Privacy Policy — How 12hbaj Collects, Uses, and Protects Your Personal Data

1 Information We Collect

12hbaj collects personal data from you in several ways: information you provide directly when registering or using the platform, information generated automatically through your use of the site, and information received from third-party service providers. The categories of personal data we collect are described below.

Information you provide directly:

• Account registration data: Full legal name, date of birth, residential address, email address, and mobile phone number.
• KYC verification documents: Copies of your National Identity Card (NID), passport, driving licence, utility bills, bank statements, or other documentation required to verify your identity and address in accordance with anti-money-laundering (AML) obligations.
• Payment information: Your bKash, Nagad, Rocket, or Upay mobile number; bank account details; or other payment method identifiers used to process deposits and withdrawals. 12hbaj does not store full bank account credentials — payment processing is handled by our regulated payment partners.
• Communication data: The content of any messages, emails, live chat transcripts, or support tickets you send to us, including the date, time, and subject matter of those communications.
• Preferences and settings: Your selected language, responsible gaming limits, marketing preferences, and other account settings you configure within the platform.

Information collected automatically:

2 How We Use Your Data

12hbaj uses the personal data we collect for the following purposes, each of which rests on a specific legal basis:

• Account creation and management (Contract): To register your account, verify your identity, process your deposits and withdrawals, and deliver the platform services you have requested. This processing is necessary for the performance of your contract with 12hbaj.
• Identity and age verification (Legal obligation): To conduct Know Your Customer (KYC) checks and verify that you meet the minimum age requirement of 18 years. This is a legal obligation applicable to online gambling platforms operating in Bangladesh.
• Anti-money-laundering compliance (Legal obligation): To monitor account activity for patterns consistent with money laundering, terrorist financing, or fraud, and to report suspicious activity to the appropriate authorities as required by law.
• Customer support (Contract / Legitimate interest): To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance. Records of support interactions are retained to ensure consistency and quality of service.
• Platform security and fraud prevention (Legitimate interest): To detect and prevent unauthorised account access, bonus abuse, collusion, and other prohibited conduct as defined in our Terms & Conditions. This includes automated monitoring of betting patterns and login behaviour.
• Responsible gaming (Legal obligation / Legitimate interest): To monitor player behaviour for indicators of problem gambling and to enforce any responsible gaming limits or self-exclusion restrictions you have set on your account.
• Marketing communications (Consent): Where you have given explicit consent during registration or via your account settings, to send you promotional emails, SMS messages, or platform notifications about bonuses, new games, and seasonal offers. You may withdraw this consent at any time via your account preferences or by contacting support.
• Platform improvement (Legitimate interest): To analyse aggregate usage data, conduct A/B testing, and improve the performance, design, and game library of the 12hbaj platform. This analysis uses anonymised or pseudonymised data wherever possible.

3 Data Sharing and Disclosure

12hbaj does not sell, rent, or trade your personal data to any third party for commercial purposes. We may, however, share your data with the following categories of recipients where strictly necessary and under appropriate data-sharing agreements:

• Payment service providers: Your payment identifiers (e.g., bKash mobile number, Nagad account reference) are shared with our regulated payment partners solely to process your deposit and withdrawal transactions. These providers are contractually prohibited from using your data for any purpose other than payment processing.
• KYC and identity verification providers: Where we use third-party identity verification services to assist with document checks or biometric verification, your KYC documents may be transmitted to those providers via encrypted channels. These providers operate under strict data processing agreements.
• Game technology providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymised player identifiers (not your full personal details) for the purpose of operating game sessions, detecting technical faults, and ensuring RNG integrity.
• Fraud and security providers: Third-party fraud detection and cybersecurity vendors may process certain technical data (IP address, device fingerprint, session metadata) on our behalf under data processing agreements to identify and prevent fraudulent activity.
• Regulatory and law enforcement authorities: 12hbaj is required by applicable law to disclose certain player data to regulatory bodies or law enforcement agencies upon receipt of a valid legal request. We will notify you of any such disclosure to the extent permitted by law.
• Professional advisors: Lawyers, auditors, and financial advisors engaged by 12hbaj may access your data on a strictly need-to-know basis in the context of legal proceedings, regulatory investigations, or financial audits. All such advisors are bound by professional confidentiality obligations.

Any third party that receives your personal data on our behalf is required to process it only for the specified purpose, to maintain appropriate technical and organisational security measures, and to delete or return the data upon the termination of the relevant service agreement. 12hbaj remains responsible for ensuring that third-party processors handle your data in accordance with this Privacy Policy.

4 Cookies and Tracking Technologies

12hbaj uses cookies and similar tracking technologies (collectively, "cookies") on its platform. A cookie is a small text file placed on your device by your browser when you visit a website. Cookies help us provide a functional, secure, and personalised experience for every player.

We use the following categories of cookies:

You can manage or disable non-essential cookies at any time through your browser's privacy or cookie settings. Most modern browsers (Chrome, Firefox, Safari, Edge) offer granular controls for accepting, blocking, or deleting cookies by category. Please note that disabling certain cookies may affect the functionality and personalisation features of the 12hbaj platform.

5 Data Security and Storage

12hbaj implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These measures include but are not limited to:

• TLS/SSL encryption: All data in transit between your device and our servers is protected by Transport Layer Security (TLS 1.2 or higher). Our SSL certificate is maintained and renewed to ensure continuous HTTPS security across the entire 12hbaj platform.
• AES-256 encryption at rest: Sensitive data stored on our servers — including KYC documents, payment method references, and account credentials — is encrypted using AES-256 encryption to prevent unauthorised access in the event of a system breach.
• Access controls: Access to personal data within 12hbaj is restricted on a strict need-to-know basis. Only authorised staff with a defined operational reason may access player data. All access is logged and subject to regular internal audit.
• Two-factor authentication: Administrative access to systems containing player data requires multi-factor authentication. We also encourage all 12hbaj account holders to enable two-factor authentication on their player accounts for additional security.
• Penetration testing and vulnerability management: 12hbaj conducts regular security assessments of its platform infrastructure to identify and remediate potential vulnerabilities before they can be exploited.
• Data breach response: In the event of a confirmed personal data breach that is likely to result in a risk to your rights, 12hbaj will notify affected players without undue delay via the email address registered to your account. Our incident response team operates 24/7 to contain and investigate any suspected breach.

While 12hbaj takes all reasonable and industry-standard precautions to safeguard your personal data, no digital platform can guarantee absolute security. You also play a role in protecting your account: use a strong, unique password, never share your login credentials with anyone, and contact our support team immediately if you suspect your account has been accessed without your authorisation.

6 Your Rights and Data Choices

As a 12hbaj account holder, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team via live chat or by emailing [email protected]. We will respond to all valid requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data that 12hbaj holds about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. Account holders can update basic profile information (email address, phone number, residential address) directly via their account settings.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent for consent-based processing. Please note that this right is subject to overriding legal obligations: 12hbaj is required by AML regulations to retain certain account and transaction records for a minimum of five years regardless of account closure.
• Right to restrict processing: You may request that 12hbaj temporarily restrict the processing of your personal data while a rectification request is under review, or where you have objected to processing based on legitimate interest.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) and to request that it be transferred to another service provider where technically feasible.
• Right to withdraw consent: Where 12hbaj processes your personal data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place prior to withdrawal.
• Right to object: You may object to the processing of your personal data where that processing is based on 12hbaj's legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

7 Data Retention Policy

12hbaj retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law and regulation. The following retention periods apply to the main categories of data we hold:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual. Where anonymisation is technically preferable to deletion, the resulting data may be retained indefinitely for aggregate statistical analysis.

8 Changes to This Privacy Policy

12hbaj reserves the right to review and update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When we make material changes to this policy, we will notify registered account holders by email to the address associated with your account, or via an in-platform notification on your next login.

The "Last updated" date at the top of this page will always reflect the date on which the most recent version of the policy took effect. We encourage you to review this Privacy Policy periodically so that you remain informed about how 12hbaj collects and uses your personal data.

Your continued use of the 12hbaj platform following the publication of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes made to this policy, you should discontinue your use of the platform and contact our support team to discuss the closure of your account.

If you have any questions about this Privacy Policy, or about how 12hbaj handles your personal data generally, please contact our Data Support team by emailing [email protected]. We aim to respond to all privacy-related enquiries within five business days.