Privacy Policy — How hbaja Protects Your Data

This Privacy Policy ("Policy") describes how hbaja ("we", "us", "our") collects, processes, stores, and shares personal information about users ("you", "your") who access or use the hbaja platform at hbaja.vip. This Policy forms part of our broader Terms & Conditions and should be read alongside them. By using the hbaja platform, creating an account, or completing the hbaja Login process, you acknowledge that you have read this Policy and consent to the data practices described herein.

1. Information We Collect

hbaja collects personal information in several ways — directly from you during registration and account use, automatically through your device and browser, and in limited circumstances from trusted third-party sources used to verify your identity.

Information You Provide Directly

• Registration data: Full legal name, date of birth, gender, residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar), email address, and Bangladeshi mobile number.
• Identity verification (KYC) documents: Government-issued photo identification such as a National Identity Card (NID), passport, or driving licence, and where required, a recent utility bill or bank statement as proof of address.
• Payment information: bKash account number, Nagad account number, Rocket mobile wallet number, Upay account details, or the last four digits of a Visa or Mastercard used to fund your account. hbaja does not store full card numbers — card transactions are processed through PCI-DSS compliant payment gateways.
• Communications data: The content of any messages you send to hbaja's support team via email at [email protected], including support tickets, complaints, and account enquiries.
• Responsible gaming information: If you voluntarily submit deposit limits, cool-off requests, or self-exclusion requests through the responsible gaming tools, we record and store this information to enforce your chosen restrictions.

Information Collected Automatically

• Device and browser data: IP address, device type (mobile, tablet, desktop), operating system version, browser type and version, screen resolution, and time zone setting.
• Usage data: Pages visited on hbaja.vip, games played, bets placed, session duration, hbaja Login timestamps, deposit and withdrawal history, and navigation patterns within the platform.
• Cookies and similar tracking technologies: Session cookies, persistent cookies, and pixel tags as described in the Cookies section of this Policy.
• Geolocation data: Approximate location derived from your IP address, used to verify that you are accessing the platform from a permitted jurisdiction and to personalise your experience where applicable.

Information from Third Parties

• Identity verification partners: We may receive confirmation data from third-party KYC service providers used to verify the authenticity of documents you submit during the verification process.
• Payment processors: Transaction status updates (success, failure, pending) from bKash, Nagad, Dutch-Bangla Bank, and card payment gateways, used to reconcile your account balance.
• Fraud and AML screening: We may screen account data against third-party databases used for anti-money laundering (AML) compliance and fraud detection purposes.

2. How We Use Your Data

hbaja uses the personal information we collect for the following purposes. We do not use your data for any purpose that is incompatible with the reasons listed here without first obtaining your explicit consent.

hbaja will never use your personal data to build profiles for sale to third-party advertisers, nor will we disclose your information to any party for their own independent marketing purposes.

3. Legal Basis for Processing

hbaja processes personal data only where a lawful basis exists for doing so. The primary legal bases on which we rely are as follows:

• Contract performance: Processing is necessary to deliver the services you have contracted with us for — including operating your account, executing bets, and processing financial transactions.
• Legal obligation: Certain processing activities are required for hbaja to comply with applicable regulations, including anti-money laundering rules, age verification requirements, and record-keeping obligations. We cannot waive these obligations even at a player's request.
• Legitimate interest: We process some data where we have a genuine legitimate business interest — such as fraud prevention, platform security, and improving our services — provided that your interests and rights do not override ours in the circumstances.
• Consent: Where we rely on your consent — for example, to send promotional emails or SMS messages about new games, bonuses, or special events — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal. To withdraw consent for marketing communications, contact [email protected] or update your notification preferences in account settings.

4. Data Sharing & Disclosure

hbaja does not sell, rent, or trade your personal information to third parties. We may share your data only in the limited circumstances described below, and only to the extent necessary for the specific purpose.

Service Providers

We share data with carefully selected third-party service providers who process data on our behalf under written data processing agreements. These include payment processors (bKash, Nagad, Rocket, Upay, Visa/Mastercard gateway operators), KYC verification providers, cloud infrastructure providers, and customer support software operators. All such providers are contractually prohibited from using your data for any purpose other than fulfilling the services they provide to hbaja.

Game Software Providers

Games on the hbaja platform are supplied by independent software providers including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. These providers receive limited technical data (such as a pseudonymous player session token) necessary to run their games. They do not receive your full identity data, payment details, or contact information.

Legal and Regulatory Disclosure

hbaja may disclose personal information to law enforcement agencies, regulatory authorities, or courts where we are legally required to do so, or where we believe in good faith that such disclosure is necessary to prevent fraud, money laundering, or other illegal activity, or to protect the rights and safety of hbaja, its employees, or other users.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of hbaja's business, personal data held by hbaja may be transferred to the acquiring entity as part of that transaction. We will notify affected users by email before their data is transferred and becomes subject to a different privacy policy.

5. Cookies & Tracking Technologies

hbaja uses cookies and similar technologies to operate the platform, remember your preferences, maintain your hbaja Login session, and collect analytical data that helps us improve the user experience for Bangladeshi players.

Types of Cookies We Use

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your session state, store your authentication token after hbaja Login, and enable core security features. These cannot be disabled without breaking the platform.
• Functional cookies: These remember your preferences such as language settings, preferred game categories (slots, cricket betting, live dealer), and display options. Disabling them will not break the platform but may reduce convenience.
• Analytical cookies: We use anonymised analytics data to understand how players navigate hbaja.vip, which games are most popular, and where technical issues occur. This data is aggregated and does not identify individual players.
• Security cookies: Short-lived cookies used to detect suspicious login attempts, protect against cross-site request forgery (CSRF), and support our fraud-detection systems.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the platform. For more granular control, refer to your browser's help documentation.

6. Data Retention

hbaja retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your account's existence plus a minimum of 5 years after account closure, in line with standard AML record-keeping requirements.
• KYC / identity documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 7 years for accounting and regulatory compliance purposes.
• Customer support communications: Retained for 3 years from the date of the last communication in a support thread.
• Marketing consent records: Retained for the duration of active consent plus 2 years after consent is withdrawn, as evidence of the consent itself.
• Anonymised analytical data: May be retained indefinitely as it cannot be linked back to individual players.

When data reaches the end of its retention period and no legal obligation requires its further storage, hbaja securely deletes or irreversibly anonymises it using industry-standard data destruction methods.

7. Your Privacy Rights

As a player on the hbaja platform, you have the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Privacy Rights Request" and include sufficient information to identify your account.

• Right of access: You have the right to request a copy of the personal data hbaja holds about you. We will provide this in a clear, readable format within 30 days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For certain data fields, you may be able to update your information directly through account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data. Note that this right is subject to our legal obligations — we cannot delete data that we are required by law to retain (for example, KYC and financial transaction records during the mandatory retention period).
• Right to restriction of processing: In certain circumstances, you may request that we temporarily halt processing of your data — for example, while a dispute about its accuracy is being resolved.
• Right to data portability: You may request your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to object: You have the right to object to processing based on our legitimate interests, including profiling and direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing that occurred prior to withdrawal.

hbaja will respond to all verified privacy rights requests within 30 calendar days. In complex cases we may extend this by a further 30 days, in which case we will inform you of the extension and the reason for it.

8. Data Security

hbaja employs a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• SSL/TLS encryption: All data transmitted between your device and the hbaja platform is encrypted using current-generation Transport Layer Security (TLS 1.2 and above).
• Data encryption at rest: Sensitive personal data stored on hbaja's servers is encrypted using AES-256 encryption. This includes identity documents, payment records, and KYC data.
• Access controls: Access to personal data within hbaja is restricted on a strict need-to-know basis. Staff members can only access the data necessary to perform their specific role. All internal data access is logged and audited.
• Two-factor authentication: The hbaja Login system supports two-step SMS verification for all player accounts. We strongly encourage all players to enable this feature to protect against unauthorised account access.
• Penetration testing: hbaja conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: hbaja maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights or freedoms, we will notify affected players by email within 72 hours of becoming aware of the breach.

While we take all reasonable steps to protect your data, no digital platform can guarantee absolute security. You also play an important role — use a strong, unique password for your hbaja account, do not share your login credentials, and contact [email protected] immediately if you suspect unauthorised activity.

9. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how hbaja has handled your personal information, please contact our Data Protection team:

• Email: [email protected] (subject line: "Privacy Enquiry")
• Response time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 calendar days.

hbaja is committed to resolving all privacy complaints fairly and promptly. If you are not satisfied with our response, you may escalate your complaint through the dispute resolution process described in our Terms & Conditions. We take all feedback seriously and use it to continually improve our data handling practices.

This Privacy Policy was last reviewed and updated on 1 January 2026. We reserve the right to update this Policy at any time. Material changes will be communicated to registered players via their registered email address at least 14 days before the new version takes effect. Continued use of the platform after the effective date of any update constitutes acceptance of the revised Policy.