hibj Privacy Policy

1. Introduction

hibj ("we", "us", "our", "the platform") is an online betting and casino platform operating primarily in the Bangladesh market at hibj.io. We take the privacy of our players extremely seriously. This Privacy Policy describes in full detail how we collect, use, store, disclose, and protect the personal information of individuals ("you", "the player", "the user") who interact with the hibj platform in any capacity.

This policy applies to all personal data collected through the hibj website, any associated mobile interfaces, promotional communications, customer support interactions, and all other touchpoints between you and hibj. It applies to registered players, prospective players who browse without an account, and former players whose data hibj retains for legal compliance purposes.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. Where there is a conflict between this Privacy Policy and those documents on privacy-related matters, this Privacy Policy shall take precedence.

We recommend that you read this document carefully and contact us at [email protected] if you have any questions about how we handle your personal data. Our support team is available 24 hours a day, 7 days a week to assist players across Bangladesh.

2. Data We Collect

hibj collects personal data in the following categories, depending on your level of interaction with the platform:

Identity Data: Full legal name, date of birth, gender, national identity card (NID) number, passport number, or other government-issued identification number. This data is collected during the registration and KYC (Know Your Customer) verification process.

Contact Data: Email address, mobile phone number (including country code), residential address including city and district (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh), and postal code.

Financial Data: Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard), account identifiers associated with those payment methods, transaction amounts, deposit and withdrawal history, and account balance information. We do not store full card numbers on our servers; payment card data is tokenised through our certified payment processors.

Account Data: Username, password (stored as a cryptographic hash — never in plain text), account preferences, login history including timestamps and IP addresses, session durations, and responsible gaming settings such as deposit limits and self-exclusion status.

Gameplay Data: Bet history, game session records, wagering activity, win and loss records, game preferences, bonus claims and usage, and any in-game communications where applicable.

Technical Data: IP address, device type and model, operating system and version, browser type and version, screen resolution, time zone setting (we expect Bangladesh Standard Time, UTC+6 for our players), and approximate geographic location derived from IP address.

Communications Data: Records of all communications between you and the hibj support team, including live chat transcripts, email correspondence, and any feedback or complaints submitted.

Verification Documents: Copies of identity documents, proof of address documents, and proof of payment method ownership submitted during the KYC process.

3. How We Use Your Data

hibj uses the personal data described above for the following specific purposes:

• Account Creation and Management: To register your hibj account, verify your identity, maintain your account settings, and provide access to all platform features.
• Transaction Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to maintain an accurate record of your financial transactions with hibj.
• Identity Verification (KYC): To verify your age (confirming you are 21 years of age or older), confirm your identity, and satisfy our anti-money laundering (AML) and counter-terrorist financing (CTF) obligations.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance related to your hibj account and gameplay.
• Responsible Gaming: To monitor gameplay patterns for signs of problem gambling behaviour, enforce deposit limits and self-exclusion requests, and deliver responsible gaming notifications and resources.
• Fraud Detection and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited activities on the hibj platform.
• Legal Compliance: To comply with applicable laws, regulations, and lawful requests from competent authorities, including record-keeping obligations and mandatory reporting requirements.
• Platform Improvement: To analyse usage patterns and gameplay data in aggregated, anonymised form to improve the features, performance, and security of the hibj platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and updates about new games or features, subject to your communication preferences. You may opt out of marketing communications at any time.

4. Legal Basis for Processing

hibj processes your personal data on one or more of the following legal bases, depending on the purpose of the processing:

• Contractual Necessity: Processing is necessary to perform the contract we have with you — namely, to operate your hibj account, process your transactions, and deliver the betting and casino services you have signed up for.
• Legal Obligation: Processing is necessary to comply with our legal obligations, including KYC/AML requirements, tax reporting obligations, and responses to lawful requests from competent authorities.
• Legitimate Interests: Processing is necessary for hibj's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services, provided that those interests are not overridden by your privacy rights.
• Consent: For marketing communications and non-essential cookies, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

5. Data Sharing & Third Parties

hibj does not sell your personal data to third parties. We may share your personal data with the following categories of third parties, strictly for the purposes described in this Privacy Policy:

• Payment Processors: We share transaction data with payment service providers including bKash, Nagad, Rocket, Upay, and card processing networks (Visa, Mastercard) to facilitate deposits and withdrawals. These providers are contractually bound to process your data only in accordance with our instructions and applicable data protection standards.
• Game Software Providers: Game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Play'n GO, Spribe, and Ezugi may receive anonymised or pseudonymised gameplay session data necessary to deliver and maintain their game software on the hibj platform. Full personal identity data is not shared with game providers.
• KYC and Identity Verification Services: Third-party identity verification providers may receive copies of your identity documents and personal details to assist us in satisfying our KYC obligations. These providers operate under strict confidentiality agreements.
• Fraud Prevention and Security Services: We share technical and behavioural data (such as IP addresses and device fingerprints) with fraud detection and cybersecurity service providers to protect the integrity of the hibj platform.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to competent authorities when required to do so by law, court order, or other lawful demand. We will notify you of such disclosure where permitted to do so by law.
• IT and Hosting Infrastructure Providers: Our platform is hosted on secure server infrastructure. Hosting and IT service providers may have access to personal data stored on those servers, subject to strict contractual data processing agreements.

All third parties with whom hibj shares personal data are required to process that data lawfully, keep it secure, and use it only for the specific purposes for which it was shared. hibj remains responsible for how those third parties handle your data.

6. Cookies & Tracking Technologies

The hibj platform uses cookies and similar tracking technologies to operate certain features, analyse usage patterns, and improve the player experience. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the hibj platform to function correctly. They include session management cookies that keep you logged in, security cookies that protect against cross-site request forgery, and load-balancing cookies. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your preferences such as language settings, display preferences, and responsible gaming tool configurations. They improve your personalised experience on the hibj platform.
• Analytics Cookies: These cookies collect anonymised data about how players navigate the hibj platform — which pages are visited most frequently, how long sessions last, and which features are used. This data helps us improve platform design and performance. Analytics data is aggregated and does not identify individual players.
• Marketing Cookies: With your consent, these cookies track your activity on the hibj platform to enable personalised promotional offers and relevant communications. You may withdraw consent for marketing cookies at any time via your account settings.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of parts of the hibj platform.

7. Data Storage & Security

hibj takes the security of your personal data extremely seriously. We implement a comprehensive set of technical and organisational security measures to protect your data against unauthorised access, loss, alteration, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the hibj servers is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Encrypted Storage: Sensitive personal data fields (including identity document data, payment method identifiers, and account credentials) are encrypted at rest using AES-256 encryption.
• Password Hashing: User passwords are stored as one-way cryptographic hashes using industry-standard algorithms. hibj never stores or transmits passwords in plain text, and our support staff cannot view your password.
• Access Controls: Access to personal data within hibj's systems is restricted to employees and contractors who have a legitimate operational need to access it. All access is logged and audited regularly.
• Regular Security Audits: The hibj platform and its underlying infrastructure undergo regular security audits and penetration testing by independent security professionals.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, hibj will notify affected players as promptly as possible and take immediate remediation steps.

8. Data Retention

hibj retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. Specific retention periods are as follows:

• Active Account Data: Retained for the full duration of your active hibj account plus a minimum of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction records are retained for a minimum of 7 years from the date of the transaction to comply with tax and financial reporting obligations.
• KYC Documents: Identity verification documents are retained for a minimum of 5 years following the end of the business relationship with the player.
• Support Communications: Records of customer support interactions are retained for 3 years following the closure of each support ticket, unless the interaction relates to a dispute or investigation that requires longer retention.
• Marketing Data: Personal data used for marketing purposes is retained until you withdraw your marketing consent, after which it is deleted or anonymised within 30 days.
• Technical/Log Data: Server logs and technical data including IP addresses and session logs are retained for 12 months from the date of collection, after which they are deleted or aggregated into anonymised form.

Once a retention period has expired, personal data is securely deleted using industry-standard data destruction methods or irreversibly anonymised so that it can no longer be linked to an individual player.

9. International Data Transfers

hibj's primary player base is located in Bangladesh and our operations are centred on serving the Bangladesh market. Some of our third-party service providers — including game software providers, fraud detection services, and hosting infrastructure providers — may operate servers in jurisdictions outside Bangladesh.

Where personal data is transferred to a jurisdiction that may not offer the same level of data protection as Bangladesh, hibj takes appropriate safeguards to ensure your data remains protected to the standard described in this Privacy Policy. These safeguards include contractual data processing agreements with all third-party recipients, incorporating obligations to maintain confidentiality, apply appropriate technical security measures, and process data only for the purposes specified by hibj.

By using the hibj platform, you acknowledge that your personal data may be processed by third-party service providers in jurisdictions outside Bangladesh, subject to the safeguards described above.

10. Children & Minors

The hibj platform is strictly intended for adults aged 21 years and above. hibj does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register a hibj account or use any feature of the platform.

If hibj discovers or is notified that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete all personal data relating to that individual, and reverse any transactions made through that account in accordance with our underage gambling procedures.

If you are a parent or guardian and believe that your child has registered a hibj account, please contact us immediately at [email protected] with details of the account. We will investigate and take appropriate action without delay.

11. Your Data Rights in Detail

As described in the summary section above, you have a range of rights with respect to your personal data held by hibj. To exercise any of these rights, please contact us at [email protected] with your registered account username, your full name, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing any data rights request to protect your privacy.

Right of Access (Subject Access Request): You may request a copy of all personal data hibj holds about you. We will provide this in a clear, structured format within 30 calendar days of receiving your verified request.

Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. We will action corrections within 14 days of receiving a valid rectification request.

Right to Erasure ("Right to Be Forgotten"): You may request that hibj delete your personal data. This right is subject to our legal obligations to retain certain records. Where deletion is not possible due to legal requirements, we will inform you of the specific retention obligation and the expected date of deletion.

Right to Restrict Processing: You may ask us to temporarily pause processing of your personal data (without deleting it) while you contest its accuracy or while a complaint is being investigated.

Right to Data Portability: You may request a copy of your personal data in a machine-readable format (such as JSON or CSV) so that you can transfer it to another service provider of your choice.

Right to Object: You may object to processing of your personal data for direct marketing purposes at any time, and we will immediately cease such processing. You may also object to processing based on hibj's legitimate interests, in which case we will consider your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your privacy interests.

Right to Withdraw Consent: Where processing is based on your consent (such as for marketing communications or non-essential cookies), you may withdraw that consent at any time via your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

12. Marketing Communications

With your consent, hibj may send you promotional communications about bonus offers, new game releases, seasonal promotions (such as those tied to Pohela Boishakh, Eid, BPL cricket season, and other occasions relevant to the Bangladesh market), and platform updates. These communications may be sent via email or SMS to the contact details registered with your hibj account.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any promotional email sent by hibj.
• Updating your communication preferences in your hibj account settings panel.
• Contacting our support team at [email protected] with a clear request to stop receiving marketing communications.

Opting out of marketing communications will not affect your receipt of essential service communications such as transaction confirmations, security alerts, account verification messages, and responsible gaming notifications. These service communications are necessary for the operation of your hibj account and cannot be disabled while your account remains active.

13. Changes to This Privacy Policy

hibj reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the features and services offered on the hibj platform. When material changes are made to this policy, we will notify registered players by email to the address on file and by posting a prominent notice on the hibj platform at least 7 days before the revised policy takes effect.

Your continued use of the hibj platform after the effective date of any revision to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with the changes, you must stop using the platform and may request account closure. The most current version of this Privacy Policy will always be accessible at hibj.io/privacy-policy. We recommend reviewing this page periodically.

14. Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about how hibj handles your personal data, please contact our Data Protection team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

• Email: [email protected]
• Subject Line: Please use "Privacy Policy Enquiry" or "Data Rights Request" in the subject line of your email to ensure it is directed to the correct team.
• Response Time: We aim to acknowledge all privacy enquiries within 24 hours and to provide a substantive response within 30 calendar days.
• Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)

If you are not satisfied with hibj's response to your privacy complaint, you have the right to escalate the matter through appropriate legal channels in your jurisdiction. We will always cooperate fully with any such process.