tbaj Privacy Policy

This Privacy Policy ("Policy") describes how tbaj ("we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you", "your", "player") who access, register with, or interact with the tbaj Platform available at https://tbaj.bio and any associated interfaces (collectively, the "Platform").

tbaj is committed to handling personal data with transparency, integrity, and security. This Policy has been prepared to reflect those commitments and to ensure that players in Bangladesh and all other territories have a clear understanding of their data rights and our obligations when processing their personal information.

By registering a tbaj account, making a deposit, placing a bet, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

tbaj collects several categories of personal data in the course of providing the Platform. The specific data collected depends on how you interact with us. The main categories are described below.

2.1 Registration and Identity Data

When you create a tbaj account, we collect the information you provide during the registration process, including your full legal name, date of birth, gender, residential address (including city and district within Bangladesh), email address, and mobile phone number. This information is required to create your account and verify your identity.

2.2 Identity Verification Data

As part of our Know Your Customer (KYC) obligations and age verification requirements, we may collect copies of government-issued identity documents such as your National Identity Card (NID), passport, or driving licence. We may also request proof of address documents such as utility bills or bank statements. These documents are used solely for verification purposes.

2.3 Financial and Payment Data

When you make deposits or withdrawals, we collect transaction-related data including payment method type (bKash, Nagad, Rocket, Upay, bank transfer), transaction amounts in BDT (৳), timestamps, and transaction reference numbers. We do not store full payment account credentials — payment processing is handled by the respective payment service providers.

2.4 Account Activity Data

We collect records of your activity on the Platform, including bet history, game participation records, deposit and withdrawal history, bonus claims and wagering activity, login timestamps, session durations, and any communications you initiate with our support team.

2.5 Technical and Device Data

We automatically collect certain technical data when you access the Platform, including your IP address, device type, operating system, browser type and version, screen resolution, referring URLs, and general geographic location inferred from your IP address. This data is used for security monitoring, fraud prevention, and Platform optimisation.

3.1 Directly From You

The majority of personal data we hold is provided directly by you during the registration process, identity verification submissions, deposit and withdrawal requests, and your communications with our support team. You are always informed at the point of collection what data is required and why.

3.2 Automatically Through Platform Use

Certain data is collected automatically whenever you access the Platform. This includes technical data gathered via server logs, cookies, and similar tracking technologies as described in Section 6 of this Policy. Automatic data collection occurs in the background during every session and does not require any specific action on your part.

3.3 From Third-Party Service Providers

We may receive supplementary data from trusted third-party service providers that help us operate the Platform. This includes fraud detection signals from payment processors, age and identity verification results from KYC service providers, and game session data from our third-party game providers (such as Pragmatic Play, Evolution Gaming, Ezugi, and others). Data received from third parties is handled with the same level of care as data collected directly from you.

3.4 From Publicly Available Sources

In limited circumstances — primarily where fraud, money laundering, or match-fixing is suspected — we may cross-reference personal data against publicly available records or databases. This is done solely for security and compliance purposes and does not form part of routine account management.

tbaj processes your personal data only for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purposes described below. The main purposes for which we process personal data are:

• Account Management: To create, operate, and maintain your tbaj account, including processing login sessions, managing your account balance, and handling account settings changes.
• Payment Processing: To process deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, and partner banks, and to maintain accurate financial records associated with your account.
• Identity and Age Verification: To verify that you are who you claim to be and to confirm you meet the 21+ age requirement before granting access to betting and gaming features.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited activities.
• Regulatory Compliance: To meet legal obligations including record-keeping requirements and to respond to lawful requests from relevant authorities.
• Responsible Gaming Monitoring: To monitor player behaviour for indicators of problem gambling and to enforce any self-exclusion, deposit limit, or cooling-off restrictions you have requested.
• Customer Support: To respond to your queries, complaints, and dispute submissions via email and live chat.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve Platform performance, game offerings, and user experience.
• Marketing Communications: Where you have provided explicit consent, to send you information about promotions, bonuses, and seasonal offers. You may withdraw marketing consent at any time by contacting support.

tbaj does not sell, rent, or trade your personal data with any third party for commercial purposes. However, in order to provide the Platform and comply with our obligations, we share data in the following limited circumstances:

5.1 Payment Service Providers

We share transaction-relevant data with payment processing partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other banking partners to facilitate your deposits and withdrawals. These providers receive only the minimum data necessary to process each transaction and are bound by their own data protection obligations.

5.2 Game and Technology Providers

Third-party game providers (such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe) receive a session token and anonymised player reference when you launch a game. They do not receive your full identity data. These providers operate under strict data processing agreements with tbaj.

5.3 Identity Verification Services

Where KYC verification is conducted via a third-party provider, your identity documents and personal details are transmitted to that provider for verification purposes only. The results are shared back with tbaj and the documents are not retained by the verification provider beyond the duration required for the verification process.

5.4 Fraud Detection and Security Partners

To protect the integrity of the Platform and the security of all players, we may share device fingerprints, IP addresses, and behavioural signals with fraud detection technology providers. This sharing is strictly limited to security purposes.

5.5 Legal and Regulatory Obligations

We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of tbaj, its players, or the public.

6.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. tbaj uses cookies and similar tracking technologies (such as web beacons and local storage) to maintain your session state, remember your preferences, and gather anonymised analytics data about Platform usage.

6.2 Types of Cookies We Use

6.3 Managing Cookies

You can manage or disable cookies through your browser settings at any time. However, please note that disabling strictly necessary cookies will impair the functionality of the Platform, including the ability to log in and place bets. Analytics and functional cookies can be disabled without affecting core Platform functionality.

tbaj retains personal data only for as long as is necessary to fulfil the purpose for which it was originally collected, or for as long as is required by applicable legal, regulatory, or contractual obligations. The key retention periods applied by tbaj are as follows:

• Active Account Data: Retained for the full duration of your account's active status plus a minimum period of five years following account closure, to meet financial record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later.
• Transaction Records: Retained for a minimum of five years from the date of each transaction in accordance with financial record-keeping best practices.
• Support Communications: Retained for three years from the date of the last communication on a given support ticket, or longer where a dispute remains unresolved.
• Marketing Consent Records: Retained until you withdraw consent and for one year thereafter as evidence of the consent event.
• Technical and Log Data: Retained for up to 12 months in identifiable form, after which it is anonymised for statistical purposes.

Upon expiry of the applicable retention period, personal data is securely deleted from tbaj systems using industry-standard data erasure methods, or anonymised in a manner that prevents re-identification.

tbaj takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. The primary security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and tbaj servers is encrypted using industry-standard SSL/TLS protocols. This applies to all Platform pages, including login, deposit, and withdrawal flows.
• Password Hashing: Account passwords are stored using a one-way cryptographic hashing algorithm. tbaj staff cannot read your password. If you forget your password, it must be reset — it cannot be retrieved.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their tbaj account for an additional layer of login security. 2FA options are available via the account security settings.
• Access Controls: Internal access to player personal data is restricted to tbaj staff who require it for their specific job function. All internal access is logged and subject to periodic review.
• Intrusion Detection: tbaj servers are monitored continuously for suspicious activity, unauthorised access attempts, and anomalous traffic patterns.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to affected individuals, tbaj will notify affected players without undue delay and take immediate remediation steps.

As a tbaj player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact tbaj support at [email protected]. All requests will be acknowledged within five business days and responded to in full within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data tbaj holds about you, along with information about how it is being processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account information directly via your account settings.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to overriding legal retention obligations — for example, we cannot delete transaction records required for financial compliance purposes.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in specific circumstances, such as while a dispute regarding data accuracy is being investigated.
• Right to Data Portability: You may request a copy of your personal data in a structured, machine-readable format (CSV or JSON) covering account activity records, transaction history, and KYC submission details.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
• Right to Object: You may object to the processing of your personal data where that processing is based on our legitimate interests, subject to tbaj demonstrating compelling grounds that override your interests.

The tbaj Platform is strictly intended for adults aged 21 years and above. tbaj does not knowingly collect personal data from individuals under the age of 21. The registration process includes a date of birth field, and age verification may be required before full account access is granted.

If tbaj becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, all associated data reviewed, and the relevant records deleted or flagged in accordance with our minor protection procedures. Any deposits made by an underage player will be returned after deducting any winnings generated during the period, which will be voided.

If you believe a minor has registered an account on the tbaj Platform, please notify us immediately at [email protected] so that appropriate action can be taken without delay.

Some of tbaj's third-party service providers — including game technology providers, fraud detection platforms, and cloud infrastructure partners — may process personal data in jurisdictions outside Bangladesh. Where such transfers occur, tbaj takes steps to ensure that your personal data receives an adequate level of protection consistent with the principles outlined in this Policy.

Protective measures applied to international transfers include data processing agreements with all third-party recipients that require them to handle personal data in accordance with standards equivalent to those described in this Policy, and a preference for service providers that operate within jurisdictions recognised as providing adequate data protection standards.

By using the tbaj Platform and consenting to this Policy, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh as described in this section.

tbaj reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they alter how your data is collected, used, or shared in a significant way — tbaj will provide advance notice via the Platform and to your registered email address. The effective date at the top of this Policy will be updated to reflect the date of the latest revision.

Non-material changes, such as clarifications of existing language, corrections of typographical errors, or updates to contact details, may be made without advance notice. We encourage you to review this Policy periodically to stay informed about how tbaj handles your personal data.

Continued use of the Platform after any revision to this Policy constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you must cease using the Platform and may request account closure in accordance with the tbaj Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please contact the tbaj data support team using the details below. All privacy-related communications must be in English.

• Email: [email protected]
• Subject Line: Use "Privacy Request" or "Data Rights" in the subject for faster routing
• Response Time: Acknowledged within 5 business days; fully resolved within 30 calendar days
• Support Hours: 24 hours a day, 7 days a week