hb888 Privacy Policy

hb888 is an internationally operated online gaming platform serving users in Bangladesh and other permitted markets. The Platform offers cricket betting, live casino games, slots, crash games, and card games, accessible via web browsers on mobile and desktop devices. hb888 is the data controller responsible for your personal information collected through the Platform.

Our registered contact email for data-related matters is [email protected]. We are committed to handling your personal information responsibly and in accordance with applicable data protection principles, including those recognised under internationally accepted privacy frameworks.

hb888 collects personal data through three primary channels: information you provide directly, information generated by your use of the Platform, and information received from third-party service providers. The specific categories of data we collect are described below.

Information You Provide Directly

• Identity data: full name, date of birth, gender, and government-issued identification document details (as required during KYC verification).
• Contact data: email address, mobile phone number, and residential address. For Bangladeshi users, this includes your division, district, and upazila.
• Financial data: payment method details sufficient to process transactions (e.g. the registered mobile number linked to your bKash or Nagad account, or bank account details). Full payment credentials are never stored directly by hb888.
• Communications data: records of your interactions with customer support, including live chat transcripts, support tickets, and email correspondence with hb888.

Information Generated by Your Use of the Platform

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers. This data is collected automatically each time you access the Platform.
• Usage data: pages visited, session duration, games played, bet amounts, bet outcomes, deposit and withdrawal history, bonus usage, and navigation paths within the Platform.
• Cookie and tracking data: session cookies, persistent cookies, and similar tracking technologies used to maintain your login state, remember preferences, and analyse aggregate Platform usage. See Section 7 for full details.

Information Received from Third Parties

• Payment processors: transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners to verify deposit and withdrawal transactions.
• Identity verification providers: confirmation of identity document authenticity received from third-party KYC service providers engaged to support our compliance obligations.
• Fraud and AML screening providers: risk signals and watchlist screening results used to fulfil our anti-money laundering and counter-terrorism financing obligations.

The table below summarises the primary purposes for which hb888 processes your personal data and the corresponding lawful basis for each use.

hb888 relies on the following legal bases when processing your personal data, consistent with internationally recognised data protection frameworks:

• Contractual necessity: processing required to enter into or perform a contract with you — for example, verifying your identity to open an account, or processing a payment to fulfil a withdrawal request.
• Legal obligation: processing necessary to comply with applicable laws, including anti-money laundering regulations, financial crime prevention obligations, and responsible gaming requirements.
• Legitimate interests: processing for purposes such as fraud detection, platform security, service improvement, and responsible gaming monitoring, where those interests are not overridden by your rights.
• Consent: processing for purposes such as sending promotional emails or SMS messages, where we have obtained your prior explicit consent. You may withdraw your consent at any time by contacting support or updating your account notification preferences.

hb888 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share data only in the limited circumstances described below.

Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf and under our instruction. These providers are contractually bound to process data only for the stated purpose, to maintain appropriate security standards, and to refrain from using the data for any independent purpose. Current categories of processor include:

• Payment processors: bKash, Nagad, Rocket, Upay, and Bangladeshi banking partners, to process deposits and withdrawals.
• KYC and identity verification providers: third-party services used to verify the authenticity of identity documents submitted during account registration.
• Game content providers: Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and other licensed game studios whose software is embedded within the Platform. These providers may process limited technical data (e.g. session tokens) to deliver their games.
• IT infrastructure and cloud hosting providers: services used to host the Platform's servers and databases in a secure environment.

Legal and Regulatory Disclosure

hb888 may disclose your personal data to law enforcement agencies, regulatory authorities, financial intelligence units, or courts if required to do so by applicable law, by a valid legal order, or where disclosure is necessary to prevent or detect financial crime, including money laundering and terrorism financing.

hb888 takes particular care with financial data. When you make a deposit or withdrawal via bKash, Nagad, Rocket, or a Bangladeshi bank, the relevant payment provider processes your financial credentials directly under their own privacy and security policies. hb888 receives only a transaction confirmation reference and the masked account identifier necessary to reconcile the payment — we do not receive or store your full mobile banking PIN, password, or card number.

All financial transaction records held by hb888 are encrypted at rest and are accessible only to authorised compliance and finance personnel. Transaction histories are retained for a minimum of 5 years in line with standard AML record-keeping requirements.

hb888 uses cookies and similar tracking technologies to operate the Platform effectively, to remember your preferences, and to gather aggregate analytics data that helps us improve the user experience. We do not use cookies to build advertising profiles or to track your activity across third-party websites.

Types of Cookies We Use

• Essential cookies: required for the Platform to function. These include session authentication cookies that keep you logged in during your gaming session, and security cookies that protect against cross-site request forgery. Essential cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: used to remember your language preference, display settings, and last-used payment method to make your experience more convenient on return visits. These can be disabled, though doing so may reduce convenience.
• Analytics cookies: aggregate, anonymised data about how users navigate the Platform, which games are most popular, and which pages generate the most engagement. This data helps us prioritise improvements. Analytics cookies do not identify you individually.

You can manage or delete cookies at any time through your browser settings. Note that disabling essential cookies will prevent you from logging in to the Platform. For more detailed instructions on managing cookies in your specific browser, please refer to your browser's help documentation.

hb888 retains personal data only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: retained for the duration of the account plus 5 years following account closure, to comply with AML record-keeping obligations. In cases of suspected fraud or active legal proceedings, data may be retained for longer.
• Transaction data: retained for a minimum of 5 years from the date of the transaction in line with standard financial record-keeping requirements.
• Marketing preferences and communications consent: retained until you withdraw consent, after which your opt-out preference is recorded and retained indefinitely to prevent accidental re-enrolment in marketing programmes.

When data is no longer required for its primary retention purpose, it is securely deleted or permanently anonymised so that it can no longer be attributed to any individual. Anonymised, aggregated data (such as site-wide analytics) may be retained indefinitely for statistical purposes.

As a user of the hb888 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request" and include your registered email address and a description of the right you wish to exercise. We will respond within 30 days.

We will verify your identity before acting on any privacy rights request to ensure that personal data is not disclosed to an unauthorised person. In complex cases, we may extend our response timeline by a further 30 days, in which case we will notify you of the extension and the reason for it.

hb888 implements a layered security architecture to protect your personal data from unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers, ensuring that data in transit cannot be intercepted or read by third parties.
• Encryption at rest for all sensitive personal data and financial records stored in our database infrastructure, using AES-256 standard encryption.
• Role-based access controls limiting internal access to personal data to only those employees and contractors with a legitimate operational need to access it, with all access logged and audited.
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform infrastructure to identify and remediate security weaknesses before they can be exploited.

Despite our robust security measures, no system is entirely immune to cyber threats. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, hb888 will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach.

The hb888 Platform is strictly for adults aged 21 and above. We do not knowingly collect or process personal data belonging to individuals under 21 years of age. If we discover or are notified that we have collected data from a person under 21, we will immediately suspend the associated account, delete the personal data, and — where a deposit has been made — arrange a full refund of any deposited funds to the payment source.

The Platform contains embedded game content provided by licensed third-party studios. These providers operate under their own privacy policies and may collect limited technical data (such as session identifiers) independently of hb888 to deliver their software. hb888 is not responsible for the privacy practices of third-party game providers. We recommend reviewing the privacy policy of any third-party service you interact with directly through the Platform.

hb888 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable privacy law, or improvements to the Platform. When we make material changes, we will notify registered users via the email address on file and will publish the updated Policy on the Platform with a revised effective date.

Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically. The "Effective Date" at the top of this page always reflects the most recent version.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to raise a concern about how hb888 has handled your personal data, please contact our support team. We aim to acknowledge all privacy-related queries within 48 hours and to resolve them fully within 30 days.

Email: [email protected]

When contacting us about a privacy matter, please include your registered email address, a clear description of your query or request, and — where relevant — your account username so we can locate your records efficiently.