tbaja Privacy Policy —
Your Data, Your Rights,
Our Commitments Explained
At tbaja, protecting the personal data of our players is a fundamental responsibility. This Privacy Policy explains exactly what data we collect, why we collect it, how it is used and stored, who it is shared with, and what rights you have over your own information.
Our Commitment
Six Privacy Principles at tbaja
The tbaja Privacy Policy is built on six core principles that govern every decision we make about personal data. These principles apply equally to all registered players on the platform, regardless of their location within Bangladesh.
Transparency
We tell you exactly what data we collect, why we collect it, and what we do with it — before you register, not after. No hidden data practices.
Data Minimisation
tbaja collects only the personal data that is strictly necessary for account operation, identity verification, payment processing, and regulatory compliance. We do not collect data speculatively.
Security First
All data stored on tbaja infrastructure is protected by SSL/TLS encryption in transit and AES-256 encryption at rest. Access to personal data is restricted to authorised personnel only.
Your Control
You have the right to access, correct, export, and request deletion of your personal data at any time. tbaja provides clear mechanisms for exercising each of these rights.
Limited Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or to meet our legal and regulatory retention obligations — then securely deleted.
Lawful Basis
Every data processing activity at tbaja is grounded in a lawful basis: either contractual necessity, legitimate interest, legal obligation, or your explicit consent where required.
Section 1
Data We Collect
tbaja collects personal data through several channels — directly from you during registration and account use, automatically via platform technology, and occasionally from trusted third parties for verification purposes.
Scope: This Privacy Policy applies to all personal data processed by tbaja in connection with your use of the tbaja platform, including the website, mobile interface, betting and casino services, promotional activities, and customer support interactions. By registering an account, you acknowledge that your personal data will be processed as described in this Policy.
1.1 Registration Data
When you create a tbaja account, we collect the personal information you provide directly: your full legal name, date of birth, residential address, email address, and mobile phone number. This data forms the foundation of your account identity and is used for KYC (Know Your Customer) verification, account management, and regulatory compliance. Providing accurate registration data is a condition of account use — see our Terms & Conditions for further detail.
1.2 Identity Verification Data
As part of our KYC obligations, tbaja may request and process copies of official identity documents, including your National Identity Card (NID), passport, or other government-issued photographic identification. We may also request proof of address documents such as utility bills or bank statements, and proof of payment method ownership. These documents are processed solely for verification purposes and are stored securely in accordance with Section 5 of this Policy.
1.3 Financial Transaction Data
tbaja records all financial transactions associated with your account, including deposit amounts, withdrawal requests, payment method identifiers (such as bKash account numbers, Nagad numbers, and Rocket numbers), transaction reference numbers, and timestamps. We do not store full debit or credit card numbers on our own servers — card payments are processed by PCI-DSS compliant third-party payment processors who handle and tokenise card data on our behalf.
1.4 Gaming Activity Data
We collect a record of all betting and gaming activity conducted through your tbaja account, including bet amounts, game selections, outcomes, session durations, and bonus utilisation history. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory reporting where applicable.
1.5 Technical and Device Data
When you access the tbaja platform, our systems automatically collect certain technical information, including your IP address, device type and operating system, browser type and version, referring URL, page interaction data, and session duration. This information is used for platform security, fraud detection, and improving user experience.
1.6 Customer Support Data
When you contact tbaja customer support via email or any other support channel, we collect and retain the content of your communications, including your name, contact details, and the subject matter of your enquiry. This data is used to resolve your query and to maintain a record of support interactions for quality assurance and dispute resolution purposes.
| Data Category | Examples |
|---|---|
| Registration | Name, DOB, email, phone |
| KYC Docs | NID, passport, address proof |
| Financial | bKash no., transaction IDs |
| Gaming | Bet history, game sessions |
| Technical | IP address, device type |
| Support | Emails, chat transcripts |
Sensitive Data: tbaja does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where identity documents incidentally contain such information and their collection is required for KYC purposes.
Section 2
How We Use Your Data
tbaja processes personal data only for clearly defined, legitimate purposes. The table below summarises each processing purpose alongside the lawful basis on which it rests.
| Processing Purpose | Data Used | Lawful Basis |
|---|---|---|
| Account creation and management | Registration data | Contractual necessity |
| Identity and age verification (KYC) | ID documents, DOB | Legal obligation |
| Processing deposits and withdrawals | Financial transaction data | Contractual necessity |
| Fraud detection and prevention | Technical, financial, gaming data | Legitimate interest |
| Anti-money laundering (AML) monitoring | Financial, registration data | Legal obligation |
| Responsible gaming monitoring | Gaming activity, session data | Legal obligation / legitimate interest |
| Customer support and dispute resolution | Support communications | Contractual necessity |
| Service improvement and analytics | Technical, aggregated gaming data | Legitimate interest |
| Promotional communications (where opted in) | Email address, gaming preferences | Consent |
| Regulatory reporting and record-keeping | All applicable categories | Legal obligation |
2.1 Marketing Communications
If you have opted in to receive promotional communications from tbaja, we may use your email address and platform activity data to send you information about relevant offers, seasonal promotions — including those tied to BPL, IPL, T20 World Cup, Eid, and Pohela Boishakh — and new features on the platform. You may withdraw your consent to receive marketing communications at any time by contacting [email protected] or by using the unsubscribe mechanism included in any marketing email. Withdrawal of marketing consent does not affect the processing of your data for other lawful purposes.
2.2 Automated Decision-Making
tbaja uses automated systems to assist with certain decisions, including fraud risk scoring, AML transaction monitoring, and responsible gaming alert generation. Where an automated process results in a significant decision affecting your account — such as a restriction or suspension — you have the right to request human review of that decision by contacting our support team. Automated systems support, but do not replace, human oversight in account management decisions.
2.3 Profiling for Responsible Gaming
As part of our commitment to player welfare, tbaja analyses gaming activity patterns to identify players who may be exhibiting signs of problem gambling. This profiling is conducted in players' interests and in accordance with responsible gaming best practices. Where our systems flag a concern, a member of the support team may contact the player to offer information about responsible gaming tools or to check on their wellbeing. You may not opt out of responsible gaming monitoring while you hold an active account, as this monitoring is a legal and ethical obligation of the platform.
2.4 Aggregated and Anonymised Analytics
tbaja may use aggregated and fully anonymised data — from which no individual player can be identified — for internal business analytics, platform performance reporting, and product development. Such data is not considered personal data and is not subject to the restrictions on personal data processing described in this Policy.
Section 3
Data Sharing & Third Parties
tbaja does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Data is shared only where strictly necessary for the operation of the platform or where required by law.
Core Principle: tbaja will never sell your personal data to advertisers, data brokers, or any commercial third party for marketing or profiling purposes unrelated to the operation of the tbaja platform. All third-party data sharing is governed by formal data processing agreements that bind recipients to confidentiality and security obligations equivalent to those maintained by tbaja.
3.1 Payment Processors
To process your deposits and withdrawals, tbaja shares the minimum necessary financial and identity data with your chosen payment provider. This includes bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and card processing partners for Visa and Mastercard transactions. These providers receive only the data required to authenticate and execute the specific transaction requested. They are not permitted to use this data for their own marketing or for any purpose beyond the transaction for which it was shared.
3.2 Identity Verification and KYC Providers
tbaja works with specialist third-party identity verification services to assist with document authentication and KYC compliance. These providers process identity documents on tbaja's behalf under strict data processing agreements. They do not retain copies of your documents beyond the period required to complete the verification process.
3.3 Game Content Providers
The tbaja platform incorporates games and betting content provided by third-party studios, including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. These providers may receive session-level technical data necessary to deliver their games (such as session tokens and anonymised player identifiers), but do not receive your name, contact details, or payment information. Their use of data is governed by their own privacy policies and their contractual obligations to tbaja.
3.4 Regulatory and Law Enforcement Authorities
tbaja may be required to disclose personal data to competent authorities — including regulatory bodies, law enforcement agencies, and courts of competent jurisdiction — where required by applicable law or by a valid legal order. tbaja will only disclose the minimum data required to comply with such a request and will endeavour to notify the affected player where legally permitted to do so.
3.5 Business Transfers
In the event that tbaja undergoes a merger, acquisition, restructuring, or sale of assets, personal data held by tbaja may be transferred to the acquiring or successor entity as part of that transaction. Players will be notified of any such transfer and of any material change to this Privacy Policy that results from it, prior to their data being processed under different terms.
Who Receives Your Data
- Payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
- KYC / identity verification providers
- Game studios (session data only, no PII)
- Regulatory / law enforcement (when legally required)
- Third-party advertisers or data brokers — NEVER
International Transfers: Some of tbaja's third-party service providers operate outside Bangladesh. Where personal data is transferred internationally, tbaja ensures that adequate safeguards are in place — including contractual data protection clauses — to maintain a standard of protection equivalent to that described in this Policy.
Section 5
Data Retention & Storage
tbaja retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or to meet our legal, regulatory, or contractual obligations. Retention periods vary by data category.
5.1 Active Account Data
While your tbaja account remains active, all personal data associated with your account is retained in full. This includes registration data, KYC documents, transaction history, gaming activity records, and support communications. Active account data is reviewed periodically to ensure it remains accurate and up to date.
5.2 Post-Closure Retention
Following the closure of your tbaja account — whether voluntary, administrative, or for cause — tbaja retains certain categories of personal data for the periods required by applicable legal, regulatory, and anti-money laundering obligations. In general, financial transaction records and KYC documentation are retained for a minimum of five years following account closure. Support communications are retained for two years. Technical logs are retained for 12 months from the date of generation.
5.3 Secure Deletion
When a data retention period expires and no other lawful basis for continued processing exists, tbaja securely deletes or irreversibly anonymises the relevant personal data. Deletion processes comply with industry-standard data destruction protocols to prevent unauthorised recovery of deleted data. Where data is held on third-party systems (for example, with KYC providers or payment processors), tbaja requires those providers to apply equivalent deletion standards under the terms of their data processing agreements.
5.4 Storage Location and Infrastructure
tbaja stores personal data on servers operated by reputable cloud infrastructure providers. All stored data is encrypted at rest using AES-256 encryption. Access to stored personal data is restricted to authorised personnel on a need-to-know basis, with access events logged and auditable. Physical access to data centre infrastructure is controlled by the infrastructure provider in accordance with ISO 27001 or equivalent security standards.
| Data Type | Retention Period |
|---|---|
| KYC documents | 5 years post-closure |
| Financial records | 5 years post-closure |
| Gaming activity logs | 5 years post-closure |
| Support communications | 2 years post-closure |
| Technical / access logs | 12 months from creation |
| Marketing consent records | Until withdrawn + 1 year |
Section 6
Your Privacy Rights
tbaja respects your right to control your personal data. The following rights are available to all registered players. To exercise any of these rights, contact us at [email protected] with your account details and the specific right you wish to exercise.
Right to Access
You may request a copy of all personal data tbaja holds about you. We will respond within 30 days of a valid request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Right to Restrict Processing
You may request that tbaja restrict the processing of your personal data in specific circumstances, such as while a rectification request is under review.
Right to Data Portability
Where technically feasible, you may request a machine-readable export of the personal data you have provided to tbaja.
Right to Object
You may object to processing based on legitimate interest, including profiling for marketing purposes. Objections to responsible gaming monitoring cannot be upheld.
Right to Human Review
Where an automated process has resulted in a significant decision affecting your account, you may request that a human member of the tbaja team review that decision.
Right to Withdraw Consent
Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time without affecting prior lawful processing.
6.1 How to Submit a Rights Request
To exercise any of the rights described above, please send a written request to [email protected] from the email address registered to your tbaja account. Your request should clearly state: your full name as registered on the account, your registered email address, the specific right you wish to exercise, and any relevant details that will help us locate and process your request efficiently.
tbaja will acknowledge your request within 5 business days (Bangladesh Standard Time, UTC+6) and will aim to provide a full response within 30 calendar days. In cases of particular complexity, this period may be extended by a further 30 days — we will notify you if an extension is required.
6.2 Identity Verification for Rights Requests
To protect your data from unauthorised access, tbaja will verify your identity before processing any rights request. We may ask you to confirm certain account details or to provide a copy of an identity document. This verification step applies to all rights requests without exception and is a necessary safeguard, not an obstacle to exercising your rights.
Submit a Privacy Request
Send your data rights request to our privacy team at:
Include your registered name and email address, and specify the right you wish to exercise. We respond within 5 business days (BST, UTC+6).
Section 7
Data Security Measures
tbaja employs a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Security is treated as an ongoing operational priority, not a one-time configuration.
7.1 Encryption
All data transmitted between your device and the tbaja platform is encrypted in transit using TLS 1.2 or higher. Personal data stored on tbaja servers is encrypted at rest using AES-256 encryption. Payment card data processed through our platform is handled exclusively by PCI-DSS Level 1 compliant payment processors — tbaja itself does not store raw card numbers.
7.2 Access Controls
Access to personal data within tbaja's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access required to perform their role. All internal access to personal data is logged and subject to periodic audit. Administrative access credentials are protected by multi-factor authentication.
7.3 Security Monitoring
tbaja operates continuous security monitoring across its platform infrastructure, including intrusion detection systems, anomaly detection for unusual account activity, and real-time alerts for potential data security incidents. Regular penetration testing is conducted to identify and remediate vulnerabilities before they can be exploited.
7.4 Data Breach Response
In the event of a confirmed or suspected personal data breach, tbaja has a documented incident response procedure that includes: immediate containment of the breach; assessment of the nature and scope of compromised data; notification to affected players where the breach is likely to result in a high risk to their rights and interests; and remediation steps to prevent recurrence. tbaja will notify affected players of a relevant breach without undue delay, providing clear information about what happened and what steps players can take to protect themselves.
7.5 Your Responsibility
Platform security is a shared responsibility. Players are responsible for maintaining the confidentiality of their account credentials. tbaja strongly recommends using a unique, complex password for your tbaja account and enabling any available account security features. tbaja will never ask you for your password via email, live chat, or telephone. If you receive a communication purporting to be from tbaja that requests your password, treat it as a phishing attempt and report it to [email protected] immediately.
Section 8
Policy Updates & Contact
This Privacy Policy is reviewed and updated periodically to reflect changes in our data practices, applicable law, and platform features. The current version is always available at tbaja.net/privacy-policy.
8.1 Policy Changes
tbaja reserves the right to update or amend this Privacy Policy at any time. When material changes are made — meaning changes that affect the nature of the data we collect, the purposes for which we use it, or your rights as a data subject — tbaja will notify registered players by email to their registered address at least 14 days before the updated Policy takes effect. For minor or administrative updates (such as clarifications of existing language or correction of typographical errors), the Policy will be updated with the revised "Last Updated" date and no advance notice will be required.
Continued use of the tbaja platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree to the updated Policy, you may close your account in accordance with the procedure described in our Terms & Conditions.
8.2 Children and Minors
The tbaja platform is strictly for adults aged 18 and above. tbaja does not knowingly collect personal data from any person under the age of 18. If tbaja discovers that personal data has been collected from a minor, that data will be deleted immediately and the associated account will be permanently closed. If you believe that a minor has registered an account on the tbaja platform, please notify us immediately at [email protected].
8.3 Links to Third-Party Sites
The tbaja platform does not include outbound links to third-party websites. However, game providers embedded within the platform operate their own environments that may be subject to their own privacy policies. tbaja is not responsible for the privacy practices of third-party game studios and recommends that players review the privacy policies of any third-party service they interact with separately from the tbaja platform.
8.4 Governing Law
This Privacy Policy is governed by and construed in accordance with applicable international data protection standards. tbaja operates as an offshore platform and processes data in accordance with its operational jurisdiction's applicable data protection framework. Players in Bangladesh are subject to the laws of their own jurisdiction with respect to their personal activities online; tbaja's data practices are designed to meet a high international standard regardless of specific jurisdictional mandates.
8.5 Contact the Privacy Team
For any questions, concerns, or requests relating to this Privacy Policy or tbaja's data processing practices, please contact the tbaja privacy team directly at [email protected]. Please include "Privacy Policy Enquiry" in the subject line of your email to ensure your message is routed to the correct team. Our target response time for privacy-related enquiries is 5 business days (Bangladesh Standard Time, UTC+6).
Policy Summary
- Effective date: January 2026
- Language: English (en-BD)
- Market: Bangladesh
- Support: BST (UTC+6)
- Minimum age: 18+
- [email protected]
Related Policies: This Privacy Policy should be read alongside the tbaja Terms & Conditions and the Responsible Gaming policy, which together form the complete framework governing your use of the tbaja platform.
Ready to Explore the tbaja Platform?
Now that you understand how tbaja handles your data, you can enjoy the platform with confidence. Browse live cricket betting, premium slots, and live casino games — all in BDT via bKash and Nagad.