Privacy Policy — How tbd22 Collects, Uses & Protects Your Data
At tbd22, protecting the personal data of our players across Bangladesh is a core responsibility — not an afterthought. This Privacy Policy explains exactly what data we collect, why we collect it, how it is stored and shared, and what rights you hold over your information.
Your Data, Your Rights
These six cards summarise tbd22's core privacy commitments. They are provided for convenience and do not replace the complete Privacy Policy text below, which governs all data processing activities on the tbd22 platform.
Data We Collect
tbd22 collects registration details (name, email, phone number), identity documents for KYC, payment transaction records, device and browser technical data, and in-platform activity logs. We collect only what is necessary to deliver a safe, compliant service.
Why We Use It
Your data is used to verify your identity, process deposits and withdrawals in BDT, deliver customer support, prevent fraud and money laundering, personalise your gaming experience, and send promotional communications only where you have opted in.
Who We Share It With
tbd22 shares personal data only with carefully selected third-party service providers — including KYC verification partners, payment processors (bKash, Nagad, Rocket), and licensed game providers — who are contractually bound to protect your data.
How Long We Keep It
Active account data is retained for the lifetime of your tbd22 account plus a minimum five-year post-closure period for regulatory compliance. Transaction and KYC records may be retained for up to seven years to meet applicable financial reporting obligations.
Your Rights
You have the right to access, correct, or request deletion of your personal data held by tbd22. You may also object to certain processing activities, withdraw marketing consent at any time, and request a portable copy of your data by contacting [email protected].
How We Protect It
tbd22 uses industry-standard SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest, role-based access controls, regular security audits, and secure data centres to ensure your personal information remains protected at all times.
Contents
- 1. Introduction
- 2. Data Controller
- 3. Data We Collect
- 4. How We Collect Data
- 5. Legal Basis for Processing
- 6. How We Use Your Data
- 7. Sharing Your Data
- 8. Cookies & Tracking
- 9. Data Retention
- 10. Data Security
- 11. Your Rights
- 12. Children & Minors
- 13. International Transfers
- 14. Third-Party Links
- 15. Policy Updates
- 16. Contact Us
1. Introduction
This Privacy Policy ("Policy") describes how tbd22 ("tbd22", "the Platform", "we", "us", "our") collects, processes, stores, and shares personal data belonging to individuals ("you", "the Player", "the User") who visit, register on, or otherwise interact with the tbd22 online casino and sports betting platform, accessible at https://tbd22.io and all associated mobile interfaces, subdomains, and related services (collectively, "the Service").
tbd22 is committed to handling personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. We recognise that players across Bangladesh — from Dhaka and Chittagong to Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh — place significant trust in tbd22 when they share their personal information with us. This Policy details exactly how that trust is honoured.
This Privacy Policy forms an integral part of the tbd22 Terms & Conditions. By registering a tbd22 account, making a deposit, or otherwise using the Service, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
Language Notice: This Privacy Policy is written in English. In the event of any inconsistency between this English version and any translated version, the English version shall take precedence in all matters.
2. Data Controller
For the purposes of applicable data protection law, tbd22 is the data controller responsible for your personal data. As data controller, tbd22 determines the purposes for which and the manner in which your personal data is processed. All enquiries relating to this Policy, data subject rights requests, and data protection concerns should be directed to tbd22's designated Privacy team via email at [email protected], clearly marking the subject line as "Privacy Policy Enquiry" or "Data Subject Request".
tbd22 does not have a physical walk-in presence in Bangladesh. All interactions, including data subject rights requests and privacy complaints, are handled exclusively through our digital support channels. Our support team is available 24 hours a day, 7 days a week via the live chat feature available within the tbd22 platform (login required), and via email at [email protected].
3. Data We Collect
tbd22 collects personal data across several categories, each serving a distinct and lawful purpose. The categories of personal data we collect are as follows:
3.1 Registration & Identity Data
- Full legal name as it appears on your Bangladesh National Identity Card (NID) or passport;
- Date of birth (used for age verification — players must be 21 years or older);
- Gender (optional, collected for demographic analytics only);
- Email address (primary communication channel);
- Bangladesh mobile phone number (+880 prefix);
- Residential address including city, district, and postal code.
3.2 Identity Verification (KYC) Data
- Scanned or photographed copies of government-issued identity documents (NID front and back, passport biographical page, or birth certificate with secondary ID);
- Selfie photograph taken while holding the submitted identity document;
- Proof of address documentation (utility bill or bank statement issued within 90 days);
- Source-of-funds documentation for transactions above applicable thresholds.
3.3 Financial & Transaction Data
- Deposit and withdrawal amounts, dates, times, and transaction reference numbers;
- Mobile wallet identifiers (bKash, Nagad, Rocket, Upay account numbers) associated with deposits and withdrawals;
- Bank account details (account holder name, account number, bank name and branch) where bank transfer payment methods are used;
- Card details — for Visa and Mastercard transactions, only truncated card numbers (last four digits) are stored by tbd22; full card numbers are processed exclusively by our PCI-DSS-compliant payment processor and are never retained on tbd22 infrastructure.
3.4 Gaming Activity Data
- Game history: games played, bet amounts, outcomes, session durations, and win/loss records;
- Sports betting history: markets wagered on, bet amounts, odds accepted, and settlement outcomes;
- Bonus and promotion activity: bonuses claimed, wagering progress, and bonus expiry records;
- Responsible gaming tool usage: deposit limits set, cooling-off periods activated, and self-exclusion history.
3.5 Technical & Device Data
- IP address at the time of registration and at each login;
- Device type, operating system, and browser version;
- Mobile device identifiers (where the tbd22 mobile interface is used);
- Session timestamps, login and logout records, and approximate geographic location derived from IP address.
3.6 Communication Data
- Content of customer support interactions (live chat transcripts, email correspondence);
- Records of marketing communications sent to you and your response or opt-out actions;
- Feedback, survey responses, and complaints submitted to tbd22.
Minimum Necessary Principle: tbd22 applies a data minimisation approach. We collect only the personal data that is strictly necessary for the purposes identified in Section 6. We do not collect sensitive special-category data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless specifically required for a responsible gaming assessment you have requested.
4. How We Collect Your Data
tbd22 collects personal data through the following channels and mechanisms:
- Directly from you: When you complete the tbd22 registration form, submit KYC documentation, make a deposit or withdrawal, place a bet, contact our support team, respond to a survey, or update your account profile;
- Automatically through platform usage: When you browse the tbd22 website or mobile interface, our systems automatically collect technical and device data as described in Section 3.5, including through the use of cookies and similar tracking technologies (see Section 8);
- From third-party service providers: tbd22 may receive personal data from third-party KYC verification providers (for NID cross-referencing and identity authentication), payment processors (for transaction confirmation and fraud screening), and fraud detection services (for risk scoring based on device and behavioural signals);
- From public sources: In limited circumstances, tbd22 may cross-reference publicly available information (such as publicly accessible court records or sanctions lists) as part of our anti-money laundering (AML) compliance obligations.
5. Legal Basis for Processing
tbd22 processes your personal data under one or more of the following legal bases, depending on the nature and purpose of the processing activity:
| Legal Basis | Processing Activities Covered |
|---|---|
| Contractual Necessity | Processing required to deliver the tbd22 service you have registered for, including account management, processing deposits and withdrawals, game delivery, and customer support. |
| Legal Obligation | KYC identity verification, anti-money laundering (AML) screening, age verification (21+), record-keeping for financial compliance, and responding to lawful requests from regulatory authorities. |
| Legitimate Interests | Fraud detection and prevention, platform security monitoring, responsible gaming risk assessment, improving platform features and performance, and conducting aggregate analytics to understand player behaviour patterns. |
| Consent | Sending promotional emails, SMS marketing, or bonus notifications where you have actively opted in. You may withdraw this consent at any time by contacting [email protected] or updating your communication preferences in account settings. |
6. How We Use Your Personal Data
The personal data collected by tbd22 is used for the following specific purposes:
- Account Registration & Authentication: Creating and maintaining your tbd22 player account, verifying your identity at registration and during subsequent logins, and enabling account recovery where necessary;
- Age Verification: Confirming that all players accessing the tbd22 platform are aged 21 years or above, in strict compliance with our minimum age policy;
- Payment Processing: Facilitating BDT deposits via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and supported bank partners, and processing withdrawal requests to your verified payment methods;
- KYC Compliance: Verifying your identity and source of funds as required by anti-money laundering obligations before processing withdrawal requests above applicable thresholds;
- Fraud Prevention & Security: Detecting and preventing fraudulent account activity, unauthorised access, bonus abuse, multi-accounting, payment fraud, and other prohibited activities outlined in the tbd22 Terms & Conditions;
- Customer Support: Responding to your enquiries, resolving account disputes, processing complaints, and providing account management assistance;
- Responsible Gaming: Monitoring gaming patterns for indicators of problem gambling behaviour, applying responsible gaming tools (deposit limits, cooling-off periods, self-exclusion) at your request, and reaching out proactively where our systems flag a potential concern;
- Platform Personalisation: Tailoring the tbd22 interface to your preferences, including game recommendations based on your play history and promotional offers relevant to your activity profile;
- Marketing Communications: Sending you bonus offers, promotions, and seasonal campaigns (such as Eid, Pohela Boishakh, or BPL special events) where you have provided explicit marketing consent;
- Legal & Regulatory Compliance: Maintaining records required by applicable law, responding to lawful information requests from regulatory or law enforcement authorities, and enforcing tbd22's Terms & Conditions.
7. Sharing Your Personal Data
tbd22 does not sell your personal data to third parties for their own marketing purposes. Your personal data is shared only in the following circumstances and only to the minimum extent necessary:
7.1 Service Providers (Data Processors)
tbd22 engages trusted third-party service providers to assist in delivering the platform. These providers process your data solely on tbd22's behalf and under binding data processing agreements that prohibit unauthorised use. Categories of service providers include:
- KYC & Identity Verification Providers: Third-party platforms that cross-reference your submitted identity documents against NID databases and watchlists;
- Payment Processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks that process financial transactions on the tbd22 platform;
- Game Suppliers: Licensed game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, who deliver games to the tbd22 platform. These providers may receive anonymised session data for game integrity and fairness auditing purposes;
- Fraud Detection & Security Partners: Providers that analyse technical and behavioural signals to identify suspicious activity on the platform;
- Cloud Infrastructure & Hosting Providers: Data centre and cloud service providers responsible for the secure hosting of the tbd22 platform and its associated databases.
7.2 Legal & Regulatory Disclosure
tbd22 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts when required to do so by applicable law, a valid court order, or a legitimate regulatory request. In such circumstances, tbd22 will disclose only the minimum data necessary to satisfy the legal obligation and, where permitted by law, will notify the affected player of the disclosure.
7.3 Business Transfers
In the event of a merger, acquisition, sale of assets, or corporate restructuring involving tbd22, your personal data may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity assuming the data protection obligations set out in this Privacy Policy. You will be notified of any such transfer and the identity of the new data controller prior to the transfer taking effect.
No Sale of Data: tbd22 strictly prohibits the sale or rental of your personal data to any third party for commercial marketing purposes. Any third party receiving your data from tbd22 does so exclusively as a service provider operating under tbd22's instructions and data protection standards.
8. Cookies & Tracking Technologies
The tbd22 platform uses cookies and similar tracking technologies to enable core platform functionality, improve your user experience, and gather aggregated analytics data. The following categories of cookies may be placed on your device when you visit tbd22:
- Strictly Necessary Cookies: These cookies are essential for the platform to function correctly. They enable core features such as maintaining your login session, remembering your language and currency preferences, and securing your account during active sessions. These cookies cannot be disabled without breaking core platform functionality;
- Analytics & Performance Cookies: These cookies collect anonymised information about how visitors use the tbd22 platform — such as which pages are visited most frequently, how long sessions last, and where users navigate from. This data helps tbd22 identify areas for improvement. No personally identifiable information is collected through analytics cookies;
- Functionality Cookies: These cookies remember your preferences (such as your preferred game lobby view, notification settings, and responsible gaming configurations) to provide a personalised experience across sessions;
- Marketing & Targeting Cookies: Where you have provided marketing consent, tbd22 may use cookies to track which promotional content you have viewed and interacted with, enabling more relevant bonus offers to be presented to you during future sessions.
Cookie Management: You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to use core tbd22 features, including logging in and placing bets. Disabling analytics or marketing cookies will not affect your ability to use the platform.
9. Data Retention
tbd22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | Legal obligation & contract |
| KYC & Identity Documents | Duration of account + 7 years post-closure | AML regulatory requirement |
| Financial Transaction Records | 7 years from transaction date | Financial reporting obligation |
| Gaming Activity Logs | Duration of account + 3 years post-closure | Dispute resolution & fair play |
| Customer Support Records | 3 years from last interaction | Legitimate interest & dispute resolution |
| Marketing Consent Records | Duration of consent + 3 years | Legal obligation (consent records) |
| Technical & Device Logs | 13 months from collection | Security monitoring |
Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes without restriction.
10. Data Security
tbd22 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- Encryption in Transit: All data transmitted between your device and the tbd22 platform is protected using industry-standard TLS 1.2 / 1.3 encryption, indicated by the HTTPS padlock in your browser address bar;
- Encryption at Rest: Sensitive data stored in tbd22's databases — including identity documents, payment details, and KYC records — is encrypted using AES-256 encryption;
- Access Controls: Access to personal data within tbd22's internal systems is governed by role-based access control (RBAC) policies. Only personnel who require access to your data to perform their legitimate job functions are authorised to view it;
- Two-Factor Authentication: tbd22 staff access to systems containing personal data requires multi-factor authentication (MFA). Players are also encouraged to enable SMS-based two-step verification on their accounts;
- Regular Security Audits: tbd22 conducts periodic security assessments, penetration tests, and vulnerability scans of its infrastructure and platform to identify and remediate potential weaknesses;
- Incident Response: tbd22 maintains a documented data breach incident response procedure. In the event of a data breach that is likely to result in a risk to affected individuals, tbd22 will notify affected players without undue delay and take all reasonable steps to mitigate the impact of the breach.
Player Responsibility: While tbd22 takes extensive measures to protect your data on the platform side, the security of your account is also partly dependent on you. You are responsible for maintaining the confidentiality of your login credentials and for choosing a strong, unique password. tbd22 will never contact you to request your password via any channel.
11. Your Data Rights
As a data subject, you hold the following rights in relation to the personal data tbd22 holds about you. To exercise any of these rights, please contact tbd22 at [email protected] with the subject line "Data Subject Rights Request", along with a copy of your identity document to allow tbd22 to verify your identity before processing the request.
- Right of Access: You have the right to request a copy of all personal data tbd22 holds about you, along with information about how it is being processed. tbd22 will respond to access requests within 30 days of receipt;
- Right to Rectification: If any personal data tbd22 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Account profile data (name, address, phone number) may also be updated directly through the account settings panel;
- Right to Erasure ("Right to be Forgotten"): You may request that tbd22 delete your personal data. Please note that this right is not absolute — tbd22 is required to retain certain data for regulatory compliance periods as detailed in Section 9. Erasure requests that conflict with legal retention obligations will be partially fulfilled, with data being deleted to the maximum extent possible while retaining only what is strictly required by law;
- Right to Restriction of Processing: You may request that tbd22 temporarily pause the processing of your personal data while a dispute regarding its accuracy or lawfulness is being investigated;
- Right to Data Portability: You have the right to receive a copy of the personal data you have provided to tbd22 in a structured, commonly used, machine-readable format (such as CSV or JSON), suitable for transfer to another service provider;
- Right to Object: You may object to the processing of your personal data where tbd22 relies on "legitimate interests" as its legal basis. tbd22 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests;
- Right to Withdraw Consent: Where tbd22 processes your data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
12. Children & Minors
The tbd22 platform is strictly intended for adults aged 21 years and above. tbd22 does not knowingly collect personal data from any individual under the age of 21. Our registration process includes mandatory age verification steps, and KYC procedures include NID cross-referencing to confirm that all account holders meet the minimum age requirement.
If tbd22 discovers or receives credible notification that an account has been registered by a person under 21 years of age, the following steps will be taken immediately:
- The account will be permanently suspended and access revoked;
- All personal data associated with the underage account will be securely deleted to the extent permitted by applicable law;
- Any deposits made by the underage player will be returned to the original payment method, net of any bonus amounts used, following an investigation period;
- All gaming history and winnings accumulated through the account will be voided.
If you are a parent or guardian and believe a minor may have registered a tbd22 account using your payment details, contact [email protected] immediately. tbd22 will investigate and act within 48 hours of receiving a verified report.
13. International Data Transfers
tbd22 primarily processes the personal data of Bangladeshi players within secure data infrastructure. However, certain third-party service providers engaged by tbd22 — including licensed game providers such as Pragmatic Play, Evolution Gaming, and Spribe, as well as global KYC verification platforms — may process personal data in jurisdictions outside Bangladesh.
Where personal data is transferred to a third country, tbd22 ensures that appropriate safeguards are in place prior to the transfer, including:
- Contractual clauses in service provider agreements that impose data protection obligations equivalent to those tbd22 applies domestically;
- Transfers only to service providers whose data protection practices have been assessed as meeting tbd22's security and privacy standards;
- Limiting the scope of transferred data to the minimum necessary for the service provider to perform their contracted function.
By using the tbd22 platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to third-party service providers in other jurisdictions, subject to the safeguards described above.
14. Third-Party Links
The tbd22 platform does not include links to external third-party websites. All navigation within the tbd22 platform remains within the tbd22 domain. Game interfaces delivered by third-party game providers (such as Pragmatic Play, Evolution Gaming, Microgaming, and others) are embedded within the tbd22 platform environment. Data processing by game providers in connection with game delivery is governed by the data processing agreements between tbd22 and those providers, as described in Section 7.
tbd22 is not responsible for the privacy practices of any external organisation not covered by this Privacy Policy. This Policy applies exclusively to data processed by tbd22 in connection with the tbd22 platform and services.
15. Policy Updates
tbd22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, platform features, data processing practices, or organisational structure. When material changes are made to this Policy, tbd22 will:
- Update the "Effective Date" displayed at the top of this page to reflect the date the revised Policy takes effect;
- Display a prominent notice on the tbd22 platform notifying logged-in players of the update during their first session following the change;
- Send an email notification to the registered email address of all active account holders where the changes are material and affect how their personal data is used;
- Maintain an accessible version history so that players can review what has changed between Policy versions.
Your continued use of the tbd22 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment to this Policy, you should cease using the tbd22 platform and submit an account closure request to [email protected] prior to the effective date of the revised Policy.
Effective Date of Current Version: This Privacy Policy is effective as of 1 January 2026. It supersedes all previous versions of the tbd22 Privacy Policy.
16. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by tbd22, please contact our Privacy team using the details below. tbd22 is committed to responding to all privacy-related enquiries within 5 business days.
- Email: [email protected] (subject line: "Privacy Policy Enquiry" or "Data Subject Rights Request")
- Live Chat: Available 24/7 within the tbd22 platform for logged-in players
- Response Time: Up to 5 business days for written enquiries; live chat responses are typically immediate during staffed hours (Bangladesh Standard Time, UTC+6)
When submitting a data subject rights request, please include your full registered name, the email address associated with your tbd22 account, and a clear description of your request. A copy of your identity document will be required before tbd22 can action any request involving account data disclosure, rectification, or deletion.
Commitment to Transparency: tbd22 believes that every player deserves clear, honest answers about how their data is handled. If any section of this Privacy Policy is unclear, do not hesitate to reach out — our support team will be happy to explain any provision in plain, accessible language.
Ready to Play at tbd22?
Now that you understand how tbd22 protects your personal data, explore our full range of games and sports markets — from live cricket betting and BPL specials to Slots, Mahjong Ways, and Fortune Gems 2.