Privacy Policy — How 13tbaje Handles Your Data

Section 01

Data We Collect

13tbaje collects personal data from users through multiple touchpoints across the Platform. The categories of data we collect, and the context in which each is gathered, are described below.

1.1 Registration Data

When you create a 13tbaje account, we collect the information necessary to establish and verify your identity and to link your account to a valid payment method. This includes:

1.2 Financial & Transaction Data

To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, we collect and retain the following transaction data:

• Mobile wallet numbers (bKash, Nagad, Rocket, Upay) used for deposits or withdrawal requests
• Bank account details and internet banking reference numbers where applicable
• Transaction reference identifiers, deposit and withdrawal amounts in BDT, timestamps
• Card type (Visa/Mastercard), last four digits, and billing postcode (full card numbers are never stored on Platform servers)

1.3 Gameplay & Behavioural Data

We automatically collect data relating to your activity on the Platform in order to deliver a personalised gaming experience, detect fraud, and fulfil our responsible gaming obligations. This includes game session logs, bet histories, wagering patterns, win/loss records, session durations, login timestamps, and device identifiers.

1.4 Technical & Device Data

When you access 13tbaje from any device, our servers automatically record technical data including your IP address, browser type and version, operating system, screen resolution, referring URL, and pages visited within the Platform. This data is used for security monitoring, fraud prevention, and service optimisation.

Section 02

How We Use Your Data

13tbaje processes your personal data only for specified, explicit, and legitimate purposes. The table below sets out the primary purposes for which we use your data and the legal basis under which each processing activity is conducted.

13tbaje does not sell your personal data to third parties for their own marketing purposes. Where we send you promotional communications about 13tbaje offers — such as BPL season bonuses, Eid special promotions, or tournament-related free spins — we do so only where you have either opted in to marketing communications at registration or have not opted out following a prior transaction relationship. You may withdraw consent for marketing communications at any time by contacting [email protected] or updating your account notification preferences.

Section 03

Cookies & Tracking Technologies

13tbaje uses cookies and similar tracking technologies to ensure the Platform functions correctly, to improve user experience, and to support security monitoring. A cookie is a small text file placed on your device by our web server when you visit the Platform. The cookies we use fall into the following categories:

• Strictly Necessary Cookies: These are required for the Platform to operate. They manage your login session, remember your account state between pages, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core Platform functionality.
• Analytical Cookies: We use first-party analytics to understand how users navigate the Platform — which game categories attract the most sessions, where users drop off during registration, and which payment methods are most frequently used. This data is aggregated and does not identify individual users by name.
• Functional Cookies: These remember your preferences such as language settings, preferred display currency (BDT), and responsible gaming limits you have set, so that your personalised settings persist across sessions.
• Security Cookies: These assist in detecting and mitigating fraudulent activity, bot traffic, and account takeover attempts by monitoring login patterns and device fingerprints.

Most web browsers allow you to control cookie settings through their privacy or settings menu. You may restrict or delete cookies at the browser level; however, disabling strictly necessary cookies will prevent you from logging in to your 13tbaje account. 13tbaje does not use third-party advertising cookies or behavioural retargeting pixels.

Section 04

Data Sharing & Disclosure

13tbaje shares your personal data only in the limited circumstances described in this section. We do not sell, rent, or trade your personal data to unaffiliated third parties for their commercial purposes.

4.1 Service Providers

We engage a number of carefully selected service providers who process data on our behalf in order to deliver Platform services. These include payment processing partners (bKash, Nagad, Rocket, Upay, and card processing networks including Visa and Mastercard), KYC and identity verification providers, game content suppliers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), and IT infrastructure and hosting providers. All such providers are bound by data processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to 13tbaje.

4.2 Legal & Regulatory Disclosure

13tbaje may disclose personal data to law enforcement agencies, regulatory authorities, courts, or other public bodies where we are legally required to do so, where disclosure is necessary to protect the safety or rights of a third party, or where disclosure is required to investigate, prevent, or act upon suspected fraud, money laundering, or other illegal activity.

4.3 Business Transfers

In the event that 13tbaje undergoes a merger, acquisition, restructuring, or sale of all or a substantial portion of its assets, user personal data may be transferred to the acquiring entity as part of that transaction. In any such scenario, we will notify affected users via email or prominent Platform notice prior to the transfer of their data, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

4.4 Aggregated & Anonymised Data

We may share aggregated, anonymised, or de-identified data — data that cannot reasonably be used to identify any individual — with business partners, research bodies, or the public for the purposes of industry analysis, product development, or marketing. No individual user can be identified from such data.

Section 05

Data Retention

13tbaje retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, or to resolve disputes and enforce our agreements. The following retention periods apply:

• Account and identity data (name, date of birth, NID) is retained for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations.
• Financial transaction records are retained for a minimum of seven (7) years following the date of each transaction, consistent with standard financial record-keeping requirements applicable to payment service providers.
• Gameplay and bet history data is retained for five (5) years to support dispute resolution, responsible gaming monitoring, and fraud investigation.
• KYC documentation (identity documents, utility bills) is retained for five (5) years following account closure or the completion of the relevant KYC review, whichever is later.
• Marketing communication preferences and opt-out records are retained for as long as your account remains active and for three (3) years thereafter, to evidence consent or withdrawal of consent.
• Technical and device log data (IP addresses, session logs) is retained for twelve (12) months for security monitoring purposes, after which it is automatically purged or anonymised.

When the applicable retention period expires, your data is securely deleted or anonymised such that it can no longer be associated with you as an individual. In some cases, data may be retained beyond these standard periods where an active legal dispute, regulatory investigation, or law enforcement request requires continued preservation of specific records.

Section 06

Your Privacy Rights

As a user of the 13tbaje Platform, you hold a number of rights in relation to your personal data. We are committed to honouring these rights promptly and without undue restriction. The rights available to you are set out below.

• Right of Access: You may request a copy of the personal data we hold about you at any time. We will provide this within 30 days of a verified request. The first copy is provided free of charge; subsequent requests within a 12-month period may attract a reasonable administrative fee.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain information (such as your email address or contact number) directly through your account settings; other corrections require a support request.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent is the legal basis). This right is subject to our legal obligations to retain certain records, as described in the Data Retention section above.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances, for example while a rectification request is under review, or while you exercise your right to object.
• Right to Object: You may object to the processing of your personal data where that processing is based on our legitimate interests. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).

To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Privacy Rights Request". We may ask you to verify your identity before processing your request, in order to protect against unauthorised access to your data by third parties. We will respond to all valid requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

Section 07

Data Security

13tbaje implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security posture is reviewed and updated on a regular basis to address evolving threats.

• All data transmitted between your device and the 13tbaje Platform is encrypted in transit using TLS 1.2 or higher (SSL encryption). Our SSL certificate is maintained continuously and monitored for expiry.
• Passwords are stored using a one-way cryptographic hash function with individual salt values. Plain-text passwords are never stored in our database and are not accessible even to our engineering team.
• Personal data at rest is stored on encrypted database servers hosted in secure data centres with physical access controls, CCTV monitoring, and restricted staff entry.
• Access to personal data within the 13tbaje organisation is restricted on a strict need-to-know basis. All staff with access to user data undergo background screening and are bound by confidentiality obligations.
• Our security team conducts regular penetration testing and vulnerability assessments of Platform infrastructure to proactively identify and remediate security weaknesses before they can be exploited.
• In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and no later than 72 hours after becoming aware of the breach.

Section 08

Contact & Policy Updates

If you have any questions, concerns, or complaints about this Privacy Policy or about the way 13tbaje processes your personal data, please contact our Data Privacy team using the details below. We are committed to resolving all privacy-related enquiries promptly and in good faith.

Policy Updates

13tbaje reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes to this Policy, we will update the effective date at the top of this page and, where the changes are significant, notify registered users via their registered email address or via a prominent notice within the Platform at login.

We encourage you to review this Privacy Policy periodically. Your continued use of the 13tbaje Platform following the publication of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with a revised Policy, please contact us to discuss your options or request account closure.