tbabaji Privacy
Policy

Data Controller Information

For the purposes of this Privacy Policy, the data controller responsible for the personal information collected through the tbabaji platform is tbabaji ("we", "us", "our"). The tbabaji platform operates at https://tbabaji.net and is the primary point of contact for all privacy-related matters relating to players based in Bangladesh and other supported markets.

As the data controller, tbabaji determines the purposes for which personal data is collected and the means by which that data is processed. We are responsible for ensuring that all data processing activities carried out under this Privacy Policy comply with applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

If you have any questions, concerns, or requests relating to your personal data, or if you wish to exercise any of the rights described in this Policy, you may contact the tbabaji privacy team at any time. Our support team is available 24/7 via live chat from your account dashboard. For written privacy enquiries, use the email address provided at the end of this document — please note that the email address is displayed as plain text and is not a clickable link.

Personal Data We Collect

tbabaji collects personal data from players through several means: directly from you when you register an account or update your profile, automatically when you use the platform, and in limited cases from third-party sources such as payment processors and identity verification services. The categories of personal data we collect are described below.

Account Registration Data

When you create a tbabaji account, we collect the following information:

• Full legal name as it appears on your official identification document.
• Date of birth (used for mandatory age verification — players must be 18 or older).
• Residential address, including district, division, and postal code within Bangladesh.
• Bangladeshi mobile phone number (used for account authentication and payment processing via bKash, Nagad, Rocket, or Upay).
• Email address (used for account communications, password recovery, and promotional notifications where opted in).
• Chosen username and encrypted password credentials.

Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, which is required before processing withdrawals and for ongoing account verification, we may collect:

• Scanned or photographed copies of your Bangladesh National Identity Card (NID), passport, or other government-issued photo identification.
• Proof of address documents such as recent utility bills, bank statements, or official correspondence addressed to your registered address.
• Photographs or scans of payment instruments (e.g., the registered bKash or Nagad account number associated with your deposits), used solely for anti-money-laundering (AML) compliance purposes.
• A live selfie or identity photo, in cases where enhanced verification is required.

Financial Transaction Data

Each time you make a deposit or request a withdrawal on the tbabaji platform, we record transaction-level data including the payment method used (e.g., bKash, Nagad, Rocket, Visa, Mastercard, BRAC Bank), the transaction amount in Bangladeshi Taka (৳ BDT), the date and time of the transaction, and the transaction reference number issued by the payment processor. This data is retained for regulatory compliance and fraud-prevention purposes.

Usage and Behavioural Data

When you interact with the tbabaji platform — whether browsing game categories, placing cricket bets, or playing slots — we automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location (city-level, not GPS-level).
• Device type, operating system, browser type, and browser version.
• Pages visited, game sessions initiated, duration of play, and betting history.
• Clickstream data showing navigation paths through the tbabaji platform.
• Session timestamps in Bangladesh Standard Time (BST, UTC+6).

How We Use Your Data

tbabaji processes your personal data only for specific, legitimate purposes. We do not sell your personal data to third parties for their own commercial use under any circumstances. The lawful bases and purposes for which we use your data are set out below.

Account Management and Service Delivery

The primary purpose for which we process your personal data is to provide and maintain your tbabaji account and to deliver the services you have requested — including facilitating deposits and withdrawals in Bangladeshi Taka (৳ BDT), providing access to cricket betting markets, casino games, slots, and live dealer tables, and managing bonus offers applied to your account.

Regulatory Compliance and Legal Obligations

tbabaji is required by applicable law and by the terms of its operating obligations to carry out identity verification (KYC), to monitor transactions for anti-money-laundering (AML) compliance, and to maintain accurate records of all financial activity on the platform. We process your identity and financial data for these purposes on the basis of legal obligation. In certain circumstances we may be required to share data with law enforcement or regulatory authorities pursuant to a lawful request — see Section 4 (Data Sharing) for further details.

Fraud Prevention and Platform Security

We use technical and behavioural data — including IP addresses, device fingerprints, and session patterns — to detect and prevent fraudulent activity, multi-accounting, bot usage, and other prohibited conduct as defined in our Terms & Conditions. This processing is carried out on the basis of our legitimate interests in maintaining a secure and fair platform for all players.

Responsible Gaming Monitoring

tbabaji takes responsible gaming seriously. We analyse account usage data to identify patterns that may indicate problematic gambling behaviour, such as rapidly escalating deposit frequency, extended uninterrupted play sessions, or repeated self-exclusion requests followed by early reinstatement attempts. Where such patterns are identified, we may proactively contact you to offer responsible gaming tools or, in serious cases, apply a temporary account restriction. This processing is carried out on the basis of our legitimate interests and our duty of care to players.

Marketing Communications

With your explicit prior consent, we may use your contact data (email address and/or mobile number) to send you information about tbabaji promotions, bonuses, seasonal offers, and new game launches. You may withdraw your consent to marketing communications at any time by updating your preferences in Account Settings or by contacting the support team. Withdrawing marketing consent will not affect the lawfulness of any processing carried out before the withdrawal.

Data Sharing & Third Parties

tbabaji does not sell, rent, or trade your personal data with third parties for their own marketing or commercial purposes. We may, however, share your personal data with carefully selected third-party service providers and in the limited circumstances described below. In all cases, data sharing is subject to strict contractual obligations requiring the recipient to protect your data with security standards equivalent to those applied by tbabaji itself.

Payment Processors

To facilitate deposits and withdrawals in Bangladeshi Taka (৳ BDT), tbabaji works with payment processors and mobile financial service providers including bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and international card networks (Visa, Mastercard). We share only the financial transaction data strictly necessary to process the relevant payment. Payment processors operate under their own privacy policies and terms of service, which we encourage you to review.

Game Providers

Game studios and software providers whose games are available on the tbabaji platform — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and Play'n GO — may receive anonymised or pseudonymised session data necessary to deliver their games and to verify game integrity. These providers do not receive your full personal identity profile and are contractually prohibited from using any data received from tbabaji for purposes beyond service delivery.

Identity Verification Services

To fulfill our KYC and age-verification obligations, tbabaji may share document images and personal identity data with third-party identity verification providers. These providers process your data solely for the purpose of verifying your identity and returning a verification result to tbabaji. Document images are not stored by tbabaji beyond the retention period described in Section 6.

Law Enforcement and Regulatory Authorities

tbabaji may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required by applicable law, a court order, or a lawful official request. We will, where legally permitted, notify you of any such disclosure. tbabaji may also proactively report suspicious transaction patterns to relevant authorities as part of its AML compliance obligations, without prior notice to the account holder where disclosure of such notice could compromise an investigation.

Analytics and Platform Improvement

We may use third-party analytics services to help us understand how players use the tbabaji platform, identify technical issues, and improve the overall user experience. Data shared with analytics providers is aggregated or pseudonymised wherever possible and is never used to identify individual players for marketing purposes by those providers.

Cookies & Tracking Technologies

tbabaji uses cookies and similar tracking technologies — including local storage objects, session tokens, and pixel tags — to operate the platform effectively, remember your preferences, keep your session secure, and improve your experience across visits. This section explains what cookies we use, why we use them, and the choices available to you.

Types of Cookies Used

Managing Your Cookie Preferences

Strictly necessary cookies cannot be disabled as they are essential to the operation of the tbabaji platform. For all other cookie categories, you may update your preferences at any time via your browser settings. Most modern browsers allow you to block, delete, or receive warnings before cookies are set. Please note that disabling functional or analytics cookies may affect certain features of the tbabaji platform, such as personalised game recommendations or session continuity across devices.

Mobile players accessing tbabaji via a browser on Android or iOS devices may manage cookie preferences through their mobile browser settings. Clearing cookies from your mobile browser will log you out of any active tbabaji session.

Data Retention

tbabaji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The specific retention periods applied to different categories of personal data are outlined below.

• Account and identity data — retained for the duration of your account plus a minimum of 5 years following account closure, in compliance with financial record-keeping obligations applicable to online gaming platforms.
• KYC documents (NID copies, address proof) — retained for a minimum of 5 years following the completion of the verification process or the closure of the account, whichever is later.
• Financial transaction records — retained for a minimum of 5 years from the date of the relevant transaction, in accordance with AML record-keeping requirements.
• Betting and gaming history — retained for the duration of your account plus 3 years following account closure, to support responsible gaming monitoring and dispute resolution.
• Marketing preferences and consent records — retained for the duration of any active marketing relationship plus 3 years, to provide evidence of consent in the event of a complaint.
• Technical and usage data (IP logs, session data) — retained for up to 24 months from the date of collection, after which they are permanently deleted or irreversibly anonymised.
• Support and communication records — retained for 3 years following the resolution of the relevant support interaction.

When personal data is no longer required for any of the purposes described above, tbabaji will permanently delete or irreversibly anonymise it using industry-standard data sanitisation procedures. Where data has been shared with a third-party processor, tbabaji will instruct that processor to delete or anonymise the data in accordance with the applicable retention schedule.

Your Rights & Choices

tbabaji respects your rights in relation to your personal data. The rights available to you as a tbabaji player are described below. To exercise any of these rights, please contact the tbabaji support team via live chat in your account dashboard or by email at the address listed at the end of this document. We will respond to all verified rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data that tbabaji holds about you. We will provide this in a clear, structured format within 30 days of your verified request.
• Right to Rectification: If any personal data tbabaji holds about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure: Subject to our legal retention obligations (see Section 6), you may request the deletion of your personal data. Please note that data required for AML compliance, fraud prevention, or ongoing legal proceedings may be retained notwithstanding an erasure request.
• Right to Restrict Processing: You may request that tbabaji restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of the data is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you may request that we provide your personal data in a structured, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on tbabaji's legitimate interests. We will comply with your objection unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time via Account Settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right Not to be Subject to Automated Decision-Making: tbabaji may use automated processes to detect fraud or verify age. Where such processing produces decisions that significantly affect you, you have the right to request human review of the decision.

Data Security

tbabaji implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures are reviewed and updated on a regular basis to reflect the current threat landscape and industry best practice.

Technical Safeguards

• 256-bit SSL/TLS encryption on all connections between your browser or mobile device and the tbabaji platform, preventing interception of data in transit.
• At-rest encryption for all database records containing personal, financial, and identity data, using AES-256 encryption standards.
• Multi-factor authentication (MFA) options available to all registered players to protect against unauthorised account access.
• Web Application Firewall (WAF) and intrusion detection systems operating continuously to identify and block malicious traffic patterns.
• Regular independent penetration testing of the tbabaji platform to identify and remediate security vulnerabilities before they can be exploited.
• Strict access controls ensuring that personal data is accessible only to tbabaji personnel and contractors who genuinely require it to perform their job functions, on a principle-of-least-privilege basis.

Organisational Safeguards

• All tbabaji staff and contractors with access to personal data are required to complete data protection training and are bound by confidentiality obligations.
• A documented data breach response plan is in place, enabling tbabaji to identify, contain, and report any personal data breach promptly.
• Third-party service providers who process personal data on behalf of tbabaji are required to demonstrate equivalent security standards as a condition of engagement.

Despite these measures, no internet-based platform can guarantee absolute security. In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, tbabaji will notify affected players without undue delay and will take all reasonable steps to mitigate the impact of the breach.

Children & Minors

The tbabaji platform is strictly an adult service. It is not directed at, designed for, or intended to be used by any person under the age of 18. tbabaji takes its obligations regarding the protection of minors extremely seriously and has implemented multiple layers of age verification to prevent underage access to the platform.

During account registration, all players are required to declare that they are aged 18 or above and to provide a date of birth. This declaration is followed by our KYC age verification process, in which players must submit a valid government-issued identity document — such as a Bangladesh National Identity Card (NID) — confirming their date of birth. Accounts are placed in a restricted state until age verification is successfully completed.

tbabaji does not knowingly collect, store, or process any personal data relating to individuals under the age of 18. If we discover or have reasonable grounds to believe that an account has been registered by or on behalf of a person under 18, we will immediately suspend the account, void any transactions associated with it, and permanently delete the personal data collected in connection with that account, except where retention is required for fraud investigation or legal compliance purposes.

If you are a parent or guardian and believe that a minor in your care has registered an account on tbabaji, please contact our support team immediately via live chat in your account dashboard. We will prioritise the investigation and closure of any such account and will cooperate fully with any associated safeguarding enquiry.

Policy Updates

tbabaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulation, or changes to the services we offer. When we make material changes to this Policy, we will notify registered players by posting a prominent notice on the tbabaji platform and, where appropriate, by sending a notification to your registered email address at least 14 days before the changes take effect.

The "Last updated" date at the top of this Policy indicates when the most recent version was published. We encourage you to review this Policy periodically to stay informed about how tbabaji protects your personal data. The version of the Policy in force at the time of any given data processing activity is the version that applies to that activity.

If you disagree with any changes made to this Privacy Policy, you have the right to close your tbabaji account and request the deletion of your personal data, subject to the mandatory retention obligations described in Section 6. Continued use of the tbabaji platform after any updated Policy comes into effect constitutes your acceptance of the revised terms.

For a summary of changes between versions, or to request a copy of a previous version of this Privacy Policy, please contact the tbabaji support team via live chat in your account dashboard. All historical versions of this Policy are retained on file and are available upon request.