tibaji Privacy Policy

🔍 Privacy at a Glance

Six key principles that guide how tibaji handles your personal data

1. Introduction and Scope

This Privacy Policy ("Policy") sets out the practices of tibaji ("we", "us", "our", "the Platform") with respect to the collection, use, storage, disclosure, and protection of personal data belonging to registered players, prospective players, and visitors to the tibaji website at https://tibaji.ws ("the Site").

This Policy applies to all personal data processed by tibaji in connection with your use of the tibaji platform — including the sports betting service, live casino, slots lobby, payment processing functions, customer support interactions, and any promotional or marketing communications you have opted in to receive.

By registering a tibaji account or otherwise using the tibaji platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you should not register or continue to use the tibaji platform.

tibaji may update this Policy from time to time. The most current version will always be published at https://tibaji.ws/privacy-policy with a revised "Last updated" date. Where changes are material, tibaji will notify active players via the registered email address or via an in-platform notification.

2. Personal Data We Collect

When you register a tibaji account, we collect the following information:

• Full legal name — as it appears on your government-issued identification document.
• Date of birth — to verify that you meet the 21+ age requirement.
• Residential address — including city, district, and postcode within Bangladesh or your country of residence.
• Email address — used for account communications, transaction confirmations, and optional promotional messages.
• Mobile phone number — used for account verification, two-factor authentication, and support contact.
• Username and password — your chosen tibaji login credentials. Passwords are stored in hashed form and are never accessible to tibaji staff in plain text.

As part of our Know Your Customer (KYC) obligations, tibaji may request and retain copies of the following documents:

• National Identity Card (NID), passport, or driver's licence.
• A recent utility bill, bank statement, or government-issued letter confirming your registered address (dated within the last 90 days).
• A selfie or short video alongside your identity document, to confirm that the document belongs to the person registering the account.
• A screenshot or statement from your bKash, Nagad, Rocket, or Upay account confirming ownership of the mobile wallet used for deposits.

KYC documents are stored in encrypted form on secured servers. Access is restricted to authorised compliance and verification staff only. KYC documents will be retained for a minimum of five (5) years following account closure, in line with standard anti-money laundering record-keeping obligations.

tibaji collects and processes the following financial data in connection with deposits, withdrawals, and gameplay:

• Deposit and withdrawal amounts, dates, and method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank).
• Mobile wallet numbers or masked card numbers associated with payment transactions.
• Account balance history and bonus credit/debit records.
• Betting and gaming history — including game selections, stake amounts, outcomes, and session durations.

tibaji does not store full card numbers, CVV codes, or full mobile banking PINs. Payment data is handled in compliance with applicable payment security standards and is never stored in plain text.

When you access the tibaji platform, our servers and analytics tools automatically collect certain technical information, including:

• IP address and approximate geographic location derived from IP.
• Device type, operating system, and browser version.
• Session timestamps, pages visited, features used, and interaction patterns.
• Referral source (how you arrived at the tibaji site).
• Cookie identifiers and similar tracking technologies (see Section 8 for full cookie details).

When you contact the tibaji support team by email or live chat, we retain a record of the communication, including the content of messages exchanged, the date and time of contact, and the resolution outcome. This data is used for quality assurance, dispute resolution, and staff training purposes.

3. How We Use Your Personal Data

tibaji processes your personal data on the following legal bases and for the following purposes:

Where tibaji relies on your consent as the legal basis for processing (for example, sending you promotional emails about new tibaji bonuses, BPL season offers, or IPL betting promotions), you may withdraw that consent at any time by contacting [email protected] or by using the unsubscribe link in any marketing email. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to that withdrawal.

4. Sharing Your Personal Data

tibaji works with a limited number of trusted third-party service providers who process personal data on our behalf under strict data processing agreements. These providers include:

• Payment processors — bKash, Nagad, Rocket, Upay, and card scheme processors (Visa, Mastercard) receive transaction data necessary to complete your deposit or withdrawal.
• Identity verification providers — third-party KYC platforms that assist with document verification and fraud screening.
• Game software providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session identifiers and game-play data necessary to deliver their games and settle outcomes.
• Customer support platform — our live-chat and ticketing system provider processes communications data on our behalf.
• Analytics tools — aggregate, anonymised usage data may be processed by analytics providers to help tibaji understand platform performance.

All third-party service providers are contractually bound to use your personal data only for the specific purpose for which it was shared and to maintain appropriate security measures. tibaji does not permit service providers to use your data for their own marketing purposes.

tibaji may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or a lawful request from a competent authority. In such cases, tibaji will disclose only the minimum amount of data necessary to satisfy the legal obligation and will, where legally permitted, notify the affected player.

In the event that tibaji or its parent company undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. tibaji will notify affected players via the registered email address prior to any such transfer becoming effective, and the successor entity will be required to honour the commitments made in this Privacy Policy.

5. Data Retention

tibaji retains your personal data for as long as your account is active and for a defined period following account closure. The retention periods below reflect standard obligations applicable to online gaming and financial services platforms:

• Account registration data — retained for the duration of account activity plus five (5) years following account closure.
• KYC and identity verification documents — retained for a minimum of five (5) years following account closure.
• Financial transaction records — retained for five (5) years from the date of each transaction.
• Gameplay and betting history — retained for three (3) years from the date of each session or bet settlement.
• Customer support communications — retained for two (2) years from the date of each interaction.
• Marketing consent records — retained for three (3) years from the date consent was given or withdrawn.
• Technical and device log data — retained for twelve (12) months on a rolling basis.

Following the expiry of the applicable retention period, your data will be securely deleted or anonymised. Anonymised aggregate data (containing no personal identifiers) may be retained indefinitely for statistical and business analysis purposes.

6. Your Privacy Rights

As a tibaji player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request".

You have the right to request a copy of the personal data that tibaji holds about you. We will respond to a verified access request within 30 days. The first copy is provided free of charge; subsequent copies within a 12-month period may be subject to a reasonable administrative fee.

If any personal data that tibaji holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information (such as your email address, phone number, or residential address) directly within your tibaji account settings. For corrections to identity or KYC data, please contact the support team.

You may request that tibaji delete your personal data. tibaji will honour erasure requests where there is no overriding legal obligation to retain the data. Please note that where legal retention periods apply (for example, financial transaction records subject to anti-money laundering retention requirements), tibaji is not able to delete data before the retention period expires. In such cases, tibaji will restrict further processing of the data to the minimum necessary to satisfy the legal obligation.

Where tibaji processes your data on the basis of your consent (for example, promotional communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing. To withdraw marketing consent, use the unsubscribe link in any tibaji marketing email or contact [email protected].

If you believe that tibaji has not handled your personal data in accordance with this Privacy Policy or applicable law, you have the right to lodge a complaint. We encourage you to contact us first at [email protected] so that we can address your concern directly. tibaji commits to acknowledging all privacy complaints within 5 business days.

7. Data Security

tibaji takes the security of your personal data seriously and maintains a range of technical and organisational measures designed to protect it against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and tibaji servers.
• Encrypted storage of sensitive data including KYC documents, hashed passwords, and payment identifiers.
• Access controls — personal data is accessible only to authorised tibaji personnel who have a legitimate need to process it in the course of their duties.
• Two-factor authentication (2FA) available for all player accounts to reduce the risk of unauthorised access.
• Regular security assessments of platform infrastructure and third-party integrations.
• Incident response procedures — in the event of a suspected data breach, tibaji will assess the risk, contain the incident, and notify affected players and relevant authorities within a reasonable timeframe.

8. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit a website. tibaji uses cookies and similar technologies (such as local storage and session tokens) to ensure the platform functions correctly, to remember your preferences, and to analyse how the platform is used.

• Strictly necessary cookies — required for the platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies — remember your preferences such as language settings, preferred odds format, and last-visited game category. These improve your experience but are not essential.
• Analytics cookies — collect anonymised, aggregate data about how players use the tibaji platform (pages visited, session length, feature engagement). This data helps tibaji improve the platform over time.
• Security cookies — used to detect suspicious login attempts, fraudulent activity patterns, and bot traffic.

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to block, delete, or receive alerts about cookies. Please note that disabling strictly necessary cookies will impair your ability to log in to and use the tibaji platform. Disabling functional or analytics cookies will not prevent you from using core betting and gaming features.

tibaji does not use cookies to serve third-party advertising or to track your browsing activity across other websites outside of the tibaji platform.

9. Protection of Minors

The tibaji platform is strictly for adults aged 21 years and above. tibaji does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete the personal data to the extent legally permissible, and return any deposited funds to the payment method used.

If you are a parent or guardian and believe that your child has registered a tibaji account, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and act on the report within 24 hours.

10. International Data Transfers

Some of tibaji's service providers — including game software providers and identity verification platforms — may be located outside of Bangladesh. Where personal data is transferred to a country that may not provide the same level of data protection as Bangladesh, tibaji ensures that appropriate safeguards are in place, including data processing agreements that contractually bind the recipient to process personal data only in accordance with this Policy and to maintain equivalent security standards.

By using the tibaji platform, you acknowledge and consent to the transfer of your personal data to countries outside of Bangladesh where necessary for the purposes described in this Policy, subject to the safeguards described above.

11. Contact and Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way tibaji handles your personal data, please contact the tibaji privacy team using the details below. The support team operates 24 hours a day, 7 days a week, and aims to respond to all privacy enquiries within 5 business days (Bangladesh Standard Time, UTC+6).

For urgent security concerns — such as suspected unauthorised access to your tibaji account — please use the subject line "Urgent Security Issue" and include your registered username and approximate date of the suspected incident. Do not include your password in any email correspondence.