Privacy Policy — How obaje Protects Your Data

1 Introduction

obaje ("obaje", "we", "us", "our") operates the online gaming platform at obaje.io, which provides casino games, sports betting, lottery, fishing arcade games, and related entertainment services to players based in Bangladesh. We are committed to protecting the privacy and security of every person who interacts with our platform.

This Privacy Policy ("Policy") describes how obaje collects, uses, stores, shares, and protects personal data relating to registered account holders, visitors to the obaje.io website, and any other individuals who engage with our services. It also explains the rights you have with respect to your personal data and how you can exercise those rights.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy. Together, these documents form the complete regulatory framework governing your relationship with obaje.

If you have any questions about this Privacy Policy or about how obaje processes your personal data, please contact us at the details provided in Section 14.

2 Data We Collect

obaje collects several categories of personal data in the course of providing its services. The categories we collect are set out in the table below:

Category	Examples of Data Collected	Purpose
Identity Data	Full name, date of birth, National Identity Card (NID) number, passport number, photograph	Account registration, KYC verification, age verification
Contact Data	Mobile phone number, email address, residential address (city/district)	Account communication, OTP delivery, support correspondence
Financial Data	bKash/Nagad/Rocket wallet number, bank account details, transaction history, deposit and withdrawal records	Payment processing, fraud prevention, AML compliance
Technical Data	IP address, device type, browser type and version, operating system, screen resolution, session tokens	Platform security, fraud detection, service optimisation
Usage Data	Games played, bet history, session duration, login timestamps, bonus activity, page navigation	Responsible gaming monitoring, personalisation, platform improvement
Communications Data	Support ticket content, chat transcripts, feedback submitted, promotional email responses	Customer support, quality assurance, dispute resolution
Preference Data	Responsible gaming limits set, self-exclusion status, marketing consent preferences, language and display settings	Account management, responsible gaming programme delivery

2.1 Sensitive Data

obaje does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly necessary for identity verification. Where identity documents submitted for KYC contain such information incidentally, it is processed solely for identity verification purposes and is not used for any other purpose.

3 How We Collect Data

obaje collects personal data through the following means:

3.1 Direct Collection

Data you provide directly to us when you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, respond to a survey, or claim a promotional offer. This is the primary source of identity, contact, and financial data.

3.2 Automated Technical Collection

When you access the obaje platform, our servers and analytics systems automatically collect technical data including your IP address, device identifiers, browser characteristics, session timestamps, and navigation behaviour. This data is collected via server logs, cookies, and similar tracking technologies (see Section 8).

3.3 Third-Party Sources

In limited circumstances, obaje may receive personal data from third-party sources, including:

• Identity Verification Providers: Third-party KYC and AML screening services that validate identity documents and screen against regulatory watchlists.
• Payment Processors: Transaction confirmation and fraud-flag data from bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported banking partners.
• Fraud Prevention Partners: Risk-scoring data from fraud detection service providers used to protect the integrity of the platform.

Data received from third-party sources is treated with the same level of protection as data you provide directly, and is used only for the purposes described in this Policy.

4 How We Use Your Data

obaje processes your personal data for the following clearly defined purposes, each supported by a lawful basis:

4.1 Account Registration and Management

To create and maintain your obaje account, verify your identity and age (21+), deliver OTPs for secure login, manage your account settings, and provide access to all platform features. This processing is necessary for the performance of our contract with you.

4.2 Payment Processing

To process deposits and withdrawals via your chosen payment method, reconcile transactions, issue refunds where applicable, and maintain accurate financial records. This processing is necessary for contract performance and compliance with financial regulations.

4.3 Regulatory and Legal Compliance

To fulfil our anti-money laundering (AML), counter-terrorist financing (CTF), and know-your-customer (KYC) obligations. obaje is legally required to verify player identities, monitor transaction patterns for suspicious activity, and report to the appropriate authorities where required by law. This processing is based on legal obligation.

4.4 Platform Security and Fraud Prevention

To detect, prevent, and investigate fraudulent activity, multi-accounting, bonus abuse, payment fraud, and any other prohibited conduct as defined in our Terms & Conditions. This processing is based on our legitimate interests in maintaining a secure and fair gaming environment.

4.5 Responsible Gaming

To monitor your gaming behaviour for signs of problem gambling, deliver self-exclusion and deposit limit tools, and contact you if our responsible gaming monitoring systems flag patterns of concern. This processing is based on legitimate interests and our duty of care to players. For more information, see our Responsible Gaming Policy.

4.6 Customer Support

To respond to support requests, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance. This processing is necessary for contract performance.

4.7 Platform Improvement and Analytics

To analyse platform usage patterns, optimise game offerings, improve the user experience, and develop new features. This processing is based on our legitimate interests in improving our product. Analytics are performed on aggregated or pseudonymised data wherever possible.

4.8 Marketing and Promotions

To send you promotional offers, bonus notifications, and platform updates via your registered contact details, where you have given your consent to receive such communications. You may withdraw your marketing consent at any time by contacting support or updating your account preferences. Withdrawal of marketing consent does not affect your ability to use the platform.

5 Data Sharing and Disclosure

obaje does not sell your personal data to any third party. We do not share your data with advertisers, data brokers, or marketing networks. Your data may be shared with the following categories of trusted third parties, solely to the extent necessary to provide our services:

5.1 Payment Service Providers

Financial data is shared with payment processors including bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported Bangladeshi banking institutions solely for the purpose of processing your deposit and withdrawal transactions. These providers are contractually bound to handle your data securely and are prohibited from using it for any other purpose.

5.2 Identity Verification and KYC Providers

Identity and contact data is shared with third-party KYC service providers to verify your identity, confirm your age, and perform AML screening. These providers operate under strict data processing agreements and applicable data protection regulations.

5.3 Technology and Infrastructure Partners

Technical data may be processed by our cloud hosting, content delivery, and cybersecurity service providers in the course of delivering the obaje platform. All such providers are engaged under data processing agreements that require them to maintain appropriate security standards.

5.4 Game Content Providers

Certain gameplay and session data may be transmitted to third-party game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi — to deliver their game content within the obaje platform. This data is limited to what is technically necessary for game delivery and is governed by the studios' own data processing terms.

5.5 Legal and Regulatory Authorities

obaje will disclose personal data to law enforcement agencies, regulatory bodies, tax authorities, or other government bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of obaje, our players, or the public. We will notify you of any such disclosure where we are legally permitted to do so.

5.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving obaje, your personal data may be transferred to the successor entity as part of that transaction. We will notify you of any such transfer and the applicable privacy terms before your data is subject to a different Privacy Policy.

6 Data Security

obaje takes the security of your personal data seriously. We implement a comprehensive set of technical and organisational measures designed to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the obaje platform is encrypted using industry-standard SSL/TLS protocols.
• Secure Password Storage: Account passwords are stored using strong cryptographic hashing algorithms. Plaintext passwords are never stored on obaje's systems.
• OTP Authentication: Account login and sensitive actions are protected by one-time password (OTP) verification sent to your registered mobile number.
• Access Controls: Access to personal data within obaje's systems is restricted on a strict need-to-know basis. Staff members who handle personal data are trained in data protection practices.
• Regular Security Audits: obaje conducts periodic security assessments and vulnerability testing of its platform infrastructure.
• Incident Response: We maintain a data breach response procedure. In the event of a security incident affecting your personal data, we will notify you and the relevant authorities in accordance with our legal obligations.

While obaje implements robust security measures, no system connected to the internet can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for promptly notifying us of any suspected unauthorised access to your account.

7 Data Retention

obaje retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

Data Category	Retention Period	Reason
Account and Identity Data	Duration of account plus 5 years after closure	AML/KYC regulatory requirements
Financial Transaction Records	7 years from date of transaction	Financial regulatory and tax compliance
Customer Support Records	3 years from last interaction	Dispute resolution and quality assurance
Technical and Usage Data	Up to 24 months	Security monitoring and platform analytics
Marketing Preferences	Until consent is withdrawn or account is closed	Consent management
Self-Exclusion Records	Minimum 5 years after exclusion period ends	Responsible gaming compliance

After the applicable retention period has expired, your personal data will be securely deleted or anonymised so that it can no longer be associated with you. Where anonymisation is used, the resulting data may be retained indefinitely for aggregated analytics purposes.

8 Cookies and Tracking Technologies

The obaje platform uses cookies and similar tracking technologies to provide essential functionality, improve your experience, and support our security and analytics operations. A cookie is a small text file placed on your device by our server when you visit our platform.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and cookies that maintain your login state. These cannot be disabled without impairing platform functionality.
• Performance Cookies: Used to collect anonymised data about how visitors use the platform — for example, which games are most popular, how long sessions last, and where errors occur. This data helps us improve the platform.
• Functionality Cookies: Store your preferences such as display settings and language choices to personalise your experience across sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and unauthorised access attempts.

8.2 Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling essential cookies will prevent you from logging in and using the obaje platform. Disabling performance or functionality cookies will not prevent platform access but may affect your experience. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

8.3 Do Not Track

Some browsers transmit a "Do Not Track" (DNT) signal. obaje's platform does not currently respond to DNT signals, as there is no universally accepted standard for how to interpret them. Our cookie practices are governed by this Policy, not by DNT signals.

9 Your Privacy Rights

As an obaje player, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at the details in Section 14. We will respond to all valid requests within 30 days.

9.1 Right of Access

You have the right to request a copy of the personal data that obaje holds about you. We will provide this information in a clear and accessible format. We may ask you to verify your identity before fulfilling an access request.

9.2 Right to Rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For certain data types (such as your registered mobile number or address), you may be able to update this directly from within your account settings.

9.3 Right to Erasure

You may request that obaje delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent. Please note that we may be unable to delete data that we are legally required to retain, such as KYC and financial records subject to regulatory retention periods.

9.4 Right to Restriction of Processing

You have the right to request that obaje restricts the processing of your data in certain circumstances, such as while a dispute about the accuracy of your data is being resolved.

9.5 Right to Data Portability

Where processing is based on your consent or on contract performance, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that we transmit that data to another data controller where technically feasible.

9.6 Right to Withdraw Consent

Where obaje processes your data based on your consent (for example, for marketing communications), you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before the withdrawal.

9.7 Right to Object

You have the right to object to the processing of your personal data where that processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.

10 Minors and Age Verification

The obaje platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If obaje discovers that personal data has been collected from a person under the age of 21, we will immediately close the account, delete the associated personal data (subject to any legal retention obligations relating to the detection of underage access), and return any deposited funds in accordance with our standard procedures.

If you are a parent or guardian and you believe your child has created an obaje account, please contact us immediately at [email protected] so that we can take prompt action.

11 Third-Party Services

The obaje platform integrates with third-party services to deliver game content, process payments, and support platform operations. When you interact with these integrated services, the respective third party's own privacy terms may also apply to data processed within their systems.

obaje is not responsible for the privacy practices of third-party game studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, or Ezugi, or of payment providers such as bKash, Nagad, Rocket, Upay, Visa, or Mastercard. We encourage you to review the privacy policies of any third-party service you interact with through our platform.

The obaje website does not contain links to external third-party websites beyond its own platform services. Any links visible on this site (in navigation or content) point exclusively to internal obaje pages.

12 International Data Transfers

The obaje platform is operated primarily for players in Bangladesh. However, in the course of providing our services — particularly in connection with cloud infrastructure, game content delivery networks, and third-party KYC providers — your personal data may be processed on servers located outside Bangladesh.

Where personal data is transferred internationally, obaje takes appropriate steps to ensure that adequate levels of protection are applied, consistent with the principles set out in this Privacy Policy. These steps may include entering into contractual data protection clauses with the recipient, or ensuring the recipient operates in a jurisdiction that provides an equivalent level of data protection.

By using the obaje platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

13 Amendments to This Policy

obaje reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform features. When material changes are made, we will notify registered players via their registered contact details with a minimum of 7 days' notice before the amended policy takes effect.

The "Last Updated" date at the top of this document will reflect the date of the most recent revision. We encourage you to review this Policy periodically. Continued use of the obaje platform after any amendment takes effect constitutes acceptance of the revised Privacy Policy.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to how obaje handles your personal data, please reach out to our support team. We are committed to addressing all privacy-related enquiries promptly and transparently.

Support contact: [email protected]

Please include your registered mobile number and clearly describe your query or request so that we can assist you as efficiently as possible. Our support team operates during Bangladesh Standard Time (BST, UTC+6) and aims to respond to all enquiries within 24 hours.

For formal data rights requests (access, erasure, portability, etc.), please use the subject line "Data Rights Request" in your email to ensure your query is routed to the appropriate team member.