hbagi Privacy Policy

This Privacy Policy (the "Policy") describes how hbagi ("hbagi", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data relating to individuals ("you" or "the Player") who access or use the hbagi website at hbagi.io, its mobile web platform, and all associated services and features (collectively, the "Platform").

hbagi is committed to handling your personal data with transparency, integrity, and respect. This Policy is written in plain English so that every player — regardless of technical background — can understand what data is collected and why. The Policy is binding on all hbagi account holders and applies from the moment you visit the Platform, whether or not you have registered an account.

This Policy should be read alongside the hbagi Terms and Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference. By using the hbagi Platform, you confirm that you have read and understood this Policy.

For the purposes of this Policy, hbagi acts as the data controller in respect of personal data collected through the Platform. As data controller, hbagi determines the purposes for which and the means by which your personal data is processed.

All queries relating to data privacy, including requests to exercise your rights under Section 11 of this Policy, should be directed to the hbagi data privacy team. Contact details are provided in Section 15 of this Policy.

hbagi collects the following categories of personal data in the course of providing its services to you:

hbagi does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data unless strictly required by applicable law or regulatory authority.

hbagi collects personal data through the following channels:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting support, or submitting feedback.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies (see Section 10).
• Third-party sources: Identity and fraud-screening data received from KYC and AML verification partners; payment confirmation data from bKash, Nagad, Rocket, Upay, and banking partners; game activity data from third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi.
• Publicly available sources: Publicly accessible records used to verify identity or investigate potential fraud, where permissible under applicable law.

hbagi uses the personal data it collects for the following specific purposes:

• To create, maintain, and administer your hbagi account, including verifying your identity and age (21+ requirement) at registration and on an ongoing basis.
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank, and to maintain accurate financial records in Bangladeshi Taka (৳).
• To detect, investigate, and prevent fraud, money laundering, and other criminal activity.
• To personalise your experience on the Platform, including surfacing promotions, game recommendations, and content relevant to your activity history.
• To send you transactional communications such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts via your registered mobile number or email address.
• To send you marketing communications about hbagi promotions, including seasonal offers tied to Eid, Pohela Boishakh, and BPL cricket, where you have given your express consent to receive such communications.
• To monitor platform usage and responsible gaming indicators, and to apply responsible gaming tools (deposit limits, self-exclusion) at your request or where required by policy.
• To improve and develop the hbagi Platform, including testing new features and analysing aggregate usage patterns.
• To comply with applicable legal and regulatory obligations, including responding to lawful requests from law enforcement or regulatory authorities.
• To resolve disputes, enforce the hbagi Terms and Conditions, and protect hbagi's legitimate legal interests.

hbagi processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and hbagi, including account administration, payment processing, and game access.
• Legal obligation: Processing required to comply with applicable laws, including Anti-Money Laundering (AML) regulations, Know Your Customer (KYC) obligations, and law enforcement requests.
• Legitimate interests: Processing carried out for hbagi's legitimate business interests where those interests are not overridden by your rights and freedoms — including fraud prevention, platform security, and service improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

hbagi does not sell your personal data. We may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive only the data necessary to process the specific transaction you have initiated. Each payment partner operates under its own privacy terms.
• KYC and AML partners: Third-party identity verification and anti-money-laundering screening services that assist hbagi in meeting its compliance obligations.
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed providers receive session and game-activity data necessary to deliver their respective game content to you.
• Technology service providers: Cloud hosting, data storage, customer support platform, and analytics service providers engaged by hbagi under data processing agreements that require them to handle your data only on hbagi's instructions and to implement appropriate security measures.
• Regulatory and law enforcement authorities: Where hbagi is required by applicable law, court order, or lawful regulatory request to disclose personal data. hbagi will, where permitted by law, notify you of such a disclosure.
• Successor entities: In the event of a merger, acquisition, or sale of all or a substantial portion of hbagi's assets, your personal data may be transferred to the relevant successor entity subject to equivalent privacy protections.

hbagi retains personal data only for as long as is necessary to fulfil the purpose for which it was collected or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the duration of your account relationship with hbagi plus a minimum period of 5 years after account closure, to comply with AML and financial record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Support correspondence: Retained for 3 years from the date of the most recent communication in a support thread, unless the matter involves a legal dispute, in which case it is retained until the dispute is fully resolved.
• Marketing consent records: Retained for the duration of your consent plus 3 years for compliance audit purposes.
• Technical and usage logs: Retained for 12 months on a rolling basis, except where flagged for security investigation.

When personal data is no longer required, hbagi will securely delete or anonymise it in accordance with industry-standard data destruction procedures.

hbagi implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the hbagi Platform.
• AES-256 encryption for sensitive personal data stored in hbagi's databases.
• Role-based access controls ensuring that hbagi employees can only access personal data relevant to their specific job function.
• Two-factor authentication (2FA) enforced for all hbagi staff systems that handle personal data.
• Regular third-party security audits and penetration testing of the hbagi Platform and infrastructure.
• Formal incident response procedures, including breach notification protocols, to ensure timely response in the event of a security incident.

While hbagi takes all reasonable precautions to protect your personal data, no internet-based platform can guarantee absolute security. You play an important role in keeping your data safe by maintaining a strong, unique password for your hbagi account and by not sharing your login credentials with any third party. If you suspect that your hbagi account credentials have been compromised, contact [email protected] immediately.

hbagi uses cookies and similar technologies (collectively, "cookies") on its Platform. Cookies are small text files placed on your device by the Platform. They help the Platform recognise your device, maintain your session, and deliver a consistent, personalised experience.

hbagi uses the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. They enable core features such as session management, account authentication, and security. These cookies cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: Collect anonymised data about how visitors interact with the Platform — such as pages visited, time on page, and error messages encountered — to help hbagi improve the Platform experience.
• Functional cookies: Remember your preferences (such as your preferred language, last selected payment method, and notification settings) to provide a more personalised experience on subsequent visits.
• Targeting and marketing cookies: Used, with your consent, to deliver relevant promotional content within the hbagi Platform. hbagi does not use third-party advertising networks or cross-site tracking cookies.

You may control cookies through your browser settings at any time. Please note that disabling certain categories of cookies may affect your ability to use some features of the hbagi Platform. Strictly necessary cookies cannot be disabled via browser settings and do not require your consent, as they are essential to Platform operation.

As an hbagi account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, contact hbagi at [email protected] with the subject line "Data Rights Request — [Your Full Name]".

• Right of access: You may request a copy of all personal data hbagi holds about you, together with information about how it is processed.
• Right to rectification: You may request that hbagi correct any inaccurate or incomplete personal data held about you.
• Right to erasure: You may request that hbagi delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to hbagi's legal retention obligations (see Section 8).
• Right to restriction: You may request that hbagi restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or object to its processing.
• Right to data portability: Where processing is based on your consent or on contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your personal data where hbagi relies on legitimate interests as the legal basis, or where your data is processed for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

hbagi will respond to all verified data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, hbagi may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

hbagi may request proof of identity before processing any data rights request to ensure that personal data is not disclosed to an unauthorised party.

The hbagi Platform is strictly for individuals aged 21 years and above. hbagi does not knowingly collect or process personal data relating to individuals under the age of 21. If hbagi discovers that an account has been registered by or on behalf of a person under the age of 21, it will immediately close that account, void all associated bets, return any verified deposits to the original payment channel, and delete all associated personal data to the extent not otherwise required to be retained for legal compliance purposes.

If you believe that hbagi has inadvertently collected personal data relating to a minor, please contact us immediately at [email protected] so that we can take prompt corrective action.

hbagi's primary operations and data storage infrastructure are hosted in data centres that serve the Bangladesh and South Asia region. In limited circumstances, personal data may be transferred to or accessed from locations outside Bangladesh — for example, where a third-party technology service provider or game content partner operates globally.

Where such transfers occur, hbagi ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that provided by this Policy. These safeguards may include contractual clauses obligating the recipient to apply equivalent data protection standards and security measures.

By using the hbagi Platform, you acknowledge and agree to the possibility of such transfers taking place in the limited circumstances described above, subject always to the protections described in this Policy.

hbagi reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform services. When material changes are made, hbagi will:

• Publish the updated Policy on this page with a revised effective date.
• Notify active account holders via their registered email address or mobile number at least 14 days before the updated Policy takes effect, where reasonably practicable.
• Where required by law, seek fresh consent before processing your data under any materially new terms.

We encourage you to review this Policy periodically. Continued use of the hbagi Platform after a revised Policy has taken effect constitutes acceptance of the updated terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way hbagi handles your personal data, please contact the hbagi data privacy team. Our support team is available 24 hours a day, 7 days a week, on Bangladesh Standard Time (BST, UTC+6).

Data Privacy Contact: [email protected]

Please use the subject line "Privacy Enquiry" for general questions or "Data Rights Request — [Your Full Name]" when exercising a specific data right. hbagi will acknowledge receipt of all privacy-related communications within 5 business days and provide a substantive response within 30 calendar days.

If you are not satisfied with hbagi's response to a privacy complaint, you may escalate the matter through the dispute resolution process outlined in the hbagi Terms and Conditions.