exbat Privacy
Policy

exbat collects personal data in several ways: directly from you when you register an account or contact our support team, automatically as you interact with the Platform, and from trusted third-party sources as part of our identity verification and fraud-prevention processes. The categories of personal data we collect include the following:

exbat does not knowingly collect data from individuals under the age of 18. If we become aware that personal data has been submitted by a person under 18, we will delete that data immediately and close the associated account. If you believe a minor has registered on the Platform, please contact us at [email protected] without delay.

exbat processes your personal data only for specific, legitimate purposes and only where we have a lawful basis for doing so. The following table sets out the purposes for which we use your data and the legal basis that applies in each case:

Where exbat relies on your consent as the lawful basis for processing — for example, to send you promotional emails about new casino games, BPL cricket betting markets, or seasonal bonus offers around Eid or Pohela Boishakh — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To opt out of marketing communications, use the unsubscribe link in any marketing email or contact our support team.

exbat does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the circumstances described below, and only to the extent necessary for the specified purpose:

• Payment service providers — We share your financial data (wallet number, transaction amount, reference) with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank solely to process deposits and withdrawals on your behalf. These providers are bound by their own privacy policies and applicable financial regulations.
• Identity verification providers — We may share your Identity Data and Verification Documents with third-party KYC and AML screening services to comply with our age verification and anti-money-laundering obligations.
• Game studio providers — When you play a game powered by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, or Spribe, your game session data (username, bet amounts, game outcomes) is processed by the relevant studio's platform. These studios operate under their own data processing agreements with exbat.
• Analytics and technology partners — We use analytics tools to understand Platform usage and improve our services. These tools may process Technical Data and Usage Data in anonymised or pseudonymised form.
• Legal and regulatory authorities — We will disclose personal data to law enforcement agencies, financial intelligence units, or other governmental bodies in Bangladesh or other jurisdictions where we are legally required to do so — for example, in response to a valid court order, subpoena, or AML reporting obligation.
• Business successors — In the event of a merger, acquisition, or sale of all or part of exbat's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer via the email address on your account.

exbat does not transfer your personal data to countries outside Bangladesh except where: (a) the transfer is necessary to process a payment via an internationally operating payment network; (b) the transfer is to a game studio operating in a jurisdiction with adequate data protection standards; or (c) you have explicitly consented to the transfer. In all cases of international transfer, exbat takes steps to ensure your data is afforded an equivalent level of protection.

exbat uses cookies and similar tracking technologies (such as web beacons and pixel tags) to operate the Platform effectively, remember your preferences, and improve your experience. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on the exbat Platform:

• Strictly Necessary Cookies — These cookies are essential for the Platform to function. They enable core features such as maintaining your logged-in session, remembering items in your account, and processing transactions securely. These cookies cannot be disabled without significantly impairing the functionality of the Platform.
• Performance & Analytics Cookies — These cookies collect information about how you use the Platform — which pages you visit most often, how long you spend on each page, and whether you experience any errors. The data collected is aggregated and anonymised. We use this information solely to improve the Platform's performance.
• Functional Cookies — These cookies allow the Platform to remember choices you make — such as your preferred language, your display settings, or whether you have previously acknowledged a particular notice — and to provide enhanced, more personalised features.
• Targeting & Marketing Cookies — These cookies record your visit to the Platform, the pages you have visited, and the links you have followed. We may use this information to make advertising more relevant to your interests. These cookies are only placed with your prior consent.

exbat's cookies do not contain your full name, password, financial account numbers, or any other highly sensitive personal data in a directly readable format. Session cookies are deleted automatically when you close your browser. Persistent cookies remain on your device for the period specified in the cookie's expiry setting, which varies by cookie type but does not exceed 24 months.

exbat retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

When personal data is no longer required, exbat securely deletes or anonymises it in accordance with our internal data destruction policy. Anonymised data — from which it is no longer possible to identify any individual — may be retained indefinitely for statistical and analytical purposes.

exbat takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the exbat Platform is encrypted using 256-bit SSL/TLS protocols. This includes login credentials, payment details, and all account activity.
• Encryption at Rest: Sensitive data stored in our databases — including financial records and KYC documents — is encrypted at rest using AES-256 encryption.
• Two-Factor Authentication (2FA): exbat offers two-factor authentication for all registered accounts. We strongly recommend all users enable 2FA to add an additional layer of security to their login process.
• Access Controls: Access to personal data within exbat's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo mandatory data protection training and are bound by confidentiality obligations.
• Regular Security Audits: exbat conducts periodic internal and external security reviews, including penetration testing, to identify and address vulnerabilities before they can be exploited.
• Incident Response: exbat maintains a documented data breach response plan. In the event of a data breach that poses a risk to your rights, we will notify affected users without undue delay and take all reasonable steps to mitigate the impact.

As a user of the exbat Platform, you have the following rights in relation to your personal data. These rights may be subject to certain conditions and limitations under applicable law, but exbat is committed to honouring them to the fullest extent possible:

To exercise any of the rights listed above, please contact our privacy team at [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within two business days and aim to fulfil it within 30 calendar days. We may need to verify your identity before processing your request to ensure that your data is not disclosed to an unauthorised party.

exbat is the data controller responsible for your personal data. If you have any questions, concerns, or complaints about this Privacy Policy or the way in which your personal data is handled, please contact our privacy team using the details below. All privacy enquiries are handled in English by our dedicated compliance and support staff.

exbat will make every effort to resolve your privacy concern promptly and fairly. If you remain dissatisfied with our response after raising the matter directly with us, you may escalate your complaint to the relevant data protection authority or seek independent legal advice.

exbat reserves the right to update this Privacy Policy at any time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify registered users by email. Continued use of the Platform following any such update constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed about how exbat protects your data.