hbja Privacy Policy
At hbja, protecting your personal information is a responsibility we take seriously. This Privacy Policy explains exactly what data we collect, why we collect it, how we use and store it, and what rights you hold over your information as a registered player on Bangladesh's trusted online betting and casino platform.
About This Policy
This Privacy Policy applies to all users of the hbja Platform, including visitors who browse the site without registering and registered Account holders who actively use hbja's sportsbook, live casino, slots, bingo, and other gaming services. By accessing or using the hbja Platform, you acknowledge that you have read and understood this Privacy Policy.
hbja is operated as an offshore gaming platform serving players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. All personal data processed in connection with your use of the hbja Platform is handled in accordance with this Policy and applicable international data protection principles.
This Privacy Policy should be read alongside hbja's Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and hbja. In the event of any conflict between these documents on a data-related matter, this Privacy Policy shall take precedence.
This Policy uses the same defined terms as hbja's Terms & Conditions. "Platform" means the hbja website at hbja.io and all associated services. "Account" means your registered user account. "We", "us", and "hbja" refer to the hbja platform operator. "You" refers to the individual user or Account holder.
Data We Collect
hbja collects personal data through several channels: directly from you when you register or interact with the Platform, automatically as you use the Platform, and in limited cases from trusted third-party sources such as payment processors and KYC verification providers. The categories of data we collect are detailed below.
2.1 Data You Provide Directly
When you register an Account, deposit funds, contact support, or participate in promotions, you provide us with personal data including but not limited to:
- Identity data: Full legal name, date of birth, gender, and nationality.
- Contact data: Email address, mobile phone number (used for OTP verification and account communications), and residential city/district within Bangladesh.
- Account credentials: Username and hashed password (we do not store your password in plaintext).
- KYC documents: National Identity Card (NID), passport, proof of address, selfie photographs, and payment method ownership evidence submitted during the identity verification process.
- Financial data: Mobile financial service account numbers (bKash, Nagad, Rocket, Upay) and card details (Visa, Mastercard) used for deposits and withdrawals, retained only to the extent necessary to process transactions and prevent fraud.
- Communications data: The content of any messages, complaints, or enquiries you send to hbja's customer support team via email or live chat.
2.2 Data Collected Automatically
When you access and use the hbja Platform, certain technical data is collected automatically by our systems:
- Device & browser data: IP address, device type (mobile/desktop/tablet), operating system, browser type and version, screen resolution, and device language settings.
- Usage data: Pages visited, time spent on each page, click patterns, game sessions initiated, bets placed, game outcomes, session start and end times (recorded in Bangladesh Standard Time, UTC+6), and deposit/withdrawal transaction history.
- Geolocation data: Approximate geographic location derived from your IP address, used for fraud prevention and jurisdiction compliance purposes. We do not use GPS-level precise location tracking.
- Cookie and tracking data: Information collected via cookies, session tokens, and similar technologies as described in Section 6 of this Policy.
2.3 Data From Third Parties
In limited circumstances, hbja may receive personal data about you from trusted third parties, including:
- Payment processors (bKash, Nagad, Rocket, Upay, Visa/Mastercard acquiring banks) who confirm transaction status, mobile number ownership, and account holder identity.
- KYC and identity verification service providers who validate the authenticity of documents you submit.
- Fraud detection agencies and anti-money-laundering screening databases consulted as part of hbja's financial crime prevention obligations.
How We Use Your Data
hbja uses the personal data we collect for specific, clearly defined purposes. We do not use your data for any purpose beyond what is described in this Policy without first obtaining your explicit consent or as required by applicable law.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account registration & management | Identity, contact, credentials | Contract performance |
| Processing deposits & withdrawals | Financial data, KYC documents | Contract performance |
| Identity & age verification (21+ check) | NID, date of birth, selfie | Legal obligation |
| Fraud prevention & anti-money-laundering | Financial data, device data, IP | Legitimate interest / legal obligation |
| Customer support & complaint resolution | Contact data, communications data | Contract performance |
| Responsible gaming monitoring | Usage data, betting history, session data | Legitimate interest / legal obligation |
| Personalised promotions & bonuses | Usage data, betting history | Consent / legitimate interest |
| Platform analytics & improvement | Device data, usage data, cookie data | Legitimate interest |
| Legal compliance & record-keeping | All categories as required | Legal obligation |
hbja will never sell your personal data to third-party marketing companies. We do not share your data with advertisers for the purpose of serving you third-party advertisements. Any use of your data for promotional communications by hbja itself is limited to offers directly related to your use of the hbja Platform, and you may opt out of such communications at any time by contacting [email protected].
Legal Basis for Processing
hbja processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:
4.1 Contract Performance
The majority of data processing by hbja is necessary to perform our contractual obligations to you as a registered Account holder — specifically, to operate your Account, process deposits and withdrawals, settle bets, administer bonuses, and provide customer support. Without processing the relevant personal data, hbja cannot fulfil these services.
4.2 Legal Obligation
hbja is required by its international gaming licence conditions and applicable anti-money-laundering obligations to collect, verify, and retain certain categories of personal data — particularly identity documents, financial transaction records, and KYC verification outcomes. This processing is mandatory and cannot be opted out of by Account holders.
4.3 Legitimate Interests
hbja processes certain data on the basis of its legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and aggregate analytics used to improve the Platform. In each case, hbja has assessed that these interests do not override your fundamental privacy rights.
4.4 Consent
Where hbja relies on your consent as the legal basis for processing — for example, for optional marketing communications related to seasonal promotions such as BPL, Eid al-Fitr, or Pohela Boishakh offers — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent, contact [email protected].
Data Sharing & Disclosure
hbja does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.
5.1 Payment Processors
To process your deposits and withdrawals, hbja shares the minimum necessary financial data with your chosen payment provider — bKash, Nagad, Rocket, Upay, or card-acquiring banks (for Visa/Mastercard). This data sharing is governed by the respective payment provider's own privacy policies, which we recommend you review independently.
5.2 KYC & Identity Verification Partners
To fulfil our age verification (21+) and anti-fraud obligations, hbja may share identity documents and related personal data with contracted KYC verification service providers. These providers are bound by strict data processing agreements and are not permitted to use your data for any purpose other than performing identity verification on hbja's behalf.
5.3 Game Technology Providers
Certain game providers — including Evolution Gaming, Pragmatic Play, Ezugi, Spribe, Microgaming, and NetEnt — may receive a session token and anonymised player identifier when you launch their games on the hbja Platform. This is a technical necessity for game delivery. These providers do not receive your full identity data, financial information, or contact details.
5.4 Legal & Regulatory Authorities
hbja may disclose personal data to law enforcement agencies, regulatory bodies, or other authorised authorities when required to do so by applicable law, court order, or as part of hbja's cooperation with anti-money-laundering investigations. Such disclosures are made only to the extent strictly required by the relevant legal obligation.
5.5 Business Transfers
In the event of a merger, acquisition, or sale of hbja's business or assets, personal data held by hbja may be transferred to the acquiring entity as part of that transaction. In such circumstances, hbja will notify affected Account holders via email prior to their data being transferred and subject to a materially different privacy policy.
Important: hbja will never share your personal data with third-party marketing companies, data brokers, or advertisers. Any third party that receives your data does so strictly under a data processing agreement and is prohibited from using it for their own commercial purposes.
Cookies & Tracking Technologies
The hbja Platform uses cookies and similar tracking technologies to operate core Platform functionality, improve user experience, and support fraud prevention. A cookie is a small text file stored on your device by your web browser when you visit a website.
6.1 Types of Cookies We Use
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Essential cookies | Maintain your login session, remember your Account preferences, enable secure page navigation, and support OTP authentication flows | No — required for Platform functionality |
| Analytics cookies | Collect aggregated, anonymised data about how users navigate the Platform to help hbja improve page layouts, game discovery, and overall usability | Yes — opt out via browser settings |
| Fraud prevention cookies | Identify and block automated bots, detect anomalous login patterns, and support hbja's responsible gaming monitoring obligations | No — required for security |
| Preference cookies | Remember your language preference, display settings, and last-visited game category to personalise your Platform experience | Yes — opt out via browser settings |
6.2 Managing Cookies
You may control or delete cookies through your browser settings at any time. Please note that disabling essential or fraud-prevention cookies may impair your ability to log into your Account or use certain Platform features. Instructions for managing cookies are available in the help documentation of all major browsers including Chrome, Firefox, Safari, and Samsung Internet (commonly used on Android devices in Bangladesh).
6.3 Session Tokens
In addition to cookies, hbja uses session tokens — short-lived cryptographic identifiers stored in your browser's session storage — to maintain your authenticated session. Session tokens expire automatically when you close your browser tab or log out of your Account and are not retained beyond the active session.
Data Retention
hbja retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our legal and regulatory obligations. The table below summarises our standard data retention periods by data category.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of Account + 5 years post-closure | Legal obligation / dispute resolution |
| KYC identity documents | Duration of Account + 5 years post-closure | AML compliance / legal obligation |
| Financial transaction records | Duration of Account + 7 years post-closure | Financial records / AML obligations |
| Betting & gaming history | Duration of Account + 3 years post-closure | Responsible gaming / dispute resolution |
| Customer support communications | 3 years from date of communication | Quality assurance / dispute resolution |
| Analytics & usage data (aggregated) | Up to 26 months (anonymised after 90 days) | Platform improvement / legitimate interest |
| Marketing consent records | Until consent is withdrawn + 1 year | Consent compliance |
When the applicable retention period expires, hbja permanently deletes or irreversibly anonymises your personal data in a secure manner. Anonymised, aggregated data that cannot be used to identify any individual may be retained indefinitely for statistical and analytical purposes.
Data Security
hbja implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes the following layers of protection:
8.1 Encryption
All data transmitted between your device and the hbja Platform is protected by 256-bit SSL/TLS encryption. This ensures that any personal data, financial information, or Account credentials you transmit to hbja cannot be intercepted by third parties during transit. The presence of "https://" in the Platform URL and the padlock icon in your browser confirm that your connection to hbja.io is always encrypted.
8.2 Password Security
hbja never stores your Account password in plaintext. Passwords are processed using industry-standard one-way cryptographic hashing before storage. This means that even hbja's own technical staff cannot read your password — only you know it. In the event of a data breach, your password remains protected by this hashing process.
8.3 Access Controls
Access to personal data within hbja's internal systems is strictly controlled on a need-to-know basis. Customer support agents, compliance officers, and other staff are granted only the minimum level of data access necessary to perform their role. All internal access is logged and subject to regular audit. No hbja staff member will ever ask you for your password.
8.4 Fraud Detection Systems
hbja employs automated fraud detection systems that monitor Account activity in real time for signs of unauthorised access, suspicious login patterns, unusual transaction behaviour, and potential account takeover attempts. Accounts flagged by these systems are suspended pending investigation to protect the Account holder's funds and personal data.
8.5 Data Breach Response
In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, hbja will notify affected Account holders by email within 72 hours of becoming aware of the breach, providing details of the nature of the breach, the categories of data affected, the likely consequences, and the steps hbja is taking to address it.
Your Role in Security: hbja's security measures protect data on our side of the connection. You play an equally important role by using a strong, unique password for your hbja Account, enabling OTP verification, never sharing your credentials with anyone, and logging out of your Account when using a shared device. If you suspect unauthorised access to your Account, contact [email protected] immediately.
Your Rights
As a data subject whose personal data is processed by hbja, you hold the following rights in relation to your personal information. To exercise any of these rights, contact hbja's support team at [email protected] with the subject line "Data Rights Request" and include your Account username and a description of your request. hbja will respond within 30 days.
Your Data Rights at hbja
hbja respects your rights over your personal information. Below are the specific rights you hold as an hbja Account holder and what each one means in practice.
Right of Access
You have the right to request a copy of all personal data hbja holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of your verified request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it promptly. Some corrections (e.g., date of birth) require supporting documentation for verification.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected. Note that data subject to legal retention obligations (e.g., AML records) cannot be deleted until the mandatory retention period expires.
Right to Restrict Processing
You may request that hbja temporarily restrict the processing of your personal data — for example, while a dispute about data accuracy is under review — without requesting full deletion of your Account.
Right to Data Portability
Where processing is based on your consent or a contract, you may request that we provide your personal data in a portable format so that you can transfer it to another service provider of your choice.
Right to Object
You have the right to object to processing carried out on the basis of hbja's legitimate interests — including direct marketing and certain analytics activities. Where you object to marketing, we will stop processing your data for that purpose immediately.
Children & Minors
The hbja Platform is strictly intended for adults aged 21 years and above. hbja does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you are not permitted to register an Account, deposit funds, place any wager, or use any service on the hbja Platform.
If hbja discovers or has reasonable grounds to suspect that personal data has been collected from an individual under the age of 21 — whether through a false date of birth provided at registration or any other means — the relevant Account will be immediately suspended, all associated data will be subject to a mandatory review, and the Account will be closed. Any deposited funds (net of any bonus or fraudulent amounts) may be returned to the payment method on record following the completion of the investigation.
Parent & Guardian Notice: If you believe a minor in your household has registered an Account on hbja, please contact us immediately at [email protected]. We will investigate and close the Account as a priority. hbja takes underage gambling prevention seriously and will cooperate fully with concerned guardians and relevant authorities.
Third-Party Links
The hbja Platform may contain references to third-party game providers (such as Evolution Gaming, Pragmatic Play, Spribe, Ezugi, Microgaming, and NetEnt) and payment services (such as bKash, Nagad, Rocket, and Upay). While these integrations are embedded within the hbja Platform, each third-party provider operates under its own privacy policy and data practices.
hbja is not responsible for the privacy practices of third-party providers whose software or payment infrastructure is integrated into the Platform. We recommend that you review the privacy policies of any third-party service you interact with, particularly your mobile financial service provider, when making deposits or withdrawals.
hbja does not maintain any external links on the Platform to unaffiliated third-party websites. All navigation within hbja.io remains within the hbja domain. If you encounter a link that appears to direct you outside of hbja.io, please report it to [email protected] immediately as it may represent a security concern.
Policy Updates
hbja reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes to this Policy, we will notify registered Account holders via email to the address on record no fewer than 7 days before the changes take effect, except where immediate changes are required for legal or security reasons.
The most current version of this Privacy Policy will always be accessible at hbja.io/privacy-policy, with the effective date and last-updated date prominently displayed at the top of the page. We encourage you to review this page periodically. Your continued use of the hbja Platform following any update to this Privacy Policy constitutes your acceptance of the revised terms.
If you disagree with any material change to this Privacy Policy, you may request voluntary Account closure as described in Section 12.2 of hbja's Terms & Conditions. Any personal data collected prior to the policy change will continue to be governed by the version of the Policy in effect at the time of collection, unless you consent to the updated terms.
Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the personal data hbja holds about you — including data access requests, rectification requests, erasure requests, or complaints about our data practices — please contact hbja's support team. We are committed to responding to all data-related enquiries within 30 days.
Email (plain text — not a clickable link):
support@hbja.
io
Response Time: Within 30 days of receiving your verified request.
Support Language: English and Bengali customer service available 24/7, including Eid, Victory Day (16 December), Independence Day (26 March), and Pohela Boishakh.
When contacting us regarding a data rights request, please include your registered Account username, the email address on your Account, and a clear description of your request. For identity verification purposes, we may ask you to confirm additional Account details before processing your request. This step protects you against unauthorised third-party data requests made in your name.
Why Your Privacy Is Safe with hbja
hbja combines enterprise-grade security infrastructure with a transparent, user-first approach to data protection — so you can focus on the game, not worry about your data.
256-Bit SSL Encryption
Every connection to hbja.io is protected by bank-grade 256-bit SSL/TLS encryption. Your personal data, payment details, and Account credentials are fully encrypted in transit — completely unreadable to any third party attempting to intercept your connection.
No Data Selling — Ever
hbja has a strict and unconditional policy against selling, renting, or trading your personal data to third-party marketers or data brokers. Your information is used only to operate your Account and improve your experience on the hbja Platform — nothing else.
Strict 21+ Age Verification
hbja enforces a mandatory 21-years-minimum age check at registration and withdrawal. KYC documents are verified by specialist identity partners to ensure the hbja Platform remains a safe, adult-only environment for all players across Bangladesh.
Minimal Data Collection
hbja collects only the personal data that is genuinely necessary to operate your Account, process payments, and fulfil our legal obligations. We do not collect excessive data, and we anonymise or delete data as soon as its retention purpose has been fulfilled.
Breach Notification
In the unlikely event of a data breach affecting your personal information, hbja is committed to notifying you within 72 hours of confirming the incident — providing full transparency about what happened, what data was affected, and what steps we are taking to protect you.
Full User Control
You hold meaningful control over your personal data at hbja. From access and rectification to erasure and portability, your data rights are clearly defined and actively supported. Submit a request to [email protected] and our team will respond within 30 days.
Ready to Play with Confidence?
Now that you understand how hbja handles your personal data, you can enjoy cricket betting, live casino, slots, and bingo knowing your privacy is fully protected. Log in to your Account or explore the Platform today.
21+ only. Gambling involves financial risk. Please play responsibly. Responsible Gaming