: amount in BDT, timestamp (Bangladesh Standard Time, UTC+6), payment method used (e.g., bKash, Nagad, Visa), transaction reference number, and account balance before and after the transaction. This data is retained for a minimum of five years to satisfy anti-money-laundering record-keeping obligations.

1.4 Behavioural and Usage Data

When you use the cbagi platform, we automatically collect technical and behavioural data including: your IP address, browser type and version, operating system, device model, screen resolution, session start and end times, pages visited and duration on each page, games played (with stake and outcome recorded for each game round), and sports betting markets accessed. This data helps us improve platform performance, detect fraud, and personalise your experience where you have consented to personalisation.

1.5 Communications Data

When you contact cbagi's support team via email at [email protected] or through any in-platform messaging feature, we retain records of those communications — including your message content, the date and time sent, and any attachments — for quality assurance and dispute resolution purposes. We do not record telephone calls at this time as cbagi provides support exclusively through written channels.

2. How We Use Your Data

cbagi uses your personal data only for legitimate, specified purposes. The table below summarises each primary purpose, the category of data used, and the legal basis that permits that processing.

Purpose	Data Categories Used	Legal Basis
Account creation and authentication	Registration data, device identifiers	Contract performance
Age and identity verification (KYC)	KYC documents, registration data	Legal obligation
Processing deposits and withdrawals	Financial transaction data, payment method details	Contract performance
Fraud prevention and AML compliance	Transaction data, IP address, behavioural data	Legal obligation / Legitimate interest
Responsible gaming monitoring	Behavioural data, financial transaction data	Legal obligation / Legitimate interest
Customer support and dispute resolution	Communications data, account history	Contract performance / Legitimate interest
Platform improvement and analytics	Behavioural and usage data (anonymised)	Legitimate interest
Promotional communications (where consented)	Email address, mobile number, game preferences	Consent

2.1 Marketing Communications

cbagi will only send you promotional emails, SMS notifications, or in-platform messages about bonuses, tournaments, and seasonal offers — such as BPL cricket specials or Eid promotions — if you have explicitly opted in to marketing communications during registration or via your account settings. You may withdraw your marketing consent at any time by updating your notification preferences in your account dashboard or by emailing [email protected] with the subject line "Unsubscribe". Withdrawal of marketing consent does not affect your ability to use cbagi's services.

2.2 Responsible Gaming Profiling

cbagi uses automated analysis of your betting patterns, session lengths, deposit frequency, and loss chasing behaviour to identify signs of problem gambling at an early stage. This profiling is conducted in your interest and forms part of cbagi's duty of care. Where our system flags a concern, a member of the support team may reach out to you in English to discuss responsible gaming resources. You may not opt out of this processing as it is required under cbagi's responsible gaming obligations. Visit the Responsible Gaming page for full details of available tools.

3. Data Sharing & Disclosure

cbagi does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the limited circumstances described below.

3.1 Game and Technology Providers

To operate cbagi's casino and sports betting features, we work with certified third-party studios and technology providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive limited technical identifiers (such as a hashed player ID and session token) for the purpose of loading game sessions and recording outcomes. They do not receive your full name, email address, or payment details. Each provider operates under strict data processing agreements with cbagi.

3.2 Payment Processors

When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the relevant payment processor receives the transaction data necessary to complete that payment. cbagi does not store full card numbers or mobile wallet PINs. Payment processing partners operate under their own privacy frameworks and are independently responsible for their data handling practices.

3.3 Legal and Regulatory Disclosure

cbagi may disclose your personal data to law enforcement agencies, the Bangladesh Financial Intelligence Unit (BFIU), or other competent authorities where we are legally required to do so — for example, in connection with an anti-money-laundering investigation, a court order, or a regulatory audit. In such cases, disclosure is limited to the minimum data required to satisfy the legal obligation, and we will inform you of any such disclosure where we are legally permitted to do so.

3.4 Business Transfers

In the event that cbagi undergoes a merger, acquisition, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide advance notice via your registered email address before any such transfer takes effect and will ensure that the receiving entity is bound by data protection obligations at least as protective as those in this Privacy Policy.

4. Cookies & Tracking

cbagi uses cookies — small text files stored on your device — and similar technologies such as local storage objects and session tokens. The cookies we use fall into the following categories:

Cookie Type	Purpose	Can Be Disabled?
Essential	Session management, authentication, security tokens, load balancing	No — required for the platform to function
Functional	Remembering your language preference (English), game lobby filters, and display settings	Yes — disabling may affect your experience
Analytics	Aggregated, anonymised data on page views, session durations, and feature usage — used to improve cbagi's platform	Yes — no impact on core functionality

4.1 Managing Your Cookie Preferences

You can control cookie storage through your browser's settings. Most modern browsers allow you to view, block, or delete cookies. Please note that disabling essential cookies will prevent you from logging in to your cbagi account, as these cookies maintain your authenticated session. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Firefox, Safari, Edge, etc.). cbagi does not respond to browser "Do Not Track" signals at this time, as there is no universally accepted standard for their implementation.

5. Data Retention

cbagi retains your personal data for only as long as is necessary for the purposes for which it was collected, subject to any legal obligations that require longer retention. The key retention periods are set out below:

• Account and registration data: Retained for the duration of your active account plus 5 years after account closure, to satisfy anti-money-laundering record-keeping requirements.
• KYC identity documents: Retained for 5 years from the date of verification or account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years in line with standard financial compliance obligations.
• Customer support communications: Retained for 3 years from the date of the last communication in a thread, then deleted unless required for ongoing dispute resolution.
• Anonymised analytics data: Retained indefinitely in anonymised, aggregated form — this data cannot be linked back to any individual player.
• Marketing consent records: Retained for 3 years from the date of consent or until consent is withdrawn, whichever is sooner.

When retention periods expire, cbagi securely deletes or anonymises personal data in accordance with our internal data destruction policy. Deletion requests submitted by players are processed within 30 days, subject to the legal retention obligations listed above.

6. Data Security

cbagi implements a layered set of technical and organisational security controls to protect your personal data against unauthorised access, loss, destruction, or disclosure. Our key security measures include:

• TLS 1.3 encryption for all data transmitted between your device and cbagi's servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Password hashing using industry-standard bcrypt with individual salts — cbagi never stores your password in plain text.
• Two-factor authentication (2FA) available for all player accounts, strongly recommended for additional login security.
• Role-based access controls — cbagi staff access to player data is restricted to personnel who require it for their specific function, and all access is logged.
• Regular security audits and penetration testing of cbagi's platform infrastructure.
• DDoS protection and web application firewall (WAF) to defend against malicious traffic.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that poses a significant risk to your rights or freedoms, cbagi will notify affected players via their registered email address within 72 hours of becoming aware of the breach, in accordance with applicable data protection obligations.

6.1 Your Responsibility

You are responsible for keeping your cbagi login credentials confidential. Never share your password with anyone — including cbagi support staff, who will never ask for your password. If you suspect your account has been compromised, contact [email protected] immediately so we can secure your account without delay.

7. Your Privacy Rights

As a cbagi player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days.

7.1 Right of Access

You have the right to request a copy of all personal data cbagi holds about you. We will provide this in a structured, machine-readable format (JSON or CSV) at no charge. We may request proof of identity before fulfilling an access request to ensure we do not disclose your data to an unauthorised party.

7.2 Right to Rectification

If any personal data cbagi holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For most registration data, you can update information directly through your account settings. For KYC-related corrections, please contact support with the corrected information and supporting documentation.

7.3 Right to Erasure

You may request that cbagi delete your personal data. We will fulfil erasure requests to the fullest extent possible, but please note that certain data must be retained to comply with legal obligations — specifically, financial transaction records and KYC documents which must be kept for five years under anti-money-laundering requirements. Data subject to mandatory retention will be clearly identified in our response to your request.

7.4 Right to Restrict Processing

You have the right to request that cbagi restricts processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while an objection to processing is under review. Restriction does not mean deletion; restricted data is flagged and set aside from active processing workflows.

7.5 Right to Object

Where cbagi processes your data on the basis of legitimate interest, you have the right to object to that processing. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests. This right does not apply to processing carried out to fulfil a legal obligation or to perform a contract with you.

7.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another service provider. This right applies to data you have provided to cbagi directly and that is processed by automated means on the basis of your consent or a contract.

7.7 Right to Withdraw Consent

Where cbagi processes your data on the basis of your consent — for example, marketing communications or personalised game recommendations — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal. To withdraw consent, update your preferences in your account dashboard or email [email protected].

8. Changes to This Policy

cbagi reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will notify all active account holders via their registered email address at least 14 days before the changes take effect. Minor clarifications or administrative updates may be made without prior notice, with the "Last updated" date revised accordingly.

We encourage you to review this Privacy Policy periodically. The most recent version published at https://cbagi.app/privacy-policy is always the version in effect. Your continued use of cbagi following the effective date of any update constitutes your acceptance of the revised policy.

For any questions, concerns, or privacy rights requests relating to this Privacy Policy, please contact the cbagi data team at [email protected]. We are available 24/7 on Bangladesh Standard Time (UTC+6) and will respond to all privacy enquiries within 30 calendar days.