Privacy Policy — habazi Data Protection

1. Data We Collect

habazi collects personal data through several channels: information you provide directly when registering or using the platform, information generated automatically by your use of our Services, and — in limited circumstances — information received from trusted third-party partners. We collect only the data that is necessary for the purposes described in this Policy and do not retain data beyond the periods set out in Section 8.

1.1 Registration and Account Data

When you create a habazi account you are required to provide:

• Full legal name (as it appears on your government-issued identity document).
• Date of birth (to verify that you are aged 18 or over).
• Residential address in Bangladesh (including district, city, and postcode where applicable).
• A valid email address used as your primary account contact.
• A valid Bangladeshi mobile number, used for account security and payment method linking.
• A username and a password of your choosing. Passwords are stored using a one-way hashing algorithm — habazi staff cannot read your password in plaintext.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer process, habazi may request copies of:

• Bangladesh National Identity Card (NID) — front and back.
• Valid passport bio-data page.
• Birth certificate (where NID is not available).
• Proof of address document (recent utility bill or bank statement, no older than three months).
• Proof of payment method ownership (screenshot of mobile wallet registration screen or card statement).

KYC documents are stored in an encrypted document vault accessible only to habazi's compliance team. They are not shared with game studios, payment processors, or any other third party unless required by law.

1.3 Financial Transaction Data

Every deposit and withdrawal transaction on habazi is logged and associated with your account record. This includes the transaction amount (in BDT), the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard, or bank transfer), the transaction timestamp, and a system-generated transaction reference number. We do not store full card numbers or mobile wallet PINs — these are handled directly by the respective payment providers over their own encrypted channels.

1.4 Gameplay and Betting Activity Data

habazi logs all game rounds and betting activity tied to your account, including game title, studio provider, bet amount, result, and settlement time. This data is used for account balance management, dispute resolution, bonus calculation, and responsible gaming monitoring. Sports betting activity — including the market, selection, stake, and result — is similarly recorded for the same purposes.

1.5 Technical and Device Data

When you access habazi from any device, our servers automatically collect certain technical information. This includes your IP address, browser type and version, operating system, device type (mobile or desktop), screen resolution, referring URL, and session timestamps. This data is used for platform security, fraud detection, geographic access controls, and performance optimisation. It is not used for targeted advertising by habazi.

1.6 Communications Data

If you contact habazi support via live chat or email, we retain a record of that correspondence — including the content of messages, the date and time, and the resolution outcome. This data is used to manage your support case, to train our support team, and to identify patterns that may indicate platform issues requiring attention. Support records are retained for a minimum of two years from the date of the conversation.

2. How We Use Your Data

habazi processes personal data for a defined set of purposes. We do not use your data for purposes that are incompatible with those stated at the time of collection. The table below summarises the principal processing activities carried out on the habazi platform:

2.1 Marketing Communications

habazi may send you promotional emails or on-platform notifications about new games, bonuses, seasonal promotions (such as Eid, Pohela Boishakh, or BPL season offers), and platform updates. You will only receive marketing communications if you have opted in during registration or subsequently via account settings. You may withdraw marketing consent at any time by updating your notification preferences in the account dashboard or by contacting support. Withdrawal of marketing consent does not affect any other aspect of your habazi account.

2.2 Automated Decision-Making

habazi uses automated systems to detect suspicious account activity, potential bonus abuse, and responsible gaming risk indicators. These automated checks may result in an account being temporarily flagged for manual review. Where an automated system flags an account, a member of the habazi compliance team will conduct a human review before any material action (such as account suspension or withdrawal hold) is taken. You have the right to request human review of any decision made in connection with your account.

3. Legal Basis for Processing

habazi processes personal data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contract performance: Processing that is necessary to deliver the Services you have requested — including account management, game access, and payment processing — is carried out on the basis that it is required to perform our contract with you.
• Legal obligation: Certain processing activities — principally age verification, KYC checks, and anti-money laundering monitoring — are carried out because habazi is legally required to do so as part of operating a responsible gaming platform.
• Legitimate interest: Processing for fraud prevention, platform security, analytics, and service improvement is carried out on the basis of habazi's legitimate interest in maintaining a safe and commercially viable platform, provided that those interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and the placement of non-essential cookies is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without penalty.

4. Data Sharing & Third Parties

habazi does not sell, rent, or trade your personal data to third parties for their own commercial use. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

4.1 Game Studio Partners

To deliver live casino, slot, and crash game content, habazi works with third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These studios receive only the technical data necessary to initialise and run game sessions (such as a session token and account currency). They do not receive your name, address, date of birth, KYC documents, or financial transaction records. Each studio partner is contractually required to handle player session data in accordance with industry-standard data security practices.

4.2 Payment Processors

To process deposits and withdrawals in BDT, habazi works with payment gateway partners who facilitate transactions via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Bangladeshi bank transfer. These processors receive only the data required to execute the specific transaction — typically the transaction amount, currency, and a reference token. Your full card details are entered directly into the payment processor's encrypted interface and are never stored on habazi's servers.

4.3 Analytics and Infrastructure Providers

habazi uses reputable third-party infrastructure providers for hosting, content delivery, and platform analytics. These providers process data only under habazi's instruction and are contractually prohibited from using habazi player data for their own purposes. Data processed by infrastructure providers is handled within secure data centre environments and is subject to the same encryption standards as data stored directly by habazi.

4.4 Legal and Regulatory Disclosure

habazi may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of habazi, its players, or the public. Where permissible, habazi will notify the affected account holder of any such disclosure request before complying with it.

5. Cookies & Tracking Technologies

habazi uses cookies and similar tracking technologies to operate the platform, maintain your session state, detect fraud, and — where you have consented — to understand how players navigate the site so that we can improve it. A cookie is a small text file placed on your device by a website. habazi uses the following categories of cookies:

5.1 Strictly Necessary Cookies

These cookies are essential for the habazi platform to function. They maintain your login session, store your currency and language preferences, and support the secure operation of the payment flow. These cookies cannot be disabled without preventing core platform functionality from working. No consent is required for strictly necessary cookies as their use is a technical requirement of delivering the Service.

5.2 Performance and Analytics Cookies

With your consent, habazi places analytics cookies that record aggregated, anonymised data about how players navigate the platform — including which game categories are visited most, where players drop off during the registration flow, and how support pages are used. This data is used exclusively to improve the habazi platform experience. It is not shared with advertising networks.

5.3 Managing Your Cookie Preferences

You may adjust your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies on a per-site basis. Please note that disabling non-essential cookies will not affect your ability to play games or process payments on habazi, but it may affect the performance of certain platform features. Clearing all cookies will end your current login session and you will need to log in again.

6. Data Security

habazi implements a multi-layered approach to data security, combining technical controls, procedural safeguards, and staff training to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction.

6.1 Encryption

All data transmitted between your browser or device and the habazi platform is encrypted using TLS 1.2 or higher. Data stored on habazi's servers — including account records, KYC documents, and transaction logs — is encrypted at rest using industry-standard symmetric encryption. Database credentials and API keys used to access player data systems are stored in a dedicated secrets management system, separate from application code.

6.2 Access Controls

Access to systems containing personal data is restricted on a need-to-know basis. habazi staff members are assigned role-based permissions that grant access only to the data required for their specific job function. All staff access to production data systems is logged and audited. Privileged access — such as the ability to view KYC documents or modify account balances — requires multi-factor authentication and is subject to additional approval controls.

6.3 Incident Response

In the event of a data security incident that poses a material risk to your personal data, habazi will notify affected account holders promptly and without undue delay. Notification will be delivered by email to the address registered on your account and will describe the nature of the incident, the categories of data affected, the steps habazi has taken to contain the incident, and the recommended actions you should take to protect yourself.

7. Your Privacy Rights

As a habazi account holder, you hold a number of rights in relation to the personal data we process about you. habazi is committed to honouring these rights promptly and without unnecessary friction. To exercise any of the rights described below, please contact habazi support via live chat or by sending a written request to the support email address shown in the platform footer.

7.1 Right of Access

You have the right to request a copy of all personal data that habazi holds about you. habazi will provide this in a structured, machine-readable format within 30 days of a verified request. The access request is free of charge for the first request in any 12-month period; habazi may charge a reasonable administrative fee for additional requests within the same period.

7.2 Right to Rectification

If any personal data habazi holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic contact details (email address, mobile number, postal address) directly from your account settings without needing to contact support. Corrections to identity data — such as your registered legal name or date of birth — require submission of a supporting KYC document to the compliance team.

7.3 Right to Erasure

You may request that habazi delete your personal data. Where there is no legal obligation requiring habazi to retain the data (for example, transaction records retained for anti-money laundering compliance), habazi will process erasure requests within 30 days. Where data must be retained to comply with a legal obligation, habazi will explain this clearly and retain only the minimum data required for the minimum period mandated.

7.4 Right to Restrict Processing

You may request that habazi restrict its processing of your personal data in certain circumstances — for example, if you believe the data is inaccurate and have requested rectification, or if you have objected to processing and habazi is considering that objection. During a processing restriction, habazi will continue to store your data but will not actively use it for any purpose other than storage.

7.5 Right to Object to Marketing

You have an absolute right to object to the processing of your personal data for direct marketing purposes. Exercising this right will result in the immediate cessation of all habazi marketing communications to you. It will not affect your account, your game access, or any other aspect of the habazi Service. You may re-enable marketing communications at any time from account settings.

7.6 Right to Data Portability

Where habazi processes your personal data on the basis of consent or contract performance, you may request that we provide your data in a portable format (JSON or CSV) so that it can be transferred to another service provider of your choice. Data portability requests are handled within 30 days of identity verification.

8. Data Retention

habazi retains personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with applicable legal obligations. The following retention periods apply:

After the applicable retention period has expired, habazi will securely delete or anonymise the relevant data. Anonymised aggregate data (which cannot be linked to any individual) may be retained indefinitely for statistical and platform improvement purposes.

9. Changes to This Privacy Policy

habazi reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When we make material changes — those that affect your rights or the way we use your data — we will notify registered account holders by email at least 7 days before the change takes effect, and we will update the "Last Updated" date at the top of this page. For non-material changes (such as typographical corrections or clarifications that do not alter the substance of the Policy), we will update the page without separate notification. The current version of this Policy is always available at habazi.com/privacy-policy.

If you have any questions about this Privacy Policy or wish to exercise any of your data rights, please contact habazi support through the live chat function available on the platform or by writing to the support address shown in the footer of this page. habazi targets an initial response to all privacy-related enquiries within 48 hours and full resolution within 30 days.