hbajji Privacy & Data Protection Policy

hbajji collects personal data from you in several ways: directly when you register an account or contact our support team, automatically when you use our platform, and from third-party sources such as payment providers and identity verification services. The categories of data we collect are described below.

1.1 — Registration & Account Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify that you meet the 18+ age requirement)
• Email address (for account management, password recovery, and communications)
• Mobile phone number (for account security and two-factor authentication)
• Username and encrypted password
• Preferred payment method and associated account details (e.g., bKash or Nagad mobile number)

1.2 — Identity Verification (KYC) Data

• Copies of government-issued photo identification (National Identity Card, passport, or birth certificate)
• Proof of address where required for enhanced due diligence
• Proof of payment method ownership (e.g., a screenshot of your bKash account showing your name and number)

1.3 — Transaction & Gaming Data

• Deposit and withdrawal records, including amounts, timestamps, and payment method references
• Betting history, game session logs, win/loss records, and bonus usage across all games including cricket betting, slot games, and live casino tables
• Account balance history and promotion redemption records

1.4 — Technical & Usage Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, browser type, and browser version
• Session duration, pages visited, features used, and interaction patterns on the hbajji platform
• Cookie identifiers and similar tracking data (see Section 4 for full details)

1.5 — Communications Data

• Records of your live chat conversations with our support team
• Email correspondence sent to or received from hbajji
• Feedback, complaints, and dispute records

hbajji uses the personal data it collects for the following specific purposes. We rely on one or more lawful bases for each type of processing activity, as described below.

hbajji does not use automated decision-making in a way that produces legal or similarly significant effects on you without human review. Our responsible gaming monitoring systems may flag accounts for review by a human compliance officer, but no account action (suspension, closure, or restriction) is taken purely by algorithm without manual oversight.

hbajji does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes under any circumstances. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose.

3.1 — Service Providers & Data Processors

hbajji works with a small number of carefully vetted third-party service providers who process personal data on our behalf. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive the minimum transaction data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers may receive copies of your identity documents to perform automated or manual verification checks.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a pseudonymous player identifier and gaming session data necessary to deliver and record game outcomes.
• IT infrastructure and hosting providers: Servers and cloud infrastructure providers that store hbajji platform data under contractual data processing agreements that require them to maintain confidentiality and security standards equivalent to our own.

All service providers acting as data processors on behalf of hbajji are bound by contractual data processing agreements that prohibit them from using your personal data for any purpose other than providing the contracted service.

3.2 — Legal & Regulatory Disclosure

hbajji may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required by law or in response to a valid legal order. In such cases, hbajji will disclose only the minimum data required to comply with the legal obligation and will, where legally permitted, notify the affected player.

3.3 — Business Transfers

In the event that hbajji undergoes a business merger, acquisition, or asset sale, personal data held by hbajji may form part of the transferred assets. In such circumstances, hbajji will ensure that the acquiring entity is bound by privacy obligations at least equivalent to those described in this policy, and affected players will be notified prior to their data being transferred.

hbajji uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how the platform is used. A cookie is a small text file placed on your device by a website. Cookies do not contain executable code and cannot access other data stored on your device.

hbajji uses the following categories of cookies:

hbajji does not use third-party advertising cookies or cross-site tracking cookies. No data collected via hbajji cookies is shared with advertising networks or social media platforms.

You can manage cookie preferences through your browser settings at any time. Most modern browsers allow you to block, delete, or review cookies stored on your device. Please note that disabling strictly necessary or responsible gaming cookies may impair your ability to use the hbajji platform fully.

hbajji retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be associated with any individual. Anonymised aggregate data may be retained indefinitely for statistical and business improvement purposes.

hbajji implements a multi-layered approach to data security designed to protect your personal information from unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes both technical and organisational measures proportionate to the sensitivity of the data we hold.

Technical Measures:

• All data in transit is encrypted using TLS 1.2 or higher. The hbajji platform enforces HTTPS across all pages and API endpoints without exception.
• Sensitive data at rest — including identity documents, payment references, and account credentials — is encrypted using AES-256 or equivalent symmetric encryption.
• Passwords are never stored in plain text. hbajji stores only a salted cryptographic hash of each player's password using an industry-standard hashing algorithm.
• Access to production systems and databases is restricted by role-based access controls. Only authorised personnel with a demonstrable operational need may access player data.
• All internal access to personal data is logged, audited, and reviewed periodically to detect any unauthorised or anomalous access patterns.
• Regular vulnerability assessments and penetration testing are conducted on the hbajji platform to identify and remediate security weaknesses before they can be exploited.

Organisational Measures:

• All hbajji staff and contractors who handle personal data are bound by confidentiality obligations and receive data protection training relevant to their role.
• hbajji maintains an internal data breach response procedure. In the event of a confirmed data breach that poses a risk to players, affected individuals will be notified promptly with details of the nature of the breach and recommended protective actions.
• Third-party service providers who process data on our behalf are required to maintain security standards equivalent to those described in this policy and are subject to periodic security reviews.

As a player on the hbajji platform, you have the following rights in respect of your personal data. These rights may be exercised by contacting our support team via live chat or by emailing [email protected]. We will respond to all valid privacy rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data that hbajji holds about you. We will provide this in a structured, commonly used format within 30 days of your verified request.
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For account details such as name or date of birth, correction may require re-submission of identity documents.
• Right to Erasure: You may request that hbajji delete your personal data. This right is subject to overriding legal obligations — for example, we are required by anti-money laundering regulations to retain transaction records for a minimum period after account closure and cannot delete these records early.
• Right to Restriction of Processing: In certain circumstances (for example, while a dispute is being investigated), you may request that hbajji restricts its processing of your personal data to storage only, pending resolution of the issue.
• Right to Data Portability: You may request that hbajji provides your personal data in a machine-readable format so that it can be transferred to another service provider. This right applies to data you have provided directly to hbajji and which is processed on the basis of your consent or a contract.
• Right to Object: You have the right to object to hbajji processing your personal data on the basis of legitimate interests, including profiling for responsible gaming purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The hbajji platform integrates with a number of third-party services to deliver the full range of gaming, payment, and support features available to players. Each third-party integration involves a limited and defined data exchange necessary to provide that specific service.

Game Content Providers: When you launch a game from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, a session token and pseudonymous player identifier are passed to the game provider's servers. This allows the game to function and for outcomes to be recorded correctly. Game providers do not receive your full name, contact details, or payment information.

Payment Service Providers: Transactions processed via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, or BRAC Bank involve those providers receiving the transaction amount, reference, and the account details necessary to complete the transfer. These providers operate under their own privacy policies and are independent data controllers for the data they receive.

Identity Verification Services: Where hbajji uses a third-party KYC provider to verify identity documents, that provider acts as a data processor under contract with hbajji. The provider is prohibited from using your identity data for any purpose other than verification on hbajji's behalf.

hbajji is not responsible for the privacy practices of independent third-party service providers beyond the contractual obligations we impose on them as data processors. We encourage you to review the privacy policies of payment providers you use independently of hbajji.

The hbajji platform is strictly intended for adults aged 18 years and above. We do not knowingly collect, process, or store personal data relating to any individual under the age of 18. Age verification is a mandatory step in the account registration process, and hbajji reserves the right to request documentary proof of age from any player at any time.

If hbajji becomes aware that a registered account belongs to or has been used by an individual under the age of 18, the account will be immediately suspended, any funds deposited will be returned to the originating payment method after verification, and all personal data associated with the account will be deleted in accordance with our data retention policy — subject to any overriding legal obligations.

hbajji reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify registered players via email or via an in-platform notification at least 7 days before the updated policy comes into effect.

The current version of this Privacy Policy will always be available at hbajji.app/privacy-policy and will display the effective date prominently at the top of the document. The effective date of the current version is 1 January 2026.

Your continued use of the hbajji platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you must cease using the platform and contact our support team to close your account and arrange deletion of your personal data to the extent permitted by law.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to raise a concern about the way hbajji handles your personal data, please contact us using the details below. Our support team is available 24 hours a day, 7 days a week.

• Live Chat: Available directly within the hbajji platform. Average response time is 2–5 minutes. Available in English and Bengali at all times.
• Email: [email protected] — for formal privacy rights requests and data protection enquiries. We aim to respond to all email enquiries within 2 business days (Bangladesh Standard Time, UTC+6).

When submitting a privacy rights request, please include your registered username or email address, a clear description of your request (e.g., access, rectification, erasure), and any relevant context. We will verify your identity before processing your request.