Privacy Policy — How tbaja Protects Your Data

1. Introduction

tbaja ("tbaja", "we", "us", "our") is committed to protecting the privacy and personal data of every individual who uses the tbaja platform, including registered account holders, visitors to tbaja.io, and any other person whose data we process in the course of operating our online betting and casino services (collectively, the "Platform").

This Privacy Policy ("Policy") describes in detail how tbaja collects, processes, stores, discloses, and protects personal data. It also explains the rights available to you in relation to that data and how to exercise those rights. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the tbaja Platform.

We review and update this Policy periodically to reflect changes in our data practices, applicable laws, or the services we offer. The "Last Updated" date at the top of this document indicates when the most recent revision was made. Material changes will be communicated to registered users via email.

2. Data Controller

For the purposes of this Privacy Policy, tbaja acts as the data controller in respect of all personal data processed through the Platform. This means tbaja determines the purposes and means of processing your personal data. As data controller, tbaja is responsible for ensuring that all processing activities comply with applicable data protection laws and the commitments set out in this Policy.

If you have any questions about how tbaja handles your personal data, or if you wish to exercise any of your data rights, you may contact our Data Protection Officer (DPO) using the contact details set out in Section 14 of this Policy.

3. Personal Data We Collect

tbaja collects personal data in several categories depending on how you interact with the Platform. The table below summarises the main data categories we process.

Data Category	Examples	When Collected
Identity Data	Full legal name, date of birth, nationality, NID or passport number	Account registration and KYC verification
Contact Data	Email address, mobile phone number, residential address	Account registration and profile updates
Financial Data	bKash/Nagad/Rocket mobile banking number, bank account details, transaction history	Deposit and withdrawal processing
Technical Data	IP address, device type, browser type, operating system, session duration	Automatically upon accessing the Platform
Usage Data	Games played, bets placed, betting history, bonus usage, login timestamps	Continuously during Platform use
Communications Data	Support chat transcripts, email correspondence, complaint records	When you contact tbaja support
Marketing Preferences	Opt-in/opt-out status, preferred communication channels	Registration and account settings

tbaja does not collect special category data (such as biometric data, health data, or religious beliefs) unless specifically required for responsible gaming interventions and with your explicit consent.

4. How We Collect Your Data

4.1 Data You Provide Directly

The majority of personal data we hold about you is data you provide directly when you create a tbaja account, complete our KYC identity verification process, make a deposit or withdrawal, contact our customer support team, participate in a promotion, or update your account settings.

4.2 Data Collected Automatically

When you access the tbaja Platform — whether on a desktop browser or mobile device — we automatically collect certain technical and usage data through server logs, cookies, and similar tracking technologies. This includes your IP address, the type and version of your browser, your operating system, the pages you visit on the Platform, the duration of your sessions, and your in-platform activity (games accessed, bets placed, features used). Please see Section 10 for full details on our use of cookies.

4.3 Data from Third Parties

In limited circumstances, tbaja may receive personal data about you from third parties, including identity verification providers who assist with our KYC process, payment processors who confirm the status of your financial transactions, and fraud prevention services who flag suspicious account activity patterns. Data received from third parties is handled with the same level of care as data you provide directly.

5. Purpose and Legal Basis for Processing

tbaja processes your personal data only where we have a valid legal basis for doing so. The table below sets out the purposes for which we process your data and the corresponding legal basis in each case.

Purpose of Processing	Legal Basis
Creating and managing your tbaja account	Performance of a contract
Processing deposits and withdrawals via bKash, Nagad, Rocket, and other payment methods	Performance of a contract
Verifying your identity and age (KYC) in compliance with anti-money laundering obligations	Legal obligation
Detecting and preventing fraud, cheating, and bonus abuse	Legitimate interests
Providing customer support and resolving disputes	Performance of a contract / Legitimate interests
Sending transactional communications (e.g., deposit confirmations, withdrawal status)	Performance of a contract
Sending promotional communications, bonus offers, and seasonal campaign updates	Consent (opt-in required)
Improving the Platform through analysis of usage patterns and feedback	Legitimate interests
Complying with applicable legal, regulatory, and tax obligations	Legal obligation
Responsible gaming monitoring (identifying at-risk gambling behaviour)	Legal obligation / Legitimate interests

Where tbaja relies on legitimate interests as its legal basis, we have carried out a balancing assessment to confirm that our legitimate interests are not overridden by your rights and interests. You may request a copy of that assessment by contacting our DPO.

6. Sharing Your Personal Data

6.1 Service Providers

tbaja engages a limited number of third-party service providers who process personal data on our behalf as data processors. These include payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard), identity verification providers, IT infrastructure and cloud hosting providers, customer support platform operators, and fraud detection services. All service providers are bound by data processing agreements that prohibit them from using your data for any purpose other than performing the specific service for tbaja.

6.2 Game Providers

Some personal data (such as your account identifier and session token) may be shared with our licensed third-party game providers — including Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe — to the extent necessary to load and operate their game software within the tbaja Platform. These providers operate under their own privacy frameworks and are independently licensed entities.

6.3 Legal and Regulatory Disclosure

tbaja may disclose your personal data to law enforcement agencies, courts, regulators, or other public authorities where we are required or permitted to do so by law, including in connection with anti-money laundering investigations, fraud enquiries, or court orders. We will notify you of such disclosures wherever legally permissible.

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of tbaja's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

6.5 No Sale of Data

tbaja does not sell, rent, or trade your personal data to any third party for commercial purposes. We do not share your data with advertising networks, data brokers, or profiling companies. Your data is used exclusively to operate the tbaja Platform and deliver the services you have requested.

7. International Data Transfers

tbaja operates as an offshore platform with server infrastructure distributed across multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside Bangladesh. Where such transfers occur, tbaja ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections in this Policy.

Safeguards we rely on for international transfers include contractual clauses in our agreements with overseas service providers that impose data protection obligations equivalent to those required under internationally recognised standards, and the selection of service providers operating in jurisdictions with adequacy determinations or comparable data protection frameworks.

8. Data Retention

tbaja retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Customer support communications: Retained for 3 years from the date of the last interaction.
• Technical and usage logs: Retained for 12 months on a rolling basis.
• Marketing preference records: Retained until you withdraw consent or close your account.

At the end of the applicable retention period, your data is securely deleted or anonymised. Anonymised data (which can no longer be linked to you as an individual) may be retained indefinitely for statistical and analytical purposes.

9. Exercising Your Data Rights

You may exercise any of the data rights summarised earlier in this Policy by submitting a written request to our Data Protection Officer at [email protected] with the subject line "Data Rights Request — [your registered username]". To protect your privacy, we will need to verify your identity before processing any data rights request.

tbaja will acknowledge your request within 5 business days and aim to provide a full response within 30 calendar days. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and explain the reason for the delay. All responses to data rights requests are provided free of charge unless the request is manifestly unfounded or excessive.

10. Cookies & Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device when you visit the tbaja Platform. They allow the Platform to remember your preferences, maintain your login session, and collect usage data to improve the overall experience. tbaja uses both first-party cookies (set by tbaja.io directly) and third-party cookies (set by our service providers).

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly. They enable core features such as login session management, account security, and payment processing. These cookies cannot be disabled.
• Performance Cookies: Collect anonymous data about how users navigate the Platform — which pages are visited most, how long sessions last, and where errors occur. This data is used to improve Platform performance and user experience.
• Functional Cookies: Remember your preferences such as language settings and display options, enabling a more personalised experience on tbaja.
• Analytics Cookies: Help tbaja understand aggregate user behaviour patterns on the Platform. Data collected via analytics cookies is anonymised and cannot be used to identify individual users.

10.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the tbaja Platform — in particular, disabling strictly necessary cookies will prevent you from logging in or using payment features.

11. Minors and Age Policy

The tbaja Platform is strictly restricted to individuals aged 21 years and above. tbaja does not knowingly collect personal data from individuals under the age of 21. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that your child has registered an account on tbaja, please contact us immediately at [email protected]. We will investigate and respond within 48 hours.

12. Security Measures

tbaja implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data at rest, including stored financial data and identity documents.
• Role-based access controls ensuring that only authorised tbaja personnel can access personal data, and only to the extent necessary for their specific job function.
• Optional two-factor authentication (2FA) for all registered tbaja accounts.
• Regular penetration testing and vulnerability assessments of the Platform's infrastructure.
• Automated fraud detection systems that monitor for suspicious account activity in real time.
• Secure, geographically distributed data backup systems with tested recovery procedures.

While tbaja takes all reasonable precautions to secure your data, no online platform can guarantee absolute security. You play an important role in keeping your data safe by using a strong, unique password for your tbaja account, enabling 2FA, and not sharing your login credentials with anyone.

13. Changes to This Privacy Policy

tbaja reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or the services we provide. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this document.
• Notify all registered tbaja users by email at the address on their account.
• Display a prominent notice on the tbaja Platform homepage for a period of at least 14 days following the update.

Your continued use of the tbaja Platform after any update to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you should stop using the Platform and contact us to close your account.

14. Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or tbaja's handling of your personal data, please contact our Data Protection Officer using the details below. All privacy-related enquiries will be treated as strictly confidential.

tbaja takes all privacy complaints seriously. If you are not satisfied with our response to your complaint, you have the right to escalate the matter to an appropriate data protection authority or seek independent legal advice.

This Privacy Policy was last updated on 1 January 2026. All previous versions are superseded by this document. By continuing to use the tbaja Platform after this date, you confirm your acceptance of this Privacy Policy in full.