Privacy Policy — How tbajji Protects Your Data

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, mobile number, residential address, payment account identifiers, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Controller" means tbajji, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of tbajji, including payment providers, game platform operators, and cloud hosting services.
• "Consent" means any freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data.
• "Cookie" means a small text file placed on your device by the tbajji platform for the purposes of session management, analytics, or personalisation.
• "KYC" means Know Your Customer — the identity and age verification process applied to tbajji accounts in compliance with anti-money-laundering obligations.

tbajji collects Personal Data through several channels: directly from you during registration and gameplay, automatically through your use of the platform, and in limited cases from trusted third-party sources for verification purposes. The categories of data we collect are set out below.

• Identity data: Full legal name, date of birth, gender (where provided), and nationality.
• Contact data: Mobile phone number, email address, and residential address including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or Barisal).
• Account credentials: Username and encrypted password hash. tbajji never stores your password in plain text.
• KYC documents: Copies of government-issued identity documents (national identity card, passport, or driver's licence) and proof-of-address documents (utility bill or bank statement) submitted during the verification process.

• Payment account identifiers: bKash wallet numbers, Nagad account numbers, Rocket account numbers, Upay identifiers, or bank account references used for deposits and withdrawals.
• Transaction records: Deposit amounts, withdrawal requests, transaction timestamps, transaction reference numbers, and currency (BDT).
• Bonus and wagering records: Bonus credits applied, wagering progress, and bonus completion or forfeiture events.

• Device identifiers: IP address, device type, operating system version, browser type and version, and mobile device model.
• Session data: Login timestamps, session duration, pages visited, games launched, bet history, and in-platform navigation paths.
• Location data: Approximate geographic location derived from IP address, used solely for fraud detection and jurisdictional compliance checks. tbajji does not collect precise GPS coordinates.

• Records of any communications you send to tbajji support via email ([email protected]), in-platform chat, or any other channel, including the content and timestamp of those communications.
• Survey responses, feedback submissions, and any voluntary information you choose to provide to tbajji.

tbajji processes your Personal Data only for specific, legitimate purposes and always on a valid legal basis. The table below summarises our primary processing activities.

Where tbajji relies on legitimate interests as the legal basis for processing, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests by contacting [email protected], and we will review your objection within a reasonable timeframe.

Where tbajji relies on your consent (e.g., for marketing communications about promotions, BPL season offers, Eid bonuses, or new game launches), you may withdraw that consent at any time by following the unsubscribe link in any marketing message or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

tbajji does not sell, rent, or trade your Personal Data. We share your data only in the limited circumstances described below, and always with appropriate safeguards in place.

To deliver game content, tbajji shares necessary session and account data with certified Game Providers including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi. This data sharing is limited to what is required for game delivery, fair-play auditing, and RNG certification. Game Providers are contractually bound to process this data only for those purposes and are prohibited from using it for independent marketing or secondary analysis.

When you make a deposit or request a withdrawal, tbajji shares relevant transaction data with the applicable payment processor — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, or Islami Bank. The data shared is limited to the information required to complete the transaction. Each payment provider operates under its own privacy and security framework, and tbajji encourages you to review those policies directly.

tbajji may disclose Personal Data to government bodies, law enforcement agencies, financial intelligence units, or courts where required to do so by applicable law, court order, or regulatory direction. In such cases, tbajji will disclose only the minimum data necessary to satisfy the legal requirement and will notify you of any such disclosure where permitted by law.

tbajji uses trusted third-party service providers for cloud infrastructure, data hosting, platform security monitoring, and customer support tooling. These providers act as data Processors under contract with tbajji and are permitted to process Personal Data only on tbajji's explicit instructions. They are not authorised to use your data for their own purposes.

tbajji retains your Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, or longer if required by applicable financial regulations.
• KYC documentation: Retained for five (5) years following account closure, or as required by law.
• Communications and support records: Retained for three (3) years from the date of the communication, or until any related dispute is fully resolved.
• Session and technical logs: Retained for up to twelve (12) months for security monitoring and fraud detection, after which they are anonymised or deleted.
• Marketing consent records: Retained for the duration of the consent plus three (3) years to demonstrate compliance in the event of a complaint or audit.

Where data is no longer required for its original purpose and no legal retention obligation applies, tbajji securely deletes or anonymises the data so that it can no longer be attributed to any identifiable individual.

The tbajji platform uses cookies and similar tracking technologies to enable core platform functionality and to understand how players interact with the site. We do not use third-party advertising cookies or cross-site tracking scripts.

• Strictly necessary cookies: These cookies are essential for the tbajji platform to function. They manage your login session, maintain your wallet state during a session, and protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Analytics cookies: These cookies collect aggregated, anonymised data about how visitors navigate the tbajji platform — which pages are visited most frequently, average session duration, and common navigation paths. This data helps us improve platform usability. These cookies are optional.
• Preference cookies: These cookies remember display preferences you have set within the tbajji platform, such as notification settings or game category filters. These cookies are optional.

You can control and delete cookies through your browser settings at any time. Most modern browsers — including those on Android and iOS devices commonly used by players in Bangladesh — allow you to block or delete all cookies, block third-party cookies specifically, or receive a notification before a cookie is stored. Please note that disabling strictly necessary cookies will impair your ability to log in and use the tbajji platform.

tbajji does not use fingerprinting, pixel tracking, or any other persistent cross-site tracking technology beyond the cookies described above.

tbajji implements a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Transport encryption: All data transmitted between your browser or app and the tbajji servers is encrypted using TLS 1.2 or higher (SSL). The padlock symbol visible in your browser address bar confirms this encryption is active.
• Password hashing: Account passwords are never stored in plain text. They are processed through a strong one-way cryptographic hashing algorithm with a unique salt per account.
• Two-factor authentication: tbajji applies OTP-based two-factor authentication on login and on sensitive account operations including withdrawal requests.
• Access controls: Access to Personal Data within tbajji's internal systems is restricted on a strict need-to-know basis. Staff access is logged and audited regularly.
• Infrastructure security: tbajji's hosting infrastructure is monitored continuously for intrusion attempts, unusual access patterns, and denial-of-service conditions.
• Payment security: tbajji does not store full payment account credentials on its own servers. Payment processing is handled directly by bKash, Nagad, Rocket, Upay, and banking partners under their respective security frameworks.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that poses a material risk to your rights and freedoms, tbajji will notify affected users and the relevant authorities without undue delay, in accordance with applicable law.

As a tbajji player, you have the following rights in relation to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". tbajji will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days.

• Right of access: You may request a copy of the Personal Data tbajji holds about you, along with information about how it is being processed.
• Right to rectification: If any Personal Data tbajji holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to erasure: You may request that tbajji delete your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where there is no overriding legal basis for continued processing. Please note that certain data must be retained for legal and regulatory compliance and cannot be deleted on request.
• Right to restriction: You may request that tbajji temporarily restrict processing of your Personal Data while a correction request, objection, or legal claim is under review.
• Right to data portability: Where processing is based on consent or contract performance and is carried out by automated means, you may request that tbajji provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing of your Personal Data that is based on tbajji's legitimate interests. tbajji will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for legal claims.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

The tbajji platform is strictly for adults aged 21 years and above. tbajji does not knowingly collect Personal Data from any individual under the age of 21. During the registration process, all users are required to confirm their date of birth and may be required to submit government-issued identity documentation to verify their age.

If tbajji becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, it will immediately suspend the relevant account, delete the associated Personal Data, and return any deposited funds to the originating payment account. If you believe a minor has registered on the tbajji platform, please notify us immediately at [email protected].

The tbajji platform does not contain links to third-party websites beyond those required for payment processing. However, certain Game Provider interfaces may include references to the provider's own terms or support resources. tbajji is not responsible for the privacy practices or content of any third-party website or service. We encourage you to review the privacy policy of any third-party service before providing your Personal Data to them.

Payment providers such as bKash, Nagad, Rocket, and Upay operate under their own independent privacy frameworks. When you initiate a payment through these providers, your interaction with their interface is governed by their respective privacy policies, over which tbajji has no control.

tbajji reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, platform features, or business operations. Where changes are material, tbajji will provide prominent notice on the platform or notify you via your registered contact details prior to the changes taking effect.

The current version of this Privacy Policy, along with its effective date, is always available at https://tbajji.pro/privacy-policy. Your continued use of the tbajji platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with the changes, you must cease using the platform and may request account closure by contacting [email protected].