Privacy Policy — How hit880 Collects, Uses, and Protects Your Data

1 Personal Data We Collect

hit880 collects personal data from you through several channels depending on how you interact with the platform. The categories of data collected are as follows:

2 How We Use Your Personal Data

hit880 processes personal data only where there is a lawful basis to do so. The primary purposes for which your data is used are as follows:

• Account creation and management: To register your account, authenticate your identity at login, and maintain your player profile across sessions.
• Transaction processing: To facilitate deposits via bKash, Nagad, Rocket, Upay, and card networks, and to process withdrawal requests to your nominated payment method.
• Legal compliance and KYC: To verify your age and identity as required by anti-money-laundering rules, and to screen against sanctions and politically-exposed-person (PEP) lists.
• Responsible gaming: To monitor play patterns for signs of problem gambling, enforce self-exclusion periods, and apply deposit or loss limits you have set on your account.
• Platform security and fraud prevention: To detect and investigate suspicious login activity, unusual betting patterns, multi-accounting, and other potential breaches of the Terms & Conditions.
• Customer support: To respond to enquiries, resolve disputes, process complaints, and provide assistance with account issues.
• Service improvement: To analyse aggregated, anonymised usage data to improve platform performance, game selection, and user experience.
• Marketing communications (opt-in only): To send promotional emails, SMS notifications, and in-platform messages about bonuses, tournaments, and seasonal offers — only to players who have explicitly opted in to receive such communications. You may withdraw consent at any time by contacting [email protected].

hit880 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

3 Who We Share Your Data With

hit880 does not sell your personal data. Data may be shared with the following categories of third party only where necessary and under strict contractual obligations:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Visa, and Mastercard receive the minimum data required to complete each transaction.
• Identity verification providers: Third-party KYC/AML service providers that verify the authenticity of submitted identity documents. These providers operate under binding data-processing agreements and may not use your data for their own purposes.
• Game technology providers: Studios such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, and Microgaming receive anonymised session tokens to facilitate gameplay. They do not receive your name, contact details, or payment information.
• IT infrastructure and cloud providers: Hosting, content delivery, and data storage providers that hold data on hit880's behalf under strict confidentiality terms.
• Law enforcement and regulatory bodies: hit880 will disclose personal data to relevant authorities where required by applicable law, court order, or to protect the rights, property, or safety of the platform and its players.
• Professional advisers: Lawyers, auditors, and accountants who are bound by professional confidentiality obligations.

Any third party receiving personal data from hit880 is required to implement appropriate technical and organisational security measures consistent with this Policy.

4 Cookies and Tracking Technologies

hit880 uses cookies and similar technologies (local storage, session storage, pixel tags) on the platform. These are categorised as follows:

• Strictly necessary cookies: Required for the platform to function. They maintain your login session, remember your language preference, and enable secure navigation between pages. These cookies cannot be disabled.
• Analytics cookies: Used to understand how players navigate the platform — which pages are visited most, where users encounter difficulties, and how long sessions last. Data collected is aggregated and anonymised. Analytics cookies may be disabled without affecting core functionality.
• Functional cookies: Store preferences such as preferred payment method, last-viewed game categories, and responsible gaming settings. Disabling these cookies may reduce the convenience of using the platform.
• Security cookies: Used to detect and prevent fraudulent activity, including bot-driven login attempts and device fingerprinting for multi-account detection.

hit880 does not deploy third-party advertising or retargeting cookies. Cookies set by game providers (Pragmatic Play, Evolution Gaming, etc.) are limited to the scope of the embedded game iframe and do not track your activity outside the hit880 platform.

Most browsers allow you to control cookie behaviour through their settings. Blocking strictly necessary cookies will prevent you from logging in or using core platform features. For guidance on managing cookies in your browser, refer to your browser's official help documentation.

5 Data Retention

hit880 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy or to comply with applicable legal and regulatory obligations. Specific retention periods are as follows:

• Active account data (registration details, transaction history, game records): Retained for the lifetime of the account and for a minimum of 5 years after account closure, to meet anti-money-laundering record-keeping requirements.
• Identity verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Customer support correspondence: Retained for 3 years from the date of the last communication in each support thread.
• Marketing consent records: Retained for the duration of your consent and for 2 years after withdrawal of consent, as evidence of the consent history.
• Technical and security logs (IP addresses, device data): Retained for 12 months, after which they are anonymised or deleted.
• Closed accounts where fraud was detected: Retained indefinitely to prevent the re-registration of fraudulent accounts.

Once data is no longer required, hit880 will securely delete or irreversibly anonymise it in accordance with established data destruction procedures.

6 Your Data Rights

As a player on hit880, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: Request a copy of all personal data hit880 holds about you. We will provide this within 30 days of a verified request.
• Right to rectification: Request correction of inaccurate or incomplete personal data. Basic profile corrections (name spelling, contact number) can also be made directly in your account settings.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data. This right is subject to legal retention obligations — data required for AML compliance cannot be deleted before the mandatory retention period expires.
• Right to restriction of processing: Request that hit880 pause processing of your data while a dispute or correction request is being resolved.
• Right to data portability: Request a structured, machine-readable copy of personal data you have provided to hit880 (e.g., account profile, transaction history in CSV format).
• Right to withdraw marketing consent: Opt out of all marketing communications at any time without affecting your ability to use the core platform.
• Right to object: Object to processing based on hit880's legitimate interests where you believe your interests or rights override those interests.

hit880 will respond to all data rights requests within 30 calendar days. Where a request is complex or high in volume, this period may be extended by a further 60 days, in which case you will be notified promptly.

7 Data Security

hit880 implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• All data in transit is protected by TLS 1.2 or higher (SSL encryption). The platform uses HTTPS exclusively.
• Passwords are stored using one-way cryptographic hashing algorithms — plain-text passwords are never stored.
• Sensitive financial data (full card numbers, bank account numbers) is not stored on hit880 servers. Processing is delegated to PCI-DSS certified payment processors.
• Access to production systems containing personal data is restricted to authorised personnel only, on a need-to-know basis, and is protected by multi-factor authentication.
• Regular security assessments and penetration testing are conducted to identify and remediate vulnerabilities.
• An incident response plan is in place. In the event of a data breach that is likely to result in risk to players, hit880 will notify affected players within 72 hours of becoming aware of the breach.

While hit880 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your own login credentials confidential and for notifying hit880 immediately if you suspect any unauthorised access to your account.

8 Minors and Age Verification

hit880 is strictly an adult platform. No person under the age of 21 years is permitted to register or use the platform in any capacity. hit880 does not knowingly collect personal data from individuals under 21. 21+

Where hit880 discovers or reasonably suspects that an account holder is under 21, the account will be immediately suspended, all pending transactions will be frozen, and the matter will be reviewed by the compliance team. Any funds held in an underage account will be handled in accordance with applicable legal requirements, which may include forfeiture.

If you are a parent or guardian and believe that a minor has registered on hit880 without your knowledge, please contact [email protected] immediately so that the account can be closed and any data relating to the minor can be deleted.

9 Changes to This Privacy Policy

hit880 reviews this Privacy Policy regularly and may update it to reflect changes in the platform, applicable law, or data-processing practices. When material changes are made, registered players will be notified by email at least 7 days before the revised Policy takes effect. The updated Policy will also be published on this page with a revised "last updated" date.

Your continued use of the hit880 platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not agree with a revised Policy, you should close your account and cease using the platform before the effective date.

For any questions or concerns regarding this Policy or hit880's data-processing practices, please write to: [email protected] — we will respond within 5 business days.