tbajj Privacy Policy — How We Collect, Use, and Safeguard Your Personal Information

This Privacy Policy ("Policy") describes how tbajj ("tbajj", "we", "us", "our") collects, stores, processes, and shares personal information relating to individuals who access or use the tbajj online betting and casino platform, accessible at tbajj.io and any associated sub-domains, mobile interfaces, or branded applications ("Platform").

This Policy applies to all current and prospective registered account holders, visitors to the tbajj website who have not yet registered, and any individual whose personal data is processed by tbajj in the course of providing the Platform's services. It applies regardless of the device or browser used to access the Platform and regardless of the geographic location from which the Platform is accessed, subject always to applicable local law.

This Privacy Policy should be read alongside the tbajj Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference into the overarching agreement between you and tbajj.

This Policy is written in plain English and is intended to be fully understandable to a general audience. Where technical or legal terminology is necessary, we have provided explanations in context. If any part of this Policy is unclear, you are encouraged to contact us at [email protected] before using the Platform.

For the purposes of this Privacy Policy, tbajj acts as the data controller in respect of all personal data collected and processed in connection with the operation of the Platform. As data controller, tbajj determines the purposes for which personal data is processed and the means by which that processing is carried out.

tbajj operates as an offshore online betting and gaming entity. All enquiries relating to data protection, privacy rights, and this Privacy Policy should be directed to the tbajj Data Protection contact point:

• Email: [email protected]
• Subject Line: "DATA PROTECTION ENQUIRY" for prioritised routing to the data protection team
• Response Time: tbajj aims to acknowledge all data protection enquiries within 48 hours (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days

Where tbajj engages third-party processors — such as payment service providers and identity verification agencies — those processors act under contractual instruction from tbajj and are bound by data processing agreements that impose obligations consistent with this Policy.

tbajj collects personal data across several categories, each of which is described below. We collect only the minimum data required for the stated purpose.

tbajj does not collect sensitive personal data such as biometric data, racial or ethnic origin data, religious beliefs, health records, or political opinions, except where required by applicable anti-money-laundering regulations or by a competent legal authority.

tbajj collects personal data through the following channels and mechanisms:

• Direct Provision by You: When you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact customer support, respond to a survey, or participate in a promotion, you directly provide personal data to tbajj.
• Automated Technical Collection: When you visit the tbajj website or use the Platform, our servers automatically log technical data including your IP address, browser user-agent string, device identifiers, pages visited, time on page, and interaction events. This data is collected via server logs, session cookies, and analytics scripts operated solely by tbajj.
• Payment Processors: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, Visa, Mastercard, or a participating Bangladeshi bank, the payment processor shares transaction confirmation data with tbajj, including the transaction reference number, amount, and masked account identifier.
• Identity Verification Providers: Where tbajj uses a third-party KYC verification service to assist with identity document checking, that provider may return a verification result and confidence score to tbajj. tbajj does not receive raw biometric data from third-party KYC providers.
• Fraud Detection and Risk Systems: tbajj's fraud prevention infrastructure may cross-reference data points across multiple sessions and accounts for the purpose of detecting prohibited conduct as defined in the Terms & Conditions. This involves automated analysis of betting patterns, device fingerprints, and login behaviour.

tbajj processes personal data on the following legal bases, depending on the purpose of the processing activity:

• Contractual Necessity: The majority of personal data processing by tbajj is necessary for the performance of the contract between tbajj and the account holder — specifically, the Terms & Conditions agreed to at the time of registration. This includes processing your identity data to open your account, your financial data to process transactions, and your gaming activity data to settle bets and apply bonuses correctly.
• Legal Obligation: tbajj is required to collect, retain, and in some cases disclose certain categories of personal data in order to comply with applicable anti-money-laundering (AML) regulations, counter-terrorism financing (CTF) obligations, and requests from competent legal authorities. Processing carried out under this basis is not subject to opt-out.
• Legitimate Interests: tbajj processes certain technical and behavioural data under the legal basis of legitimate interests — specifically, to protect the security and integrity of the Platform, to detect and prevent fraud and prohibited conduct, and to improve the Platform's functionality and user experience. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your fundamental rights and freedoms.
• Consent: Where tbajj processes personal data for optional marketing communications — such as promotional emails or SMS notifications about bonuses, new games, or seasonal offers — we will do so only on the basis of your freely given, specific, and informed consent. You may withdraw marketing consent at any time by contacting [email protected] or by using the unsubscribe mechanism in any marketing communication.

The personal data collected by tbajj is used for the following purposes:

• Account Creation and Management: To open, maintain, and administer your tbajj account, including verifying your identity, managing your account balance, applying bonus credits, and recording your gaming history.
• Transaction Processing: To process your deposit and withdrawal requests via your chosen payment method, to reconcile transactions, and to issue refunds or reversals where applicable.
• KYC and AML Compliance: To verify your identity and age in accordance with our KYC procedures; to monitor your account for suspicious financial activity consistent with money laundering, terrorist financing, or fraud; and to report such activity to relevant authorities where required by law.
• Responsible Gaming: To administer the responsible gaming tools you have activated on your account, including deposit limits, session timers, cooling-off periods, and self-exclusion. Your gaming activity data is also analysed to identify indicators of problem gambling behaviour, in order to allow tbajj to intervene with appropriate support resources.
• Customer Support: To respond to your support enquiries, process complaints and disputes, and maintain records of communications for quality assurance and dispute resolution purposes.
• Platform Security and Fraud Prevention: To detect and investigate prohibited conduct including collusion, match-fixing, bonus abuse, use of automated bots, and identity fraud. To protect the integrity of the Platform and the fairness of the gaming environment for all players.
• Service Improvement: To analyse aggregate, anonymised usage data in order to improve Platform performance, game offering, payment method options, and user experience. Individual player data is anonymised before being used for this purpose.
• Marketing Communications (Consent-Based Only): To send you promotional offers, bonus notifications, new game announcements, and seasonal promotions via email or SMS, where you have provided explicit consent to receive such communications. You may opt out at any time.

tbajj does not sell, rent, or commercially transfer your personal data to any third party. Personal data is shared with external parties only in the following strictly defined circumstances:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, and Mastercard receive the minimum personal and financial data necessary to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are regulated by the relevant financial authorities in Bangladesh and internationally.
• Identity Verification Providers: Where tbajj engages a third-party KYC or AML screening service, your identity documents and personal details are shared with that provider solely for the purpose of completing the verification check. Verification providers are contractually bound to use your data only for the verification purpose and to delete it upon completion of the check, subject to their own legal retention obligations.
• Game Technology Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive your session token and anonymised player ID to facilitate your gameplay. These providers do not receive your full identity, contact, or financial data.
• Legal and Regulatory Authorities: tbajj may disclose personal data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, by a court order, or in response to a legally valid demand. tbajj will notify the affected account holder of such a disclosure where permitted by law to do so.
• Business Successors: In the event of a merger, acquisition, restructuring, or sale of substantially all of tbajj's assets, personal data held by tbajj may be transferred to the acquiring or successor entity. Affected account holders will be notified of such a transfer with reasonable advance notice.

tbajj retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

Where you submit a data deletion request under Clause 11, tbajj will delete your personal data to the extent permitted by law. Data that must be retained to comply with AML, financial record-keeping, or other legal obligations cannot be deleted upon request and will be retained for the legally mandated period notwithstanding your request.

The tbajj Platform uses cookies and similar tracking technologies to maintain session integrity, remember your preferences, and analyse aggregate Platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They maintain your login session, preserve your account balance display, remember your responsible gaming settings, and protect the Platform against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without rendering the Platform non-functional.
• Preference Cookies: These cookies remember your Platform preferences, such as your chosen language, display settings, and last-visited game category. They are set only once you have made a preference selection. Disabling these cookies means the Platform will not remember your preferences between sessions.
• Analytics Cookies: tbajj uses first-party analytics cookies to collect anonymised, aggregated data about how the Platform is used — including which pages are visited most frequently, how long sessions last, and which device types are used. This data is used solely to improve Platform performance and is not shared with third-party advertising networks.

tbajj does not use third-party advertising cookies, retargeting cookies, or cross-site behavioural tracking technologies. The tbajj Platform does not integrate advertising networks, social media trackers, or affiliate tracking pixels from external parties.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Please note that blocking strictly necessary cookies will prevent you from logging in to your tbajj account. Detailed instructions for managing cookies are available in the help documentation of your specific browser.

tbajj maintains a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption at Rest: All personal data stored on tbajj servers — including identity records, financial data, gaming history, and KYC documents — is encrypted at rest using AES-256 encryption with key management practices that restrict decryption access to authorised systems only.
• Encryption in Transit: All data transmitted between your device and tbajj servers is encrypted using 256-bit TLS 1.3 (Transport Layer Security). The tbajj website enforces HTTPS on all pages and sub-domains. HTTP connections are automatically redirected to HTTPS.
• Access Controls: Access to personal data within tbajj's internal systems is restricted on a strict role-based, need-to-know basis. Customer-facing support staff have access only to the data fields necessary to resolve your specific query. Administrative access to databases containing personal data is multi-factor authenticated and subject to comprehensive audit logging.
• Intrusion Detection and Monitoring: tbajj operates continuous network intrusion detection, server health monitoring, and automated anomaly alerting across all production infrastructure. Any suspected security incident triggers an immediate internal response procedure.
• Penetration Testing: tbajj engages independent security professionals to conduct regular penetration tests of the Platform's infrastructure, application layer, and API endpoints. Identified vulnerabilities are remediated on a risk-prioritised basis.
• Employee Data Handling Training: All tbajj personnel with access to personal data receive mandatory data protection and information security training upon onboarding and annually thereafter.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, tbajj will notify affected account holders without undue delay, describing the nature of the breach, the categories of data involved, the likely consequences, and the measures taken or proposed to address it.

Subject to applicable law and the limitations described in this Policy, you hold the following rights in respect of the personal data that tbajj holds about you:

• Right of Access: You have the right to request a copy of all personal data that tbajj holds about you. tbajj will provide this in a commonly used electronic format within 30 days of receiving a valid access request.
• Right to Rectification: You have the right to request that any inaccurate or incomplete personal data held by tbajj is corrected. Simple corrections to contact data (email address, phone number, residential address) can be made directly from the account settings panel. Corrections to identity data (name, date of birth) require submission of supporting documentary evidence.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (for consent-based processing), or where processing is unlawful. tbajj will fulfil erasure requests to the fullest extent permitted by law. Data subject to AML, financial record-keeping, or other legal retention obligations cannot be erased until the applicable retention period has expired.
• Right to Restriction of Processing: You have the right to request that tbajj restricts its processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing and tbajj is assessing the grounds for that objection.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have that data transmitted directly to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where tbajj is relying on legitimate interests as the legal basis for that processing. tbajj will assess your objection and cease processing unless tbajj can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent — in particular, the sending of marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw marketing consent, email [email protected] with the subject line "WITHDRAW MARKETING CONSENT" or use the unsubscribe link in any marketing communication sent by tbajj.

To exercise any of the rights listed above, submit a written request to [email protected] with the subject line "DATA RIGHTS REQUEST". Please include your full name, registered email address, and account username so that tbajj can verify your identity before processing the request. tbajj will not fulfil data rights requests from unverified individuals, as doing so could result in the disclosure of personal data to an unauthorised party.

The tbajj Platform is strictly intended for adults aged 21 years and above. tbajj does not knowingly collect, process, or retain personal data belonging to any individual under the age of 21.

During the registration process, tbajj requires all applicants to confirm that they are 21 years of age or older. Where tbajj's KYC procedures reveal that a registered account holder is under the age of 21, that account will be immediately suspended pending investigation, all pending transactions will be frozen, any winnings derived from bets placed while under-age will be voided, and deposited funds will be returned to the original payment method used for the deposit after verification of ownership.

If you are a parent or guardian and believe that a minor under your care has registered an account on the tbajj Platform or has otherwise provided personal data to tbajj, please contact us immediately at [email protected] with the subject line "MINOR ACCOUNT REPORT". tbajj will investigate the report promptly and will take all necessary steps to close the account and delete the associated personal data in accordance with applicable law.

tbajj strongly recommends the use of parental control software to prevent minors from accessing online gambling platforms. A 21+ age restriction is displayed prominently across the tbajj Platform and in all marketing materials.

tbajj operates as an offshore entity and its server infrastructure may be located in one or more jurisdictions outside of Bangladesh. As a result, personal data that you provide to tbajj may be transferred to, stored in, and processed in a country other than your country of residence.

Where personal data is transferred internationally, tbajj takes appropriate safeguards to ensure that your data continues to receive a level of protection consistent with the principles set out in this Privacy Policy. These safeguards include:

• Entering into contractual data processing agreements with all third-party processors that impose data protection obligations consistent with those described in this Policy, regardless of the jurisdiction in which those processors operate.
• Ensuring that data centres and hosting providers used by tbajj maintain internationally recognised security certifications, including ISO/IEC 27001 information security management standards where applicable.
• Applying end-to-end encryption to all personal data during transmission across jurisdictional boundaries, so that data cannot be read in transit by any intermediary.

By using the tbajj Platform, you acknowledge and consent to the transfer of your personal data to tbajj's infrastructure and processors as described in this clause. If you do not consent to international data transfers, you should not use the tbajj Platform.

tbajj reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, changes in tbajj's data processing practices, changes in the services offered through the Platform, or improvements in our data protection standards.

When material changes are made to this Privacy Policy — that is, changes that materially affect your rights, the categories of data collected, or the purposes for which data is used — tbajj will notify registered account holders by email to the registered email address on record and will display a prominent notice on the Platform for a minimum of 7 days prior to the revised Policy taking effect.

The "Last Updated" date displayed at the top of this document and in the hero section of this page indicates when the most recent revision was made. The most current version of this Privacy Policy is always accessible at tbajj.io/privacy-policy.

Your continued use of the tbajj Platform following the publication of a revised Privacy Policy constitutes your acceptance of that revised Policy. If you do not agree to the terms of a revised Privacy Policy, you must stop using the Platform and may request account closure by contacting [email protected].

Minor amendments — such as corrections to typographical errors, clarifications that do not materially alter your rights or tbajj's obligations, or updates required solely to reflect changes in applicable law — may be made without individual advance notice and will take effect immediately upon publication on the Platform.

All enquiries, requests, and complaints relating to this Privacy Policy or to tbajj's handling of your personal data should be directed to the tbajj data protection team using the contact details below. tbajj provides 24/7 customer support in English and Bengali to all registered account holders.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line Guidance:
  • Data access requests: "DATA RIGHTS REQUEST"
  • Data deletion requests: "DATA RIGHTS REQUEST — ERASURE"
  • Marketing opt-out: "WITHDRAW MARKETING CONSENT"
  • Minor account reports: "MINOR ACCOUNT REPORT"
  • General privacy enquiries: "DATA PROTECTION ENQUIRY"
• Response Time: Acknowledgement within 48 hours; full response within 30 calendar days (Bangladesh Standard Time, UTC+6)
• Support Availability: 24 hours a day, 7 days a week, including Bangladesh public holidays

If you are not satisfied with tbajj's response to a privacy-related complaint, you may escalate your concern by replying to the original support email thread with the subject line "FORMAL PRIVACY COMPLAINT". The escalated complaint will be reviewed by a senior member of the data protection team, who will provide a final written response within 10 business days.