xbagh Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how xbagh ("xbagh", "the Platform", "we", "us", "our") collects, uses, stores, and protects personal information provided by or obtained about users ("you", "your", "Player") of the xbagh website located at xbagh.io and any related applications or services (collectively, the "Platform").

We are committed to handling your personal data responsibly and in accordance with applicable data protection principles. By registering an account on the Platform, depositing funds, placing bets, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the practices described herein.

This Policy should be read in conjunction with xbagh's Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions, the Terms & Conditions shall take precedence unless this Policy expressly states otherwise on a specific data-processing matter.

02 Data Controller

For the purposes of this Policy, xbagh acts as the data controller in respect of personal data collected from users of the Platform. As data controller, xbagh determines the purposes for which and the means by which personal data is processed.

If you have any questions or concerns regarding how xbagh processes your personal data, you may contact our support team at any time. Contact details are provided in Section 15 of this Policy.

03 Data We Collect

xbagh collects several categories of personal data in the course of providing its services. The table below summarises the main categories, along with examples of the specific data points within each category.

3.1 Sensitive Data

xbagh does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless it is strictly required for a specific regulatory or identity-verification obligation. Where such data must be collected, it will be treated with heightened care and will not be used for any purpose beyond that specific obligation.

04 How We Collect Data

xbagh collects personal data through the following mechanisms:

4.1 Direct Collection

Information you provide directly when you: register an account; complete KYC verification; make a deposit or withdrawal request; contact our customer support team; respond to a survey or promotion; or communicate with us by email or live chat.

4.2 Automated Collection

Technical data is collected automatically when you interact with the Platform. This includes data gathered via cookies, server logs, pixel tags, and similar tracking technologies. Details of our cookie usage are set out in Section 8.

4.3 Third-Party Sources

We may receive data about you from third parties where this is permitted by law, including:

• Identity verification and KYC service providers who confirm the accuracy of the documents you submit;
• Payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard networks) who confirm transaction status;
• Fraud prevention and anti-money-laundering screening services;
• Publicly available databases where we are required by law to conduct background checks.

05 Legal Basis for Processing

xbagh processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Performance of a Contract: Processing is necessary to provide the services you have requested — including operating your account, processing bets and payments, and communicating account-related information.
• Legal Obligation: Processing is necessary to comply with legal and regulatory obligations, including identity verification (KYC), anti-money laundering (AML) procedures, and record-keeping requirements.
• Legitimate Interests: Processing is necessary for xbagh's legitimate business interests — such as fraud detection, platform security, responsible gaming monitoring, and improving platform performance — where those interests are not overridden by your fundamental rights.
• Consent: Where processing is based on your consent (for example, sending you promotional emails or SMS about offers and bonuses), you may withdraw that consent at any time by updating your marketing preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

06 How We Use Your Data

xbagh uses the personal data we hold about you for the following purposes:

6.1 Account Management

To create and maintain your player account, authenticate your identity at login, process your registration, and manage your account settings and preferences.

6.2 Transaction Processing

To process deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard), reconcile your account balance in Bangladeshi Taka (৳), and maintain accurate financial records.

6.3 Identity Verification & Compliance

To verify that you meet the minimum age requirement of 21 years, confirm your identity through our KYC programme, and comply with applicable anti-money laundering, counter-terrorism financing, and data protection obligations.

6.4 Platform Security & Fraud Prevention

To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, money laundering, and any other conduct that violates our Terms & Conditions or applicable law.

6.5 Customer Support

To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance.

6.6 Responsible Gaming

To monitor gaming activity for signs of problem gambling, apply self-imposed limits or restrictions at your request, enforce self-exclusion decisions, and provide relevant support resources.

6.7 Marketing Communications

Where you have given consent, to send you information about promotions, bonuses, new games, and special events on the xbagh Platform. You may opt out of marketing communications at any time.

6.8 Platform Improvement

To analyse usage patterns, understand how players interact with the Platform, improve existing features, and develop new ones. This analysis is typically conducted on aggregated or anonymised data wherever possible.

07 Data Sharing & Disclosure

xbagh does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We may share your data with the following categories of recipients, strictly as required:

7.1 Service Providers

Trusted third-party vendors engaged to support Platform operations, including:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard networks, to facilitate deposits and withdrawals;
• Identity verification and KYC providers, to confirm the authenticity of documents submitted during registration;
• Cloud hosting and infrastructure providers, who store Platform data on secured servers;
• Customer support software providers, who power our live chat and ticketing systems;
• Analytics providers, who help us understand aggregate usage patterns on the Platform.

All service providers engaged by xbagh are bound by contractual obligations that restrict their use of your data to the specific services they provide and require them to maintain appropriate security standards.

7.2 Legal & Regulatory Disclosure

xbagh may disclose your personal data to law enforcement agencies, regulators, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of xbagh, its players, or the public.

7.3 Business Transfers

In the event that xbagh undergoes a merger, acquisition, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity. In such circumstances, we will endeavour to provide you with notice before your data is transferred and becomes subject to a different privacy policy.

7.4 With Your Consent

We may share your data with third parties in other circumstances where you have provided your explicit consent to that specific sharing arrangement.

08 Cookies & Tracking Technologies

The xbagh Platform uses cookies and similar technologies to deliver a functional, personalised, and secure user experience. A cookie is a small text file placed on your device by a web server. The cookies we use fall into the following categories:

8.1 Managing Cookies

You can control and delete cookies through your browser settings. Please note that disabling certain cookie categories may affect the functionality of the Platform — for example, disabling strictly necessary cookies will prevent you from staying logged in. Most modern browsers provide guidance on managing cookies in their help documentation.

8.2 Local Storage & Session Storage

In addition to cookies, xbagh may use browser local storage and session storage to temporarily store data on your device that supports the Platform's performance. This data is not transmitted to third parties and is cleared when you end your session or clear your browser storage.

09 Data Retention

xbagh retains personal data for only as long as is necessary for the purposes described in this Policy, or as required by applicable law. The following general retention periods apply:

• Account Data (active accounts): Retained for the lifetime of your account and for a period of five (5) years following account closure, to satisfy legal record-keeping obligations;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in line with anti-money laundering record-keeping requirements;
• KYC & Identity Verification Documents: Retained for five (5) years following account closure or the completion of the business relationship;
• Customer Support Communications: Retained for three (3) years from the date of the communication, or longer where related to an unresolved dispute;
• Marketing Preference Records: Retained for the duration of your account and for one (1) year following opt-out, to maintain an accurate suppression list;
• Technical & Log Data: Retained for up to twelve (12) months from the date of collection, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained for statistical or analytical purposes without restriction, as it can no longer identify any individual.

10 Data Security

xbagh implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and xbagh's servers is encrypted using SSL/TLS protocols, preventing interception during transit;
• Access Controls: Access to personal data within xbagh is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data are trained in data protection obligations;
• Secure Data Storage: Personal data is stored on servers protected by industry-standard physical and logical security controls, including firewall protection and intrusion detection systems;
• Password Security: Account passwords are stored in hashed form and are never stored or transmitted as plain text;
• Fraud Detection Systems: Real-time monitoring systems operate continuously to detect and respond to suspicious activity on the Platform;
• Regular Security Reviews: xbagh conducts periodic reviews of its security practices and updates them in line with evolving best practices and threat landscapes.

While xbagh takes all reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, xbagh will notify affected users without undue delay and take all practicable steps to contain and mitigate the breach.

11 Your Rights

Subject to applicable law and xbagh's legal obligations, you have the following rights in relation to your personal data held by xbagh:

• Right of Access: You have the right to request a copy of the personal data xbagh holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request correction of any personal data held by xbagh that is inaccurate or incomplete. You may update certain information directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where it has been unlawfully processed. This right is subject to xbagh's legal obligations to retain certain records.
• Right to Restrict Processing: You have the right to request that xbagh suspends processing of your personal data in certain circumstances — for example, while the accuracy of data is being verified following a rectification request.
• Right to Data Portability: Where processing is based on consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where it is carried out on the basis of xbagh's legitimate interests. You also have an unconditional right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

To exercise any of the above rights, please contact xbagh's support team at [email protected] with the subject line "Data Rights Request". We will respond within a reasonable period and in any event within 30 days of receiving your request. We may need to verify your identity before processing certain requests to prevent unauthorised access to your data.

12 Children & Minors

The xbagh Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Registration by or on behalf of a minor is prohibited under our Terms & Conditions.

If we become aware that personal data has been collected from a person under the age of 21 without appropriate verification, we will take immediate steps to suspend that account, delete the data, and void any associated transactions. Parents or guardians who have reason to believe that a minor has registered on xbagh are encouraged to contact our support team immediately at [email protected].

xbagh also implements technical controls, including age-verification checks during the KYC process, to minimise the risk of underage access to the Platform.

13 Third-Party Links

The xbagh Platform may contain references to game providers and studio names (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi). These are third-party entities with their own privacy practices. xbagh does not control and is not responsible for the privacy practices of game providers or any other third parties. This Policy applies solely to data processed by xbagh in the operation of the Platform itself.

Similarly, payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard) operate under their own privacy policies and terms of service. xbagh encourages you to review those policies to understand how your payment data is handled outside of the xbagh Platform.

14 Policy Updates

xbagh reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When we make material changes, we will post the updated Policy on this page with a revised effective date and, where practicable, notify registered players via email.

We encourage you to review this Policy periodically. Your continued use of the Platform following the posting of an updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the Platform and contact support to request account closure.

The current version of this Privacy Policy is effective as of 1 January 2026.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xbagh handles your personal data, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Support Availability: 24 hours a day, 7 days a week, 365 days a year
• Subject Line for Data Requests: "Data Rights Request" or "Privacy Enquiry"
• Response Target: xbagh aims to acknowledge all privacy-related enquiries within 5 business days and provide a substantive response within 30 days

For responsible gaming support or account closure requests, please include the relevant subject heading so your message is directed to the appropriate team without delay.