hbdd Privacy Policy

1. Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can be used to identify a natural person, directly or indirectly, including by reference to an identifier such as a name, identification number, or online identifier.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means hbdd, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Subject" means any identified or identifiable natural person whose Personal Data is processed by hbdd — in practice, any registered or visiting user of the hbdd Platform.
• "Platform" means the hbdd website at hbdd.io and all services, features, and pages accessible therein.
• "Third Party" means any natural or legal person other than you, hbdd, or hbdd's processors acting under hbdd's direct authority.

2. Data Controller

hbdd acts as the Data Controller in respect of all Personal Data collected through the Platform. hbdd determines why and how your Personal Data is processed. All data protection enquiries, access requests, and complaints should be directed to:

Support email: [email protected]

We will respond to all data-related requests within 30 days of receipt. Where requests are complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

3. Data We Collect

hbdd collects Personal Data in the following categories:

3.1 Identity and Contact Data

• Full legal name as it appears on official government-issued identification
• Date of birth (for age verification — users must be 21 or older)
• Residential address in Bangladesh (city, district, postal code)
• Email address and mobile phone number
• National Identity Card (NID) number or passport number when KYC is required

3.2 Financial Data

• Mobile financial service account identifiers (e.g., bKash, Nagad, Rocket, or Upay registered numbers)
• Bank account details where bank transfers are used (e.g., Dutch-Bangla Bank, City Bank, BRAC Bank)
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used
• Account balance history

3.3 Gaming and Behavioural Data

• Betting history, game session data, stake amounts, and outcomes
• Bonus usage, wagering progress, and promotional interaction history
• Responsible gaming tool usage (deposit limits set, cool-off periods, self-exclusion requests)

3.4 Technical Data

• IP address and geolocation data (country and city level)
• Device type, operating system, browser type and version
• Session timestamps, login history, and access logs
• Cookie identifiers and session tokens (see Section 9)

3.5 Communications Data

• Records of communications with the hbdd support team (live chat transcripts, support ticket correspondence, email threads)
• Survey responses and feedback submitted voluntarily by users

4. How We Collect Data

hbdd collects your Personal Data through the following channels:

• Direct collection: Data you provide during account registration, KYC verification, deposit and withdrawal requests, form submissions, and support communications.
• Automated collection: Technical data collected automatically as you navigate the Platform, including through cookies, server logs, and analytics tools.
• Third-party sources: Data received from payment processors (e.g., transaction confirmation details from bKash, Nagad, Rocket), identity verification providers, and fraud prevention databases when you interact with those services in connection with your hbdd account.

5. Purposes & Legal Basis for Processing

hbdd processes your Personal Data for the following purposes, each supported by a valid legal basis:

Purpose	Data Categories Used	Legal Basis
Account registration and management	Identity, contact, technical	Contract performance
Age and identity verification (KYC)	Identity, financial	Legal obligation
Processing deposits and withdrawals	Financial, identity	Contract performance
Fraud prevention and security monitoring	Technical, financial, gaming	Legitimate interests
Delivering bonuses and promotions	Gaming, identity, contact	Contract performance / Consent
Responsible gaming monitoring	Gaming, identity	Legal obligation / Legitimate interests
Customer support	Communications, identity	Contract performance
Platform analytics and improvement	Technical, behavioural	Legitimate interests
Marketing communications (where opted in)	Contact, gaming preferences	Consent
Legal and regulatory compliance	All categories as required	Legal obligation

Where processing is based on your consent (e.g., marketing emails), you have the right to withdraw that consent at any time by updating your communication preferences in your Account settings or contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

6. Data Sharing

hbdd does not sell, rent, or trade your Personal Data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive the minimum financial data necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers may receive identity and document data to complete verification checks on behalf of hbdd.
• Fraud prevention and security services: Data may be shared with specialist providers to detect and prevent fraudulent activity, money laundering, or other prohibited conduct.
• IT and hosting providers: Infrastructure and cloud hosting providers that process data on our behalf under strict data processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory directive, hbdd may disclose Personal Data to law enforcement agencies, government bodies, or regulatory authorities in Bangladesh or other applicable jurisdictions.
• Professional advisers: Lawyers, auditors, and compliance consultants where necessary, subject to professional confidentiality obligations.

7. Data Retention

hbdd retains your Personal Data for as long as is necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law. The following general retention periods apply:

• Active account data: Retained for the duration of your account with hbdd.
• Transaction and financial records: Retained for a minimum of 7 years following the date of the transaction, in accordance with standard financial record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Support and communications records: Retained for a period of 3 years from the date of the last interaction.
• Technical and log data: Retained for up to 12 months unless extended retention is required for a specific security or fraud investigation.
• Marketing consent records: Retained until you withdraw consent plus an additional 1 year to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

8. Security Measures

hbdd implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the hbdd Platform.
• Encryption at rest for sensitive data stored in hbdd databases, including financial information and identity documents.
• Strict role-based access controls ensuring that Personal Data is accessible only to hbdd personnel and authorised processors who have a legitimate operational need.
• Multi-factor authentication requirements for internal systems that handle Personal Data.
• Regular penetration testing and vulnerability assessments conducted by qualified security professionals.
• Automated fraud detection and anomaly monitoring systems operating 24 hours a day, 7 days a week.
• Incident response procedures to detect, report, and respond to any Personal Data breach in a timely manner.

While hbdd takes all reasonable steps to protect your Personal Data, no method of electronic transmission or storage is entirely secure. You are responsible for maintaining the security of your own account credentials and for notifying hbdd immediately if you suspect unauthorised access to your Account.

9. Cookies Policy

hbdd uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account state during navigation, and enable security features. These cannot be disabled without preventing core Platform functions from working.
• Analytical Cookies: These cookies collect aggregated, anonymised data about how users navigate the Platform — such as which pages are visited most frequently and how long sessions last. This data is used solely to improve Platform performance and the user experience.
• Preference Cookies: These cookies remember settings you have previously selected, such as language preferences, to provide a more consistent experience across sessions.

hbdd does not use advertising cookies, cross-site tracking cookies, or cookies that profile your behaviour across third-party websites.

10. Your Rights

As a Data Subject, you hold the following rights with respect to the Personal Data hbdd holds about you. To exercise any of these rights, contact us at [email protected]:

• Right of Access: You have the right to request a copy of the Personal Data hbdd holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held by hbdd.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to hbdd's legal retention obligations.
• Right to Restriction: You may request that hbdd restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is being assessed.
• Right to Object: Where processing is based on legitimate interests, you have the right to object to that processing. hbdd will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out prior to the withdrawal.
• Right to Data Portability: Where processing is carried out by automated means on the basis of contract or consent, you may request that your data be provided to you in a structured, machine-readable format.

hbdd will respond to all rights requests within 30 days. We may need to verify your identity before acting on any request. There is no charge for exercising these rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

11. Minors

hbdd strictly prohibits use of the Platform by individuals under the age of 21. We do not knowingly collect Personal Data from persons under 21 years of age. If hbdd becomes aware that Personal Data has been collected from a minor, that data will be deleted immediately and the associated Account will be closed. If you believe a minor has registered on the Platform, please notify us immediately at [email protected].

12. International Data Transfers

hbdd operates primarily within Bangladesh and processes the majority of user Personal Data within the region. Where data is transferred to or processed by third-party service providers located outside Bangladesh (for example, cloud infrastructure providers or specialist fraud detection services), hbdd ensures that appropriate safeguards are in place. These safeguards may include contractual data protection clauses, binding corporate rules, or equivalent protections ensuring that your data receives a level of protection consistent with this policy.

13. Changes to This Policy

hbdd reserves the right to update or revise this Privacy Policy at any time. When material changes are made, hbdd will notify registered users by email to the address on file, and will update the "Last Updated" date at the top of this policy. For non-material changes (such as clarifications of existing practices), the policy will be updated without direct notification.

We encourage you to review this Privacy Policy periodically to stay informed about how hbdd protects your Personal Data. Your continued use of the Platform following notification of changes constitutes acceptance of the revised policy.

14. Contact Us

For all data protection enquiries, Personal Data access requests, complaints, or questions regarding this Privacy Policy, please contact the hbdd data protection team:

Support email: [email protected]

We aim to respond to all data protection requests within 30 days. For complex requests, we may require additional time and will inform you promptly if an extension is necessary. All enquiries should be submitted in English to ensure prompt and accurate handling.