hbaj Privacy Policy — How We Protect and Use Your Personal Data

Introduction

hbaj ("we", "us", "our") operates the online betting and casino platform accessible at hbaj.lat. We are committed to protecting the privacy and personal data of every individual who interacts with the hbaj platform, whether as a registered player, a prospective player visiting the site, or a former account holder whose data we retain for legal compliance purposes.

This Privacy Policy describes the categories of personal data that hbaj collects, the purposes for which that data is processed, the legal grounds on which processing is based, the parties with whom data may be shared, the security measures we apply to protect it, and the rights you hold as a data subject. This policy is written in plain English to ensure it is accessible and understandable to all players.

This Privacy Policy should be read alongside the hbaj Terms & Conditions and Responsible Gaming Policy, all of which together form the complete framework governing your relationship with the hbaj platform.

Data We Collect

hbaj collects personal data through several channels: information you provide directly when registering an account or contacting support, data generated automatically through your use of the platform, and information received from trusted third-party service providers such as payment processors and identity verification partners.

2.1 Registration and Account Data

• Full legal name — required for identity verification and account ownership.
• Date of birth — required to verify that you meet the 21+ age eligibility requirement.
• Email address — used for account communications, transaction confirmations, and support.
• Mobile phone number — used for SMS verification, two-factor authentication, and account security alerts.
• Residential address — collected for KYC compliance and fraud prevention purposes.
• Username and encrypted password — used to secure access to your hbaj account.

2.2 Identity Verification (KYC) Data

• Government-issued photo ID — National Identity Card (NID), passport, or driving licence image.
• Proof of address — utility bill, bank statement, or official government correspondence dated within 90 days.
• Selfie or liveness check — where required by our identity verification partner to confirm document authenticity.
• Source of funds documentation — for high-volume players, bank statements or payslips may be requested.

2.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates, and payment method identifiers (e.g., bKash mobile number, Nagad account reference, last four digits of card).
• Transaction history, wagering records, bonus activity, and account balance movements.
• Payment method ownership verification details.

2.4 Technical and Usage Data

• IP address, device type, operating system, browser type and version.
• Session timestamps, pages visited, features used, games played, and navigation patterns.
• Geolocation data (country and city level) derived from IP address.
• Cookie identifiers and similar tracking technologies (see Section 7).

2.5 Communications Data

When you contact the hbaj support team via email or live chat, we retain records of that correspondence, including the content of messages and any attachments you provide. These records are used for quality assurance, dispute resolution, and compliance purposes.

How We Use Your Data

hbaj processes personal data for specific, documented purposes only. The table below summarises the primary processing activities and the data categories involved in each.

hbaj will not use your personal data for any purpose incompatible with the purposes listed above without first obtaining your explicit consent or establishing a new lawful basis for processing.

Legal Basis for Processing

Every processing activity carried out by hbaj is grounded in one of the following recognised legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted when registering your hbaj account — including account management, payment processing, and wagering services.
• Legal obligation: Processing required to comply with applicable laws including anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and financial crime prevention obligations.
• Legitimate interests: Processing conducted to pursue hbaj's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where hbaj relies on your consent to send marketing communications or to use non-essential cookies, we will obtain that consent clearly and separately. You may withdraw consent at any time by contacting [email protected] or by adjusting your account preferences.

Data Sharing

hbaj does not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent strictly necessary for the stated purpose:

• Identity verification providers: Third-party KYC and AML compliance partners who verify the authenticity of identity documents submitted during account verification. These providers are contractually bound to process data only for the verification purpose.
• Payment processors: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, Visa, Mastercard, and bank partners — only the minimum data necessary to initiate and confirm transactions is shared with each provider.
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed studio partners may receive a session token and anonymised player identifier to deliver game content. These studios do not receive your full personal profile.
• IT and infrastructure providers: Hosting, cloud storage, and cybersecurity vendors who process data on hbaj's behalf under strict data processing agreements.
• Legal and regulatory authorities: Government bodies, law enforcement agencies, financial intelligence units, or courts where hbaj is required to disclose data by law or valid legal process.
• Fraud prevention networks: Industry-standard shared fraud databases used to identify and prevent fraudulent account activity, where participation is required for platform integrity.

Payment Data

hbaj takes particular care with financial and payment data. Full payment card numbers are never stored on hbaj servers. Card payments are processed by PCI-DSS compliant payment processors, and only a masked token (e.g., last four digits and card type) is retained by hbaj for transaction reference purposes.

For mobile money transactions via bKash, Nagad, and Rocket, hbaj retains the mobile number used for the transaction and the transaction reference number. This data is retained for the period specified in Section 8 (Data Retention) and is used solely for transaction verification, dispute resolution, and regulatory compliance.

hbaj verifies that all payment methods used are beneficially owned by the registered account holder. Any discrepancy identified during payment verification may result in the transaction being held pending further documentation, as outlined in the hbaj Terms & Conditions.

Cookies & Tracking Technologies

hbaj uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your session security, and to collect anonymised usage analytics that help us improve the platform experience for all players.

7.1 Types of Cookies Used

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in securely. Essential cookies cannot be disabled without breaking platform functionality.
• Analytics cookies: Used to collect anonymised data about how players interact with the platform — which pages are visited most frequently, average session duration, and common navigation paths. This data is aggregated and does not identify individual users.
• Preference cookies: Store your platform preferences such as language settings, display options, and responsible gaming tool configurations so they persist across sessions.
• Security cookies: Used to detect and prevent fraudulent access attempts, bot activity, and account takeover attacks.

7.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling essential cookies will impair your ability to log in and use the hbaj platform. Disabling analytics cookies will not affect your ability to use any hbaj feature.

Data Retention

hbaj retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

After the applicable retention period expires, personal data is securely deleted or anonymised in accordance with hbaj's data destruction procedures. Anonymised, aggregated data that can no longer be linked to any individual may be retained indefinitely for statistical purposes.

Data Security

hbaj implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between your device and hbaj servers.
• AES-256 encryption for sensitive data at rest in hbaj databases.
• Role-based access control ensuring only authorised personnel with a documented business need can access personal data.
• Multi-factor authentication required for all internal hbaj staff accessing production systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• 24/7 intrusion detection and security event monitoring.
• Formal incident response procedures that include player notification in the event of a data breach affecting their personal information.

While hbaj employs industry-standard security measures, no online system can guarantee absolute security. You are responsible for keeping your own account credentials confidential and for notifying hbaj immediately at [email protected] if you suspect any unauthorised access to your account.

Your Rights

As a data subject, you hold a number of rights in relation to the personal data that hbaj holds about you. hbaj is committed to honouring these rights promptly and without undue obstruction.

• Right of access: You may request a copy of all personal data hbaj holds about you. We will provide this within 30 days of receiving your verified request.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held on your account. Corrections to core identity data may require supporting documentation.
• Right to erasure: You may request deletion of your personal data. Note that hbaj may be required by law to retain certain categories of data (see Section 8) even after account closure, and erasure requests will be fulfilled only to the extent permitted by applicable legal obligations.
• Right to restriction: You may request that hbaj restrict the processing of your data in specific circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing carried out on the basis of hbaj's legitimate interests, including profiling for responsible gaming monitoring. hbaj will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the rights listed above, please contact the hbaj Data Protection team at [email protected], including your full name and registered account email address so we can verify your identity before processing the request. All rights requests are handled free of charge.

Children's Privacy

The hbaj platform is strictly restricted to adults aged 21 years and above. hbaj does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person who does not meet the minimum age requirement, that account will be immediately suspended, the data will be deleted, and any funds deposited will be returned to the original payment method following identity verification.

If you are a parent or guardian and believe your child has registered an account with hbaj, please contact us immediately at [email protected] and we will take prompt action to close the account and remove all associated personal data.

International Data Transfers

hbaj is an international online betting platform and may transfer personal data to servers or service providers located outside of Bangladesh. Where such transfers occur, hbaj ensures that appropriate safeguards are in place to protect the data to a standard equivalent to the protections described in this policy. These safeguards include contractual clauses in data processing agreements with all third-party processors that mandate data protection standards consistent with internationally recognised frameworks.

By using the hbaj platform and accepting this Privacy Policy, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside Bangladesh in connection with the operation of the platform.

Third-Party Links

The hbaj platform may contain links to third-party game providers' informational pages or payment partner websites. This Privacy Policy applies solely to data processed by hbaj. hbaj is not responsible for the privacy practices of any third-party website or service, and we encourage you to review the privacy policies of any third-party services you interact with independently of the hbaj platform.

Policy Updates

hbaj reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, legal requirements, or platform features. The effective date at the top of this page reflects the date of the most recent revision. Where changes are material — meaning they significantly affect how we use your data or the rights available to you — hbaj will provide advance notice via email to your registered address before the changes take effect.

Your continued use of the hbaj platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any revision, you should discontinue use of the platform and contact us to request account closure and data deletion as outlined in Section 10.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how hbaj has handled your personal data, please contact us using the details below. Our support team is available 24 hours a day, seven days a week.

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available within the hbaj platform after logging in to your account. Average response time under two minutes.
• Response time for privacy requests: We aim to acknowledge all privacy-related requests within 24 hours and to provide a full response within 30 days.

If you are not satisfied with hbaj's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. hbaj is committed to cooperating fully with any such regulatory inquiry.