Privacy Policy — How tbaje Protects Your Data

1. Introduction & Scope

This Privacy Policy ("Policy") applies to all personal data collected and processed by tbaje ("we", "us", "the platform") in connection with the operation of the tbaje website at https://tbaje.bio and all associated services, including sports betting, live casino games, slots, arcade games, customer support, and promotional communications.

This Policy applies to all individuals who interact with the tbaje platform in any capacity, including registered account holders, individuals who browse the platform without registering, and individuals who communicate with our support team. By registering a tbaje account or by continuing to use the platform after this Policy has been published, you acknowledge that you have read and understood how your personal data is handled.

This Policy should be read alongside the tbaje Terms & Conditions, which govern the overall relationship between you and the platform. In the event of any conflict between this Policy and the Terms & Conditions on a privacy-related matter, this Policy takes precedence.

2. Data Controller Information

tbaje operates as the data controller in respect of all personal data collected through the platform. As data controller, tbaje determines the purposes for which your personal data is processed and the means by which that processing takes place. All data rights requests, privacy enquiries, and complaints relating to the use of your personal data should be directed to:

• Platform Name: tbaje
• Website: https://tbaje.bio
• Privacy Contact Email: [email protected] (plain text — not a clickable link)
• Support Hours: Monday to Sunday, 9:00 AM – 11:00 PM Bangladesh Standard Time (BST, UTC+6)

When contacting us about a privacy matter, please include your registered tbaje username and a clear description of your request or concern so we can respond efficiently.

3. Personal Data We Collect

The personal data tbaje collects falls into the following categories. We collect only what is necessary for the stated purpose of each category.

3.1 Registration & Identity Data

When you create a tbaje account, we collect your full legal name, date of birth, mobile phone number, and a password of your choosing. This information is required to establish your account, verify your eligibility (including age verification for the 21+ requirement), and identify you as the account holder in any future support or compliance interaction.

3.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, we may request copies of identity documents including your National Identity Card (NID), passport, driving licence, or a recent utility bill or bank statement for address verification. We may also request a selfie photograph to match against your submitted identity document. KYC documents are processed by our verification systems and, where applicable, by a contracted third-party identity verification provider.

3.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, bets, game play outcomes, and account balance movements associated with your tbaje account. We also collect the mobile wallet numbers (e.g., bKash, Nagad, Rocket) or bank account references used to process your transactions. We do not store full bank account credentials or mobile wallet PINs — payment transactions are processed via the respective payment provider's secure infrastructure.

3.4 Technical & Usage Data

When you access the tbaje platform, we automatically collect certain technical information including your IP address, device type, operating system, browser type and version, screen resolution, referring URL, pages visited, time spent on each page, and session timestamps. This data is used for platform security, fraud detection, and service quality improvement.

3.5 Communications Data

When you contact tbaje support or respond to a promotional communication, we retain a record of that correspondence including the content of messages, timestamps, and any attachments provided. This data is used to resolve your enquiry, maintain a history of account interactions, and improve our support quality.

3.6 Responsible Gaming Data

If you use any responsible gaming tools — such as deposit limits, session time limits, cooling-off periods, or self-exclusion — we record the details of those settings and any changes you make to them. This data is retained to ensure the platform correctly enforces the restrictions you have chosen and to comply with our responsible gaming obligations.

4. How We Use Your Data

tbaje uses the personal data we collect for the following purposes:

• Account management — creating, maintaining, and closing your tbaje account; authenticating your identity when you log in; processing password resets and security updates.
• Service delivery — enabling you to place bets, play casino and arcade games, participate in promotions, and access all platform features you are eligible to use.
• Payment processing — verifying deposit and withdrawal requests, matching transactions to your account, processing payouts via bKash, Nagad, Rocket, Upay, and bank transfer channels.
• Identity verification — confirming your age (21+ requirement), matching your registration data against KYC documents, and re-verifying identity where required by our compliance obligations.
• Fraud prevention and security — detecting and investigating suspicious account activity, identifying duplicate accounts, monitoring for automated bot usage, and protecting the integrity of the platform and its player community.
• Anti-money laundering (AML) compliance — monitoring deposit and withdrawal patterns, conducting source-of-funds checks where required, and maintaining transaction records as required for AML compliance purposes.
• Responsible gaming — enforcing deposit limits, session limits, cooling-off periods, and self-exclusion settings as instructed by you; monitoring for behavioural indicators of problem gambling where required by our responsible gaming framework.
• Customer support — responding to enquiries, resolving disputes, processing formal complaints, and maintaining a history of account interactions.
• Platform improvement — analysing aggregated, anonymised usage data to identify technical issues, improve navigation and user experience, and develop new features.
• Promotional communications — where you have opted in, sending you notifications about relevant promotions, bonuses, seasonal offers (e.g., BPL season, Eid promotions), and platform updates via your registered mobile number.

5. Legal Bases for Processing

tbaje processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — processing required to perform the contract between you and tbaje (i.e., the Terms & Conditions), including account management, payment processing, and service delivery.
• Legal obligation — processing required to comply with applicable legal obligations, including KYC/AML requirements, age verification, and the retention of financial records.
• Legitimate interests — processing carried out for tbaje's legitimate business interests where those interests are not overridden by your privacy rights. This includes fraud prevention, platform security, abuse detection, and aggregated analytics for service improvement.
• Consent — where tbaje relies on your consent as the legal basis for processing (e.g., sending you promotional communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Third Parties

tbaje does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own commercial purposes. We may share your data with the following categories of third parties, strictly as necessary to fulfil the purposes described in this Policy:

6.1 Payment Service Providers

To process deposits and withdrawals, tbaje shares the minimum required transaction data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank (DBBL), City Bank, BRAC Bank, Islami Bank, and Sonali Bank. These providers operate under their own privacy frameworks and are responsible for the security of data processed within their own systems.

6.2 Identity Verification Providers

For KYC purposes, tbaje may share identity document images and registration data with contracted third-party identity verification providers. These providers are bound by confidentiality and data protection agreements and may not use your data for any purpose other than performing the verification service on tbaje's behalf.

6.3 Game Technology Providers

Casino and slot game providers — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi — may receive session data (such as game round identifiers and bet amounts) to operate their games. These providers do not receive your full identity or financial profile.

6.4 Regulatory & Law Enforcement Authorities

tbaje will disclose personal data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, a valid legal order, or to protect the rights, property, or safety of tbaje, its players, or the public. We will notify affected players of such disclosures where we are legally permitted to do so.

6.5 Professional Advisers

tbaje may share personal data with legal, accounting, and audit advisers on a confidential basis where required for the conduct of professional services. Such advisers are bound by professional secrecy obligations.

7. International Data Transfers

Some of the third-party service providers used by tbaje — particularly game technology providers and cloud infrastructure services — may be located outside Bangladesh, which means your personal data may be transferred to and processed in other countries.

Where such transfers occur, tbaje takes reasonable steps to ensure that an adequate level of protection is applied to your personal data, equivalent to the protection it receives within Bangladesh. This may include entering into data transfer agreements with the recipient organisation, incorporating standard contractual clauses, or relying on the recipient's adherence to recognised international data protection frameworks.

If you have questions about the safeguards applied to any specific international transfer of your personal data, please contact [email protected].

8. Data Retention & Deletion

tbaje retains personal data for as long as it is needed to fulfil the purpose for which it was collected, or for as long as required by applicable law or regulatory obligation. The following general retention principles apply:

• Active account data — retained for the lifetime of your tbaje account and for a minimum of five (5) years after account closure, to satisfy financial record-keeping and AML retention requirements.
• KYC documents — retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction records — retained for a minimum of five (5) years from the date of each transaction.
• Support communications — retained for three (3) years from the date of last contact, unless a longer period is required in connection with an open dispute.
• Marketing consent records — retained for as long as you remain opted in to marketing communications, plus three (3) years after opt-out to evidence consent status.
• Technical and usage logs — retained for twelve (12) months from the date of collection, after which they are either deleted or anonymised for aggregated analytics purposes.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (from which no individual can reasonably be identified) may be retained indefinitely for statistical analysis and service improvement purposes.

9. Cookies & Tracking Technologies

The tbaje website uses cookies and similar tracking technologies to operate certain platform functions and to understand how visitors interact with the site. The cookies used by tbaje fall into the following categories:

• Strictly necessary cookies — required for the platform to function, including session management, login authentication, and security token validation. These cookies cannot be disabled without preventing core platform functionality.
• Functional cookies — used to remember your preferences, such as your preferred language setting and certain display configurations, so that you do not need to reconfigure these each time you visit.
• Analytics cookies — used to collect anonymised or pseudonymised data about how visitors navigate the site, which pages receive the most traffic, and where users encounter difficulties. This data is used solely to improve the platform and is not used to identify individual users.
• Fraud detection cookies — used to identify anomalous patterns of platform access that may indicate automated bot activity, account takeover attempts, or other fraudulent behaviour.

tbaje does not use third-party advertising or behavioural targeting cookies. No cookie data is shared with advertising networks or data brokers. You may adjust your browser settings to block or delete cookies at any time; however, blocking strictly necessary cookies will impair your ability to log in and use the platform.

10. Your Data Rights

You hold the following rights in respect of the personal data tbaje holds about you. To exercise any of these rights, contact [email protected] with your registered username and a clear description of the right you wish to exercise.

11. Children's Privacy

The tbaje platform is strictly for adults aged 21 years and above. tbaje does not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by, or that personal data has been collected from, an individual under the age of 21, we will immediately close the account, delete the associated personal data, and reverse any transactions made from that account to the extent technically possible.

If you believe that a minor may have created a tbaje account or submitted personal data to the platform, please notify us immediately at [email protected] so that we can take prompt action.

12. Security Measures

tbaje implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• SSL/TLS encryption — all data transmitted between your browser or device and the tbaje platform is encrypted in transit using current-generation TLS protocols.
• Encrypted data storage — sensitive personal data including identity documents, financial records, and KYC materials is stored in encrypted form at rest.
• Access controls — access to player personal data by tbaje staff is restricted on a strict need-to-know basis. Staff with data access are subject to confidentiality obligations and receive regular data protection training.
• OTP authentication — sensitive account actions including login from a new device, withdrawal requests, and password resets are protected by one-time password (OTP) authentication sent to your registered mobile number.
• Fraud monitoring systems — automated systems monitor account activity patterns in real time to detect and flag anomalies that may indicate unauthorised access or fraudulent behaviour.
• Regular security reviews — tbaje conducts periodic security assessments of its platform infrastructure, data handling practices, and third-party integrations to identify and remediate vulnerabilities.

13. Changes to This Policy

tbaje may update this Privacy Policy from time to time to reflect changes in our data processing practices, updates to applicable law, or developments in the platform's services. When material changes are made, we will notify registered players by sending a message to their registered mobile number and by displaying a prominent notice on the platform for a minimum of seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy will be revised each time a new version is published. We encourage you to review this page periodically to stay informed about how your personal data is being protected. Continued use of the tbaje platform after the effective date of any revision constitutes your acceptance of the updated Policy.

14. Contact & Data Requests

All privacy-related enquiries, data rights requests, and complaints should be directed to the tbaje privacy team using the contact details below. Please note that email addresses are displayed as plain text and are not clickable links.

• Privacy Enquiries: [email protected]
• Subject Line for Data Rights Requests: "Data Rights Request — [Your Registered Username]"
• Subject Line for Privacy Complaints: "Privacy Complaint — [Your Registered Username]"
• Response Time: Acknowledgement within five (5) business days; resolution within thirty (30) calendar days
• Support Hours: Monday to Sunday, 9:00 AM – 11:00 PM Bangladesh Standard Time (BST, UTC+6)

When submitting any data rights request, please include your registered tbaje username, the specific right you wish to exercise, and any supporting context that will help us locate and assess the relevant data efficiently. Requests submitted without sufficient identifying information may be delayed while we carry out identity verification.