Privacy Policy
— How tk baje Protects Your Data

tk baje collects personal data from you in three principal ways: information you provide directly when registering and using the platform, information generated automatically by your use of the platform, and information received from trusted third-party sources as part of our legal compliance obligations. We are committed to collecting only the minimum data necessary for each purpose.

Information You Provide Directly

When you register an account, use platform features, or contact our support team, you may provide the following categories of personal data:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification numbers (e.g., Bangladesh National ID / NID number, Passport number).
• Contact Data: Email address, mobile phone number, and residential address (including city, district, and postcode — relevant for players in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and other locations across Bangladesh).
• Financial Data: Payment method details including bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details (for Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank transfers), and Visa/Mastercard card details. Full card numbers are never stored by tk baje — card processing is handled by our PCI-DSS compliant payment processor.
• KYC Verification Documents: Scanned copies or photographs of your National ID Card, Passport, Birth Certificate, utility bills, or bank statements submitted for identity and age verification purposes.
• Account Credentials: Your chosen username and an encrypted hash of your password. We never store passwords in plain text.
• Communications Data: Records of any correspondence between you and tk baje via live chat, email ([email protected]), or WhatsApp (+880 1700 000000), including support ticket content.
• Responsible Gaming Data: Any deposit limits, session time limits, self-exclusion requests, or cool-off periods you set on your account.

Information Collected Automatically

When you access the tk baje platform, our systems automatically collect certain technical and behavioural data, including:

• Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, features used, games played, bet history, session duration, time and date of access (recorded in Bangladesh Standard Time, BST UTC+6), and navigation paths through the platform.
• Transaction Data: Details of all deposits, withdrawals, bonus claims, wagers, and game outcomes associated with your account.
• Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS-level location data unless you explicitly grant permission via a mobile browser.

Information from Third Parties

tk baje may receive information about you from the following third-party sources:

• Payment Processors: Transaction confirmation and status updates from bKash, Nagad, Rocket, Upay, and banking partners to verify deposits and withdrawals.
• Identity Verification Services: Results of automated identity and document verification checks conducted via our KYC compliance partners.
• Fraud Prevention Services: Risk scores and flagging data from third-party fraud detection systems used to protect the integrity of the platform.
• Game Providers: Game outcome data and session logs from Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt, and other integrated studios, for dispute resolution and auditing purposes.

tk baje processes your personal data only for lawful, specified, and transparent purposes. The following table sets out the primary purposes for which we use your data, together with the legal basis for each processing activity.

Marketing Communications

tk baje will only send you promotional emails, SMS messages, or push notifications if you have explicitly opted in to receive them during account registration or via your account preferences. You may withdraw your consent to marketing communications at any time by updating your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Automated Decision-Making

tk baje uses automated systems for certain processing activities including fraud risk scoring, AML transaction monitoring, and responsible gaming alerts. Where an automated decision has a significant effect on your account (for example, triggering an account freeze pending a fraud review), you have the right to request human review of that decision by contacting our compliance team at [email protected].

tk baje does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf and under our instruction. These include:

• Payment Processors: bKash, Nagad, Rocket, Upay, and banking partners process payment transaction data to facilitate deposits and withdrawals in Bangladeshi Taka (৳).
• KYC & Identity Verification Providers: Third-party compliance technology vendors that assist with automated document verification and age checks.
• Fraud & Risk Management Platforms: Services that analyse transaction patterns and device data to detect and prevent fraudulent activity.
• Cloud Infrastructure & Hosting Providers: Secure server and database infrastructure providers where platform data is stored and processed.
• Customer Support Software: Live chat and ticketing system providers through which player support communications are managed.
• Game Studios: Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt, and other integrated studios may receive session-level data for game outcome certification and dispute resolution. They act as independent data controllers for their own platform data.

All service providers are bound by contractual data processing agreements that prohibit them from using your personal data for any purpose other than fulfilling services for tk baje.

Legal & Regulatory Disclosure

tk baje may be required to disclose personal data to government authorities, regulators, law enforcement agencies, or courts where required by applicable law, legal process, or in response to a lawful request. This includes disclosure required under anti-money laundering legislation, tax obligations, or court order. Where permitted by law, tk baje will attempt to notify you of such a disclosure request before complying.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the tk baje business, your personal data may be transferred to the acquiring or successor entity as part of that transaction. You will be notified of any such transfer and any change to the applicable privacy policy via your registered email address.

International Data Transfers

As an internationally licensed offshore platform, some of tk baje's service providers and infrastructure may be located outside of Bangladesh. Where personal data is transferred internationally, tk baje ensures that appropriate safeguards are in place — including standard contractual clauses or equivalent measures — to protect your data to the same standard as set out in this Privacy Policy.

tk baje uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage objects) on our platform to provide core functionality, enhance your experience, and analyse platform performance. This section explains what types of cookies we use and how you can manage them.

What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to recognise your device across sessions and store preferences and session data. Cookies set by tk baje are first-party cookies; cookies set by third-party services (such as analytics or game providers) are third-party cookies.

Types of Cookies We Use

Managing Your Cookie Preferences

You can manage non-essential cookies through your browser settings. Most browsers allow you to block, delete, or receive notifications about cookies. Please note that disabling strictly necessary cookies may prevent the tk baje platform from functioning correctly — for example, you may be unable to log in or maintain a session. Instructions for managing cookies in common browsers are available via the respective browser's help documentation. Blocking third-party cookies will not affect your ability to play games but may affect session continuity within embedded game frames.

tk baje implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security posture includes the following key controls:

• Transport Encryption: All data transmitted between your browser or mobile device and our servers is protected using TLS 1.2 or higher (SSL). This applies to all page loads, login requests, payment submissions, and API calls.
• Data Encryption at Rest: Sensitive data fields — including KYC documents, financial account references, and identification numbers — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Password Security: User passwords are never stored in plain text. Passwords are hashed using a strong one-way cryptographic algorithm with a unique salt per user, rendering stolen password hashes computationally infeasible to reverse.
• Access Controls: Access to personal data within tk baje's internal systems is restricted to authorised personnel only, based on role-based access controls (RBAC) and the principle of least privilege. All internal access to personal data is logged and auditable.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable OTP-based two-factor authentication on their accounts. All internal admin systems require multi-factor authentication.
• Security Monitoring: tk baje operates continuous security monitoring, intrusion detection, and alerting systems. In the event of a detected or suspected data breach, our incident response procedures are activated immediately.
• Regular Audits: Our platform undergoes periodic security assessments and vulnerability scans conducted by qualified security professionals.

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, tk baje will notify affected players via their registered email address without undue delay, and in any case within 72 hours of becoming aware of the breach where technically feasible. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it.

tk baje respects your rights over your personal data. The following rights are available to you as a player on our platform. To exercise any of these rights, contact our support team at [email protected] with your registered email address and a clear description of your request. We aim to respond to all privacy rights requests within 30 calendar days.

Right of Access

You have the right to request a copy of the personal data that tk baje holds about you, together with information about how it is being used, who it has been shared with, and how long it will be retained. This is commonly known as a Subject Access Request (SAR). We will provide your data in a structured, machine-readable format where technically feasible.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For certain data categories (such as registered name or date of birth), a correction request may require you to provide updated verification documentation.

Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where you object to processing based on legitimate interests and there are no overriding grounds. Please note that tk baje is required by law to retain certain categories of data — particularly KYC identity records, transaction history, and AML compliance records — for defined periods even after your account is closed. Erasure requests will be fulfilled to the maximum extent permitted by these legal obligations.

Right to Restriction of Processing

You may request that tk baje restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is disputed, or while an objection to processing is being assessed.

Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another data controller where technically feasible.

Right to Object

You have the right to object to the processing of your personal data where tk baje relies on legitimate interests as its legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims. You may also object at any time to processing of your data for direct marketing purposes — this objection is absolute and will always be honoured.

Right to Withdraw Consent

Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawing consent to marketing does not affect your ability to continue using the tk baje platform.

tk baje retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention schedule sets out the standard periods applied to each data category:

After the applicable retention period expires, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data is anonymised rather than deleted, it may be retained indefinitely in aggregate statistical form for platform analytics purposes.

Updates to this Privacy Policy

tk baje reserves the right to update or amend this Privacy Policy at any time. The most current version will always be accessible on this page at tk-baje.com/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Where a change is material — for example, a new category of data being collected, or a new purpose for processing — tk baje will notify registered players via their registered email address prior to the change taking effect. Your continued use of the tk baje platform following notification of a material update constitutes your acceptance of the revised Privacy Policy.

Children's Privacy

The tk baje platform is strictly for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data has been collected from a minor, that account will be immediately closed and all associated personal data will be deleted. If you believe a minor has registered on the platform, please notify our support team immediately.

Contact Our Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or the way tk baje handles your personal data, please contact us using the details below. All privacy-related enquiries are handled by our compliance and data protection team.

• Email: [email protected] — include "Privacy Request" in the subject line
• WhatsApp: +880 1700 000000 (10 AM – 10 PM BST, UTC+6)
• Live Chat: Available 24/7 via the tk baje platform

We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a full response within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.