tbajj Privacy Policy
Your privacy matters to us. This Privacy Policy explains in plain, formal English exactly what personal data tbajj collects, why we collect it, how it is stored and protected, and the rights you hold over your own information as a player based in Bangladesh.
How tbajj Protects Your Data
We understand that sharing personal information with an online platform requires trust. The cards below summarise the core commitments tbajj makes to every player regarding the handling of their data.
Information We Collect
tbajj collects personal data in several ways: directly from you when you register an account or interact with our platform, automatically through your use of the site, and in limited circumstances from third-party verification and payment service providers. The categories of data we collect are described below.
Registration and Account Data
When you create a tbajj account, we collect the following information:
- Full legal name as it appears on your government-issued identification document
- Date of birth — used to verify that you meet the 18+ age requirement
- Residential address in Bangladesh, including district and administrative division
- Mobile phone number — used for account authentication and communication
- Email address — used for account correspondence, security alerts, and promotional communications (where opted in)
- Username and password — your password is stored using one-way cryptographic hashing and is never accessible in plain text to tbajj staff
Identity Verification (KYC) Data
To comply with our obligations relating to age verification and anti-money laundering (AML), tbajj may request and retain copies of the following documents:
- National Identity Card (NID) issued by the Bangladesh Election Commission
- Valid passport (biographic data page)
- Bangladesh driving licence (front and back)
- Proof of address (e.g., recent utility bill, bank statement, or government correspondence dated within three months)
- Source of funds documentation (e.g., bank statements, payslips) where required by our AML procedures
Financial Transaction Data
We record details of all financial transactions conducted through your tbajj account, including deposits, withdrawals, bonus credits, and adjustments. For mobile financial service transactions via bKash, Nagad, Rocket, or Upay, we retain the transaction reference number and the mobile number associated with the transaction. For bank card payments via Visa or Mastercard, we retain a tokenised representation of your card details provided by our payment processor — we do not store full card numbers on our own systems.
Gameplay and Betting Data
tbajj logs all gameplay activity on the platform, including game titles accessed, bet amounts, round outcomes, session timestamps, and wager history. This data is used for account management, dispute resolution, responsible gaming monitoring, and fraud detection. Gameplay logs are retained in accordance with the data retention schedule set out in Section 6 of this policy.
Technical and Device Data
When you access tbajj, our systems automatically collect certain technical information, including:
- IP address and approximate geolocation derived from IP data
- Device type, operating system, and browser version
- Session start and end times
- Pages visited and features accessed within the platform
- Referral source (the URL from which you arrived at tbajj, if applicable)
This technical data does not on its own identify you personally but may be combined with account data where necessary for fraud prevention, security investigations, or legal compliance purposes.
Customer Support Communications
When you contact tbajj support — whether via live chat, email, or any other channel — we retain a record of your communications, including the content of messages exchanged, the date and time of contact, the nature of the query, and any resolution provided. These records are used to ensure quality of service and to maintain an accurate history of your interactions with our team.
How We Use Your Data
tbajj uses the personal data it collects for a defined set of purposes directly related to the delivery, security, and improvement of our platform. We do not use your data for any purpose inconsistent with those described in this section.
Service Delivery
The primary purpose for which we collect your personal data is to provide the tbajj online casino and sports betting platform to you. This includes processing your registration, maintaining your account, crediting and debiting your account balance, processing deposits and withdrawals, delivering games, calculating odds, and providing customer support.
Identity Verification and Legal Compliance
tbajj is obligated to verify the identity and age of all players prior to enabling full withdrawal functionality. KYC data is processed for the purpose of confirming that you are who you say you are, that you are aged 18 or above, and that your use of the platform does not conflict with our anti-money laundering obligations. We may also be required to disclose certain data to authorities in connection with legally mandated reporting or investigations — see Section 4 for further detail on data disclosure.
Fraud Detection and Platform Security
Technical data, transaction patterns, and gameplay behaviour are analysed on an ongoing basis to detect suspicious activity including account takeover attempts, multi-account abuse, bonus farming, chargeback fraud, and money laundering. Where fraud is detected or suspected, your account may be suspended and relevant data shared with our fraud detection partners and, where legally required, with law enforcement.
Responsible Gaming Monitoring
tbajj uses gameplay and transaction data to monitor for indicators of problem gambling behaviour, such as escalating deposit frequency, extended session durations, or patterns inconsistent with recreational play. Where such indicators are detected, our responsible gaming team may contact you to offer support tools including deposit limits, session reminders, or self-exclusion options. For more information, visit our Responsible Gaming page.
Marketing Communications
Where you have opted in to marketing communications at the time of registration or subsequently through your account settings, we may contact you via email or SMS to inform you of promotions, seasonal offers (such as those tied to BPL cricket season, Eid, or Pohela Boishakh), and platform updates. You may withdraw your consent to marketing communications at any time by updating your preferences in your account settings panel or by contacting support at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of prior communications.
Platform Improvement and Analytics
Aggregated, anonymised technical and behavioural data is used internally to understand how players interact with the platform, identify areas for improvement in user experience, and evaluate the performance of new features. This analytics activity does not involve the use of individually identifiable data and the outputs are used solely for internal product development purposes.
Legal Basis for Processing
tbajj processes personal data only where a legitimate legal basis exists for doing so. The table below maps each category of processing activity to its corresponding legal basis.
| Processing Activity | Legal Basis | Notes |
|---|---|---|
| Account registration and service delivery | Contractual necessity | Processing is required to fulfil the agreement between tbajj and the player. |
| Age and identity verification (KYC) | Legal obligation | Required to comply with age restriction and anti-money laundering obligations. |
| Fraud detection and AML monitoring | Legitimate interest / Legal obligation | tbajj has a legitimate interest in protecting its platform and players from fraud. |
| Responsible gaming monitoring | Legitimate interest | Proactive duty of care to identify and support players showing signs of harm. |
| Marketing communications | Consent | Only sent to players who have explicitly opted in. Withdrawable at any time. |
| Platform analytics | Legitimate interest | Processed in anonymised, aggregated form only — no individual profiling. |
| Disclosure to authorities | Legal obligation | Where required by law or court order, data may be disclosed to relevant authorities. |
Where tbajj relies on legitimate interests as the legal basis for processing, we have assessed that such interests are not overridden by the rights and interests of individual players. Players who wish to object to processing conducted on legitimate interest grounds may do so by contacting [email protected] — we will assess each objection on its individual merits and respond within a reasonable timeframe.
Data Sharing and Disclosure
tbajj does not sell, rent, or trade your personal data. We share data only with the categories of recipients listed below, and only to the extent necessary for the specified purpose.
Payment Processors and Financial Partners
To process deposits and withdrawals, tbajj shares transaction-relevant data with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card processing networks (Visa and Mastercard). Data shared with payment partners is limited to what is required to execute and verify a specific financial transaction. These partners operate under their own privacy frameworks and are bound by contractual obligations to handle data appropriately.
Game Providers and Technology Partners
Games available on the tbajj platform are supplied by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. To facilitate gameplay, certain technical identifiers (such as a session token or anonymised player ID) may be shared with game providers. We do not share your full identity or payment data with game studios. These providers are bound by contractual data processing agreements.
Identity Verification Services
To fulfil our KYC obligations, tbajj may engage third-party identity verification service providers. These providers receive copies of your submitted identity documents and return a verification result. All such providers are contractually bound to use your data solely for the purpose of completing the verification and to delete or return documents following completion of the process.
Fraud Prevention and Security Partners
tbajj may share technical and behavioural data with specialist fraud detection and cybersecurity service providers for the purpose of protecting the platform and our players from fraudulent activity. Data shared in this context is used exclusively for security analysis and is not used for commercial profiling.
Legal and Regulatory Authorities
tbajj will disclose personal data to law enforcement, regulatory bodies, or other competent authorities where we are legally required to do so — for example, in response to a court order, lawful investigative request, or mandatory reporting obligation related to anti-money laundering or counter-terrorism financing. We do not disclose data to authorities voluntarily beyond what is required by law.
Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of tbajj's business assets, player personal data may be transferred to the acquiring entity as part of that transaction. Affected players will be notified via the email address registered to their account prior to any such transfer taking effect, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.
Data Retention
tbajj retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, or to resolve disputes and enforce our agreements. The retention periods applicable to each major category of data are summarised below.
| Data Category | Retention Period | Reason for Retention |
|---|---|---|
| Account registration data | Duration of active account + 5 years post-closure | Legal obligation; dispute resolution; AML record-keeping requirements. |
| KYC identity documents | Duration of active account + 5 years post-closure | Anti-money laundering regulations require retention of verification records. |
| Financial transaction records | 7 years from date of transaction | Financial record-keeping obligations and potential dispute investigation. |
| Gameplay and bet history | 3 years from date of activity | Dispute resolution; responsible gaming monitoring; fraud investigation. |
| Customer support records | 3 years from date of interaction | Quality assurance; evidence in the event of a dispute or complaint. |
| Marketing consent records | Duration of consent + 2 years post-withdrawal | Evidence of consent and its withdrawal for regulatory compliance. |
| Technical / device logs | Up to 12 months | Security monitoring; fraud investigation; platform performance analysis. |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data is anonymised rather than deleted, the anonymised data set may be retained indefinitely for aggregate analytical purposes.
If a legal hold is placed on data in connection with an ongoing investigation, regulatory inquiry, or litigation, the relevant data will be preserved until the hold is formally lifted, regardless of the standard retention schedule.
Your Privacy Rights
tbajj respects your rights in relation to the personal data we hold about you. The following rights are available to all registered players. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Subject Request — [Your Username]". We will acknowledge your request within five business days and provide a substantive response within a reasonable period consistent with our legal obligations.
Right to Access
You have the right to request a copy of the personal data that tbajj holds about you, including details of how it is used, with whom it is shared, and how long it is retained. We will provide this information in a structured, commonly used format. Requests that are manifestly unfounded or excessive may be declined or subject to a reasonable administrative fee.
Right to Rectification
If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain categories of data (such as your registered name or date of birth), rectification may require submission of a supporting identity document to prevent fraudulent amendment of account details.
Right to Erasure
In certain circumstances, you may request that tbajj delete the personal data we hold about you. This right is not absolute — we may be required to retain certain data to comply with legal obligations (such as AML record-keeping requirements) or to defend against legal claims. Where erasure is not possible in full, we will erase the data that can lawfully be deleted and inform you of any data that must be retained and the reason for its retention.
Right to Restrict Processing
You may request that tbajj restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or where you have objected to processing on legitimate interest grounds and we are evaluating that objection. Restriction means your data will be stored but not actively processed during the restriction period.
Right to Object to Marketing
You have an unconditional right to object to the use of your personal data for direct marketing purposes at any time. Following receipt of an opt-out request, tbajj will cease all marketing communications within five business days. Opting out of marketing does not affect the delivery of transactional communications (such as account confirmation emails, security alerts, or withdrawal notifications).
Right to Data Portability
Where we process your data by automated means on the basis of your consent or a contractual necessity, you have the right to receive a structured, machine-readable copy of your personal data that you can transfer to another service provider.
Data Security Measures
tbajj employs a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme encompasses technical controls, organisational procedures, and ongoing staff training. Key measures in place include:
- 256-bit SSL/TLS Encryption: All data transmitted between your browser or app and the tbajj platform is encrypted in transit using TLS 1.2 or higher.
- Password Hashing: Account passwords are never stored in plain text. We apply a one-way adaptive hashing algorithm (bcrypt) so that passwords cannot be recovered even in the event of a data breach.
- Payment Tokenisation: Card payment details are tokenised by our PCI-compliant payment processor. tbajj does not store full card numbers, CVV codes, or expiry dates on our own servers.
- Access Controls: Access to personal data within tbajj's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
- Two-Factor Authentication (2FA): Internal staff accounts with access to player data require 2FA. We also strongly recommend (and may require) that players enable 2FA on their tbajj accounts.
- Penetration Testing: tbajj engages independent security specialists to conduct periodic penetration testing of our platform infrastructure. Identified vulnerabilities are remediated in accordance with our security patching SLA.
- Data Breach Response: In the event of a data breach that is likely to result in a risk to the rights and freedoms of individual players, tbajj will notify affected players via their registered email address without undue delay. We will describe the nature of the breach, the categories of data affected, and the steps we are taking in response.
While tbajj takes all reasonable and appropriate steps to protect your personal data, no internet-based platform can guarantee absolute security. Players are encouraged to use a strong, unique password for their tbajj account, to enable two-factor authentication, and to contact support immediately at [email protected] if they suspect any unauthorised activity on their account.
This Privacy Policy may be updated from time to time to reflect changes in our data practices, legal obligations, or platform features. The current version will always be published at tbajj.net/privacy-policy with the effective date clearly displayed at the top. Continued use of the platform following publication of an updated policy constitutes your acceptance of the revised terms. If you have any questions about this Privacy Policy or your personal data, contact our support team at [email protected].