hbahe Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") describes how hbahe ("hbahe", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at hbahe.org, collects, uses, stores, and discloses personal data in connection with your use of the hbahe platform and any related services. This Policy applies to all registered users, visitors, and prospective users of hbahe who are located in Bangladesh or who access hbahe.org from any location.

By registering an account with hbahe or by continuing to use the hbahe platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not access or use hbahe. This Policy should be read alongside hbahe's Terms and Conditions, which are available at hbahe.org/terms-conditions.

hbahe collects personal data from you in the following ways: directly from you when you register an account, make a deposit, submit a withdrawal request, contact customer support, or voluntarily provide information through use of the platform; automatically when you access the hbahe website or app, through cookies, log files, and similar technologies; and from third parties such as identity verification providers and payment processors where necessary to fulfil our compliance and operational obligations. The categories of personal data we collect include:

• Identity data: full legal name, date of birth, nationality, and government-issued identification document details (collected during KYC verification).
• Contact data: Bangladesh mobile number (primary contact method), email address, and residential address for identity verification purposes.
• Financial data: payment method details (bKash/Nagad/Rocket/Upay mobile wallet numbers, Visa/Mastercard card details masked to last 4 digits), transaction history, deposit amounts, withdrawal amounts, and account balance records.
• Technical data: IP address, device type, operating system, browser type and version, session duration, pages visited, and referring URLs — collected automatically when you access hbahe.
• Behavioural data: gaming history, betting patterns, bonus usage, responsible gaming tool activations (deposit limits, self-exclusion requests, cooling-off periods), and session time records.

hbahe collects only the personal data that is necessary for the purposes described in this Policy. We do not collect special categories of sensitive personal data (such as health data or biometric data) except where expressly required for age verification or responsible gaming purposes.

hbahe uses the personal data we collect for the following specific purposes. Each purpose is tied to a legitimate operational, legal, or compliance need:

hbahe processes your personal data on the following legal bases:

• Contractual necessity — processing your identity data, financial data, and transaction records is necessary to perform the contract between you and hbahe (i.e., to operate your account, process payments, and provide access to the platform's services).
• Legal obligation — processing for KYC, age verification, anti-money laundering checks, and regulatory compliance is required by applicable law and cannot be refused or limited by you.
• Legitimate interests — hbahe processes technical data and behavioural data to maintain platform security, detect fraud, prevent bonus abuse, improve platform performance, and operate the responsible gaming monitoring programme. These are legitimate interests that do not override your privacy rights.
• Consent — where hbahe relies on your consent as the legal basis for processing (for example, for optional marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

hbahe does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. However, in order to operate the platform and comply with our legal obligations, we share personal data with the following categories of recipients:

• Payment processors and mobile wallet providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard) — to process deposits and withdrawals. These providers receive only the data necessary to complete the transaction and are bound by their own data protection obligations.
• Identity verification providers — third-party KYC service providers who assist hbahe in verifying your identity, age, and source of funds. These providers operate under strict data processing agreements.
• Technology and platform service providers — cloud hosting providers, customer support software vendors, and security monitoring services who process data on hbahe's behalf under contractual obligations that restrict their use of your data.
• Regulatory and law enforcement authorities — where hbahe is legally required to disclose personal data to a competent authority, government body, or law enforcement agency, such as in response to a court order, anti-money laundering investigation, or tax authority enquiry. hbahe will notify you of such disclosure where it is legally permissible to do so.

Where personal data is transferred to a service provider located outside Bangladesh, hbahe ensures that appropriate contractual safeguards are in place to protect your data to a standard equivalent to or higher than the protections described in this Policy.

hbahe uses cookies and similar tracking technologies on its website and platform. Cookies are small text files stored on your device that enable the platform to recognise your browser, maintain your session, and improve your experience. The types of cookies used by hbahe include:

• Strictly necessary cookies — required for the platform to function. These include session cookies that maintain your login state and security tokens. They cannot be disabled without disrupting core platform functionality.
• Functional cookies — used to remember your preferences such as language settings and responsible gaming tool configurations, so you do not need to reset them on each visit.
• Analytics cookies — used to collect aggregated, anonymised information about how users interact with hbahe, including pages visited, session duration, and navigation paths. This data helps hbahe improve platform usability and performance.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use the hbahe platform. Analytics and functional cookies can be disabled without affecting core functionality. Note that clearing cookies will log you out of your current hbahe session.

hbahe retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply: account data and transaction records are retained for a minimum of 5 years from the date of account closure, in accordance with standard financial record-keeping requirements; KYC and identity verification documents are retained for a minimum of 5 years from the date of the last transaction on the account; responsible gaming records, including self-exclusion requests and cooling-off period activations, are retained for a minimum of 5 years to support the integrity of our player safety programme; marketing preference records are retained until you opt out, after which they are updated promptly to reflect your opt-out status.

When personal data is no longer required for the purposes for which it was collected and no legal retention obligation applies, hbahe will securely delete or anonymise that data. Anonymised data — data from which all identifying information has been permanently removed — may be retained indefinitely for statistical and platform improvement purposes, as it no longer constitutes personal data.

hbahe implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include 256-bit SSL/TLS encryption for all data transmitted between your device and hbahe servers; encrypted storage of sensitive account data including payment details and identity documents; access controls ensuring that personal data is accessible only to hbahe staff and service providers who require it to perform their authorised functions; regular security audits and penetration testing of the hbahe platform infrastructure; and two-factor authentication available on all hbahe accounts to protect against unauthorised login.

While hbahe takes every reasonable precaution to protect your personal data, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, hbahe will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach. You are also responsible for maintaining the security of your hbahe account credentials and should notify hbahe immediately at [email protected] if you suspect your account has been accessed without your authorisation.

As a user of hbahe, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact hbahe at [email protected]. hbahe will respond to all valid data subject requests within 30 days. In some cases, exercising certain rights may affect your ability to use the hbahe platform (for example, requesting deletion of your account data will result in account closure):

• Right of access — you have the right to request a copy of the personal data hbahe holds about you, free of charge. This is sometimes referred to as a Subject Access Request (SAR).
• Right to rectification — if any personal data hbahe holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure — you have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing was unlawful. This right is subject to hbahe's legal obligation to retain certain data for a minimum period.
• Right to restrict processing — you have the right to request that hbahe restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where the processing is unlawful but you prefer restriction to erasure.
• Right to object to marketing — you have the absolute right to object to hbahe processing your personal data for direct marketing purposes at any time. Upon receipt of a valid objection, hbahe will cease processing your data for marketing purposes immediately.

To exercise any of the above rights, please send a written request to [email protected] with the subject line "Data Rights Request" and your registered account details. hbahe may need to verify your identity before processing your request. hbahe will not charge a fee for responding to a data rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

hbahe's platform, services, and all content available on hbahe.org are strictly intended for adults aged 21 years and above. hbahe does not knowingly collect personal data from any person under the age of 21. Age verification is conducted as part of the mandatory KYC process for all new account registrations. If hbahe discovers or has reasonable grounds to believe that personal data has been collected from a person under 21, it will immediately suspend the relevant account, delete the personal data concerned, and refund any real-money balance to the source payment method used, minus any bonus funds that cannot be legitimately returned. Parents and guardians who are concerned that a minor may have accessed hbahe should contact [email protected] immediately.

The hbahe platform may contain references to or integrations with third-party services, including game providers such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming. While hbahe works only with reputable providers, hbahe is not responsible for the privacy practices of these third-party game studios or technology providers. Their data collection and processing activities are governed by their own privacy policies, which are separate from this Policy. hbahe does not control and is not responsible for the content or privacy practices of any external website or service that you may access through links or integrations on the hbahe platform.

hbahe reserves the right to update or amend this Privacy Policy at any time. Where material changes are made, hbahe will notify registered users by SMS to their registered Bangladesh mobile number and will publish the revised Policy at hbahe.org/privacy-policy with a clearly updated effective date at the top of the document. Your continued use of hbahe following notification of a material change constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you must cease use of hbahe and may request account closure. hbahe recommends that you review this Policy periodically to stay informed about how your personal data is being protected.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how hbahe is handling your personal data, you may contact our data protection team by email at [email protected] with the subject line "Privacy Enquiry". hbahe also offers 24/7 live chat support accessible directly through hbahe.org for general account queries. Please note that all contact email addresses on hbahe are provided for correspondence purposes only and are not clickable links — type them directly into your email application. hbahe is committed to responding to all privacy-related queries promptly and transparently, and to maintaining the trust of every player in Bangladesh who chooses to use our platform.