hbaee Privacy Policy — How We Handle Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how hbaee ("hbaee", "we", "us", "our") collects, uses, stores, shares, and protects personal information in connection with your use of the online betting and casino platform accessible at https://hbaee.io ("the Platform"). This Policy applies to all visitors, registered players, and anyone who interacts with the Platform in any capacity.

hbaee is committed to handling your personal data responsibly, transparently, and in accordance with good data protection practices. We understand that the information you share with us is sensitive, and we take every reasonable technical and organisational measure to keep it secure.

By registering an account on the Platform, making a deposit, or otherwise using any feature of the Platform, you acknowledge that you have read this Privacy Policy in full and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should immediately cease using the Platform and contact our support team to request account closure.

2. Who We Are

hbaee is an online entertainment and gaming platform operated under the hbaee brand, serving players across Bangladesh — including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. The Platform offers sports betting (with a particular focus on cricket BPL, T20 World Cup, IPL, and international football), live casino games, slot titles from leading providers including Pragmatic Play, NetEnt, Microgaming, and Spribe, and speciality games including Andar Bahar and The Great Icescape.

For any privacy-related enquiries, hbaee can be contacted directly at the email address set out in Section 15 of this Policy. Our support team is available 24 hours a day, seven days a week, Bangladesh Standard Time (BST, UTC+6).

3. Personal Data We Collect

hbaee collects personal data in the following categories. We only collect information that is necessary for a specific, documented purpose:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (used to verify that you meet the minimum age requirement of 21 years);
• Gender (optional, collected during registration);
• Username chosen at registration;
• Copies of identity documents submitted for KYC verification (National ID card, passport, or driving licence).

3.2 Contact Data

• Email address;
• Mobile phone number (primary contact for account verification and transactional SMS);
• Residential address in Bangladesh (required for KYC and withdrawal verification).

3.3 Financial & Transaction Data

• Payment method details — including bKash account number, Nagad account number, Rocket number, Upay details, or masked Visa/Mastercard number — used for deposit and withdrawal processing;
• Deposit and withdrawal history, including amounts in BDT (৳), timestamps, and transaction reference numbers;
• Betting history, including bet amounts, markets wagered on, odds accepted, and settlement outcomes;
• Bonus and promotion redemption records.

3.4 Technical & Device Data

• IP address at the time of registration, login, and each session;
• Device type, operating system, and browser version;
• Session duration, pages visited, and click-path data (collected via cookies and analytics tools — see Section 8);
• Geolocation data derived from IP address (country and city level; we do not access GPS-level device location).

3.5 Communications Data

• Records of any communications you send to our customer support team via live chat or email, including the content of those messages and timestamps;
• Survey responses, feedback submissions, or complaint correspondence.

3.6 Responsible Gaming Data

• Any deposit limits, loss limits, session time alerts, or self-exclusion settings you configure in your account dashboard;
• Records of responsible gaming tool activations and their effective periods.

4. How We Collect Your Data

hbaee collects personal data through the following channels:

4.1 Directly From You

The majority of the personal data we hold is provided directly by you at various points during your use of the Platform:

• During the account registration process when you complete the sign-up form;
• When you submit KYC verification documents through the secure upload portal in your account settings;
• When you initiate a deposit or withdrawal through the cashier section of the Platform;
• When you contact our support team via live chat or email;
• When you configure your responsible gaming settings or account preferences;
• When you participate in any survey, promotion, or competition we run on the Platform.

4.2 Automatically Through Your Use of the Platform

When you visit or use the Platform, certain technical data is collected automatically by our systems and third-party analytics tools:

• Your IP address and approximate geographic location are logged whenever you access the Platform;
• Session data, including pages visited and time spent on the Platform, is captured via cookies and server logs;
• Device and browser information is recorded to support technical troubleshooting and security monitoring.

4.3 From Third Parties

hbaee may receive limited personal data from the following trusted third-party sources:

• Payment Providers: bKash, Nagad, Rocket, Upay, and card payment processors may pass transaction confirmation data (reference numbers, amounts, and sender identifiers) to us upon completion of a deposit or withdrawal;
• Identity Verification Partners: Where we use a third-party KYC/AML verification service, that service may return a verification status and associated document validity confirmation to hbaee;
• Fraud Prevention Services: Our fraud detection partners may share risk signals or flagged transaction patterns with us to help protect the Platform and its players.

5. How We Use Your Personal Data

hbaee uses the personal data it collects for the following specific purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent:

6. Legal Basis for Processing

hbaee processes your personal data on the following legal bases, depending on the processing activity:

6.1 Contractual Necessity

The majority of our data processing activities are necessary to perform the contract we have with you — specifically, to operate your player account, process your deposits and withdrawals, settle your bets, and provide customer support. Without this processing, we would be unable to deliver the Platform services you have signed up for.

6.2 Legal Obligation

hbaee is required by applicable law and regulation to conduct identity verification (KYC), retain certain transaction records, and cooperate with law enforcement and regulatory authority requests. Processing for these purposes is mandatory and cannot be declined by players.

6.3 Legitimate Interests

hbaee processes certain data on the basis of its legitimate interests as a platform operator, provided those interests are not overridden by your rights and interests. Legitimate interest processing activities include: fraud detection and prevention; security monitoring; product improvement using anonymised analytics; and responsible gaming monitoring. Before relying on legitimate interests as a basis for processing, hbaee conducts a balancing assessment to ensure player rights are appropriately protected.

6.4 Consent

Where hbaee processes your data for marketing purposes — including sending promotional emails about bonuses, new games, or seasonal offers — we do so on the basis of your consent. You may withdraw your consent at any time by clicking the unsubscribe link in any marketing communication or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

7. Sharing Your Personal Data

hbaee does not sell, rent, or disclose your personal data to third parties for commercial or marketing purposes. We share your data only in the following limited and controlled circumstances:

7.1 Payment Processing Partners

To process deposits and withdrawals, hbaee shares the minimum necessary financial and identity data with payment partners including bKash, Nagad, Rocket, Upay, and card payment processors. These partners operate their own privacy and security controls and are bound by contractual data protection obligations with hbaee.

7.2 Identity Verification & KYC Providers

Where hbaee uses a third-party identity verification service to conduct KYC checks, your identity documents and personal details may be shared with that service solely for the purpose of completing the verification. The provider is contractually prohibited from using your data for any other purpose.

7.3 Fraud Prevention & Security Services

hbaee works with fraud detection and cybersecurity partners who may receive certain technical and transactional data (such as IP addresses, device fingerprints, and betting patterns) to help identify and prevent fraudulent activity on the Platform. These partners process data under strict confidentiality and security obligations.

7.4 Game Content Providers

To provide you with access to slot games and live casino titles from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, certain anonymised or session-level technical data may pass through those providers' game servers. No identifiable personal data (such as your full name, contact details, or payment information) is shared with game content providers beyond what is technically required for game session initialisation.

7.5 Legal & Regulatory Authorities

hbaee will disclose personal data to law enforcement agencies, regulatory bodies, or government authorities where required to do so by applicable law, valid legal process, or in connection with an investigation into suspected fraud, money laundering, or other criminal activity. Where legally permissible, hbaee will notify the affected player of any such disclosure.

7.6 Business Transfers

In the event that hbaee's business or assets are acquired, merged, or transferred to a third party, player personal data held by hbaee at the time of the transaction may form part of the transferred assets. In such circumstances, the acquiring entity will be required to honour the terms of this Privacy Policy in respect of all pre-existing player data. hbaee will provide notice to affected players via the Platform or by email prior to any such transfer taking effect.

8. Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember your preferences, maintain your session, and collect usage data. The hbaee Platform uses both first-party cookies (set by hbaee directly) and third-party cookies (set by service partners such as analytics and fraud detection providers).

8.2 Types of Cookies We Use

8.3 Managing Cookies

You can manage non-essential cookies through your browser's cookie settings. Most modern browsers (Chrome, Firefox, Safari, Edge) allow you to view, block, or delete cookies on a per-site basis. Please note that disabling functional or analytics cookies may reduce the quality of your Platform experience but will not prevent you from accessing core betting and gaming features.

9. Data Retention Periods

hbaee retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from hbaee's systems or irreversibly anonymised so that it can no longer be linked to any identifiable individual.

10. Data Security

hbaee implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS Encryption: All data transmitted between your browser or mobile app and the hbaee Platform is encrypted using TLS 1.2 or higher;
• Encrypted Data Storage: Sensitive personal data stored on hbaee's servers — including payment details and KYC documents — is encrypted at rest using industry-standard encryption algorithms;
• Access Controls: Access to personal data within hbaee's internal systems is restricted to authorised personnel on a strict need-to-know basis. All staff with access to player data undergo background screening and regular data protection training;
• Multi-Factor Authentication: Internal systems containing personal data are protected by multi-factor authentication requirements;
• Intrusion Detection & Monitoring: hbaee's infrastructure is continuously monitored for suspicious activity, unauthorised access attempts, and anomalous data transfers;
• Regular Security Audits: hbaee conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.

While hbaee takes every reasonable precaution, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, hbaee will notify affected players promptly and take all necessary remedial action.

11. Your Privacy Rights

As a player on the hbaee Platform, you have the following rights in respect of your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and your registered account username. hbaee will respond to all verified rights requests within 30 calendar days.

11.1 Right of Access

You have the right to request a copy of all personal data that hbaee holds about you. We will provide this data in a structured, commonly used format. Note that we may redact information that would reveal confidential business information or data relating to other individuals.

11.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain data fields (such as your registered name or date of birth), correction requests will require documentary evidence to prevent fraud.

11.3 Right to Erasure

You may request deletion of your personal data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; or (c) you object to processing based on legitimate interests and your interests override ours. The right to erasure does not apply where hbaee is required to retain data by law — for example, KYC and transaction records retained for AML compliance cannot be deleted on request.

11.4 Right to Restriction of Processing

You may request that hbaee restrict the processing of your data while a rectification or objection request is being assessed. During a restriction period, hbaee will store your data but will not actively process it beyond what is necessary for the restriction itself.

11.5 Right to Data Portability

Where hbaee processes your data by automated means on the basis of your consent or contractual necessity, you have the right to receive a machine-readable copy of that data for transfer to another service provider.

11.6 Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on legitimate interests, although hbaee may continue processing where it can demonstrate compelling legitimate grounds that override your interests.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. To withdraw marketing consent, click the unsubscribe link in any marketing email or contact [email protected].

12. Minors & Age Policy

The hbaee Platform is strictly restricted to individuals who are aged 21 years or older. hbaee does not knowingly collect, use, or retain personal data from anyone under the age of 21. All registration attempts undergo age verification as part of the KYC process, and accounts where the player is found to be under 21 will be immediately suspended and any deposited funds returned to the source payment method.

If you are a parent or guardian and you believe that a minor under your care has registered on the hbaee Platform, please contact us immediately at [email protected]. We will investigate and, where confirmed, promptly close the account and delete all associated personal data in accordance with our data protection obligations.

13. International Data Transfers

hbaee's primary operations are focused on serving players in Bangladesh. However, some of our third-party service partners — including payment processors, identity verification providers, game content providers, and fraud detection services — may operate infrastructure located outside Bangladesh. In such cases, your personal data may be transferred to and processed in jurisdictions outside your country of residence.

Where international data transfers occur, hbaee takes appropriate steps to ensure that your personal data receives a level of protection consistent with the standards set out in this Privacy Policy. These steps may include: entering into contractual data protection agreements with the receiving party; requiring the receiving party to implement appropriate technical and organisational security measures; and limiting the transfer to the minimum data necessary for the specific purpose.

By using the hbaee Platform and accepting this Privacy Policy, you consent to the transfer of your personal data to third-party service partners in accordance with the terms described in this section.

14. Changes to This Privacy Policy

hbaee reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes in our data processing activities, the introduction of new Platform features, or improvements to our privacy practices based on player feedback and internal review.

When we make material changes to this Policy, we will notify you by one or more of the following methods: (a) posting a prominent notice on the Platform homepage or your account dashboard; (b) sending a notification to your registered email address; or (c) updating the "Last Updated" date at the top of this Policy. We encourage you to review this Policy periodically to stay informed about how hbaee protects your personal information.

Your continued use of the hbaee Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should stop using the Platform and contact our support team to close your account and request deletion of your personal data, subject to applicable legal retention obligations.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way hbaee handles your personal data, please do not hesitate to get in touch. Our dedicated Privacy and Support team is available 24 hours a day, seven days a week, Bangladesh Standard Time (BST, UTC+6), and will respond to all privacy-related enquiries within 2–5 business days.

When submitting a data rights request, please provide as much relevant detail as possible to help us process your request efficiently. For account-related requests (such as data access or erasure), we will ask you to verify your identity before we action your request, in order to protect your data from unauthorised third-party requests.

hbaee is committed to resolving all privacy concerns promptly and fairly. If after contacting us you feel your concern has not been adequately addressed, you may seek further assistance through the appropriate consumer protection channels available in Bangladesh.