hbaja Privacy Policy — How We Collect, Use, and Safeguard Your Personal Data

hbaja is an online sports betting and casino platform accessible at hbaja.io, operated for the Bangladesh market. References to "hbaja", "we", "us", or "our" throughout this Privacy Policy refer to the entity operating the hbaja Platform.

hbaja acts as the data controller for personal information collected from registered players, prospective players, and visitors to the hbaja Platform. As data controller, hbaja determines the purposes for which personal data is collected and the means by which it is processed. Where hbaja engages third-party service providers to process data on its behalf, those providers act as data processors under binding data processing agreements.

For all data-related enquiries, requests, or complaints, you may contact us at [email protected] with the subject line "Privacy / Data Request". Our team targets a response within five business days for all data-related correspondence.

This Privacy Policy applies to all personal data collected and processed by hbaja in connection with:

• Your registration and maintenance of an account on the hbaja Platform at hbaja.io.
• Your use of any betting, gaming, casino, or promotional feature offered through the Platform.
• Your deposit or withdrawal transactions conducted via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, Mastercard, or any other supported payment method.
• Your communications with hbaja customer support, whether via live chat, email, or any other channel.
• Your browsing of the hbaja website, including pages you visit, features you interact with, and content you view, regardless of whether you hold a registered account.
• Your participation in promotions, tournaments, bonus programmes, or any other marketing activities run by hbaja.

This Policy does not apply to third-party websites, payment platforms, game providers, or any external service that may be linked from or integrated into the hbaja Platform. Those services operate under their own independent privacy policies, and hbaja accepts no responsibility for the data practices of third parties.

By registering an account on hbaja or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

hbaja collects the following categories of personal data, depending on the nature of your interaction with the Platform:

hbaja does not collect or store full payment card numbers. Where card payments are processed via Visa or Mastercard, the card data is handled exclusively by the relevant payment processor and is never stored on hbaja servers.

hbaja collects personal data through the following mechanisms:

• Directly from you: When you complete the registration form, submit KYC documentation, initiate a deposit or withdrawal, contact our support team, opt into a promotion, or update your account profile settings.
• Automatically through the Platform: When you visit any page of hbaja.io, our servers and analytics systems automatically log Technical Data including your IP address, device identifiers, browser fingerprint, and on-site navigation behaviour via cookies and similar tracking technologies (see Section 8).
• From payment service providers: When you initiate a transaction via bKash, Nagad, Rocket, Upay, or a supported bank, the payment provider may share confirmation data — such as transaction reference numbers, partial wallet/account identifiers, and transaction timestamps — with hbaja solely for the purpose of crediting or debiting your account balance accurately.
• From identity verification partners: Where hbaja uses third-party KYC or identity verification services to assist in document authentication, those providers may share the outcome of their verification checks (pass, fail, or refer) and associated document metadata with hbaja.
• From publicly available sources: hbaja may, where legally permitted and operationally necessary, cross-reference publicly available information (such as sanction lists or fraud databases) to fulfil anti-money-laundering and fraud-prevention obligations.

hbaja processes personal data only where a legitimate legal basis exists. The table below maps each processing purpose to the applicable legal basis:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your preferences in your account settings or contact [email protected].

hbaja uses the personal data it collects for the following specific purposes:

• Account administration: Creating your account, maintaining accurate records, processing login authentication, and managing account settings including responsible gaming preferences.
• Transaction processing: Verifying, crediting, and debiting deposit and withdrawal amounts in BDT via bKash, Nagad, Rocket, Upay, and supported bank channels. Generating transaction records and communicating confirmation details to you.
• Identity verification: Conducting KYC checks to confirm that you are at least 21 years of age, that you are who you claim to be, and that your account is not being used for fraudulent purposes or by a prohibited person.
• Fraud and security monitoring: Monitoring account activity in real time for patterns consistent with fraud, multi-accounting, bonus abuse, money laundering, or unauthorised access. Investigating and acting on flagged activity in accordance with the Terms and Conditions.
• Responsible gaming: Monitoring for indicators of problem gambling behaviour, applying self-imposed limits at your request, and sending responsible gaming communications where warranted.
• Customer communications: Responding to your support enquiries, communicating material changes to the Terms or this Privacy Policy, and sending transactional notifications (deposit confirmations, withdrawal approvals, bet settlements).
• Marketing (with consent): Sending you personalised promotions, bonus offers, and seasonal campaigns (such as Eid, Pohela Boishakh, BPL season, or IPL promotions) where you have opted in to receive such communications.
• Platform improvement: Using aggregated, anonymised data derived from user behaviour analytics to improve the Platform's features, performance, navigation, and overall user experience.
• Legal compliance: Retaining records as required by applicable law, responding to lawful requests from competent authorities, and defending hbaja's legal rights in any dispute.

hbaja does not use personal data for automated decision-making that produces legal or similarly significant effects without a human review stage. Where automated screening flags an account for review, the outcome is reviewed by a qualified member of the hbaja compliance or support team before any account action is taken.

hbaja does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. Personal data is shared with third parties only in the following controlled circumstances:

• Payment processing partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive only the data strictly necessary to execute the specific transaction you have initiated. Payment partners operate under their own privacy policies and applicable financial regulations.
• Identity verification providers: Third-party KYC and document verification services engaged by hbaja receive identity documents and personal details solely for the purpose of conducting verification checks on hbaja's behalf. These providers are bound by data processing agreements that restrict their use of your data to KYC purposes only.
• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game suppliers may receive a session token and pseudonymised player identifier when you launch their games through the Platform. These providers do not receive your full identity profile, financial data, or contact details.
• Technology and infrastructure providers: Cloud hosting, content delivery, analytics, and cybersecurity vendors that support the operation of the Platform may process technical and usage data as processors acting on hbaja's instructions under binding data processing agreements.
• Legal and regulatory authorities: Where required by law, court order, or regulatory directive, hbaja may disclose personal data to competent authorities. hbaja will, where legally permitted, notify affected users of such disclosures.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of hbaja's business, personal data may be transferred to the acquiring entity as part of that transaction. Affected users will be notified and given the opportunity to opt out of any material change in data processing terms.

hbaja uses cookies and similar tracking technologies on its Platform to support functionality, security, and performance analysis. Cookies are small data files stored on your device by your browser when you visit hbaja.io. The following categories of cookies are in use:

• Essential cookies: Required for the Platform to function correctly. These include session cookies that maintain your logged-in state, security tokens that protect against cross-site request forgery, and load-balancing cookies. Essential cookies cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how visitors navigate the Platform — which pages are visited most frequently, session durations, and referral sources. This data helps hbaja improve the Platform experience. Analytics cookies are activated only with your consent.
• Preference cookies: Store your Platform preferences such as language settings, display options, and responsible gaming reminder intervals, so these preferences persist across sessions.
• Fraud prevention cookies: Assist in identifying and blocking suspicious or automated access patterns, protecting all users from account compromise and fraudulent activity.

You may manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking essential cookies will impair your ability to log into and use the hbaja Platform. Blocking analytics or preference cookies will not affect your access to core Platform features.

hbaja does not use third-party advertising cookies or behavioural targeting cookies that profile your activity across external websites for commercial advertising purposes.

hbaja retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active account and for a minimum of five years following account closure, in accordance with standard record-keeping obligations applicable to financial services operators.
• Transaction and financial records: Retained for a minimum of seven years following each transaction to support audit, compliance, and dispute resolution requirements.
• KYC documents: Retained for the duration of the account relationship and for a minimum of five years post-closure. In cases where a suspicious activity report has been filed, longer retention may apply in accordance with applicable law.
• Customer support communications: Retained for two years from the date of the most recent communication in each support thread, unless the communication relates to an ongoing dispute in which case records are retained until final resolution.
• Marketing data: Retained until you withdraw consent for marketing communications, after which your preference to opt out is retained indefinitely as a record to ensure no further marketing is sent.
• Technical and analytics data: Aggregated analytics data is retained for up to 24 months. Raw IP log data is retained for up to 90 days for security monitoring purposes, after which it is deleted or anonymised.

When personal data is no longer required and no legal retention obligation applies, hbaja securely deletes or irreversibly anonymises that data using industry-standard data disposal methods.

hbaja implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. The primary security measures in place include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and hbaja servers is encrypted in transit using current-generation TLS protocols, ensuring that data cannot be intercepted in readable form.
• Encryption at rest: Personal data and sensitive documents stored on hbaja infrastructure are encrypted at rest using AES-256 or equivalent encryption standards.
• Password hashing: Account passwords are never stored in plain text. hbaja uses a strong, salted cryptographic hash function to store password credentials so that even in the event of a data breach, password values cannot be recovered from stored hashes.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Only authorised hbaja personnel with a legitimate operational requirement may access user data, and all such access is logged and auditable.
• Two-factor authentication: hbaja supports two-factor authentication for player accounts and enforces it for all internal staff systems that process personal data.
• Intrusion detection and monitoring: hbaja operates real-time intrusion detection systems and security monitoring tools that alert on anomalous access patterns, brute-force attempts, and other indicators of compromise.
• Third-party security assessments: hbaja conducts periodic security assessments of its Platform and data infrastructure to identify and remediate vulnerabilities on a proactive basis.

While hbaja takes all reasonable and industry-standard steps to protect your personal data, no digital security system can guarantee absolute security against all possible threats. In the event of a personal data breach that poses a risk to your rights and freedoms, hbaja will notify affected users without undue delay.

As a registered hbaja player and as a data subject, you hold the following rights with respect to your personal data. hbaja is committed to honouring these rights promptly and without undue administrative burden:

• Right of access: You may request a copy of all personal data hbaja holds about you. hbaja will provide this in a structured, readable format within a reasonable timeframe.
• Right to rectification: You may request correction of any personal data that is inaccurate or incomplete. Account profile data can be updated directly within your account settings for most fields; KYC-related corrections require a support request.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no legal retention obligation requires its continued storage. hbaja will respond to erasure requests within 30 days, explaining any data that cannot be deleted due to legal retention requirements.
• Right to restrict processing: You may request that hbaja restricts processing of your data in specific circumstances, such as where you contest the accuracy of the data or have objected to processing on legitimate interests grounds pending outcome of that objection.
• Right to data portability: You may request that hbaja provides your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You may object to processing of your personal data where that processing is based on hbaja's legitimate interests. hbaja will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests. You may withdraw marketing consent at any time with immediate effect.
• Right not to be subject to automated decisions: You have the right to request human review of any decision made about your account that has been processed automatically and that significantly affects you.

To exercise any of the above rights, contact hbaja at [email protected] with the subject line "Data Request — [Your Right]" (for example, "Data Request — Erasure" or "Data Request — Access"). hbaja will verify your identity before processing any data rights request to ensure requests are acted upon only for the legitimate account holder.

hbaja operates an online gambling Platform and enforces a strict minimum age of 21 years. The Platform is not directed at, and must not be used by, any person under the age of 21. hbaja does not knowingly collect or process personal data from individuals under 21 years of age.

Age verification is conducted as part of the account registration and KYC process. Any account found to belong to a person under the age of 21 will be immediately suspended, all balances withheld pending investigation, and all associated personal data reviewed for appropriate action in line with applicable law.

If you are a parent or guardian and have reason to believe that a person under 21 has registered an account on hbaja or has provided personal data to hbaja without appropriate consent, please contact us immediately at [email protected] with the subject line "Underage Account — Urgent". hbaja will investigate and take appropriate action, including deletion of any data associated with an underage user, within the shortest possible timeframe.

hbaja is operated for the Bangladesh market and processes the majority of data within its primary infrastructure. However, some third-party service providers engaged by hbaja — including cloud hosting partners, game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, and KYC verification services — may be located or operate infrastructure in jurisdictions outside Bangladesh.

Where personal data is transferred to third parties in other jurisdictions, hbaja ensures that adequate safeguards are in place to protect that data, including:

• Contractual data processing agreements that impose obligations on the recipient equivalent to those applied by hbaja under this Privacy Policy.
• Transfers only to service providers that maintain demonstrably adequate data protection practices in line with internationally recognised standards.
• Where technically feasible, data minimisation in cross-border transfers — limiting the data shared to the minimum necessary for the specific processing purpose.

By using the hbaja Platform and accepting this Privacy Policy, you acknowledge that your personal data may be processed in jurisdictions outside Bangladesh where data protection laws may differ from those in your home jurisdiction. hbaja takes all reasonable steps to ensure that such transfers are conducted securely and in compliance with the data protection principles set out in this Policy.

hbaja reserves the right to update, amend, or replace this Privacy Policy at any time. Updates may be made to reflect changes in applicable law, changes in hbaja's data processing practices, the introduction of new platform features, or changes in the third-party service providers hbaja engages.

When material changes are made to this Privacy Policy — meaning changes that affect your rights or the way hbaja uses your data in a meaningful way — hbaja will notify registered users via the email address on file or via an on-platform notification at the time of next login. The updated Policy will display a revised "Effective date" at the top of this page.

Minor changes such as clarifications, formatting updates, or correction of typographical errors that do not materially affect your rights or hbaja's data processing practices may be made without individual notification and will take effect immediately upon publication.

Your continued use of the hbaja Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any revision, you must cease using the Platform and may request account closure by contacting [email protected].

For any privacy-related enquiry, data rights request, or concern regarding hbaja's handling of your personal information, please contact us using the details below. All contact information is provided as plain text — no clickable links:

• Data enquiries email: [email protected] (subject line: "Privacy / Data Request")
• Support availability: 24 hours a day, 7 days a week, operating at Bangladesh Standard Time (BST, UTC+6)
• Expected response time: Initial acknowledgement within 2 business days; substantive response within 20 business days for formal data rights requests
• For underage account reports: [email protected] (subject line: "Underage Account — Urgent")
• For marketing opt-out: Update preferences in your account settings or email [email protected] with the subject line "Marketing Opt-Out"

hbaja takes all privacy correspondence seriously. No data rights request will be dismissed without a substantive written response explaining hbaja's position and the basis for any decision to limit or decline the request.