bcaji Privacy Policy

This Privacy Policy ("Policy") describes how bcaji ("the Platform", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "the Player", "the User") who access or use the bcaji website at https://bcaji.io and any associated services, features, games, or promotional offers made available through it.

bcaji is committed to handling your personal information with transparency, integrity, and care. This Policy is intended to provide you with a clear and complete picture of our data practices so that you can make informed decisions about your use of the platform. We review and update this Policy on a regular basis to reflect changes in our services, technology, and applicable data protection standards.

This Policy should be read alongside the bcaji Terms & Conditions, which govern your overall use of the platform, and the Responsible Gaming Policy, which addresses the specific data handling practices associated with player protection tools such as self-exclusion and deposit limits.

bcaji collects personal data in three principal ways: directly from you when you register or interact with the platform, automatically as you use the platform, and from third-party identity verification and payment providers. The following table details the categories of data we collect and their source:

bcaji does not collect special categories of sensitive personal data (such as health data, biometric data, or political opinions) except where strictly required for responsible gaming interventions at your explicit request (for example, self-exclusion records).

bcaji uses your personal data for the following purposes, each of which is tied to a lawful basis described in Section 4:

• Account creation and management: To register your bcaji account, verify your identity, maintain your profile, and provide access to all platform features including cricket betting, live casino, slots, and crash games.
• Transaction processing: To process deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, and supported bank channels. Financial data is used only for payment execution and fraud prevention — never for profiling or advertising.
• KYC and age verification: To confirm that you are at least 21 years of age and to satisfy applicable anti-money laundering (AML) and Know Your Customer (KYC) obligations. This is a legal requirement and cannot be waived.
• Customer support: To respond to enquiries, resolve disputes, process complaints, and provide assistance via email and live chat in English.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling, to enforce self-exclusion orders, and to apply deposit or session limits you have set on your account.
• Platform security: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, collusion, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Service improvement: To analyse aggregated, anonymised usage data to improve platform performance, game selection, and user experience for all Bangladesh players.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates via email or SMS, where you have opted in to receive such communications. You may opt out at any time.

bcaji processes your personal data only when a recognised lawful basis applies. The primary bases we rely on are as follows:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration — including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, age verification requirements, and the retention of financial records.
• Legitimate interests: Processing carried out for bcaji's legitimate business interests, such as fraud prevention, platform security, and analytics, where those interests are not overridden by your privacy rights.
• Consent: Processing of your data for marketing communications and for optional platform features (such as personalised game recommendations), where you have provided explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where bcaji relies on legitimate interests as a lawful basis, a balancing assessment is conducted to confirm that our interests do not disproportionately impact your privacy rights. You may request details of this assessment by contacting the support team.

bcaji does not sell, rent, or trade your personal data. We share your information only in the following limited and controlled circumstances:

• Payment processors: We share the minimum necessary financial data with payment providers (including bKash, Nagad, Rocket, Upay, Visa, and Mastercard) solely to facilitate deposits and withdrawals. These providers process your data under their own privacy policies and are bound by contractual data protection obligations with bcaji.
• Identity verification providers: We may use third-party KYC service providers to verify the authenticity of identity documents submitted during registration or at withdrawal. These providers are contractually restricted from using your data for any purpose other than identity verification for bcaji.
• Game content providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session identifiers necessary to deliver game content and to resolve game-related disputes. They do not receive your name, contact details, or financial data.
• Legal and regulatory authorities: Where required by applicable law or a valid legal process (such as a court order or regulatory request), bcaji may disclose personal data to law enforcement or other governmental authorities. bcaji will, where legally permitted, notify you of such a request before disclosing.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bcaji's business, your personal data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and of any material change to this Policy that results from it.

bcaji uses cookies and similar tracking technologies on the platform website to support essential functionality, measure performance, and (with your consent) personalise your experience. The categories of cookies we use are as follows:

• Essential cookies: Required for the platform to function correctly. They maintain your logged-in session, remember your language and currency preferences, and support security features. These cookies cannot be disabled without impairing platform functionality.
• Analytics cookies: Collect anonymised data about how players navigate the platform — which pages are visited, which games are launched, and how long sessions last. This data is used to identify and fix usability issues and to improve the overall experience for Bangladesh players. Analytics cookies are only placed with your consent.
• Marketing cookies: Track your interactions with bcaji promotional content to enable us to deliver more relevant bonus offers via email or on-platform notifications. Marketing cookies are only placed where you have opted in to receive marketing communications from bcaji.

You may manage cookie preferences at any time through your browser settings or via the cookie preference centre accessible from the platform footer. Withdrawing consent for non-essential cookies will not affect your ability to use the core betting and casino features of the platform.

bcaji retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted from bcaji systems or irreversibly anonymised so that it can no longer be attributed to any individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

bcaji implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Encryption in transit: All data exchanged between your browser or mobile device and bcaji servers is encrypted using 256-bit SSL/TLS protocols. You can verify this by checking for the padlock indicator in your browser address bar when accessing https://bcaji.io.
• Encryption at rest: Sensitive data fields stored in bcaji databases — including identity document references and financial account identifiers — are encrypted at the storage layer using AES-256 encryption.
• Password hashing: Account passwords are never stored in plaintext. They are processed through a bcrypt one-way hashing algorithm with a work factor calibrated to current computational norms, ensuring that even a full database compromise cannot expose your login credentials.
• Access controls: Access to personal data within bcaji's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access required to perform their role. All internal access is logged and subject to periodic audit.
• Incident response: bcaji maintains a documented data breach response procedure. In the event of a confirmed breach that poses a risk to your rights and freedoms, bcaji will notify affected players within 72 hours of becoming aware of the incident, providing details of the nature of the breach and the remedial steps taken.

The bcaji platform is strictly intended for adults aged 21 and above. bcaji does not knowingly collect personal data from any person under the age of 21. Age verification is conducted at the point of registration, and additional documentary verification is required before any withdrawal is processed.

If bcaji discovers or is notified that personal data has been collected from an individual under the age of 21, the relevant account will be immediately suspended, all data collected will be securely deleted (subject to any legal retention obligations), and any deposited funds will be returned to the originating payment method after investigation.

If you are a parent or guardian and believe your child has registered an account on the bcaji platform, please contact our support team immediately. We will take prompt action to close the account and delete the associated data.

The bcaji platform integrates with a number of third-party service providers to deliver its full range of features. Each provider operates under its own privacy policy and is bound by a contractual data processing agreement with bcaji that requires them to handle your data only as instructed and in compliance with applicable data protection standards.

Third-party categories used by bcaji include: payment gateway providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard), identity verification services, game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi), web analytics platforms, and cloud hosting infrastructure providers. All cloud infrastructure used by bcaji employs encryption at rest and is subject to strict physical and logical access controls.

bcaji does not permit any third-party service provider to use your personal data for their own marketing purposes or to share it with further parties without bcaji's explicit authorisation and, where required, your consent.

bcaji reviews this Privacy Policy regularly and may update it to reflect changes in our data processing activities, changes in applicable law or regulatory guidance, or improvements to our privacy practices. The effective date displayed at the top of this document reflects the date of the most recent revision.

Where a material change is made to this Policy — one that significantly affects how your personal data is used or your rights in relation to it — bcaji will notify registered players via a prominent on-platform notification and, where the change is particularly significant, via email to the address registered on your account. Minor updates such as clarifications and typographical corrections will be made without advance notice.

Your continued use of the bcaji platform after a policy update is published constitutes acceptance of the revised Privacy Policy. If you do not agree with the changes, you should discontinue use of the platform and contact support to request account closure and data deletion.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or want to raise a concern about how bcaji has handled your personal data, please contact our support team in writing at the email address listed in the footer of this page. All privacy-related enquiries are handled in English and responses are provided within Bangladesh Standard Time (BST, UTC+6) business hours.

bcaji takes privacy complaints seriously. Upon receiving a complaint, bcaji will:

• Acknowledge receipt of the complaint within 2 business days.
• Investigate the matter thoroughly, including reviewing relevant data logs, access records, and communication history.
• Provide a written response setting out the findings and any corrective action taken within 14 business days of acknowledgement.
• Where the complaint cannot be resolved within 14 business days, provide an interim update explaining the delay and a revised expected resolution date.