hbaej Privacy Policy — How We Handle Your Data

When you register for, access, or use the hbaej platform, we collect personal data across several categories. The specific data collected depends on how you interact with the platform — for example, whether you are browsing as a guest, completing registration, making a deposit, or contacting our support team.

Registration & Identity Data

When you create a hbaej account, we collect your full legal name as it appears on your government-issued identification, your date of birth, your email address, your Bangladeshi mobile phone number, and a password of your choosing. This information is required to create and secure your account and to verify that you meet the minimum age requirement of 18 years.

Identity Verification (KYC) Data

As part of our mandatory Know Your Customer (KYC) programme, you will be required to submit copies of identity documents, which may include your Bangladeshi National Identity Card (NID), passport, or other government-issued photo identification, a utility bill or bank statement confirming your residential address in Bangladesh, and a selfie photograph taken at the time of verification. This data is used solely for age and identity verification purposes and is handled with the highest level of security.

Financial & Transaction Data

When you make deposits or withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, or other supported Bangladeshi payment methods, we collect records of the transaction including the payment method used, the amount in BDT, the date and time, and the transaction reference number. We do not store full card numbers or mobile banking PINs. Payment data is processed by our approved payment partners and is subject to their own privacy and security standards.

Gameplay & Betting Activity Data

We collect records of all games played, wagers placed, bets settled, bonuses claimed, and sports markets bet upon through your hbaej account. This data is used to operate the platform fairly, to calculate and verify winnings and bonuses, to detect and prevent fraudulent or collusive behaviour, and to comply with our record-keeping obligations.

Technical & Device Data

When you access the hbaej platform, we automatically collect certain technical data including your IP address, browser type and version, device type and operating system, screen resolution, session timestamps, and referring URL. This data is used for platform security, fraud detection, and to optimise the platform experience across different devices.

Communications Data

If you contact our support team by email or live chat, we retain records of those communications, including the content of messages and any attachments you send. This data is used to resolve your query, improve our support quality, and maintain an audit trail of account-related interactions.

hbaej processes your personal data only for the purposes described in this Privacy Policy and only where we have a lawful basis for doing so. The primary purposes for which we use your data are set out below.

hbaej will not use your personal data for any purpose that is incompatible with the purposes listed above without first informing you and, where required, obtaining your consent. Where we rely on legitimate interest as our lawful basis, we have assessed that our interest does not override your fundamental privacy rights.

Automated Decision-Making

hbaej uses automated systems for fraud detection, bonus abuse detection, and responsible gaming monitoring. These systems may flag or restrict account activity without direct human intervention. Where an automated decision materially affects your account — for example, a withdrawal hold or account suspension — you have the right to request a manual review by our compliance team. To request a review, contact [email protected] with your account details and a description of the decision you wish to contest.

hbaej does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only with trusted partners and service providers where sharing is necessary to deliver the Services, fulfil a legal obligation, or protect the integrity of the platform. All third-party partners engaged by hbaej are bound by data processing agreements that require them to protect your information to a standard consistent with this Privacy Policy.

Categories of Third Parties We Share Data With

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and Visa/Mastercard processing networks receive transaction data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Authorised third-party identity verification partners receive your submitted identity documents and photograph for the purpose of age and identity verification. These partners are contractually prohibited from using your data for any other purpose.
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other integrated game studios receive anonymised or pseudonymised session data necessary to operate their games within the hbaej platform. These providers do not receive your full identity or payment data.
• Fraud prevention and security services: Specialist fraud detection and cybersecurity partners may receive IP addresses, device fingerprints, and transaction metadata to identify and prevent fraudulent activity.
• Analytics providers: Aggregated, anonymised usage data may be shared with platform analytics providers to help us understand how players interact with the hbaej platform and to identify areas for improvement.
• Legal and regulatory authorities: hbaej will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by applicable law, court order, or regulatory direction. hbaej will notify affected players of such disclosures where legally permitted to do so.

International Data Transfers

Some of our third-party service providers operate outside Bangladesh. Where your data is transferred internationally, hbaej takes appropriate steps to ensure that the receiving organisation provides an adequate level of data protection, including through contractual safeguards. If you have concerns about international data transfers affecting your account, please contact [email protected].

hbaej uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies allow the hbaej platform to remember your preferences, keep your session active while you are logged in, and gather anonymised usage data to help us understand how players use our Services.

Types of Cookies We Use

Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Please note that disabling essential cookies will prevent you from logging into your hbaej account and using real-money features of the platform. Disabling functional or analytical cookies will not affect your ability to access the platform but may reduce the quality of your experience.

hbaej does not use cookies for third-party behavioural advertising. We do not allow advertising networks to place tracking cookies on the hbaej platform or to build advertising profiles based on your activity on our site.

hbaej retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below represent our standard practices and may be extended where required by law or where data is needed to resolve an ongoing dispute.

Standard Retention Periods

• Account registration data: Retained for the duration of your active account and for a minimum of 5 years following account closure, in line with anti-money laundering record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the transaction date, as required for financial audit and AML compliance purposes.
• Gameplay and betting activity records: Retained for a minimum of 3 years from the date of activity, or longer if required for an ongoing dispute or investigation.
• Support communications: Retained for 2 years from the date of the last communication in a support thread, unless the communication relates to an ongoing dispute or compliance matter.
• Technical and device data (logs): Retained for up to 12 months from collection, after which it is anonymised or deleted.
• Marketing consent records: Retained from the date consent was given until consent is withdrawn, plus 1 year for compliance record-keeping.

Data Storage Location

hbaej stores primary account and transaction data on servers protected by physical and digital security controls. Where data is stored or processed outside Bangladesh by third-party service providers, hbaej ensures that appropriate contractual protections are in place as described in the Data Sharing section above.

Data Deletion

When personal data is no longer required and no legal retention obligation applies, hbaej permanently deletes or anonymises the data using secure data destruction procedures. Anonymised, aggregated data that cannot be used to identify an individual may be retained indefinitely for statistical and platform improvement purposes.

hbaej respects your rights over your personal data. The following rights are available to all registered hbaej players. To exercise any of these rights, submit a written request to [email protected] from your registered email address, clearly stating which right you wish to exercise and providing sufficient information for us to identify your account.

• Right of access: You may request a copy of all personal data that hbaej holds about you. We will respond to verified access requests within 30 days.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For basic account details, you may also update information directly via your account settings.
• Right to erasure: You may request that hbaej delete your personal data. This right is subject to our legal retention obligations — we cannot delete data that we are required to retain under anti-money laundering, tax, or other applicable law.
• Right to restrict processing: In certain circumstances, you may request that hbaej restrict the processing of your personal data while a query or dispute is being resolved.
• Right to data portability: You may request that hbaej provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to withdraw marketing consent: If you have opted in to receive marketing communications from hbaej, you may withdraw that consent at any time by clicking the unsubscribe link in any marketing email or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of communications sent prior to withdrawal.
• Right to object to automated decisions: If an automated decision has materially affected your account, you have the right to request a manual human review of that decision. See the automated decision-making section above for details.

hbaej takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect your information against unauthorised access, accidental loss, alteration, and destruction.

Technical Security Controls

• Transport encryption: All data transmitted between your browser or device and the hbaej platform is encrypted using TLS 1.2 or higher (256-bit SSL). Our security certificates are maintained and renewed on a regular schedule.
• Data-at-rest encryption: Sensitive personal data and identity documents stored on hbaej infrastructure are encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data within hbaej is restricted on a strictly need-to-know basis. All internal system access is authenticated, logged, and subject to regular review.
• Intrusion detection: hbaej operates continuous network monitoring and intrusion detection systems to identify and respond to suspicious activity in real time.
• Two-factor authentication: hbaej offers two-factor authentication (2FA) to all registered players. We strongly recommend enabling 2FA on your account via your account security settings.

Organisational Security Controls

• All hbaej staff with access to personal data receive data protection training and are bound by confidentiality obligations.
• Third-party vendors with access to personal data are vetted for security compliance before engagement and are subject to ongoing review.
• hbaej conducts periodic security assessments to identify and remediate vulnerabilities in the platform and its data handling practices.

Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, hbaej will notify affected players by email to their registered address without undue delay, and in any case within the timeframe required by applicable law. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures hbaej is taking to address and mitigate the breach.

Despite our extensive security measures, no online platform can guarantee absolute security. You are responsible for keeping your own account credentials secure. If you suspect that your hbaej account has been compromised, contact [email protected] immediately.

If you have any questions, concerns, or complaints about this Privacy Policy or about how hbaej handles your personal data, please contact our support team at [email protected]. We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a full response within 30 calendar days.

Policy Updates

hbaej reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will publish the updated policy at https://hbaej.net/privacy-policy and update the "Last Updated" date at the top of the document. For significant changes that affect how we use your data in new ways, we will notify registered players by email to their registered address prior to the changes taking effect, providing a reasonable period to review the updated policy.

Your continued use of the hbaej platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you should discontinue use of the platform and may request account closure by contacting [email protected].

Complaints

If you believe that hbaej has not handled your personal data in accordance with this Privacy Policy or applicable law, you have the right to lodge a complaint. We encourage you to first contact us directly at [email protected] so that we can investigate and attempt to resolve your concern promptly. If you remain unsatisfied following our response, you may escalate your complaint to the relevant data protection authority in your jurisdiction.