hai baji Privacy Policy

Section 1

Information We Collect

hai baji collects personal data through several distinct channels: directly from you at registration and during Platform use, automatically via technical systems as you navigate the site, and — in limited circumstances — from trusted third-party sources for verification purposes. The categories of information collected are as follows:

1.1 Registration and Identity Data

When you create a hai baji account, we collect:

• Full legal name as it appears on your government-issued identity document
• Date of birth (used exclusively for age verification — players must be 18 or older)
• Residential address in Bangladesh (district, thana, and full postal address)
• Bangladeshi mobile phone number (used for OTP authentication and account communications)
• Email address (used for account notifications, withdrawal confirmations, and — where consented — promotional communications)
• Username and hashed password credential

1.2 Identity Verification (KYC) Documents

To comply with Know Your Customer (KYC) obligations and to process withdrawals, hai baji may request copies of government-issued identity documents such as your National Identity Card (NID), passport, or birth certificate. These documents are used solely for age and identity verification and are stored in encrypted form with access restricted to the compliance team.

1.3 Financial and Transaction Data

All financial transactions on the hai baji Platform are denominated in Bangladeshi Taka (BDT). We collect and retain records of:

• Deposit amounts, timestamps, and the mobile wallet or bank account used (bKash, Nagad, Rocket, Upay, or bank transfer)
• Withdrawal requests, amounts, destination payment method, and processing status
• Transaction reference numbers issued by mobile financial service providers
• Wagering history, including bet amounts, market selections, game titles, and settlement outcomes

hai baji does not store full mobile wallet PINs, bank card numbers, or full bank account credentials. Payment method identifiers are stored only in masked or tokenised form.

1.4 Technical and Usage Data

When you access the Platform, our servers and analytics systems automatically collect:

• IP address and approximate geolocation (city-level, derived from IP)
• Device type, operating system, and browser version
• Mobile network operator (e.g., Grameenphone, Banglalink, Robi, Teletalk)
• Pages visited, session duration, and click-path data
• Error logs and performance diagnostics

1.5 Communications Data

When you contact hai baji via the support email or live chat, we retain a record of the conversation — including any attachments you send — for quality assurance, dispute resolution, and regulatory audit purposes. Support communications are stored for a minimum of 24 months from the date of the interaction.

1.6 Data from Third-Party Sources

In limited circumstances, hai baji may receive supplementary identity or fraud-risk data from trusted third-party identity verification services. This data is used only to confirm information you have already provided at registration and is not used for any marketing or profiling purpose.

Section 2

How We Use Your Information

The personal data collected by hai baji is used only for the specific, defined purposes set out in the table below. We do not use your data for purposes that are incompatible with those you were informed of at the time of collection.

Purpose	Data Categories Used	Legal Basis
Account creation and authentication	Registration data, device/IP data	Contractual necessity
Age and identity verification (KYC)	Identity documents, date of birth	Legal obligation
Processing deposits and withdrawals	Financial and transaction data	Contractual necessity
Fraud prevention and AML screening	Transaction data, IP/device data, third-party verification data	Legal obligation and legitimate interest
Customer support and dispute resolution	Communications data, account data	Contractual necessity and legitimate interest
Responsible gaming monitoring	Wagering history, session data, account data	Legal obligation and legitimate interest
Platform performance and bug diagnostics	Technical and usage data	Legitimate interest
Sending promotional offers and newsletters	Email address, mobile number, wagering preferences	Consent (opt-in only)
Regulatory reporting and audit	Transaction data, identity data, communications data	Legal obligation

Section 3

Sharing and Disclosure of Data

hai baji does not sell or rent personal data to any third party. Data is shared externally only in the specific, limited circumstances described below. All third-party service providers who handle personal data on behalf of hai baji are bound by data processing agreements that restrict their use of the data to the contracted purpose only.

3.1 Payment Processing Partners

To facilitate deposits and withdrawals in BDT, hai baji shares the minimum necessary transaction data with mobile financial service providers (bKash, Nagad, Rocket, Upay) and Bangladeshi banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank). This data exchange is limited to transaction reference numbers, amounts, and account identifiers required to complete the payment instruction. hai baji does not receive or store your mobile wallet PIN or full bank account number.

3.2 Identity Verification Services

Where automated identity verification is used, encrypted document images and biometric data (if applicable) may be processed by a contracted third-party KYC provider. These providers operate under strict data processing agreements and are not permitted to use verification data for any purpose other than confirming identity on behalf of hai baji.

3.3 Game Content Providers

Third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive a pseudonymous player session token to enable game play and record RNG outcomes. These providers receive no personally identifiable information (no name, no mobile number, no financial data). Game session tokens are rotation-based and cannot be used to identify you outside the Platform context.

3.4 Legal and Regulatory Disclosure

hai baji may disclose personal data to law enforcement authorities, financial intelligence units, or other competent authorities where required by applicable law — including in connection with anti-money laundering investigations, fraud inquiries, or court orders. Such disclosures are made only to the extent strictly required by the relevant legal instrument.

3.5 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of hai baji's assets, personal data held on registered players may be transferred to the successor entity. Players will be notified via their registered email address at least 14 days before any such transfer takes effect, and the successor entity will be required to honour the terms of this Privacy Policy.

Section 4

Cookies and Tracking Technologies

The hai baji Platform uses cookies and similar client-side storage technologies to maintain session state, optimise performance, and — where consented — support analytics and personalisation. The categories of cookies deployed are described below.

Cookie Type	Purpose	Consent Required
Strictly Necessary	Session authentication, CSRF protection, load balancing, and maintaining login state across pages. Without these, the Platform cannot function.	No — these are essential
Functional	Remembering language preference, odds format (decimal/fractional), and responsible gaming limit settings configured in Account Settings.	No — service delivery
Analytics	Aggregated, anonymised data on page performance, feature usage, and navigation flow — used to improve the Platform experience for all Bangladesh players.	Yes — opt-in
Marketing	Tracking promotional campaign effectiveness to ensure players receive relevant bonus offers. No data is shared with external advertising networks.	Yes — opt-in

You can manage cookie preferences at any time via your browser settings. Disabling strictly necessary cookies will prevent you from logging in to your hai baji account. Disabling analytics and marketing cookies will not affect your ability to deposit, wager, or withdraw.

Section 5

Data Security and Storage

hai baji applies a layered security architecture to protect the personal data of Bangladesh players at rest and in transit. The following technical and organisational measures are in place:

• Transport Layer Security (TLS 1.2+): All data transmitted between your browser or mobile device and the hai baji Platform is encrypted in transit. The Platform does not support unencrypted HTTP connections.
• Database Encryption: Sensitive data fields — including identity document records, financial transaction logs, and hashed password credentials — are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff access is logged, audited quarterly, and revoked immediately upon role change or employment termination.
• Password Hashing: Account passwords are never stored in recoverable form. Passwords are processed through a bcrypt-based one-way hashing function with a unique salt per account. The hai baji support team cannot view or recover your password.
• Two-Factor Authentication: Players are strongly encouraged to enable SMS OTP two-factor authentication on their account. This significantly reduces the risk of unauthorised account access even if login credentials are compromised.
• Penetration Testing: The Platform undergoes periodic security assessments conducted by independent third-party security specialists to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a material risk to player privacy, hai baji will notify affected players via their registered email address within 72 hours of confirming the breach, and will take immediate steps to contain and remediate the incident.

While hai baji applies industry-standard security measures, no online platform can guarantee absolute immunity from all possible security threats. Players are strongly advised to use a unique, strong password for their hai baji account, enable two-factor authentication, and report any suspicious account activity to [email protected] without delay.

Section 6

Your Privacy Rights

Registered players on the hai baji Platform hold a defined set of rights with respect to their personal data. These rights may be exercised by submitting a written request to [email protected] from the email address registered to your account. hai baji will acknowledge your request within 48 hours and provide a substantive response within 10 business days.

6.1 Right of Access

You have the right to request a complete summary of the personal data hai baji holds about you — including registration data, KYC records, transaction history, and communications logs. This summary will be delivered in a structured, readable format to your registered email address.

6.2 Right to Rectification

If any personal data held by hai baji is inaccurate or incomplete, you have the right to request that it be corrected. Name and date-of-birth corrections require supporting identity documentation to prevent fraudulent amendment. Address and mobile number changes can be processed via the Account Settings page or support request.

6.3 Right to Erasure

You may request deletion of your personal data and permanent closure of your hai baji account. Please note that certain data categories — specifically transaction records, KYC documents, and communications logs — are subject to mandatory retention periods under applicable financial regulations and cannot be erased prior to the expiry of those retention periods, even upon player request. All other personal data will be deleted within 30 days of a confirmed erasure request.

6.4 Right to Restrict Processing

Where you contest the accuracy of data held about you, or where you have objected to processing and a determination is pending, you may request that hai baji restrict active processing of your personal data while the matter is resolved. Restricted data will be retained but not actively used until the restriction is lifted.

6.5 Right to Data Portability

For data processed on the basis of your consent or contractual necessity, you may request that your personal data be provided in a structured, machine-readable format (JSON or CSV) suitable for transfer to another service provider.

6.6 Right to Withdraw Consent

Where hai baji processes your personal data on the basis of your consent — specifically for marketing communications and non-essential analytics cookies — you may withdraw that consent at any time via Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Section 7

Data Retention

hai baji retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 5 years post-closure	Legal obligation (AML compliance)
KYC and identity documents	Duration of account + 5 years post-closure	Legal obligation
Financial transaction records	7 years from transaction date	Financial regulatory requirement
Wagering history	3 years from account closure	Legitimate interest (dispute resolution)
Customer support communications	24 months from last interaction	Legitimate interest (quality assurance)
Technical and usage logs	90 days rolling	Legitimate interest (platform security)
Marketing consent records	Until consent is withdrawn + 12 months	Legal obligation (consent audit trail)

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised such that it can no longer be attributed to an individual player. Anonymised aggregate data (e.g., statistical platform usage trends) may be retained indefinitely for business analysis purposes.

Section 8

Changes to This Policy

hai baji reviews this Privacy Policy periodically and updates it to reflect changes in Platform functionality, applicable law, or data processing practices. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

Material changes — those that meaningfully affect how your personal data is collected, used, or shared — will be communicated to registered players via email to their registered address at least 7 days before the revised policy takes effect. Non-material clarifications (such as typographical corrections or improved explanatory language that does not alter the substance of the policy) take effect immediately upon publication.

Continued use of the hai baji Platform after the effective date of any revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with a material change to this policy, you may request account closure and data deletion before the change takes effect by contacting [email protected].