tbji Casino Privacy Policy

tbji Casino ("tbji," "we," "us," or "our") is committed to protecting the privacy and personal data of every player who uses the tbji online gaming platform. This Privacy Policy describes, in clear and plain language, the types of personal information we collect from players in the Philippines and elsewhere, the purposes for which that information is used, the conditions under which it may be shared, and the rights available to you as a data subject under Philippine law.

This Policy is issued in compliance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines. It is also aligned with applicable PAGCOR regulatory requirements for licensed online gaming operators serving Filipino players.

References in this Policy to "personal data" or "personal information" refer to any information from which you can be directly or indirectly identified, as defined under the DPA. This includes, but is not limited to, your name, contact details, financial information, government-issued identification numbers, and device identifiers.

tbji collects personal data through several channels — directly from you when you register or interact with the platform, automatically through your use of our services, and occasionally from trusted third parties. The categories of data we collect are described below.

2.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, gender, nationality, residential address (including city — Manila, Cebu, Davao, Quezon City, Makati, or otherwise), email address, and mobile number.
• KYC & Verification Documents: Copies of government-issued Philippine identification documents such as PhilSys National ID, passport, driver's licence, SSS/UMID card, or Postal ID. We may also collect proof of address documents such as utility bills or bank statements.
• Financial Data: GCash mobile number, PayMaya account details, BPI/BDO/Metrobank account information, and any other payment method details used to fund or withdraw from your tbji account.
• Communications: Records of live chat conversations, email correspondence, and support ticket submissions you send to tbji.
• Responsible Gaming Preferences: Deposit limits, session reminders, cooling-off periods, and self-exclusion status you set via your Account settings.

2.2 Data Collected Automatically

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, games played, session duration, wager amounts, bet history, login timestamps, and navigation paths within the tbji platform.
• Cookie Data: Information stored by cookies and similar tracking technologies placed on your device. See Section 6 for full details on our cookie practices.

2.3 Data from Third Parties

• Payment Processors: Transaction status and confirmation data from GCash, PayMaya, BPI, BDO, Metrobank, 7-Eleven, and Cebuana.
• Identity Verification Providers: Results of automated identity and document checks performed by our KYC technology partners.
• Fraud & AML Screening: Risk scores and alerts generated by our anti-money laundering and fraud detection service providers.
• Game Providers: Game round identifiers, RTP data, and session records provided by our licensed game supply partners.

tbji processes your personal data for the following clearly defined purposes. We do not use your data for any purpose other than those described here without first obtaining your consent or being required to do so by law.

Where tbji sends you promotional communications such as bonus offers, event notifications, or game recommendations, we will only do so where you have given your explicit consent at registration or via your Account communication preferences. You may withdraw consent for marketing communications at any time by updating your Account settings or contacting our support team.

Under the Philippine Data Privacy Act of 2012, tbji processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to fulfill the tbji Terms & Conditions — for example, to create your Account, process your GCash deposit, or pay out a withdrawal.
• Legal Obligation: Processing is required to comply with Philippine laws and regulations, including PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) requirements, and obligations to the Anti-Money Laundering Council (AMLC).
• Legitimate Interest: Processing is necessary for tbji's legitimate business interests, including fraud prevention, platform security, and the responsible operation of our gaming services — provided these interests do not override your rights and freedoms.
• Consent: For marketing communications and non-essential cookies, tbji relies on your freely given, specific, and informed consent, which you may withdraw at any time.

tbji does not sell your personal data. We may share your information with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment Processors: GCash (Mynt), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, and other payment partners receive transaction data necessary to process your deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party identity verification technology partners receive copies of your KYC documents solely for the purpose of automated identity checking.
• Game Providers: Licensed game studios and aggregators receive a player session token and wager data necessary to deliver and record game outcomes. They do not receive your full identity or financial details.
• Regulatory Authorities: PAGCOR, the AMLC, the National Privacy Commission, and other Philippine government agencies may receive personal data where tbji is legally obliged to disclose it, such as in response to a lawful order, audit, or suspicious transaction report.
• IT & Cloud Service Providers: Hosting, database, and cybersecurity vendors who process data on tbji's behalf under strict data processing agreements are obligated to maintain the same level of data protection tbji applies.
• Professional Advisers: Lawyers, auditors, and compliance consultants may access relevant personal data under duties of confidentiality where necessary for tbji to obtain professional advice.

The tbji website uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and — with your consent — deliver relevant promotions. Below is a summary of the cookie categories used on tbji.org:

You can manage your cookie preferences at any time via your Account settings or browser controls. Note that disabling strictly necessary cookies will impair the functionality of the tbji platform and may prevent you from logging in or accessing certain features.

tbji retains your personal data for as long as your Account is active and for a defined period thereafter, in line with our legal and regulatory obligations. The table below summarises our general retention periods by data category:

Where retention is required to comply with the Anti-Money Laundering Act, a minimum of five (5) years applies from the date of the last transaction, regardless of account status. Upon expiry of the applicable retention period, tbji will securely delete or anonymise your personal data.

tbji implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• SSL/TLS Encryption: All data in transit between your device and tbji servers is encrypted using current industry-standard Transport Layer Security protocols.
• Encryption at Rest: Sensitive personal data and financial records stored on tbji servers are encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Role-based access controls limit internal access to personal data on a strict need-to-know basis. Multi-factor authentication is required for all staff accessing production systems.
• Security Audits: tbji conducts regular internal and third-party security assessments, vulnerability scans, and penetration tests.
• Incident Response: tbji maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission within 72 hours and affected players as soon as reasonably practicable.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by tbji. We are committed to facilitating the exercise of these rights promptly and without undue burden.

To exercise any of these rights, contact the tbji Data Protection Officer at [email protected] with the subject line "Data Privacy Request." We will acknowledge your request within five (5) business days and respond fully within thirty (30) calendar days. We may require you to verify your identity before processing your request.

The tbji platform is strictly intended for adults. The minimum legal age to participate in casino-style gambling in the Philippines is 21 years old, and tbji enforces this requirement rigorously at the point of registration and through ongoing KYC verification.

tbji does not knowingly collect personal data from individuals under 21 years of age. If we discover that an Account has been created by or on behalf of a person under 21, we will:

• Immediately suspend and then permanently close the Account;
• Return any deposits to the originating payment method;
• Void all wagers and withhold any winnings derived from underage gambling activity;
• Delete or anonymise all personal data associated with the Account, subject to any legal retention obligations.

The tbji platform may, from time to time, reference third-party services such as payment gateways in the context of transaction processing. When you interact with a third-party payment provider such as GCash or PayMaya, their own privacy policies govern the handling of your data on their platforms. tbji is not responsible for the privacy practices of external third-party services.

We encourage you to review the privacy policies of any third-party services you use in connection with your tbji Account, particularly your chosen payment provider. tbji's responsibility for data protection extends only to the tbji platform and services operated directly by tbji.

tbji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine laws and regulations, or PAGCOR regulatory requirements. When we make material changes to this Policy, we will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date;
• Send a notification to your registered email address where the changes are significant; and
• Where required by law, obtain your renewed consent before processing your data under the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how tbji protects your personal data. Your continued use of the tbji platform following the posting of any updated Privacy Policy constitutes your acknowledgment of the changes.

tbji has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012. The DPO is responsible for overseeing tbji's compliance with the DPA and serves as the primary point of contact for all data privacy matters.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by tbji, please reach out to us through the following channels:

• Email: [email protected] (subject line: "Data Privacy Request" or "DPO Enquiry")
• Live Chat: Available 24/7 within your tbji account dashboard
• Website: tbji.org

We aim to acknowledge all data privacy enquiries within five (5) business days. Complex requests requiring investigation may take up to thirty (30) calendar days to resolve. We will keep you informed of progress throughout.

If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which can be reached through the NPC's official website and public assistance channels.