hiabaji Privacy Policy

hiabaji collects personal data that is necessary to provide you with a safe, compliant, and personalised gaming experience. We collect data in three primary ways: directly from you when you register and use the platform, automatically through your device and browser, and from trusted third-party verification and payment partners.

Data You Provide Directly

Data Collected Automatically

When you access the hiabaji platform, our servers and analytics tools automatically record certain technical information. This includes your IP address, device type and operating system, browser type and version, pages visited and time spent on each page, game sessions initiated (game title, stake amounts, outcomes), and login timestamps. This data is used for security monitoring, fraud detection, and service optimisation. It is not used to build advertising profiles.

Data From Third Parties

hiabaji may receive limited personal data from trusted third-party service providers in the following circumstances:

• Payment processors (bKash, Nagad, Rocket, Upay) confirm transaction status and the registered mobile number or account name associated with a payment, to validate that deposits originate from an account in your name.
• Identity verification partners may cross-reference the documents you submit against authoritative databases to confirm authenticity as part of our KYC process.
• Fraud prevention services may flag IP addresses, device fingerprints, or behavioural signals associated with known fraudulent activity.

We do not purchase data lists from data brokers or marketing aggregators. Any third-party data we receive is used exclusively for the specific purpose for which it was shared and is not combined with your profile for advertising purposes.

hiabaji processes your personal data only where a lawful basis exists for doing so. The primary lawful bases we rely on are: performance of a contract (providing you with the services you have registered for), compliance with legal obligations (KYC, anti-money laundering requirements), and legitimate interests (fraud prevention, security monitoring, platform improvement).

The following table summarises the main purposes for which we use your data and the corresponding lawful basis:

Marketing Communications

hiabaji sends promotional emails and SMS messages only to users who have explicitly opted in to receive them during registration or via their account settings. If you have opted in, you may receive communications about new games, seasonal promotions tied to events such as BPL season, Eid, Pohela Boishakh, and ICC tournaments, as well as platform updates and personalised bonus offers. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting live chat support. Withdrawal of consent does not affect any processing carried out before the opt-out was submitted.

Automated Decision-Making

hiabaji uses automated systems to detect fraud, identify responsible gaming risk indicators, and flag accounts for manual review. These automated processes may result in temporary account restrictions pending human review. You have the right to request human review of any automated decision that significantly affects your account. Contact our support team via live chat to submit such a request.

hiabaji does not sell your personal data to any third party under any circumstances. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

Payment Service Providers

To process deposits and withdrawals, hiabaji shares the minimum necessary transaction data with payment partners including bKash, Nagad, Rocket, Upay, and Bangladeshi bank card processors (Visa, Mastercard networks via City Bank, BRAC Bank, Islami Bank, Dutch-Bangla Bank, and Sonali Bank). These providers process your payment data under their own privacy policies and are contractually prohibited from using your data for any purpose other than completing the specific transaction.

Identity Verification Partners

KYC document verification is performed with the assistance of specialised identity verification service providers. Your NID number, passport data, and submitted photographs are shared with these providers solely for the purpose of confirming your identity and age. Verification partners are bound by strict data processing agreements and are not permitted to retain your data beyond the verification period.

Game Content Providers

Games on the hiabaji platform are powered by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you participate in a live casino game or a third-party slot, limited session data (game round ID, stake amount, outcome) may be transmitted to the relevant provider's servers for game integrity purposes. Personal identity data is not shared with game studios.

Law Enforcement & Regulatory Bodies

hiabaji will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by a valid legal process, court order, or statutory obligation. We do not voluntarily disclose data to authorities beyond what is legally required. Where permitted by law, we will notify you of such a disclosure request.

The hiabaji platform uses cookies and similar browser-based storage technologies to ensure the site functions correctly, to remember your preferences, and to understand how players interact with the platform. The following categories of cookies are in use:

hiabaji does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You will not be followed around the internet with hiabaji adverts based on your browsing behaviour on our platform.

Managing Cookies

You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, block third-party cookies only, or clear cookies on browser close. Note that disabling strictly necessary cookies will prevent you from logging in to your hiabaji account. Instructions for managing cookies are available in the help documentation for your specific browser (Chrome, Firefox, Safari, Edge, or Samsung Internet on Android devices).

hiabaji retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by our legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the lifetime of your account and for a minimum of five years following permanent account closure. This retention is required to meet anti-money laundering record-keeping obligations.
• Transaction records: Retained for a minimum of five years from the date of each transaction, in compliance with financial record-keeping requirements applicable in Bangladesh.
• KYC documents: Retained for a minimum of five years following account closure or the completion of the KYC process, whichever is later.
• Support communications: Retained for three years from the date of each interaction, to allow us to refer to previous support history and resolve any disputes that may arise.
• Analytical and technical data: Aggregated and anonymised after 13 months. Individual session logs are retained for up to 90 days for fraud investigation purposes.
• Marketing consent records: Retained for the duration of your account and for two years following account closure, as evidence of your consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data has been anonymised, it may be retained indefinitely for statistical and platform improvement purposes, as it can no longer be used to identify any individual.

Data Storage Location

The hiabaji platform's primary data infrastructure is hosted on secure cloud servers. All servers that store personally identifiable information are subject to access controls, regular security audits, and encrypted-at-rest storage. Physical access to server infrastructure is restricted to authorised personnel only.

As a user of the hiabaji platform, you hold the following rights in relation to the personal data we hold about you. These rights may be exercised free of charge by contacting our support team via live chat or by emailing us at the address listed in Section 8 of this policy.

hiabaji will respond to all valid privacy rights requests within 30 days of receipt. Where a request is particularly complex or involves a high volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

We may need to verify your identity before processing a privacy rights request, to ensure that personal data is not disclosed or deleted at the request of an unauthorised party. Verification may require you to confirm account details or provide a copy of your registered identity document.

hiabaji takes the security of your personal data seriously and maintains a layered set of technical and organisational measures designed to protect against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption. This protects your login credentials, financial data, and personal information in transit.
• Encryption at rest: Sensitive personal data stored on our servers — including KYC documents, payment method details, and account credentials — is stored in encrypted form. Password data is stored as a one-way cryptographic hash and is never stored in plain text.
• Access controls: Access to personal data is restricted to hiabaji personnel who require it to perform their specific job functions. Access rights are reviewed regularly and revoked promptly when an employee changes role or leaves the organisation.
• Intrusion detection: Our infrastructure is monitored continuously for unusual access patterns, failed login attempts, and other indicators of potential compromise. Automated alerts are reviewed by our security team around the clock.
• Penetration testing: hiabaji conducts regular security assessments and vulnerability testing of the platform to identify and remediate potential weaknesses before they can be exploited.
• Incident response: In the event of a personal data breach that is likely to result in a risk to affected individuals, hiabaji will notify affected users promptly, providing details of what data was involved, what steps have been taken to contain the breach, and what actions you should take to protect yourself.

While we apply robust security measures, no online platform can guarantee absolute security against all threats. You play an important role in keeping your account secure by choosing a strong, unique password, enabling two-factor authentication where available, and contacting support immediately if you suspect any unauthorised access to your account.

hiabaji reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. When material changes are made, we will publish the revised policy on this page with an updated effective date. For significant changes that affect how we use your data in a way that is less favourable to you, we will provide advance notice via the email address registered on your account before the change takes effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the hiabaji platform after a revised policy has been published constitutes your acceptance of the updated terms, to the extent permitted by applicable law.

How to Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to raise a concern about how hiabaji handles your personal data, please contact our support team using any of the following methods:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the hiabaji platform. Average response time is under 3 minutes.
• Email: [email protected] — please include "Privacy Request" in the subject line along with your registered username for fastest processing.

All privacy-related requests are handled by a dedicated team member and are logged for audit purposes. We aim to acknowledge all privacy enquiries within 24 hours of receipt and to provide a full response within the 30-day period described in Section 6 of this policy.