bcaji Privacy Policy

bcaji ("bcaji", "we", "us", "our") is the data controller responsible for the personal data collected and processed through the bcaji platform at bcaji.net. As data controller, bcaji determines the purposes for which your personal data is used and the means by which it is processed.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data bcaji holds about you, please contact the bcaji data protection team using the following details:

When contacting bcaji regarding a privacy matter, please include your registered email address or mobile number so that we can verify your identity before disclosing or amending any personal data. bcaji will not act on a privacy request without first confirming the identity of the requester.

This Privacy Policy applies to all individuals who access or use the bcaji platform, including registered players, individuals browsing the site without an account, and any person whose personal data is submitted through the bcaji platform by another user (for example, a payment beneficiary). By using bcaji, you acknowledge that you have read this policy and that you consent to the data practices described herein to the extent that consent is the applicable legal basis.

bcaji collects personal data through several channels: directly from you when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or use the platform; automatically through your device and browser when you interact with the bcaji website; and from third-party service providers where necessary to verify your identity or process payments.

2.1 Registration & Account Data

When you create a bcaji account via the bcaji Login registration flow, we collect:

• Full legal name
• Date of birth (to verify the 18+ age requirement)
• Bangladesh mobile number
• Email address
• Username and hashed password (we cannot read your password)
• Residential city or district within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi)
• Preferred currency (Bangladeshi Taka, BDT)

2.2 Identity Verification (KYC) Data

To comply with our anti-money laundering and player protection obligations, bcaji requires identity verification before enabling full withdrawal access. KYC data collected includes:

• Scanned copy or photograph of your Bangladesh National Identity Card (NID), valid passport, or driving licence
• A recent utility bill, bank statement, or other proof of residential address (where required)
• A selfie or live photograph where bcaji's compliance team requires a facial comparison
• Source of funds documentation where transaction volumes trigger enhanced due diligence thresholds

2.3 Financial Transaction Data

When you make a deposit or withdrawal, bcaji records:

• Payment method used (e.g., bKash, Nagad, Rocket, Upay, bank transfer)
• Mobile wallet number or bank account number associated with the transaction
• Transaction amount in Bangladeshi Taka (৳)
• Transaction date, time, and reference number
• Running account balance

2.4 Usage & Device Data

bcaji automatically collects the following technical data when you access the platform:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Pages visited, game sessions started, bets placed, and session duration
• Referring URL and exit URL
• Cookie identifiers and session tokens (see Section 6)

2.5 Communications Data

When you contact bcaji support or respond to platform communications, we retain:

• The content of your support messages and our responses
• Email correspondence related to your account
• Records of any complaints submitted and their resolution

bcaji uses the personal data described in Section 2 for the following purposes:

bcaji does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Responsible Gaming risk flags generated by bcaji's monitoring systems are reviewed by a human member of the bcaji compliance team before any account action is taken.

If you have opted in to marketing communications from bcaji — for example, to receive news about BPL cricket promotions, seasonal offers around Eid or Pohela Boishakh, or new slot releases — you may withdraw that consent at any time by contacting [email protected]. Withdrawing consent for marketing does not affect the lawfulness of any processing that took place prior to withdrawal, and it does not affect bcaji's ability to continue processing your data on the other legal bases described in this section.

bcaji processes your personal data under the following legal bases, which are applied on a purpose-by-purpose basis as set out in the table in Section 3:

• Contract Performance: Processing that is necessary to provide the bcaji service to you under the agreement formed when you registered your account and accepted the bcaji Terms & Conditions. This includes operating your account, processing your bets, paying out winnings, and handling your support queries.
• Legal Obligation: Processing that bcaji is required to carry out by applicable law. This includes age and identity verification (KYC), anti-money laundering (AML) monitoring, suspicious activity reporting, and data retention obligations imposed by financial regulation.
• Legitimate Interest: Processing that bcaji conducts to pursue its legitimate business interests, provided those interests are not overridden by your privacy rights. Legitimate interests include platform security, fraud detection, abuse prevention, and aggregate analytics used to improve the bcaji service. Where bcaji relies on legitimate interest, we conduct a balancing assessment to confirm that the processing does not disproportionately impact your rights.
• Consent: Processing that you have actively agreed to, such as receiving marketing emails about new bcaji promotions, seasonal bonuses, or upcoming cricket events. Consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time without detriment to your account.

Where processing is necessary for compliance with a legal obligation, bcaji must carry it out regardless of whether you object. In all other cases, you retain the rights described in Section 8 of this policy to limit or object to processing.

bcaji does not sell your personal data to any third party. bcaji shares personal data only with the categories of recipients listed below, and only to the extent necessary for the stated purpose:

5.1 Payment Service Providers

To process your deposits and withdrawals, bcaji shares your payment credentials and transaction data with your chosen payment provider. In Bangladesh, this includes bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and partner banks such as City Bank, BRAC Bank, Dutch-Bangla Bank, Islami Bank, and Sonali Bank. Payment providers process this data under their own privacy policies and are independently responsible for compliance with applicable payment data regulations.

5.2 Identity Verification Providers

bcaji uses third-party KYC and identity verification services to authenticate documents submitted by players. These providers receive only the minimum data necessary to conduct a verification check. They are bound by strict data processing agreements and are not permitted to use your identity data for any purpose other than completing the verification requested by bcaji.

5.3 Game Content Providers

bcaji's platform hosts games supplied by certified providers including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe. When you launch a game, technical session data (such as a session token and wallet balance) is shared with the relevant game provider to enable the game to function. Game providers do not receive your full personal profile. All game providers integrated on bcaji are certified by independent testing laboratories and operate under contractual data protection obligations.

5.4 Analytics & Platform Operations

bcaji uses analytics tools to monitor aggregate platform performance, identify technical issues, and understand how players navigate the site. Analytics data is processed in aggregate or pseudonymised form wherever possible. bcaji does not share individually identifiable player profiles with analytics vendors.

5.5 Regulatory & Law Enforcement Authorities

bcaji may be required to disclose personal data to competent authorities where mandated by law, court order, or where bcaji has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or other criminal activity. bcaji will notify affected players of such disclosures where it is legally permitted to do so.

bcaji uses cookies and similar browser-based technologies on the bcaji.net website. Cookies are small text files stored on your device that help bcaji recognise your browser across sessions and provide a consistent, personalised experience. The table below describes the categories of cookies bcaji uses:

bcaji does not use advertising cookies, tracking pixels, or third-party retargeting scripts that build a profile of your behaviour across external websites. The bcaji platform does not integrate Facebook Pixel, Google Ads conversion tags, or any similar cross-site advertising technology.

You may manage or delete cookies at any time through your browser's settings. Note that disabling strictly necessary cookies will prevent bcaji Login and other core platform features from functioning correctly. For guidance on managing cookies in your specific browser, refer to your browser's help documentation. If you wish to opt out of analytics cookies specifically, please contact [email protected] and our team will update your preference within 5 business days.

bcaji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The retention periods below reflect bcaji's standard practices:

When a retention period expires, bcaji will securely delete or anonymise the relevant data. Anonymised data — from which all identifying information has been irreversibly removed — may be retained beyond these periods for aggregate statistical analysis and platform improvement purposes. Such anonymised data cannot be used to identify any individual player.

If you request deletion of your personal data under Section 8 of this policy, bcaji will delete or anonymise your data as promptly as practicable, subject to any overriding legal obligation to retain it for the periods specified in the table above. Where a legal obligation prevents immediate deletion, bcaji will inform you of the specific reason and the expected date after which deletion will be possible.

As a player on the bcaji platform, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact bcaji at [email protected] with the subject line "Privacy Request — [Your Full Name]". bcaji will respond within 30 calendar days of receiving a verified request.

• Right of Access: You have the right to request a copy of the personal data bcaji holds about you, along with information about how it is used, where it came from, and with whom it has been shared. This is sometimes called a Subject Access Request (SAR).
• Right to Rectification: If any personal data bcaji holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details directly through the account settings area of the bcaji platform.
• Right to Erasure: You have the right to request that bcaji delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to bcaji's legal obligations to retain certain data as described in Section 7.
• Right to Restrict Processing: You have the right to request that bcaji limits the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interest, including profiling for responsible gaming monitoring. bcaji will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit it to another controller.
• Right to Withdraw Consent: Where bcaji processes your data on the basis of your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

bcaji takes the security of your personal data seriously. The following technical and organisational measures are in place to protect your data against unauthorised access, accidental loss, destruction, or disclosure:

• TLS/SSL Encryption in Transit: All data exchanged between your browser or device and bcaji's servers is encrypted using TLS 1.2 or higher. This applies to all platform interactions, including bcaji Login, deposits, withdrawals, KYC document uploads, and support communications.
• Encryption at Rest: Sensitive data fields — including KYC documents, payment method details, and account credentials — are encrypted at rest using industry-standard encryption algorithms. Passwords are stored as salted cryptographic hashes; bcaji staff cannot read your password in plain text.
• Access Controls: Access to personal data within bcaji's internal systems is restricted on a need-to-know basis. Staff members access only the data necessary for their specific role. Access is logged and reviewed regularly.
• Two-Factor Authentication: bcaji offers two-factor authentication (2FA) for all player accounts, providing an additional layer of security beyond the account password. Players are encouraged to enable 2FA via their account settings.
• Regular Security Reviews: bcaji conducts regular internal security reviews and works with external security specialists to identify and remediate vulnerabilities. The bcaji platform is tested against common attack vectors including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
• Incident Response: In the event of a confirmed data security incident that poses a risk to player rights and freedoms, bcaji will notify affected players by email without undue delay and will take all necessary steps to contain and remediate the incident.

Despite these measures, no internet-based platform can guarantee absolute security. Players are also responsible for maintaining the security of their own device and bcaji account credentials. bcaji recommends that players use a strong, unique password for their bcaji account, enable 2FA, and never share their login details with any other person.

bcaji reserves the right to update or revise this Privacy Policy at any time. Changes may be required to reflect updates to bcaji's services, changes in applicable data protection law, new payment methods or game providers being added to the platform, or improvements to bcaji's internal data handling practices.

When material changes are made to this Privacy Policy, bcaji will notify registered players by email to their registered address and by displaying a prominent notice on the bcaji platform at the time of next login. The effective date shown in the page header will be updated to reflect when the revised policy came into force.

Continued use of the bcaji platform following notification of a revised Privacy Policy constitutes acceptance of the updated terms, to the extent permitted by applicable law. If you do not agree to a revised Privacy Policy, you should cease using the bcaji platform and request account closure in accordance with the bcaji Terms & Conditions.

The current version of this Privacy Policy is always accessible at bcaji.net/privacy-policy. Players are encouraged to review this policy periodically. If you have questions about any change to this policy, contact bcaji at [email protected] and our support team will respond within 4 hours (BST, UTC+6).