Privacy Policy — t bajji

Data You Provide Voluntarily

When you register for a t bajji account, you directly provide us with identity and contact data. You also supply financial data when adding a payment method or requesting a withdrawal. Any information you include in support messages or feedback forms is collected and stored as communication data.

Data Collected Automatically

Certain technical data is collected automatically when you access the t bajji platform. This includes your IP address (which may be used to determine your approximate location within Bangladesh), your device and browser characteristics, and session timing information. This data is collected primarily through server logs and cookies — see the Cookies section for full details.

Data from Third Parties

In limited circumstances, t bajji may receive personal data about you from third parties. For example, our payment processing partners (bKash, Nagad, Rocket, Upay) may confirm the status of a transaction. Our game providers (such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming) may share technical event data associated with game sessions on our platform. We may also receive fraud-screening signals from identity verification services during the KYC process.

Sensitive Personal Data

t bajji does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health information beyond what is necessary for responsible gaming compliance (for example, noting a player's self-exclusion status). Where responsible gaming assessments identify a potential issue with a player's gambling behaviour, the related notes are treated with the highest level of access restriction within our systems.

t bajji does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data with external parties only in the limited circumstances described below, and only to the minimum extent necessary to achieve the stated purpose.

Payment Service Providers

To process your deposits and withdrawals, we share the necessary transaction data with your chosen payment provider — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, or BRAC Bank. These providers receive only the data required to execute the specific transaction. They are contractually prohibited from using t bajji player data for any other purpose.

Game Technology Providers

t bajji's platform incorporates games and live casino streams from third-party providers including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. A unique player identifier (not your full name or contact details) is passed to these providers to enable game session management, fair-play auditing, and real-time result delivery. Full personal data is not shared with game providers beyond what is technically required.

Identity Verification Services

During the KYC verification process, we may share your identity document images and personal data with a specialist identity verification provider to confirm your age and identity. These providers are bound by strict data processing agreements and may not retain or use your documents for any purpose other than the verification service they provide to t bajji.

Legal & Regulatory Disclosure

t bajji may disclose your personal data to law enforcement agencies, regulatory authorities, or courts if required to do so by applicable law, by a valid legal order, or where we reasonably believe disclosure is necessary to prevent fraud, protect the safety of any person, or protect the rights and assets of t bajji. We will, where legally permissible, notify you of any such disclosure.

Business Transfers

In the event that t bajji undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, player data may be transferred to the acquiring entity as part of that transaction. In such an event, t bajji will post a notice on the platform and, where practicable, notify affected players by email, giving them the opportunity to close their accounts before the transfer is completed.

What We Will Never Do

• Sell your personal data to advertising networks, data brokers, or marketing agencies.
• Share your full financial details (bKash PIN, bank login credentials) with any third party — t bajji staff will never ask you for these.
• Use your data for profiling that could cause you discrimination based on your identity, religion, or any other protected characteristic.
• Transfer your data to any country or territory that does not provide an adequate level of data protection without implementing appropriate contractual safeguards.

t bajji retains your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or for as long as required by applicable law. The following retention periods apply to the main categories of data we hold:

• Account and Identity Data: Retained for the life of your account and for a period of 5 years following permanent account closure. This retention period is required to comply with anti-money-laundering obligations and to resolve any disputes or legal claims that may arise after closure.
• Financial Transaction Records: Retained for 7 years from the date of each transaction in accordance with standard financial record-keeping requirements applicable in Bangladesh.
• KYC Verification Documents: Retained for 5 years following the completion of verification or account closure, whichever is later. Document images are stored in encrypted form with access restricted to compliance personnel.
• Gaming Activity Data: Detailed session-level records are retained for 2 years. Aggregated statistical data may be held indefinitely in anonymised form for platform analytics purposes.
• Support Communication Data: Retained for 3 years from the date of each communication. Correspondence related to ongoing legal disputes may be held for longer.
• Marketing Consent Records: Retained for the duration of your marketing consent plus 2 years following any withdrawal of consent, as evidence of your original agreement.
• Technical / Log Data: Server logs and IP records are retained for 6 months and then automatically deleted unless flagged for ongoing security investigation.

Data Deletion

When the applicable retention period expires, t bajji permanently deletes or anonymises the relevant data in a secure manner that prevents recovery. You may request earlier deletion of certain categories of data by submitting a formal data deletion request to [email protected] — see the Your Privacy Rights section for more details on how deletion requests are handled.

Data Storage Location

t bajji stores player data on secure servers. All data is held behind enterprise-grade firewalls, and access is restricted to authorised personnel on a strict need-to-know basis. Regular security audits are conducted to ensure ongoing compliance with data protection best practices.

t bajji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme is reviewed and updated regularly to reflect current best practices and emerging threats.

Technical Safeguards

• 256-Bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using current SSL/TLS protocols. Our SSL certificate is renewed and audited regularly.
• Encrypted Data Storage: Sensitive data fields — including payment account numbers, NID references, and verification document images — are stored using AES-256 encryption at rest. Encryption keys are managed separately from the data they protect.
• Two-Factor Authentication (2FA) : Players are strongly encouraged to enable 2FA on their t bajji accounts. Internal staff accounts with access to player data require mandatory 2FA at all times.
• Firewall & Intrusion Detection: Our servers are protected by enterprise-grade firewalls and continuous intrusion detection systems that monitor for unusual access patterns and flag potential threats in real time.
• Regular Penetration Testing: t bajji commissions independent security assessments and penetration tests on a periodic basis to identify and remediate vulnerabilities before they can be exploited.
• Access Controls: Access to player data is restricted to authorised personnel on a strict need-to-know basis. All internal data access is logged and audited. Staff with data access privileges undergo background screening and regular security training.

Organisational Safeguards

• Data Minimisation Policy: Staff are trained to access only the minimum amount of player data necessary to fulfil a specific operational task. Bulk data exports require senior management approval.
• Incident Response Plan: t bajji maintains a documented data breach response plan. In the event of a confirmed breach that poses a risk to player data, affected players will be notified by email within 72 hours where technically feasible, with guidance on steps they can take to protect themselves.
• Third-Party Due Diligence: All third-party service providers that process player data on our behalf are assessed for security compliance before engagement. Data processing agreements are in place with all such providers.
• Staff Training: All t bajji employees who handle personal data receive mandatory data protection training upon onboarding and refresher training annually.

Your Role in Data Security

While t bajji takes robust measures to protect your data, account security also depends on actions you take. We strongly recommend that you use a unique, complex password for your t bajji account, enable two-factor authentication, never share your login credentials with any other person, and contact [email protected] immediately if you suspect unauthorised access to your account. t bajji staff will never ask you for your password or your mobile banking PIN.