Your Privacy at hbji — Transparent, Secure, and Respectful

1 Who We Are

hbji operates the online sports betting and casino platform accessible at hbji.io. We are the data controller responsible for the personal data of players who register and use our platform. hbji is committed to handling personal data with transparency, integrity, and in full compliance with applicable data protection law.

Our platform is specifically designed for the Bangladesh market, serving adult players aged 21 and above. All data handling practices described in this Policy apply to all users of hbji.io, regardless of the device or method used to access the platform.

If you have any questions about this Policy or how hbji handles your personal data, please contact our data team at [email protected] with the subject line "Privacy Enquiry".

2 Personal Data We Collect

hbji collects several categories of personal data in order to provide a safe, compliant, and personalised betting and gaming experience. The categories of data we collect are described below:

hbji does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is required for identity verification. If any such data is incidentally disclosed during KYC or support communications, it will be handled with the highest level of care and not used for any secondary purpose.

3 How We Collect Your Data

hbji collects personal data through the following means:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion;
• Automated technologies: When you browse hbji.io, we automatically collect technical and usage data via cookies, server logs, and similar tracking technologies (see Section 9);
• Payment providers: When you initiate a deposit via bKash, Nagad, Rocket, Upay, or a bank transfer, your payment provider shares transaction reference data with hbji to confirm the transaction;
• Identity verification providers: Where hbji uses a third-party KYC service to verify the authenticity of your identity documents, that provider may share verification results and risk scores with us;
• Third-party game studios: Game providers such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe may share aggregated game session data with hbji for settlement, dispute resolution, and responsible gaming purposes;
• Publicly available sources: In certain fraud investigation or AML screening scenarios, hbji may consult publicly available information to verify identity or assess risk.

4 How We Use Your Personal Data

hbji uses your personal data for the following purposes:

• Account management: To create, maintain, and manage your hbji player account, including processing logins, password resets, and account settings changes;
• Identity & age verification: To confirm that you are who you say you are and that you meet the minimum age requirement of 21 years before allowing withdrawals or access to certain features;
• Payment processing: To process deposits and withdrawal requests, reconcile transactions, and investigate payment disputes with your payment provider;
• Fraud prevention and AML compliance: To detect and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct as described in our Terms & Conditions;
• Responsible gaming: To monitor betting patterns for signs of problem gambling behaviour and to apply deposit limits, self-exclusion, or cool-down periods when requested or when mandated by our responsible gaming policy;
• Customer support: To respond to your queries, resolve complaints, and improve the quality of our support interactions;
• Platform improvement: To analyse how players use hbji.io in order to fix bugs, improve performance, develop new features, and refine the user experience;
• Marketing and promotions: To send you relevant promotional offers, seasonal bonuses (Eid, Pohela Boishakh, BPL, IPL, T20 World Cup), and platform news — subject to your consent and opt-in preferences;
• Legal and regulatory compliance: To fulfil our obligations under applicable law, respond to legal process, and cooperate with law enforcement and regulatory authorities;
• Security monitoring: To monitor for unauthorised access, suspicious login attempts, and other security threats to your account and to the hbji platform as a whole.

5 Legal Bases for Processing

hbji processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between hbji and you as a registered player — including account management, payment processing, and game settlement;
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering (AML) obligations, age verification requirements, and responses to lawful requests from law enforcement or regulatory bodies;
• Legitimate interests: Processing carried out for hbji's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided these interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications, non-essential cookies, and any other purpose where hbji has requested and received your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Sharing Your Personal Data

hbji does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your data only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — strictly to the extent necessary to process your deposits and withdrawals;
• Identity verification providers: Third-party KYC and AML screening services that help us verify the identity of players and screen against financial crime watchlists;
• Game studio partners: Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and other certified game providers — to the extent required for game session settlement, dispute resolution, and jackpot verification;
• IT and hosting providers: Cloud infrastructure, server hosting, and cybersecurity providers that process data on hbji's behalf under strict data processing agreements;
• Professional advisers: Legal counsel, auditors, and compliance consultants acting under confidentiality obligations;
• Law enforcement and regulators: Where hbji is legally required or compelled by court order to disclose data to a government authority, law enforcement agency, or financial intelligence unit;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of hbji's business, player data may be transferred to the acquiring entity, subject to the same privacy protections set out in this Policy.

All third-party service providers who receive your personal data are contractually bound to process it only for the specified purpose and to maintain appropriate security standards consistent with those described in this Policy.

7 International Data Transfers

As an online platform, hbji may process and store your personal data on servers located outside Bangladesh, including in jurisdictions that may not have data protection laws equivalent to those in your home country. Where such transfers occur, hbji takes appropriate safeguards to ensure your data remains protected, including:

• Contractual clauses binding the recipient to process data only in accordance with hbji's instructions and to apply appropriate technical and organisational security measures;
• Ensuring that third-party service providers to whom data is transferred maintain certifications or operate under recognised data protection frameworks;
• Conducting transfer impact assessments where required to ensure that the level of protection afforded to your data is not undermined by the laws of the destination country.

If you would like further information about the specific safeguards in place for any international transfer of your data, please contact us at [email protected].

8 Data Retention

hbji retains your personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal and regulatory obligations. The following retention periods apply as a general guide:

When personal data is no longer required under the applicable retention period, hbji will securely delete or anonymise it. Anonymised data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

9 Cookies & Similar Technologies

hbji uses cookies and similar tracking technologies on hbji.io to provide a functional, secure, and personalised user experience. The types of cookies we use are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function. They manage your login session, maintain your bet slip, and ensure platform security. These cannot be disabled without impairing core platform functionality;
• Functional cookies: These cookies remember your preferences such as language settings, display preferences, and previously visited game categories to provide a more personalised experience;
• Analytics cookies: hbji uses privacy-respecting analytics tools to understand how players navigate hbji.io in aggregate — which pages are most visited, average session duration, and common user journeys. This data is used solely to improve the platform;
• Security cookies: Used to detect suspicious activity, bot traffic, and repeated failed login attempts in order to protect your account and the platform from malicious actors.

hbji does not use advertising cookies or permit third-party ad networks to set tracking cookies on hbji.io. We do not build or share advertising profiles derived from your browsing behaviour on our platform.

You can control and manage cookies through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use hbji.io and may prevent you from logging into your account. For guidance on managing cookies in your specific browser, refer to your browser provider's help documentation.

10 Data Security

hbji takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational security measures to protect your information from unauthorised access, loss, misuse, alteration, or disclosure.

Key security measures in place at hbji include:

• Industry-standard SSL/TLS encryption for all data in transit between your browser or device and hbji.io servers;
• Encryption at rest for sensitive stored data including KYC documents and financial records;
• Strict role-based access controls ensuring that only authorised hbji personnel with a legitimate need can access player data;
• Multi-factor authentication requirements for all internal hbji staff accounts with access to player data systems;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Real-time intrusion detection and monitoring systems that alert our security team to anomalous access patterns;
• Data minimisation practices — hbji collects only what is genuinely necessary and purges data that is no longer required;
• Staff training on data protection obligations and secure data handling procedures.

While hbji maintains robust security practices, no internet-based system can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, hbji will notify affected players promptly in accordance with applicable data breach notification obligations.

11 Your Rights & Choices

As a player on hbji, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving your request.

• Right of access: You have the right to request a copy of the personal data hbji holds about you, along with information on how it is being used;
• Right to rectification: You have the right to request that inaccurate or incomplete personal data we hold about you is corrected or updated. For straightforward corrections (e.g., phone number, email address) you may also update these directly in your account settings;
• Right to erasure: You have the right to request that hbji delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent on which processing is based. Please note that this right is subject to our legal obligation to retain certain data for AML, fraud prevention, and financial record-keeping purposes (see Section 8);
• Right to restriction of processing: You have the right to request that hbji restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate interests;
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that it be transmitted directly to another controller where technically feasible;
• Right to object: You have the right to object at any time to processing of your personal data where that processing is based on hbji's legitimate interests. hbji will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights, or where processing is necessary for the establishment, exercise, or defence of legal claims;
• Right to withdraw consent: Where hbji processes your data on the basis of your consent (e.g., for marketing communications or non-essential cookies), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal;
• Right not to be subject to automated decisions: hbji may use automated systems for fraud detection, AML screening, and responsible gaming monitoring. Where such automated processing produces a decision with a significant effect on you (such as account suspension), you have the right to request human review of that decision.

12 Children & Underage Players

hbji is strictly an adult platform. We do not knowingly collect personal data from any individual under the age of 21. Our registration process requires users to confirm that they are aged 21 or above, and we conduct identity and age verification as part of our KYC process to enforce this requirement.

If hbji discovers or has reasonable grounds to believe that a registered account belongs to an individual under the age of 21, we will immediately:

• Suspend the account and freeze all associated funds pending investigation;
• Conduct an expedited age and identity verification review;
• If underage status is confirmed, permanently close the account and return any deposits made (net of any bonuses claimed) in accordance with our Terms & Conditions;
• Delete or anonymise all personal data associated with the underage account, except where retention is required by law.

If you are a parent or guardian and believe your child may have registered on hbji.io, please contact us immediately at [email protected] with the subject line "Underage Account Report". We take such reports extremely seriously and will act on them with priority.

13 Third-Party Links & Services

hbji.io may contain references to third-party game providers, payment services, and other platforms. While hbji carefully selects its partners, we do not control the privacy practices of third-party websites or services and are not responsible for their content or privacy policies.

The following categories of third-party services are integrated within the hbji platform, each operating under their own privacy terms:

• Game studios and providers: Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and other certified providers operate their own game engines. Game session data may be processed by these providers to render games and settle outcomes. hbji selects only providers with established data security certifications;
• Payment processors: bKash, Nagad, Rocket, Upay, and banking partners process payment data under their own privacy policies and applicable financial regulations. hbji shares only the minimum data required to execute a transaction;
• KYC and identity verification providers: Third-party identity verification services process your ID documents and biometric data solely for the purpose of verifying your identity on hbji's behalf, under a data processing agreement with hbji.

hbji recommends that you review the privacy policies of any third-party service you interact with directly. hbji's Privacy Policy applies only to data collected and processed by hbji in the operation of hbji.io.

14 Marketing Communications

With your consent, hbji may send you marketing communications about promotions, bonuses, new game releases, seasonal offers (such as Eid bonuses, BPL season specials, IPL promotions, T20 World Cup tournaments, and Pohela Boishakh rewards), and platform updates via email or SMS.

You can opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link included at the bottom of every hbji marketing email;
• Updating your communication preferences in your hbji account settings;
• Contacting our support team at [email protected] with the subject line "Unsubscribe Request".

Please note that opting out of marketing communications does not affect transactional and service communications — hbji will continue to send you account-related messages such as deposit confirmations, withdrawal notifications, security alerts, and important policy updates regardless of your marketing preferences.

15 Changes to This Policy

hbji reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, platform features, legal obligations, or regulatory guidance. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

Where changes to this Policy are material — for example, if we introduce a new purpose for processing your data or change the categories of third parties with whom we share data — hbji will notify registered players via email or an in-platform notification at least 7 days before the revised Policy takes effect.

Minor clarifications, corrections of typographical errors, or editorial restructuring that do not affect the substance of the Policy may be made without prior notice. We encourage you to review this Policy periodically to stay informed about how hbji protects your personal data.

Continued use of hbji.io after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes, you must stop using the platform and may request account closure by contacting [email protected].

16 Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or hbji's handling of your personal data, please contact us using the details below. Our support team is available 24 hours a day, 7 days a week.

• Email: [email protected]
• Subject Line for Data Requests: "Privacy Enquiry" or "Data Rights Request"
• Response Time: General privacy queries within 24 hours; formal data rights requests within 30 days
• Support Hours: 24/7, 365 days a year — English support available at all times
• Platform: hbji.io — Bangladesh's Premier Betting Platform

For responsible gaming enquiries, self-exclusion requests, or concerns about problem gambling, please visit our Responsible Gaming page or include "Responsible Gaming Request" in the subject line of your email to our support team.