h baji Privacy Policy

This Privacy Policy ("Policy") describes how h baji ("we", "us", "our") collects, uses, stores, and protects the personal information of individuals ("you", "your", "the Player") who access or use the h baji online casino and sports betting platform available at h-baji.app. This Policy applies to all services offered by h baji, including but not limited to sports betting, live casino games, slot games, crash games, and all associated account management and payment services.

By registering an account or continuing to use the h baji platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree to any part of this Policy, you must cease using the platform immediately and may request account closure at any time by contacting our support team.

h baji may update this Privacy Policy from time to time. The date of the most recent update is displayed in the hero section above. Continued use of the platform after any update constitutes your acceptance of the revised Policy. We recommend bookmarking this page and reviewing it periodically.

Information We Collect

h baji collects personal information through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and occasionally from third-party verification or payment service providers. The specific categories of data collected are described below.

Registration and Account Data

When you create a h baji account, we collect the information you provide during the registration process. This may include:

• Full legal name
• Date of birth (for age verification purposes — 18+ only)
• Email address and/or mobile phone number
• Preferred username and encrypted account password
• Current residential address (city and country)
• Preferred currency (BDT / Bangladeshi Taka)

Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, h baji may request the following documents to verify your identity before processing withdrawals or at any other stage deemed necessary by our compliance team:

• National Identity Card (NID) — front and back scan or clear photograph
• Valid passport — biographical data page
• Driving licence — if used as primary identity document
• Proof of address — recent utility bill, bank statement, or government-issued letter (dated within 90 days)
• Proof of payment method — screenshot or statement confirming ownership of the bKash, Nagad, Rocket, or bank account used for deposits

Financial Transaction Data

When you make a deposit or request a withdrawal, h baji records the following financial data in connection with that transaction:

• Payment method used (e.g., bKash, Nagad, Rocket, Upay, bank transfer)
• Transaction amount in BDT
• Transaction date, time (Bangladesh Standard Time, UTC+6), and reference number
• Account or wallet number associated with the payment method (partial masking applied in stored records)
• Transaction status (pending, completed, failed, reversed)

h baji does not store full payment card numbers or full mobile wallet credentials on its own servers. Financial data is processed by our payment service providers under their own applicable data security standards.

Gameplay and Behavioural Data

During your use of the h baji platform, we collect data relating to your activity to enable gameplay, personalise your experience, detect fraud, and comply with responsible gaming obligations:

• Games played, bet amounts, win/loss history, and session duration
• Sports betting markets accessed, wagers placed, and outcomes
• Bonus offers accepted and wagering progress
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

Technical and Device Data

When you access the h baji platform, our servers automatically record certain technical information:

• IP address and approximate geographic location (country and city level)
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and navigation path
• Session start and end timestamps
• Referral source (e.g., search engine, direct URL entry)

How We Use Your Data

h baji processes personal data only for specific, defined purposes. We do not process your data in any manner that is incompatible with the purpose for which it was collected. The primary purposes for which your data is used are set out in the table below.

Marketing Communications

h baji will only send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, and seasonal offers if you have explicitly opted in to receive such communications during registration or in your account settings. You may withdraw this consent at any time by updating your notification preferences in your account dashboard or by contacting our support team. Opting out of marketing communications will not affect your ability to use the platform or receive transactional messages (e.g., deposit confirmations, withdrawal notifications).

Data Sharing & Disclosure

h baji does not sell, rent, or trade your personal information to third parties for commercial or marketing purposes. However, in the course of providing our services, your data may be shared with certain trusted third parties under strict contractual controls. The categories of third parties with whom data may be shared are described below.

Service Providers and Technology Partners

h baji engages third-party companies to assist in delivering platform functionality. These include:

• Payment processors — bKash, Nagad, Rocket, Upay, and banking partners receive transaction data necessary to complete your deposit or withdrawal.
• Identity verification providers — KYC and age-verification service providers receive identity document data strictly for the purpose of completing mandatory verification checks.
• Game content providers — providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised player session data necessary for game operation and RNG certification.
• Fraud prevention and security services — specialised providers that help detect and prevent fraudulent account activity, multi-accounting, and bot usage receive technical and behavioural data in pseudonymised form.
• Cloud infrastructure and hosting providers — h baji's platform is hosted on secure cloud infrastructure. Hosting providers have access to encrypted server data but are contractually prohibited from processing it for any purpose other than infrastructure delivery.

All third-party service providers are required to process data solely on h baji's documented instructions and are bound by contractual obligations that prohibit any secondary use of the data shared with them.

Legal and Regulatory Disclosures

h baji may be required to disclose your personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction when compelled to do so by applicable law, a valid court order, or a legitimate regulatory investigation. In such cases, h baji will disclose the minimum data necessary to satisfy the legal obligation and will, where permitted by law, notify you of the disclosure request.

Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of h baji or its operating entities, personal data held by h baji may be transferred to the acquiring or successor entity as part of that transaction. You will be notified of any such transfer and of any material change to this Privacy Policy that results from it, via the email address registered on your account.

Cookies & Tracking Technologies

h baji uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate the platform, maintain your logged-in session, remember your preferences, and gather anonymised usage analytics. This section explains what types of cookies are used and how you can control them.

Types of Cookies Used

Managing Your Cookie Preferences

Strictly necessary cookies cannot be disabled as they are essential for the platform to function. For functional and analytics cookies, you may adjust your preferences through your browser settings. Most modern browsers allow you to block or delete cookies via the privacy or security settings menu. Please be aware that disabling functional cookies may affect your user experience and certain platform features may not operate as intended. Disabling analytics cookies will not affect your ability to use any h baji service.

Data Retention

h baji retains personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal and regulatory obligations. Once data is no longer required, it is securely deleted or anonymised in accordance with our internal data lifecycle procedures. The following retention schedules apply to the principal categories of data we hold.

At the end of the applicable retention period, personal data is permanently deleted from live systems and from any backups within 90 days of the scheduled deletion date. Where data is anonymised rather than deleted, it is no longer associated with any identifiable individual and is retained solely in aggregate statistical form.

Your Privacy Rights

As a player on the h baji platform, you hold several rights in relation to the personal data we process about you. h baji is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights described below, please contact our support team at [email protected] with a clear description of your request. We will respond within 5 business days (Bangladesh Standard Time, UTC+6).

• Right of Access: You may request a copy of all personal data h baji holds about you. We will provide this in a structured, commonly used, machine-readable format where technically practicable.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated. Where the data subject to correction has been shared with third-party processors, h baji will notify those processors of the correction.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that certain data (e.g., financial transaction records, KYC documents) must be retained for the minimum statutory periods described above, and deletion requests cannot override these obligations.
• Right to Restriction of Processing: You may request that h baji restricts processing of your personal data in certain circumstances — for example, while a rectification request is being investigated, or where you have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that h baji provides your personal data in a portable format so that you may transfer it to another service provider.
• Right to Object: You may object at any time to processing of your personal data that is based on h baji's legitimate interests, including profiling for fraud detection or responsible gaming monitoring. h baji will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Human Review of Automated Decisions: Where a significant decision affecting your account is made solely by automated means, you have the right to request that a member of the h baji compliance team conducts a manual review of that decision.

Data Security

h baji implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. While no online platform can guarantee absolute security, h baji applies the following safeguards as standard across all systems that process personal data.

Technical Safeguards

• TLS/SSL encryption: All data transmitted between your browser or app and the h baji platform is encrypted using TLS 1.2 or higher. This ensures that your login credentials, financial data, and personal information cannot be intercepted during transit.
• Encrypted data storage: Sensitive personal data — including identity document scans and payment method details — is stored in encrypted form at rest using AES-256 or equivalent encryption standards.
• Password hashing: Account passwords are never stored in plain text. h baji applies industry-standard cryptographic hashing algorithms with unique salts to protect all user passwords.
• Access controls: Access to personal data within h baji's systems is restricted on a strict need-to-know basis using role-based access controls. Staff with no operational need to access personal data are denied system access.
• Firewall and intrusion detection: h baji's infrastructure is protected by enterprise-grade firewalls and continuous intrusion detection systems that monitor for and alert on anomalous activity in real time.
• Regular security audits: h baji conducts periodic security assessments of its platform infrastructure, including vulnerability scanning and penetration testing, to identify and remediate security weaknesses before they can be exploited.

Organisational Safeguards

• All h baji staff who handle personal data receive mandatory data protection and security training at onboarding and on an annual basis thereafter.
• Staff are bound by confidentiality obligations in their employment contracts, prohibiting any disclosure of player data outside of authorised operational contexts.
• Third-party processors and technology partners undergo due diligence assessments and are required to maintain security standards no less stringent than those applied by h baji.

Data Breach Response

In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, h baji will take immediate steps to contain and assess the breach. Affected players will be notified without undue delay where the breach is likely to result in a high risk to their personal data. Notification will be sent to the email address registered on your account and will include a description of the nature of the breach, the categories of data affected, and the steps taken or recommended to mitigate any potential harm.

Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which h baji processes your personal data, you are encouraged to contact us in the first instance using the details below. Our support and compliance teams are available around the clock and will acknowledge all data-related enquiries within one business day (Bangladesh Standard Time, UTC+6).

When submitting a data rights request, please include your registered username or email address, a clear description of your request, and — where relevant — the data category or processing activity your request relates to. This allows us to locate your records promptly and respond accurately.

This Privacy Policy was last reviewed and updated in January 2026. h baji is committed to maintaining the highest standards of data privacy and will continue to refine this Policy as our platform evolves and as applicable data protection frameworks develop. Thank you for trusting h baji with your personal information — we take that responsibility seriously.