hbja Privacy Policy
At hbja, protecting your personal data is a core responsibility we take seriously. This Privacy Policy explains exactly what information we collect when you use our platform, why we collect it, how it is used and stored, and the rights you hold over your own data. Transparency and trust are central to how hbja operates in the Bangladesh market.
Your Privacy at hbja
This Privacy Policy applies to all personal data collected by hbja through the hbja.net website, its mobile-optimised interfaces, and any other services offered under the hbja brand. By creating an account, depositing funds, or otherwise using the hbja platform, you acknowledge that you have read and understood this policy. If you do not agree with any part of this policy, please do not use the hbja platform.
hbja is committed to handling your personal information with the highest standards of care, security, and transparency. We collect only the data necessary to deliver our services, comply with our legal obligations, and continually improve your experience on our platform. We do not sell your personal data to third parties, and we do not use it for any purpose beyond what is described in this policy.
- We do not sell your data
- 256-bit SSL encryption at all times
- Data collected for KYC & service only
- You may request deletion at any time
- Cookies used with your consent
- 18+ players only — age data verified
End-to-End Encryption
Every connection between your browser or mobile device and the hbja platform is protected by 256-bit SSL/TLS encryption. Your personal details, payment information, and account credentials are transmitted securely at all times and are never exposed in plain text.
Minimal Data Collection
hbja collects only the data that is strictly necessary for account management, identity verification, fraud prevention, and regulatory compliance. We do not collect data speculatively or build behavioural profiles for advertising to third-party networks.
No Data Sales
hbja will never sell, rent, or lease your personal data to any third party for commercial purposes. Your information is used exclusively to operate our platform, verify your identity, process your transactions, and communicate with you about your account.
Your Consent Matters
Where data processing relies on your consent — for example, receiving promotional emails or enabling non-essential cookies — hbja will always ask for your explicit permission first. You may withdraw consent at any time by contacting our support team or updating your account preferences.
Defined Retention Periods
hbja retains your personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law. Once the retention period expires, data is securely deleted or anonymised in accordance with our internal data lifecycle policy.
Full Access & Deletion Rights
As an hbja account holder, you have the right to access a copy of all personal data we hold about you, to request corrections, to request deletion where legally permissible, and to object to specific types of processing. Requests are handled within 30 days.
1 Data We Collect
hbja collects personal data from you in several ways: directly when you register and use the platform, automatically through the technical operation of our services, and occasionally from trusted third-party sources as part of our identity verification and fraud prevention processes. The categories of personal data we collect are described below.
1.1 Registration and Account Data
When you create an hbja account, we collect the information you provide during the registration process. This includes:
1.2 Identity Verification (KYC) Data
As part of our mandatory Know Your Customer process, we collect copies of identity documents submitted by players to verify their age and identity. These documents may include:
- National Identity Card (NID) — required for all Bangladesh-based players
- Passport (photo page and data page)
- Driving licence (where accepted as proof of age and identity)
- Proof of residential address (utility bill, bank statement dated within 3 months)
- Selfie photograph for liveness checks, where required
KYC documents are handled with the highest level of security and access is restricted to authorised compliance personnel only. Documents are never used for any purpose other than identity verification and regulatory compliance.
1.3 Financial Data
When you make deposits or withdrawals via bKash, Nagad, Rocket, Upay, or a Bangladeshi bank, hbja collects transaction records including the payment method used, the mobile wallet number or bank account reference (in masked form), transaction amounts in BDT, and timestamps. hbja does not store full card numbers or complete bank account credentials on its own servers. Payment data is processed by our certified payment partners and is subject to their own privacy and security standards.
1.4 Gaming and Betting Activity Data
hbja records your activity on the platform, including games played, bet amounts, session durations, win and loss records, bonus usage, and sport betting market selections. This data is used to deliver your game history, resolve disputes, fulfil responsible gaming obligations, and improve platform performance. It is never shared with third-party advertising networks.
1.5 Technical and Device Data
When you access the hbja platform, our servers automatically collect certain technical information. This includes your IP address, browser type and version, operating system, device type and model, screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and platform optimisation. It is not linked to your personal identity for marketing purposes.
2 How We Use Your Data
hbja uses your personal data strictly for the purposes described in this policy. We do not process your data in ways that are incompatible with the original purpose for which it was collected. The primary purposes for which we use your data are outlined below.
- Account Management: To create and maintain your hbja account, authenticate your login sessions, manage your account preferences, and communicate with you about account-related matters including security alerts and verification requests.
- Transaction Processing: To process deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, or Bangladeshi bank transfer), to maintain accurate financial records, and to investigate and resolve payment disputes.
- Identity Verification: To verify that you meet our minimum age requirement of 18 years, to confirm your identity in compliance with our KYC obligations, and to prevent the creation of duplicate or fraudulent accounts.
- Fraud and Financial Crime Prevention: To monitor account activity for indicators of fraud, money laundering, match-fixing, or other financial crime. Where such activity is detected or suspected, hbja may share relevant data with law enforcement or regulatory authorities as required by law.
- Responsible Gaming Compliance: To monitor player behaviour for signs of problem gambling, to enforce deposit limits and self-exclusion orders, and to provide targeted responsible gaming support where appropriate. This is a legal obligation and also reflects our commitment to player welfare.
- Customer Support: To respond to your support enquiries, investigate complaints, process account closure requests, and communicate the outcome of any investigations. Support communications are logged and retained for quality assurance and dispute resolution purposes.
- Platform Improvement: To analyse usage patterns, identify technical issues, optimise game performance, and improve the overall user experience on the hbja platform. Analysis is conducted on anonymised or aggregated data wherever possible.
- Promotional Communications: To send you information about bonuses, promotions, seasonal offers (such as Eid, BPL season, or Pohela Boishakh promotions), and new features — but only where you have consented to receive such communications. You may opt out at any time.
- Legal and Regulatory Compliance: To maintain records required by applicable law, to respond to lawful requests from regulatory authorities or law enforcement agencies, and to enforce our Terms & Conditions.
3 Cookies & Tracking Technologies
hbja uses cookies and similar tracking technologies to ensure the platform functions correctly, to keep your session active while you are logged in, to remember your preferences, and to gather anonymised analytics data that helps us improve the platform. This section explains what cookies we use and how you can control them.
Essential Cookies: These cookies are strictly necessary for the hbja platform to operate. They maintain your login session, store your currency and language preferences, protect against cross-site request forgery (CSRF) attacks, and ensure that the correct game content is served to your device. You cannot opt out of essential cookies while using the platform, as disabling them would prevent the site from functioning correctly.
Analytics Cookies: With your consent, hbja uses anonymised analytics cookies to understand how players navigate the platform — which pages are visited most frequently, how long players spend on different sections, and where technical errors occur. This data is aggregated and cannot be used to identify individual players. Analytics cookies help us prioritise improvements to the platform experience.
Preference Cookies: These cookies remember your stated preferences such as notification settings, interface layout choices, and responsible gaming tool configurations. They improve your experience by avoiding the need to re-enter preferences on each visit.
No Third-Party Advertising Cookies: hbja does not use third-party advertising networks or tracking pixels that would allow external companies to build a profile of your browsing behaviour across other websites. We have no relationships with advertising networks of this kind. Any analytics data collected on the hbja platform stays within the hbja platform.
hbja's cookie practices are reviewed and updated periodically as the platform evolves. If material changes are made to how we use cookies, we will notify registered players via email and update this policy accordingly.
4 Data Sharing & Disclosure
hbja does not sell, rent, or trade your personal data with any third party for commercial gain. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose.
- Payment Service Providers: To process your deposits and withdrawals, we share the necessary transaction details with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and Islami Bank. These partners operate under their own privacy and data security obligations and are not permitted to use your data for any purpose other than processing the transaction.
- Identity Verification Partners: hbja works with specialist third-party KYC service providers to verify identity documents submitted during the account verification process. These providers are contractually bound to handle your documents securely and to use them only for the purpose of identity verification on behalf of hbja.
- Game Content Providers: When you play a game supplied by a third-party studio such as Pragmatic Play, Evolution Gaming, Microgaming, or Spribe, limited technical data (such as your player session ID and currency) is shared with that provider to enable the game to function. Game providers are not supplied with your full name, NID, or financial account details.
- Regulatory and Law Enforcement Authorities: hbja will disclose personal data to competent regulatory authorities or law enforcement agencies where required to do so by applicable law, court order, or lawful government request. We will notify affected players of such disclosures where we are legally permitted to do so.
- Business Transfers: In the event that hbja undergoes a merger, acquisition, or sale of all or part of its business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it.
All third parties with whom hbja shares personal data are required to enter into data processing agreements confirming their obligations regarding data security, confidentiality, and permitted use. hbja conducts periodic assessments of its data-sharing arrangements to ensure that all partners maintain adequate data protection standards.
5 Data Retention
hbja retains your personal data for the minimum period necessary to fulfil the purposes described in this policy, or for the duration required by applicable legal and regulatory obligations, whichever is longer. The following retention periods apply to the main categories of data we hold.
- Account and Registration Data: Retained for the duration of your active account relationship with hbja, plus a minimum of five (5) years following account closure. This retention period reflects anti-money laundering (AML) record-keeping requirements.
- KYC and Identity Documents: Retained for a minimum of five (5) years following the date of verification or account closure, whichever is later, in accordance with financial crime prevention regulations. Documents are stored in encrypted form and access is strictly limited.
- Financial Transaction Records: Retained for a minimum of six (6) years following the date of each transaction to meet financial record-keeping obligations and to support any potential dispute resolution or regulatory audit.
- Gaming and Betting Activity Logs: Retained for a minimum of three (3) years to support dispute resolution, responsible gaming monitoring, and platform audits. Anonymised and aggregated analytics data may be retained indefinitely.
- Customer Support Communications: Retained for a minimum of two (2) years following the resolution of each case, to provide context in the event of related future enquiries and for quality assurance purposes.
- Technical and Device Logs: Retained for up to twelve (12) months for security monitoring and fraud prevention purposes, after which they are automatically purged or anonymised.
At the end of each applicable retention period, personal data is securely destroyed using methods that render recovery impossible — including cryptographic erasure of encrypted databases and physical destruction of any backup media containing the relevant data. hbja conducts an annual data audit to ensure that retention periods are being observed correctly across all data categories.
6 Your Data Rights
As a registered hbja player, you hold a number of important rights over your personal data. hbja is committed to facilitating the exercise of these rights promptly, without unnecessary barriers, and at no cost to you. A summary of your rights and how to exercise them is set out in the table below.
| Your Right | What It Means | How to Exercise It |
|---|---|---|
| Right of Access Art. 15 | You are entitled to request a complete copy of all personal data hbja holds about you, along with information about how it is processed and with whom it is shared. | Submit a Subject Access Request to [email protected]. Fulfilled within 30 days. |
| Right to Rectification Art. 16 | If any personal data hbja holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay. | Contact [email protected] with the corrected information. Identity re-verification may be required. |
| Right to Erasure Art. 17 | You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations. | Email [email protected] with a deletion request. We will confirm what can be deleted and what must be retained by law. |
| Right to Restriction Art. 18 | You may request that hbja restricts the processing of your data in specific circumstances — for example, while the accuracy of data is being contested. | Contact [email protected]. Processing will be restricted pending investigation and resolution. |
| Right to Portability Art. 20 | Where processing is based on your consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, machine-readable format. | Submit a portability request to [email protected]. Data will be provided in CSV or JSON format within 30 days. |
| Right to Object Art. 21 | You may object to hbja processing your data for direct marketing purposes or where processing is based on legitimate interests. Objections to direct marketing are always honoured immediately. | Unsubscribe via email preferences, or contact [email protected] to object to specific processing activities. |
| Right to Withdraw Consent Art. 7(3) | Where processing is based on your consent (for example, promotional emails or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing. | Update preferences in your account settings, or contact [email protected]. |
7 Data Security
hbja employs a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme is reviewed and updated regularly to keep pace with evolving threats and best practices in the online gaming industry.
- 256-bit SSL/TLS Encryption: All data transmitted between your device and the hbja platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to login sessions, payment processing, form submissions, and all API communications.
- Encrypted Data Storage: Personal data and KYC documents stored on hbja's servers are encrypted at rest using AES-256 encryption. Database backups are encrypted to the same standard and stored in geographically separate secure facilities.
- Access Controls: Access to personal data is restricted to hbja employees and authorised third-party processors who have a legitimate need to access it for the performance of their duties. All staff with data access undergo privacy and security training as part of their onboarding and annually thereafter. Access privileges are reviewed quarterly.
- Two-Factor Authentication: hbja strongly recommends that all registered players enable two-factor authentication (2FA) on their accounts. 2FA provides an additional layer of protection by requiring a one-time code in addition to your password. This significantly reduces the risk of unauthorised access even if your password is compromised.
- Penetration Testing: hbja's platform undergoes regular independent penetration testing conducted by specialist cybersecurity firms. Any vulnerabilities identified are remediated as a priority before the next scheduled test cycle.
- Incident Response: In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, hbja will notify those players without undue delay and will take immediate steps to contain and remediate the breach. Our incident response team operates 24/7 and follows a documented breach response procedure aligned with international best practices.
8 Contact & Data Protection Officer
If you have any questions, concerns, or requests relating to this Privacy Policy or to hbja's data processing practices generally, you are encouraged to contact us directly. hbja has appointed a dedicated Data Protection Officer (DPO) who is responsible for overseeing our compliance with data protection obligations and for handling player enquiries relating to privacy.
You may contact our Data Protection team using the following details:
When contacting us about a data rights request, please include your registered email address, your hbja username, and a clear description of your request. This will allow us to locate your account records promptly and respond to your request within the required timeframe.
Policy Updates: hbja reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal obligations, or platform features. When material changes are made, registered players will be notified via the email address associated with their account at least 14 days before the changes take effect. The updated policy will also be published on this page with a revised effective date. Your continued use of the hbja platform following the effective date of any update constitutes acceptance of the revised policy.
Ready to Explore hbja?
Now that you understand how we protect your data, dive into everything hbja has to offer — from live cricket betting and premium slots to immersive live casino tables and exclusive bonuses for Bangladesh players.