tbaej Privacy Policy

Privacy at a Glance

1. Introduction

tbaej (referred to in this policy as "we", "us" or "our") is committed to protecting the privacy and personal data of every player who uses our Platform. We recognise that our players entrust us with sensitive financial and personal information, and we take that responsibility seriously. This policy sets out the legal basis on which we process your data, the purposes for which it is used, the circumstances under which it may be disclosed, and the controls available to you.

This policy should be read together with tbaej's Terms and Conditions, which also form part of the agreement between you and tbaej. If you do not agree with any part of this Privacy Policy, please discontinue your use of the Platform and contact support to request account closure.

2. Information We Collect

We collect personal data in three principal ways: information you provide directly when registering or using the Platform, information generated automatically by your use of the Platform, and information received from third-party partners such as payment processors and identity verification services. The following table summarises the main categories of data we collect:

Sensitive Data

tbaej does not intentionally collect sensitive categories of personal data such as racial origin, religious beliefs, health data or biometric data unless expressly required for identity verification under applicable anti-money-laundering regulations. Where such data is incidentally included in KYC documents (for example, a national ID card that displays religion), it is processed only for the purpose of identity verification and is not used for any other purpose.

3. How We Use Your Information

We use the personal data we collect only for the specific purposes described in this policy. We do not use your data for purposes that are incompatible with those for which it was originally collected without first obtaining your explicit consent. The primary purposes for which we process your data are:

• Account creation, verification and management — processing your registration details, verifying your age and identity, maintaining your account profile and managing your preferences.
• Processing deposits and withdrawals — verifying payment method ownership, processing transactions via bKash, Nagad and Rocket, preventing fraudulent transactions and maintaining financial records as required by law.
• Delivering gaming services — providing access to cricket betting, live casino, slots, crash games, fishing arcade and other games on the Platform; settling bets and crediting winnings to your account.
• Responsible gaming compliance — monitoring gaming patterns to identify at-risk behaviour, applying deposit limits or cooling-off periods, fulfilling self-exclusion requests and complying with responsible gaming obligations.
• Fraud prevention and security — detecting and preventing fraudulent account activity, money laundering, bonus abuse, collusion and other prohibited conduct; conducting KYC and anti-money-laundering checks.
• Customer support — responding to queries, complaints and requests submitted through the support channel at [email protected]; maintaining records of support interactions to improve service quality.
• Marketing communications (with consent only) — sending you information about promotions, bonuses and seasonal offers relevant to your account where you have given explicit consent to receive such communications. You may opt out at any time.

We apply the principle of data minimisation: we collect and process only the minimum amount of personal data necessary to fulfil each stated purpose. Data that is no longer needed for the purpose for which it was collected is deleted or anonymised in accordance with our retention schedule set out in Section 9.

4. Legal Basis for Processing

We process your personal data only where we have a lawful basis for doing so. Depending on the processing activity, we rely on one or more of the following legal bases:

• Contractual necessity — processing required to fulfil our obligations under the account registration agreement and the Terms and Conditions, including account management, game delivery, payment processing and customer support.
• Legal obligation — processing required to comply with applicable laws and regulations, including anti-money-laundering requirements, age verification obligations and data subject access request procedures.
• Legitimate interests — processing for fraud detection, platform security, responsible gaming monitoring and improvement of our services, provided those interests are not overridden by your data protection rights.
• Consent — where you have given us explicit consent to process your data for a specific purpose (such as sending promotional communications), we rely on that consent as the legal basis. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Sharing Your Information

tbaej does not sell your personal data. We may share your personal data with third parties only in the limited circumstances described below:

• Payment service providers — we share the minimum necessary financial data with payment processors (bKash, Nagad, Rocket and Upay) solely for the purpose of processing deposits and withdrawals on your behalf. These providers are bound by their own privacy obligations and are not permitted to use your data for any other purpose.
• Identity verification and KYC providers — where required to meet our age-verification and anti-money-laundering obligations, we may share identity documents and related data with accredited KYC service providers. These providers operate under strict confidentiality and data protection agreements with tbaej.
• Regulatory and law enforcement authorities — we may disclose personal data to competent authorities (including financial intelligence units, gaming regulators or law enforcement agencies) where required to do so by applicable law, court order or regulatory obligation, without prior notice to you where legally prohibited from doing so.
• Service providers acting as data processors — we engage certain third-party technology and analytics providers who process data strictly on our behalf under binding data processing agreements. These providers have no independent right to use your data and are required to maintain the same level of data security that tbaej applies.

6. Payment Data and Financial Information

When you deposit or withdraw funds using bKash, Nagad, Rocket or Upay, tbaej records the mobile wallet number, transaction reference and amount for the purposes of reconciliation, fraud prevention and regulatory compliance. We do not store full wallet PINs, one-time passwords (OTPs) or any credential that could be used to access your mobile financial account. The mobile number registered to your payment method is stored in encrypted form and is used solely to verify that deposits and withdrawals are made to and from your own account.

All financial records are retained for a minimum of five years from the date of the relevant transaction to comply with applicable financial record-keeping requirements. After the retention period has elapsed, financial records are securely deleted or anonymised such that they can no longer be linked to an individual player.

7. Cookies and Tracking Technologies

tbaej uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences and analyse how players use our services. A cookie is a small text file placed on your device when you visit the Platform. We do not use cookies to collect sensitive personal data or to track your activity across unrelated third-party websites.

Types of Cookies We Use

• Strictly necessary cookies — required for the Platform to function correctly. They enable login session management, security token validation and payment flow completion. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies — used to remember your preferences (such as language selection) and personalise your experience on return visits. These cookies do not track you across other websites.
• Analytics cookies — used to collect aggregated, anonymised data about how players navigate the Platform, which games are most popular and where technical errors occur. This data helps us improve the quality and performance of tbaej.
• Session security cookies — short-lived cookies that expire when you close your browser, used to protect your session against cross-site request forgery (CSRF) attacks and other session-hijacking techniques.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. tbaej does not currently respond to browser Do Not Track (DNT) signals because no industry-wide standard for DNT compliance has been adopted.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention periods are as follows: active account data is retained for the lifetime of the account plus a post-closure period of five years to meet financial record-keeping and anti-money-laundering requirements; KYC documentation is retained for five years from the date of account closure; marketing consent records are retained until consent is withdrawn plus one additional year; server and access logs are retained for 90 days.

When data reaches the end of its retention period, we securely delete it from our systems or, where deletion is technically impractical in the short term, anonymise it so that it can no longer be associated with any individual. Where a legal hold is placed on specific data (for example, as part of an ongoing fraud investigation), the relevant data will be retained until the hold is lifted.

9. Security Measures

tbaej implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include: SSL/TLS encryption for all data in transit; encryption of sensitive data fields (including payment account numbers) at rest; access controls limiting data access to authorised personnel on a need-to-know basis; regular security assessments and vulnerability testing of Platform infrastructure; and incident response procedures designed to contain and report data security incidents in a timely manner.

While we take all reasonable steps to secure your data, no internet-based service can guarantee absolute security. In the event of a data security incident that is likely to result in a high risk to your rights and freedoms, we will notify you as soon as practicable using the contact details registered to your account. You should ensure that the mobile number and email address on your tbaej account are kept current so that you can receive security alerts promptly.

10. Your Rights Over Your Data

As a player whose data is processed by tbaej, you have a number of rights in relation to your personal data. You may exercise any of these rights at any time by contacting us at [email protected]. We will respond to all legitimate requests within 30 days. Requests that are manifestly unfounded or excessive may be subject to a reasonable processing fee or may be refused, in which case we will explain our reasons.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered mobile number and full name so we can verify your identity before processing the request.

11. Children's Privacy

tbaej is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will delete that data immediately and close the associated account. Parents or guardians who believe that a minor has registered on tbaej should contact us immediately at [email protected] so that we can take prompt action. We apply age verification controls at registration and may request documentary proof of age at any stage of the account lifecycle.

12. Third-Party Links

The tbaej Platform does not contain links to external third-party websites. Where references are made to payment providers (bKash, Nagad, Rocket) or game software providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi), those references are informational only. tbaej has no responsibility for the privacy practices or data handling of any external organisation. If you independently access the website of any third party mentioned in connection with tbaej services, you should review that organisation's own privacy policy.

13. Changes to This Privacy Policy

tbaej reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or regulatory requirements. When material changes are made, we will notify active players via the mobile number or email address registered to their account, or by displaying a prominent notice on the Platform.

The date at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically. Your continued use of the Platform following notification of a material change constitutes your acceptance of the updated policy.

14. Contact and Data Controller

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how your personal data has been handled, please contact tbaej's support team. We will acknowledge your request within 5 business days and provide a full response within 30 days.

Email: [email protected]