tbage Privacy
Policy

tbage operates an online casino and sports betting platform at tbage.io, serving players primarily based in Bangladesh. As a platform that handles financial transactions, identity verification, and real-money wagering activity, we necessarily collect and process personal data in order to deliver our services safely and responsibly.

This Policy applies to all personal data collected through the tbage website, any mobile-optimised version of the Platform, our customer support channels (live chat and email), and any promotional communications you have opted into. It does not apply to the data practices of third-party game providers, payment processors, or other external services that may be accessible via or in connection with the Platform — those parties operate under their own privacy policies.

tbage is committed to handling your personal data with transparency, integrity, and appropriate security. We process your data only where we have a lawful basis to do so, and we never use it for purposes that are incompatible with those stated in this Policy.

This Policy should be read alongside the tbage Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference into the overall agreement between you and tbage.

For the purposes of applicable data protection law, tbage is the data controller in respect of the personal data collected through the Platform. This means tbage determines the purposes and means by which your personal data is processed.

Where tbage engages third-party service providers to process data on its behalf (for example, payment processors and identity verification providers), those parties act as data processors under written agreements that require them to process data only on tbage's documented instructions and to maintain appropriate security standards.

If you have any questions about how your personal data is handled, or wish to exercise any of your data rights described in Section 10, you may contact tbage's data team using the contact details provided in Section 15 of this Policy.

tbage collects the following categories of personal data, depending on your interactions with the Platform:

• Identity Data: Full legal name, date of birth, nationality, government-issued identification number (National ID card, passport number, or driver's licence number), and a photograph of your identity document where required for KYC verification.
• Contact Data: Mobile phone number (a valid Bangladesh number is required for account registration), email address, and residential address including district (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh).
• Financial Data: Mobile banking account numbers (bKash, Nagad, Rocket, Upay), bank card details (Visa, Mastercard — stored and processed via PCI-DSS-compliant payment processors; tbage does not store raw card numbers), deposit and withdrawal transaction records, and account balance history.
• Technical Data: IP address, device identifiers, browser type and version, operating system, screen resolution, time zone (Bangladesh Standard Time, UTC+6), referral URL, and session duration.
• Usage Data: Games played, bets placed (including amounts, markets, and outcomes), pages visited on tbage.io, features accessed, promotional offers viewed or claimed, and responsible gaming tool interactions.
• Communications Data: The content of messages exchanged via live chat and email with tbage's support team, including any attachments or screenshots submitted as part of a support query or dispute.
• Marketing Preference Data: Your opt-in/opt-out choices for promotional communications by email, SMS, and in-platform notification.
• Responsible Gaming Data: Any deposit limits, loss limits, cooling-off periods, session reminders, or self-exclusion requests you have set or submitted, together with associated dates and durations.

tbage collects personal data through the following channels and mechanisms:

• Direct Collection — Account Registration: When you create a tbage account, you directly provide identity data, contact data, and financial data via the registration form.
• Direct Collection — Transactions: When you make a deposit or request a withdrawal, you provide financial data to our payment processing partners, which is then confirmed to tbage.
• Direct Collection — KYC Submission: When you submit identity documents for verification (triggered when you first request a withdrawal or when requested by our compliance team), you provide identity data directly by uploading documents.
• Direct Collection — Support Interactions: When you contact tbage via live chat or email, you provide communications data directly.
• Automated Collection — Platform Activity: As you browse and use tbage.io, we automatically collect technical data and usage data via server logs, session tracking, and first-party cookies and similar technologies (see Section 6).
• Third-Party Sources: tbage may receive data from identity verification providers (to confirm the authenticity of documents you submit), payment processors (to confirm transaction status), and fraud-detection services (to flag unusual activity patterns).

tbage uses the personal data it collects for the following specific purposes, each supported by a lawful basis:

• Account Creation and Management — To register your account, authenticate your identity on login, maintain your account settings, and process account closure requests. Lawful basis: contractual necessity.
• Payment Processing — To process deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, reconcile your account balance, and manage refunds or disputed transactions. Lawful basis: contractual necessity.
• Identity Verification (KYC) — To verify your identity and age (you must be 21 or older) in compliance with our platform policies, and to satisfy anti-money laundering obligations. Lawful basis: legal obligation; contractual necessity.
• Fraud and Security — To detect, investigate, and prevent fraudulent transactions, account takeovers, collusion, bonus abuse, and other prohibited conduct on the Platform. Lawful basis: legitimate interests.
• Responsible Gaming — To monitor player activity for signs of problem gambling, enforce self-imposed limits and cooling-off periods, and fulfil our duty of care to players. Lawful basis: legitimate interests; legal obligation.
• Customer Support — To respond to your support queries, investigate complaints, and maintain records of resolutions for quality assurance and dispute-resolution purposes. Lawful basis: contractual necessity; legitimate interests.
• Promotional Communications — To send you relevant bonus offers, tournament invitations, and tbage news where you have opted in to receive such communications. Lawful basis: consent.
• Platform Analytics and Improvement — To analyse how players use tbage.io, identify technical issues, improve game recommendations, and enhance the overall user experience. Lawful basis: legitimate interests.
• Legal Compliance — To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions. Lawful basis: legal obligation.

tbage does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without human review, except where required by fraud-detection or AML obligations, in which case you have the right to request human review of any automated decision affecting your account.

tbage uses cookies and similar tracking technologies (such as local storage and session tokens) on tbage.io to support the operation of the Platform and to collect technical and usage data as described in this Policy.

The categories of cookies tbage uses are:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without breaking the Platform.
• Functional Cookies: Used to remember your preferences such as language settings, lobby view preferences, and responsible gaming tool settings. These improve your experience but are not strictly required.
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how players navigate tbage.io, which pages are most visited, and where technical errors occur. This data helps tbage improve the Platform.
• Security Cookies: Used by our fraud and bot-detection systems to distinguish legitimate player traffic from automated or malicious activity.

tbage does not use third-party advertising cookies or behavioural tracking cookies that follow your activity across other websites. Our cookie footprint is limited to what is necessary to operate and secure the Platform.

tbage does not sell, rent, lease, or trade your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa/Mastercard acquiring banks, and related payment infrastructure providers receive the financial data necessary to process your transactions. These parties are bound by their own regulatory obligations and data protection commitments.
• Identity Verification Providers: Where you submit KYC documents, tbage uses third-party identity verification services to authenticate those documents. These providers process your identity data solely for verification purposes under strict data processing agreements.
• Fraud and Security Vendors: tbage works with specialist fraud-detection and cybersecurity vendors who may receive technical and usage data to help identify and prevent fraudulent activity on the Platform.
• IT and Infrastructure Providers: Cloud hosting providers, database providers, and content delivery network providers that store and process Platform data on tbage's behalf under data processing agreements that restrict their use of the data.
• Legal and Regulatory Authorities: Where tbage is required by law, court order, or lawful regulatory request to disclose personal data, we will comply. We will notify affected players of such disclosures where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, asset sale, or restructuring involving tbage, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

All third-party data processors engaged by tbage are required to process data strictly in accordance with tbage's documented instructions, maintain appropriate technical and organisational security measures, and not use the data for any purpose other than the one for which it was shared.

tbage's primary player base is in Bangladesh. Some of the third-party service providers we work with — including cloud infrastructure providers and fraud-detection vendors — may process data on servers located outside of Bangladesh. Where such international transfers occur, tbage takes appropriate steps to ensure that your data receives an equivalent level of protection to that applied within Bangladesh.

These steps may include entering into standard contractual clauses with the receiving party, relying on the receiving party's participation in a recognised data protection framework, or conducting a transfer impact assessment to verify that the destination jurisdiction offers adequate protections in practice.

If you would like further information about the safeguards applied to any particular international transfer of your data, please contact us using the details in Section 15.

tbage retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account and for a minimum of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping obligations.
• KYC Documents: Retained for the duration of the account relationship and for 5 years post-closure, or longer if required by applicable law or an ongoing investigation.
• Support and Communications Data: Retained for 3 years from the date of the interaction, or for the duration of any unresolved dispute to which the communication is relevant.
• Technical and Usage Data: Retained in identifiable form for up to 13 months, after which it is aggregated and anonymised for long-term analytics purposes.
• Marketing Preference Data: Retained until you withdraw consent for marketing communications, at which point your opt-in record is archived (but not deleted) to demonstrate your prior consent and the withdrawal thereof.
• Responsible Gaming Records: Self-exclusion records and limit-setting history are retained for the full duration of your account and for 5 years post-closure to support responsible gaming compliance.

When a retention period expires, tbage will securely delete the data or render it permanently anonymous so that it can no longer be associated with you as an individual. Deletion is conducted using methods that prevent recovery of the deleted data.

As a data subject, you hold the following rights in respect of your personal data held by tbage. To exercise any of these rights, contact us using the details in Section 15. We will respond to all verified data rights requests within 14 days.

• Right of Access: You may request a copy of all personal data tbage holds about you, together with information about the purposes for which it is processed and any third parties with whom it has been shared.
• Right to Rectification: If any personal data tbage holds about you is inaccurate or incomplete, you may request that we correct or complete it.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where you object to processing based on legitimate interests and tbage has no overriding grounds. Note that this right is subject to tbage's legal retention obligations — we cannot delete data we are legally required to retain.
• Right to Restriction: You may request that tbage restricts processing of your data in certain circumstances, such as while the accuracy of data is being contested or while an objection is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing of your personal data that is based on tbage's legitimate interests. tbage will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based solely on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right Not to Be Subject to Automated Decisions: You have the right to request human review of any decision made solely by automated means that has a significant effect on you, such as a fraud-related account suspension.

The tbage Platform is strictly for adults aged 21 years and above. tbage does not knowingly collect personal data from individuals under the age of 21. The Platform is not directed at or intended for use by minors.

If tbage becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the relevant account, delete all personal data associated with that account, and void any balances or winnings accumulated during the period of underage access.

If you believe that a minor has accessed or registered an account on tbage.io, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

tbage implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and tbage.io is encrypted in transit using industry-standard TLS 1.2 or higher.
• AES-256 Encryption at Rest: Sensitive personal and financial data stored on tbage's infrastructure is encrypted at rest using AES-256.
• Access Controls: Access to personal data is restricted to tbage personnel with a demonstrated need for access in order to perform their role. All internal access is logged and audited.
• Multi-Factor Authentication: Administrative access to tbage's core systems requires multi-factor authentication.
• Intrusion Detection and Monitoring: tbage employs continuous automated monitoring for anomalous access patterns, potential intrusions, and data exfiltration attempts.
• Penetration Testing: The Platform undergoes periodic security assessments and penetration tests by qualified security professionals.
• Staff Training: All tbage personnel with access to personal data receive regular data protection and security awareness training.

While tbage takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You also play a role in protecting your account — please use a strong, unique password for your tbage account, do not share your login credentials with anyone, and contact us immediately if you suspect unauthorised access to your account.

tbage.io may contain references to third-party game providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) and payment partners (such as bKash, Nagad, and Rocket). While these providers deliver games and payment functionality within the tbage Platform, they operate under their own privacy policies and data practices.

tbage is not responsible for the privacy practices of any third-party provider whose services are integrated into the Platform. We encourage you to review the privacy policies of any third party whose services you interact with. tbage's Privacy Policy applies solely to data collected and processed by tbage in connection with the tbage.io Platform.

tbage reserves the right to amend or update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform functionality, or data processing practices. The effective date at the top of this Policy indicates when the current version was last reviewed and approved.

Where an amendment is material — meaning it significantly changes the way tbage processes your personal data or reduces your rights under this Policy — tbage will notify registered players via email or via a prominent in-Platform notification at least 14 days before the amendment takes effect. Your continued use of the Platform after the effective date of a material amendment constitutes acceptance of the updated Policy.

For non-material amendments (such as typographical corrections, clarifications of existing practices, or updates to contact details), tbage will update this page without prior notice. We recommend reviewing this Policy periodically to stay informed of how we protect your data.

A record of previous versions of this Policy is available upon written request to our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights as described in Section 10, or have a concern about how tbage has handled your personal data, please contact our support team:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the tbage.io Platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 14 days

If you submit a data rights request, please include your registered email address, a brief description of your request, and a form of identity confirmation so that we can process your request securely and efficiently.

If you are not satisfied with tbage's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. tbage is committed to cooperating fully with any regulatory investigation arising from a complaint about our data practices.