hbajae Privacy Policy

This Privacy Policy ("Policy") describes how hbajae ("we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you", "your") who access or use the hbajae website, mobile platform, sportsbook, casino, and related services (collectively, the "Platform"). hbajae is an online gaming platform serving players in Bangladesh.

By registering an account or continuing to use the hbajae Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the hbajae Terms and Conditions and should be read in conjunction with them. Defined terms used in this Policy and not defined herein have the meanings given to them in the Terms and Conditions.

hbajae collects personal information in two principal ways: information you provide directly to us, and information collected automatically through your use of the Platform. The categories of personal data we collect are set out below.

1.1 Information You Provide Directly

1.2 Information Collected Automatically

When you access or use the hbajae Platform, we automatically collect certain technical and behavioural data, including:

• Device and Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, games played, bet amounts, session duration, click patterns, search queries made within the Platform, and features accessed.
• Location Data: Approximate geographic location derived from your IP address, used for fraud prevention and regulatory compliance purposes. hbajae does not collect precise GPS location data.
• Cookie and Tracking Data: Information collected via cookies, web beacons, and similar technologies as described in Section 4 of this Policy.

1.3 Information from Third Parties

In limited circumstances, hbajae may receive personal data about you from third parties, including identity verification service providers engaged to assist with KYC checks, payment processors confirming transaction status, and fraud prevention agencies. All third-party data sources used by hbajae are contractually bound to handle personal data in compliance with applicable data protection standards.

hbajae processes your personal data only where a lawful basis exists for doing so. The primary purposes for which we use your data are as follows:

• Account management: To create, maintain, and administer your hbajae account, including processing registrations, verifying your identity, and managing account security.
• Service delivery: To provide access to the sports betting, live casino, slots, and other gaming services available on the Platform, including processing bets, calculating outcomes, and crediting winnings to your account wallet.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain an accurate transaction history for your account.
• Legal and regulatory compliance: To comply with applicable laws, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, age verification, and responsible gambling regulations. hbajae may be legally required to retain certain data for specified periods regardless of account closure.
• Fraud prevention and security: To monitor accounts and transactions for suspicious activity, protect against unauthorised access, and investigate and respond to potential breaches of our Terms and Conditions.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance through our support channels.
• Platform improvement: To analyse usage patterns, conduct internal research, test new features, and improve the overall quality and performance of the hbajae Platform.
• Marketing communications: Where you have provided explicit consent, to send you promotional emails, SMS notifications, or in-platform messages about hbajae offers, bonuses, and seasonal promotions relevant to Bangladesh players. You may withdraw consent at any time by contacting our support team.
• Responsible gaming: To identify and respond to indicators of problem gambling behaviour, enforce self-exclusion requests, and provide access to responsible gaming tools and resources.

hbajae does not sell, rent, or trade your personal information to third parties for commercial purposes. We may share your personal data with the following categories of recipients only where necessary and only to the extent required for the stated purpose:

• Payment service providers: Processing partners including bKash, Nagad, Rocket, Upay, and card payment networks receive only the transaction data necessary to process your deposit or withdrawal. These providers operate under their own data protection policies and are not controlled by hbajae.
• Identity verification providers: Third-party KYC and AML service providers who assist hbajae in verifying player identities and screening against sanctions and fraud databases. These providers are contractually bound to use your data only for the verification purpose and to maintain appropriate security standards.
• Game content providers: Certain game studios and platform providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive limited technical data (such as a pseudonymous session identifier) necessary to deliver their game content within the hbajae Platform. These providers do not receive your full identity data.
• IT and infrastructure providers: Cloud hosting, data storage, and platform infrastructure partners who process data on our behalf under strict data processing agreements and are not permitted to use your data for their own purposes.
• Legal and regulatory authorities: hbajae may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required to do so by law, court order, or in connection with the prevention or detection of crime. hbajae will notify affected users of such disclosures to the extent legally permissible.
• Professional advisers: Lawyers, accountants, auditors, and insurers who provide professional services to hbajae, subject to strict confidentiality obligations.

hbajae uses cookies and similar technologies (including web beacons and local storage) to operate and improve the Platform. A cookie is a small text file placed on your device by a website. The following categories of cookies are used on the hbajae Platform:

hbajae does not use third-party advertising cookies or tracking pixels for the purpose of building external advertising profiles. You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect your ability to use some features of the Platform, including staying logged in and accessing personalised content.

hbajae retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active account data: Personal data associated with an active hbajae account is retained for the duration of the account relationship plus a minimum post-closure period required for legal compliance and dispute resolution purposes.
• KYC and identity documents: Identity verification documents are retained for a minimum of five (5) years following account closure, in line with anti-money laundering record-keeping obligations.
• Financial transaction records: Records of deposits, withdrawals, and betting activity are retained for a minimum of five (5) years following the date of the transaction for AML and audit purposes.
• Support communications: Live chat transcripts and support email records are retained for a minimum of two (2) years from the date of the communication to facilitate dispute resolution and quality assurance.
• Marketing data: Where you have consented to marketing communications, your contact details for this purpose are retained until you withdraw consent. Following opt-out, a suppression record is maintained to ensure future marketing messages are not sent.
• Self-exclusion records: Where a player has requested self-exclusion, a record of that self-exclusion is retained for the full exclusion period plus a minimum of three (3) years following expiry, to prevent inadvertent re-registration.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction. Where data cannot be immediately deleted due to technical constraints, it is isolated from further processing pending deletion.

hbajae implements a layered approach to data security, combining technical, organisational, and physical controls to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Key security measures in place include:

• Encryption in transit: All data exchanged between your browser or device and the hbajae Platform is encrypted using TLS (Transport Layer Security) protocols. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields — including identity document data and financial account references — are encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within hbajae's systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Password security: Player passwords are stored in hashed form using modern cryptographic hashing algorithms. hbajae never stores passwords in plain text and will never ask you to provide your password via any communication channel.
• Fraud and anomaly monitoring: Automated systems monitor account and transaction activity for patterns indicative of fraud, account takeover, or other security threats, with alerts triggering manual review where appropriate.
• Incident response: hbajae maintains a documented data breach response procedure. In the event of a security incident that is likely to result in risk to affected individuals, hbajae will notify impacted players without undue delay and take immediate steps to contain and remediate the breach.

As a player on the hbajae Platform, you hold the following rights with respect to your personal data. hbajae is committed to honouring these rights promptly and without charge:

• Right of access: You have the right to request a copy of the personal data hbajae holds about you, together with information about how that data is being used. Requests will be fulfilled within 30 days of receipt.
• Right to rectification: If any personal data hbajae holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain account details directly through the Platform's account settings area.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you believe the data has been processed unlawfully. Please note that certain data may be retained where hbajae has a legal obligation to do so (for example, AML transaction records).
• Right to restrict processing: You may request that hbajae restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you do not wish for the data to be deleted.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where hbajae processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to other processing activities where hbajae relies on legitimate interests as the legal basis, subject to hbajae's overriding legitimate grounds.

To exercise any of the above rights, contact the hbajae data team at [email protected] with the subject line "Privacy Rights Request". Please include your registered username and a brief description of your request. hbajae may request proof of identity before processing a data subject request in order to protect against unauthorised disclosure.

hbajae reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, Platform functionality, applicable law, or regulatory guidance. When material changes are made, the "Last Updated" date at the top of this document will be revised and hbajae will provide reasonable advance notice through in-platform notifications or email to your registered address where the changes are significant.

Your continued use of the hbajae Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how hbajae protects your information.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which hbajae handles your personal data, please contact us using the details below. All privacy enquiries are handled by our dedicated data protection team and will receive a response within 48 hours of receipt.

This Policy, together with the hbajae Terms and Conditions and Responsible Gaming Policy, constitutes the complete framework governing your relationship with hbajae with respect to the collection and use of your personal information. In the event of any conflict between this Policy and any other document, this Policy shall prevail with respect to data protection matters.