vaji Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Introduction and Scope

This Privacy Policy ("Policy") describes how vaji ("vaji", "we", "us", or "our") collects, processes, stores, and shares personal data in connection with the operation of the vaji online casino and sports betting platform, accessible at https://vaji.io (the "Platform").

This Policy applies to all individuals who access or use the Platform in any capacity, including registered account holders, visitors who browse the Platform without registering, and individuals who contact vaji support. By creating an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read alongside the vaji Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. Where there is any conflict between this Policy and a more specific data-related notice provided to you at the point of data collection, the more specific notice prevails in relation to that particular processing activity.

2 Data Controller

vaji acts as the data controller in respect of all personal data collected through the Platform. As data controller, vaji determines the purposes and means by which personal data is processed. vaji is responsible for ensuring that personal data is handled in accordance with this Policy and applicable data protection principles.

All enquiries relating to data protection, the exercise of data rights, or any concern regarding the processing of your personal data should be directed to vaji's support team using the contact details set out in Section 15 of this Policy.

3 Personal Data We Collect

vaji collects the following categories of personal data, depending on how you interact with the Platform:

vaji does not collect or store full payment card numbers. Where card payments are processed, this is handled directly by the relevant payment service provider and vaji receives only a tokenised reference.

4 How We Collect Personal Data

vaji collects personal data through the following means:

• Directly from you: When you complete the registration form, submit identity verification documents, make a deposit or withdrawal request, contact vaji support, or respond to a survey or promotion.
• Automatically: When you access the Platform, vaji's systems automatically collect technical and usage data through server logs, cookies, and similar tracking technologies as described in Section 8 of this Policy.
• From third-party identity verification providers: Where vaji engages a third-party KYC service to assist with identity verification, that provider may return verification results and associated data to vaji as part of the verification process.
• From payment processors: Payment service providers such as bKash, Nagad, Rocket, and Upay may transmit transaction confirmation data to vaji to facilitate the crediting and debiting of Account balances.
• From fraud prevention and security services: vaji may receive data from third-party fraud screening tools to assist with detecting and preventing fraudulent or suspicious activity on the Platform.

5 How We Use Personal Data

vaji uses the personal data it collects for the following purposes:

• Account management: To create, maintain, and administer your vaji Account, including processing your registration, verifying your identity, and managing account settings.
• Payment processing: To process deposit and withdrawal transactions via your chosen payment method, reconcile account balances, and maintain accurate financial records.
• Legal compliance: To fulfil anti-money-laundering (AML), know-your-customer (KYC), and other applicable legal and regulatory obligations, including record-keeping requirements.
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited conduct as defined in the vaji Terms & Conditions.
• Customer support: To respond to your enquiries, resolve complaints, and provide technical assistance through vaji's 24/7 live chat and email support channels.
• Responsible gaming: To administer responsible gaming tools including deposit limits, loss limits, cooling-off periods, and self-exclusion requests, and to monitor account activity for indicators of problem gambling behaviour.
• Platform improvement: To analyse usage patterns, game performance data, and technical metrics in order to improve the vaji Platform, fix bugs, and develop new features.
• Marketing communications: Where you have provided explicit consent, to send you promotional offers, bonus notifications, and news about the vaji Platform. You may withdraw marketing consent at any time by contacting vaji support.
• Legal proceedings: To establish, exercise, or defend legal claims where necessary.

vaji will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.

6 Legal Basis for Processing

vaji processes personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between vaji and you (i.e., to provide the Platform services, process payments, and maintain your Account).
• Legal obligation: Processing is required to comply with applicable legal obligations, including AML, KYC, and financial record-keeping requirements.
• Legitimate interests: Processing is necessary for vaji's legitimate interests in operating a secure platform, preventing fraud, improving services, and protecting vaji and its players from harm — provided those interests are not overridden by your rights and interests.
• Consent: Where vaji relies on consent as its legal basis (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

7 Sharing Personal Data with Third Parties

vaji does not sell personal data. We may share your personal data with the following categories of third parties solely to the extent necessary for the purposes described in this Policy:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank, to the extent necessary to process deposit and withdrawal transactions.
• Identity verification providers: Third-party KYC and document verification services engaged by vaji to assist with player identity checks and age verification.
• Game studio providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive limited technical data (such as session tokens) necessary to deliver game content to authenticated players.
• Fraud prevention and security partners: Third-party services engaged to assist with fraud screening, AML monitoring, and platform security.
• IT infrastructure and hosting providers: Cloud hosting and data storage providers who process data on vaji's behalf under strict data processing agreements.
• Legal and regulatory authorities: Where required by law or a valid legal order, vaji may disclose personal data to law enforcement agencies, courts, or regulatory bodies.

All third-party service providers engaged by vaji are contractually required to process personal data solely on vaji's instructions, to maintain appropriate security measures, and to handle data in a manner consistent with this Policy.

8 Cookies and Tracking Technologies

vaji uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage, and support security functions. The following categories of cookies are used on the vaji Platform:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during a gaming session and security tokens that protect against cross-site request forgery. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, preferred payment method, and responsible gaming tool configurations.
• Analytics cookies: Used to collect aggregated data about how players navigate the Platform, which games are most played, and where technical errors occur. This data helps vaji improve the Platform experience. Analytics data is processed in aggregated, non-identifiable form wherever possible.
• Security cookies: Used to detect and prevent fraudulent login attempts, identify suspicious account activity, and support vaji's AML monitoring obligations.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. vaji does not use third-party advertising or tracking cookies for retargeting purposes.

9 Data Security

vaji takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and the vaji Platform.
• Encryption at rest for sensitive personal data and financial records stored on vaji's servers.
• Access controls: Personal data is accessible only to vaji staff and authorised service providers who have a legitimate need to access it in the performance of their duties. Access is controlled on a least-privilege basis.
• Regular security assessments to identify and remediate vulnerabilities in the Platform's infrastructure and codebase.
• Incident response procedures: In the event of a personal data breach, vaji has documented procedures for identifying, containing, and notifying affected individuals and relevant authorities in a timely manner.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. vaji cannot guarantee the absolute security of your data but commits to implementing and maintaining industry-standard protections at all times.

10 Data Retention

vaji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the Account relationship and for a minimum of 5 years following Account closure, to satisfy AML record-keeping obligations.
• Financial transaction data: Retained for a minimum of 5 years following the date of the transaction, in accordance with applicable financial record-keeping requirements.
• Support communication data: Retained for 2 years following the resolution of the relevant support interaction, unless the communication is relevant to an ongoing legal or regulatory matter.
• Technical and usage data: Retained in aggregated or anonymised form indefinitely for analytical purposes; identifiable usage logs are retained for up to 12 months.
• Marketing consent records: Retained for the duration of the marketing relationship and for 1 year following withdrawal of consent, as evidence of the consent previously given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to you as an individual.

11 Your Data Rights

You have the following rights in respect of your personal data held by vaji. To exercise any of these rights, please contact vaji support using the details in Section 15. vaji will respond to all data rights requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data vaji holds about you, together with information about how it is used and with whom it is shared.
• Right to rectification: You have the right to request that vaji correct any inaccurate or incomplete personal data held about you. You may also update certain Account details directly through your Account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to overriding legal obligations such as AML record-keeping requirements.
• Right to restriction: You have the right to request that vaji restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests at any time on grounds relating to your particular situation. You also have an unconditional right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where vaji processes your data on the basis of consent, you may withdraw that consent at any time by contacting vaji support. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

12 Children and Minors

The vaji Platform is strictly for adults aged 21 years and above. vaji does not knowingly collect personal data from individuals under the age of 21. If vaji becomes aware that personal data has been collected from a person under the age of 21, it will take immediate steps to delete that data and close the associated Account.

If you are a parent or guardian and believe that a minor has registered an Account on the vaji Platform or has provided personal data to vaji, please contact support immediately at [email protected]. vaji treats reports of underage account access with the highest priority and will act promptly upon receipt of any such report.

13 Responsible Gaming and Data Processing

vaji processes certain personal data specifically to support responsible gaming obligations. This includes monitoring account activity for behavioural patterns that may indicate problem gambling, administering player-requested responsible gaming tools, and maintaining records of self-exclusion requests.

Where a player activates a self-exclusion, vaji retains the self-exclusion record for the full duration of the exclusion period and for a minimum of 5 years thereafter, to ensure that the exclusion can be enforced and re-enforced if necessary. During a self-exclusion period, vaji will suppress all marketing communications to the excluded Account.

Responsible gaming data is treated with the highest level of sensitivity and is accessible only to vaji staff directly responsible for player welfare and account management. For full details of the responsible gaming tools available to vaji players, please visit the Responsible Gaming page.

14 Changes to This Privacy Policy

vaji reserves the right to update this Privacy Policy at any time. Where changes are material — for example where vaji begins processing personal data for a new purpose, shares data with a new category of third party, or alters retention periods — vaji will provide at least 14 days' advance notice by email to the address registered on your Account and/or by displaying a prominent notice on the Platform.

Non-material changes such as typographical corrections or clarifications that do not alter the substance of the Policy may take effect immediately without advance notice. The effective date shown at the top of this Policy will be updated to reflect the date of the most recent revision. Continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

15 Contact and Data Enquiries

For all questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the vaji support team using the following details:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the vaji Platform
• Response Time: Live chat average under 2 minutes; email responses within 24 hours
• Operating Hours: 24/7, Bangladesh Standard Time (UTC+6)
• Subject Line for Data Requests: Please include "Data Rights Request" or "Privacy Enquiry" in your subject line to ensure prompt routing to the appropriate team member

vaji is committed to resolving all privacy-related concerns promptly and transparently. If you are not satisfied with vaji's response to a data enquiry or complaint, you may seek further recourse through applicable legal channels.