tibaji Privacy Policy

1 Introduction and Scope

This Privacy Policy describes how tibaji (hereinafter referred to as "tibaji", "we", "us", or "our") collects, uses, stores, shares, and protects the personal information of individuals who access or use the tibaji platform at tibaji.vip and any associated sub-domains or applications (collectively, the "Platform").

This policy applies to all registered players, prospective players who visit the Platform without registering, and any individual who contacts tibaji through a support channel. By accessing the tibaji Platform, registering an account, or submitting any personal information to us, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.

This policy should be read alongside the tibaji Terms & Conditions and the Responsible Gaming Policy, both of which are available on the Platform. Where there is any conflict between this Privacy Policy and those documents regarding data handling, this Privacy Policy shall prevail.

2 Data Controller

tibaji operates the Platform and acts as the data controller in respect of the personal data collected through the Platform. As data controller, tibaji determines the purposes and means by which your personal data is processed.

All queries relating to how tibaji handles your personal data, including requests to exercise your privacy rights, should be directed to the tibaji support team via the 24/7 Live Chat on the Platform or by written communication to the email address listed in the footer of this page. tibaji will acknowledge privacy-related enquiries within 5 business days and provide a substantive response within 30 days of receipt.

3 Data We Collect

tibaji collects personal data in the following categories. The specific data points collected depend on how you interact with the Platform:

tibaji does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where such data is voluntarily provided in a support context (for example, a player disclosing a health condition in connection with a responsible gaming request). Where such data is provided, it is handled with heightened care and used only for the stated purpose.

4 How We Collect Your Data

tibaji collects personal data through the following channels:

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or update your account settings.
• Automatically through the Platform: Technical data including IP address, device identifiers, browser information, and session activity is collected automatically each time you visit or interact with the tibaji Platform. This collection is facilitated by cookies and similar tracking technologies, as described in Section 7 of this policy.
• From payment service providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a Bangladeshi bank, the relevant payment provider shares transaction confirmation data with tibaji for the purpose of crediting or debiting your account balance.
• From identity verification partners: Where tibaji uses a third-party service to assist with Know Your Customer (KYC) verification, that service may return identity confirmation data to tibaji for the purpose of completing your account verification.
• From publicly available sources: In cases of fraud investigation or responsible gaming compliance, tibaji may reference publicly available information where this is necessary and proportionate.

5 Purpose and Legal Basis for Processing

tibaji processes your personal data only for legitimate, specified purposes. The table below sets out the primary purposes for which we process data and the lawful basis that applies to each:

6 Sharing Your Data

tibaji does not sell your personal data. We may share your personal data with third parties only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — to the extent necessary to process your financial transactions. Each provider is bound by their own privacy and security obligations.
• Identity verification partners: Third-party KYC service providers who assist tibaji in verifying player identity and age. These providers receive only the data necessary for the verification task and are contractually prohibited from using it for any other purpose.
• Game technology providers: Software providers such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, and Microgaming may receive technical session identifiers to facilitate game delivery. These providers do not receive full identity or payment data.
• Legal and regulatory authorities: tibaji may disclose personal data to competent authorities where required by applicable law, court order, or regulatory instruction. tibaji will disclose the minimum data necessary to satisfy such requirements.
• Fraud prevention services: In cases of suspected fraud or money laundering, tibaji may share data with industry fraud prevention networks or financial intelligence services as required.
• Professional advisers: Lawyers, auditors, and accountants where necessary for the legitimate conduct of tibaji's business operations. All such advisers are bound by confidentiality obligations.

All third parties with whom tibaji shares personal data are required to process that data in accordance with applicable data protection standards and are prohibited from using it for any purpose beyond that for which it was shared.

7 Cookies and Tracking Technologies

tibaji uses cookies and similar tracking technologies on the Platform to ensure the correct functioning of the site, to maintain your login session, to remember your preferences, and to collect anonymised analytics data that helps us improve the Platform.

The following categories of cookies are used on the tibaji Platform:

• Strictly Necessary Cookies: These are essential for the Platform to function correctly. They enable core features such as login session management, cashier functionality, and security token validation. These cookies cannot be disabled without impacting the usability of the Platform.
• Functional Cookies: These remember your preferences such as language settings, display options, and responsible gaming notification settings, to provide a more personalised experience across sessions.
• Analytics Cookies: These collect anonymised, aggregated data about how players interact with the Platform — including which pages are visited most frequently and where errors occur. This data is used solely to improve the Platform and is not linked to individual player identities.
• Performance Cookies: These help tibaji monitor Platform performance, including page load times and server response times, to ensure a consistent experience for all players across Bangladesh including those accessing from Dhaka, Chittagong, Sylhet, and Rajshahi.

8 Data Retention

tibaji retains personal data for as long as is necessary to fulfil the purposes described in this policy, or for as long as is required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active account data: Retained for the duration of the account relationship — from registration until account closure.
• Post-closure account data: Following account closure, core identity and transaction data is retained for a minimum period of 5 years to meet anti-money-laundering and financial record-keeping requirements.
• KYC and verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Support communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, after which they are deleted unless they relate to an open dispute or regulatory matter.
• Technical and analytics data: Anonymised analytics data may be retained indefinitely in aggregated form. IP addresses and device identifiers associated with a specific account are retained for the duration of the account relationship plus 2 years.
• Marketing preference data: Retained until you withdraw consent or close your account. Records of consent and its withdrawal are retained for 5 years as evidence of compliance.

When personal data is no longer required under the applicable retention period, tibaji will securely delete or anonymise it in a manner that prevents reconstruction of the original data.

9 Data Security

tibaji takes the security of your personal data seriously. We implement a range of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between your device and the tibaji Platform.
• Encryption at rest for sensitive stored data including identity documents, payment references, and account credentials.
• Role-based access controls ensuring that only authorised tibaji staff can access personal data, and only to the extent required by their role.
• Regular internal security reviews and vulnerability assessments of Platform infrastructure.
• Two-step SMS verification available to all players as an additional layer of account security.
• Monitoring systems that detect and alert to unusual account activity, including logins from unrecognised devices or locations.

In the event of a personal data breach that poses a risk to your rights and freedoms, tibaji will take prompt action to contain the breach and, where appropriate, will notify affected players as soon as reasonably practicable.

10 Your Privacy Rights

As a tibaji player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact tibaji support via the 24/7 Live Chat or by email at the address in the footer of this page. We will respond within 30 days of receiving your request.

• Right of Access: You have the right to request a copy of the personal data tibaji holds about you. This is commonly referred to as a Subject Access Request (SAR). tibaji will provide the data in a clear, readable format, free of charge, within 30 days.
• Right to Rectification: If any personal data tibaji holds about you is inaccurate or incomplete, you have the right to request that we correct or complete it. Corrections to core identity data may require supporting documentation.
• Right to Erasure: In certain circumstances, you have the right to request that tibaji delete the personal data we hold about you. This right is not absolute — tibaji may be required to retain certain data to comply with legal or regulatory obligations, as outlined in Section 8 of this policy.
• Right to Restrict Processing: You may request that tibaji restricts the processing of your data in certain circumstances, for example while a correction request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contractual relationship, you have the right to receive a copy of your data in a structured, machine-readable format.
• Right to Object: You have the right to object to tibaji processing your data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you have grounds relating to your particular circumstances.
• Right to Withdraw Consent: Where tibaji relies on your consent for processing, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11 Protection of Minors

The tibaji Platform is strictly intended for adults aged 18 and above. tibaji does not knowingly collect or process personal data relating to individuals under the age of 18. Age verification is a mandatory step in the account registration and withdrawal process.

If tibaji becomes aware that personal data has been collected from an individual who is under 18 years of age, we will take immediate steps to delete that data, close the associated account, and refund any deposited funds to the payment source from which they originated.

If you believe that a person under 18 has registered for a tibaji account or that a minor has accessed the Platform, please notify tibaji support immediately via the 24/7 Live Chat facility. tibaji treats such reports with the highest priority.

12 Changes to This Privacy Policy

tibaji reserves the right to update or amend this Privacy Policy at any time. Changes may be necessary to reflect updates to our data processing practices, changes in applicable law or regulatory guidance, the introduction of new Platform features, or changes to our third-party service providers.

When material changes are made to this policy — meaning changes that significantly affect how we use or share your personal data — tibaji will provide advance notice by posting a prominent notice on the Platform and, where practicable, by notifying registered players via their registered contact details.

The effective date of the current version of this policy is displayed at the top of the page. Your continued use of the tibaji Platform following the effective date of any revised policy constitutes your acceptance of the changes. If you do not accept a material change, you should cease using the Platform and may request account closure in accordance with the tibaji Terms & Conditions.

13 Contact the Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way tibaji handles your personal data, please get in touch using any of the following methods:

• 24/7 Live Chat: Available directly on the tibaji Platform. Our support team aims to respond within 3 minutes and can route privacy-specific enquiries to the appropriate team.
• Email: Write to the tibaji support address shown in the footer of this page. Please mark your message with the subject line "Privacy Enquiry" so it can be directed promptly to the right team. Do not include sensitive documents as email attachments unless requested by our team.

tibaji is committed to resolving all privacy-related concerns fairly and promptly. We aim to acknowledge all written privacy requests within 5 business days and provide a full response within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by up to a further 30 days, in which case we will notify you of the extension and the reason for it.

This Privacy Policy is written and published in English. In the event of any inconsistency between a translated version and the English version of this policy, the English text shall prevail.