Your Privacy Matters
at 24baje

For the purposes of this Privacy Policy, the data controller responsible for the personal information collected through the 24baje platform — including the website at https://24baje.com and all associated services, games, and betting markets made available through it — is 24baje. When this policy refers to "24baje", "we", "us", or "our", it refers to the data controller entity operating the 24baje platform and serving account holders primarily located in Bangladesh.

As the data controller, 24baje determines the purposes for which your personal data is collected and the means by which it is processed. Where 24baje engages third-party processors — such as payment providers, game suppliers, or technical infrastructure partners — those parties act strictly on 24baje's instructions and are contractually prohibited from using your data for their own independent purposes.

All enquiries relating to this Privacy Policy, including subject access requests, correction requests, and data deletion requests, should be addressed to the 24baje data team at [email protected]. We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve them fully within 30 calendar days.

24baje collects personal data across several categories. The specific data collected about you depends on how you interact with the platform — whether you are simply browsing anonymously, registering an account, making a deposit, or contacting customer support. The table below summarises the main categories of personal data 24baje collects and representative examples within each category.

24baje does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If any such data is incidentally included in a document you submit for KYC verification (for example, a national identity card that lists religion), it will not be recorded, processed for any purpose other than identity verification, or retained beyond the period necessary for that verification.

24baje collects personal data through three primary channels: data you provide directly, data collected automatically as you use the platform, and data received from trusted third parties.

Data You Provide Directly

You provide data to 24baje when you register an account, complete the KYC verification process, make a deposit or withdrawal request, contact the customer support team, respond to a survey or promotional campaign, or submit a complaint. All forms and data entry fields on the 24baje platform are served over HTTPS connections, ensuring that data you submit is encrypted in transit from the moment you enter it.

Automatically Collected Data

When you visit or use the 24baje platform, certain technical and usage data is automatically collected by our servers and analytics systems. This includes your IP address, the type of browser and device you are using, pages you visit, the duration of your session, and information about how you navigate between pages and features. This data is collected using server logs, first-party cookies, and analytics tools operated solely by 24baje.

Data From Third Parties

24baje may receive limited personal data about you from trusted third-party sources in the following circumstances:

• Payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard) may confirm successful transaction completions and flag potentially fraudulent payment activity to 24baje as part of their standard anti-fraud processes.
• Identity verification services engaged by 24baje to assist with KYC compliance may return confirmation of identity verification results and flag document authenticity issues.
• Game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) share game session outcome data with 24baje for wallet crediting and dispute resolution purposes.

In all cases, data received from third parties is used only for the specific purpose for which it was shared and is subject to the same security and retention standards as data collected directly by 24baje.

24baje processes personal data only for clearly defined, lawful purposes. The legal bases on which 24baje relies for processing differ depending on the purpose. The primary purposes and their associated legal bases are set out below.

Contract Performance

Processing your identity data, contact data, financial data, and gaming data is necessary for 24baje to perform its contractual obligations to you under the Terms & Conditions. This includes creating and managing your account, processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, crediting game winnings to your wallet, and providing English customer support around the clock.

Legal and Regulatory Compliance

24baje is required by applicable anti-money laundering (AML) regulations to collect and retain identity and financial transaction data. KYC verification, transaction monitoring, and the production of records for regulatory review are all processing activities carried out on this legal basis. Data processed under a legal obligation cannot be deleted on request during the applicable retention period.

Legitimate Interests

24baje processes technical data, usage data, and gaming behaviour data on the basis of legitimate interests — specifically, the interest in operating a secure, fair, and commercially viable platform. This processing supports fraud detection, responsible gaming monitoring (including identifying patterns of problem gambling behaviour), platform optimisation, and security incident response. 24baje has assessed that its legitimate interests in these processing activities are not overridden by the privacy rights of account holders, given the safeguards in place.

Consent

Where 24baje wishes to send you marketing communications — including promotional emails, SMS notifications about new bonuses, and cricket betting offers relating to BPL, IPL, and T20 World Cup fixtures — it will do so only with your explicit prior consent. You may withdraw this consent at any time by updating your preferences in the account dashboard or by contacting [email protected]. Withdrawing marketing consent does not affect your ability to use the 24baje platform or receive essential account communications.

The 24baje platform uses cookies and similar tracking technologies to operate core platform functionality, improve your user experience, and analyse how the site is used. A cookie is a small text file placed on your device by a web server. Cookies do not execute code and cannot carry viruses. They are used by 24baje solely for the purposes described in this section.

Categories of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the 24baje platform to function correctly. They maintain your login session, remember your language and currency preferences, and support security features such as CSRF token validation. These cookies cannot be disabled without breaking core platform functionality.
• Performance and Analytics Cookies: These first-party cookies help 24baje understand how players navigate the platform — which pages are most visited, where users encounter friction, and how session durations vary across device types. This data is aggregated and anonymised; it does not identify individual users.
• Functionality Cookies: These cookies remember choices you make on the platform — such as preferred game categories, table stake defaults in live dealer games, and notification settings — to provide a more personalised experience across sessions.
• Marketing and Preference Cookies: With your consent, 24baje may use cookies to record your interests and tailor promotional content — such as cricket bonus offers during BPL fixtures — to your demonstrated preferences. These cookies are only set where you have affirmatively opted in to marketing communications.

Managing Cookies

You can manage your cookie preferences at any time through your 24baje account settings. You may also configure your browser to block or delete cookies; however, please be aware that disabling strictly necessary cookies will impair or entirely prevent your ability to use the platform. 24baje does not use third-party advertising network cookies or cross-site tracking technologies.

24baje does not sell, rent, or trade your personal data. Data is shared with third parties only where strictly necessary for the operation of the platform, compliance with legal obligations, or the protection of 24baje's legitimate interests. All third parties with whom data is shared are bound by written data processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to 24baje.

Categories of Third-Party Recipients

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data necessary to process your deposits and withdrawals. Each payment provider is subject to its own regulatory framework and data protection obligations.
• Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive your account identifier and session data to initiate and settle game rounds. They do not receive your full identity data, payment details, or contact information.
• Identity Verification Services: Where 24baje uses a third-party KYC provider to assist with identity document verification, that provider receives a copy of the documents you submit. Verified results are returned to 24baje and the third party retains only the minimum data required by its own regulatory obligations.
• Technical Infrastructure Providers: Cloud hosting, content delivery, and database service providers who store or process platform data on 24baje's behalf under strict data processing agreements.
• Law Enforcement and Regulatory Bodies: 24baje will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by a valid legal obligation or court order. 24baje will not notify you of such a disclosure where doing so would be prohibited by law or would compromise an active investigation.

24baje retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The table below summarises the retention periods applied to each category of personal data.

When the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual. Anonymised and aggregated data — such as statistical reports on platform usage or game popularity — may be retained indefinitely, as it no longer constitutes personal data.

Where you request deletion of your account and personal data before the end of the applicable retention period, 24baje will delete all data that is not subject to a legal retention obligation and will restrict processing of retained data to compliance purposes only, with no further use for marketing, analytics, or product development.

As a 24baje account holder, you hold specific rights over your personal data. 24baje is committed to honouring these rights promptly and without charge. To exercise any of the rights described below, contact the 24baje data team at [email protected] from the email address registered to your account, clearly stating which right you wish to exercise and providing sufficient information to verify your identity.

Right of Access

You have the right to request a copy of all personal data that 24baje holds about you. Upon receipt of a verified subject access request, 24baje will provide a structured summary of your personal data in a commonly readable format within 30 calendar days. Where requests are unusually complex or numerous, 24baje may extend this period by a further 30 days and will notify you of the extension and the reason for it.

Right to Rectification

If any personal data held by 24baje is inaccurate or incomplete, you have the right to request that it be corrected. Where data accuracy affects your ability to make deposits or withdrawals — for example, a misspelled name on your bKash account — prompt correction is particularly important. Contact [email protected] with the correct information and supporting documentation where applicable.

Right to Erasure

You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been unlawfully processed. Erasure requests will be fulfilled subject to 24baje's legal retention obligations — data required to be retained under AML regulations cannot be deleted until the mandatory retention period has expired.

Right to Restrict Processing

You may request that 24baje restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed. During a restriction period, 24baje will continue to store your data but will not use it for any purpose other than storage.

Right to Data Portability

Where 24baje processes your personal data on the basis of your consent or contract performance, and that processing is carried out by automated means, you have the right to receive a copy of your data in a structured, machine-readable format. You may also request that this data be transmitted directly to another controller where technically feasible.

Right to Object

You have the right to object to 24baje processing your personal data on the basis of legitimate interests — including profiling for responsible gaming monitoring or platform personalisation. Where you raise an objection, 24baje will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests. You may also object to the use of your data for direct marketing at any time, without providing any reason, and 24baje will cease marketing communications immediately upon receipt of your objection.

Right to Withdraw Consent

Where processing is based on your consent — including marketing communications and non-essential cookies — you may withdraw that consent at any time through your account dashboard or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

The 24baje platform is strictly intended for adults aged 18 and above. 18+ 24baje does not knowingly collect, store, or process personal data belonging to individuals under the age of 18. All account registrations require the applicant to confirm that they are 18 years of age or older at the time of registration, and identity verification procedures are in place to validate this declaration.

If 24baje becomes aware — through its KYC process, a parental complaint, or any other means — that an account has been registered by or on behalf of a person under the age of 18, the following steps will be taken immediately:

• The account will be suspended pending investigation.
• Any funds in the account wallet will be frozen during the investigation period.
• All personal data associated with the account will be securely deleted from 24baje's systems once the investigation is complete, subject only to any AML retention obligations that may apply.
• The case will be reviewed by the 24baje compliance team to determine whether any further action is required.

Parents or guardians who believe that a minor in their care has registered a 24baje account are urged to contact [email protected] immediately. The 24baje customer support team is available 24 hours a day, 7 days a week, and will treat all such reports with the highest priority. For further guidance on preventing underage gambling and available parental control tools, please visit the Responsible Gaming page.

24baje applies a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure. The principal security measures in place are described below.

Encryption

All data transmitted between your device and the 24baje platform is protected by 256-bit SSL/TLS encryption. Data stored on 24baje's servers — including identity documents, financial records, and account credentials — is encrypted at rest using the AES-256 standard. Encryption keys are stored separately from the encrypted data and rotated on a regular schedule.

Access Controls

Access to personal data within 24baje's internal systems is restricted on a strict need-to-know basis. Employees and contractors are granted the minimum level of data access required to perform their specific role. All access to personal data systems is logged, and logs are reviewed regularly for anomalous access patterns. Administrative access requires multi-factor authentication.

Network and Infrastructure Security

The 24baje platform is hosted on infrastructure protected by enterprise-grade firewalls, intrusion detection systems, and distributed denial-of-service (DDoS) mitigation services. Regular vulnerability assessments and penetration tests are conducted by independent security professionals to identify and remediate weaknesses before they can be exploited.

Account Security — Your Responsibilities

24baje's security measures protect your data on the platform side. You also play an important role in protecting your own account. 24baje recommends that you:

• Use a strong, unique password for your 24baje account — one that is not used for any other service.
• Enable two-factor authentication (2FA) on your account where available.
• Never share your login credentials with another person.
• Log out of your account when using a shared or public device.
• Be alert to phishing attempts — 24baje will never ask for your password via email, SMS, or live chat.

If you suspect that your 24baje account has been accessed without your authorisation, contact [email protected] immediately. Our security team operates around the clock and will act swiftly to secure your account.

Data Breach Response

In the event of a personal data breach that poses a risk to the rights and freedoms of account holders, 24baje will notify affected individuals without undue delay, describing the nature of the breach, the categories of data involved, the likely consequences, and the remedial measures taken or proposed. 24baje maintains a documented data breach response plan and conducts periodic drills to ensure readiness.

24baje reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. When material changes are made to this Privacy Policy, 24baje will notify registered account holders by email to the address on file at least 7 days before the changes take effect. A revised version of the Privacy Policy will be published at https://24baje.com/privacy-policy with an updated effective date at the top of the page.

For changes that are not material — such as minor clarifications of existing wording, correction of typographical errors, or updating of contact details — 24baje may publish the revised version without advance email notification, though the effective date will always be updated to reflect the revision.

It is your responsibility to review this Privacy Policy periodically. Your continued use of the 24baje platform following the publication of an updated Privacy Policy constitutes your acknowledgement that you have read the updated policy. If you disagree with any amendment to the Privacy Policy, you may request account closure by contacting [email protected].

The version history of this Privacy Policy — including the dates of all material amendments and a brief summary of the changes made — is available upon request by emailing [email protected]. 24baje retains archived versions of all previous Privacy Policy versions for a period of 5 years.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a complaint about how 24baje has handled your personal data, please contact the 24baje data protection team using the details below. All privacy enquiries are handled exclusively in English by a dedicated team available 24 hours a day, 7 days a week.

• Email: [email protected] — plain text only, not a clickable link
• Subject Line: Use "Privacy Enquiry", "Subject Access Request", "Data Deletion Request", or "Privacy Complaint" as appropriate
• Response Time: Acknowledgement within 48 hours; full resolution within 30 calendar days
• Operating Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Language: English

Raising a Formal Complaint

If you are not satisfied with 24baje's response to a privacy enquiry, you may escalate your complaint to a senior privacy officer by replying to the original support thread and clearly indicating that you wish to escalate. 24baje aims to resolve all escalated privacy complaints within 15 business days of escalation.

Where a complaint cannot be resolved through direct engagement with 24baje's privacy team, you retain the right to pursue the matter through any applicable legal or regulatory channel available to you in your jurisdiction. 24baje will cooperate fully with any legitimate regulatory enquiry concerning its data processing practices.