heybaj Privacy Policy

This Privacy Policy ("Policy") is issued by heybaj ("heybaj", "we", "us", "our") and applies to all individuals who visit, register, or otherwise interact with the heybaj website at https://heybaj.net ("Platform"). This Policy sets out in plain English how heybaj collects, processes, stores, shares, and protects personal data relating to users ("you", "your") located in Bangladesh and elsewhere, and describes the rights available to you in connection with that data.

heybaj is committed to handling your personal information responsibly and transparently. We do not sell your personal data to third parties. We collect only the information we genuinely need to operate a safe, compliant, and enjoyable online gaming experience for adults aged 18 and above across Bangladesh — including players in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.

By creating a heybaj account or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree to the terms of this Policy, you should not use the heybaj Platform.

Data We Collect

heybaj collects personal data through several channels: information you provide directly during registration and account management, information generated automatically through your use of the Platform, and information received from third-party payment and identity verification partners. The categories of data we collect are described below.

1.1 Information You Provide to Us

• Registration Data: Full legal name, date of birth, mobile phone number registered in Bangladesh, chosen username, and password (stored in hashed form — we never store plain-text passwords).
• Identity Verification (KYC) Data: Scanned or photographed copies of government-issued photo identification (e.g., National Identity Card, passport, driving licence), proof of address (e.g., utility bill, bank statement), and selfie images submitted for liveness verification.
• Payment Data: Mobile wallet numbers (bKash, Nagad, Rocket, Upay), bank account details (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and card details (Visa / Mastercard) submitted to initiate deposits or withdrawals. Card numbers are tokenised and never stored in full on heybaj servers.
• Communication Data: Messages, attachments, and metadata from emails, live chat transcripts, and support tickets submitted to [email protected] or through the Platform's built-in support channels.
• Preference Data: Language preferences, marketing communication opt-in/opt-out choices, self-imposed deposit limits, loss limits, session time reminders, and self-exclusion requests.

1.2 Information Collected Automatically

• Device & Technical Data: IP address, device type and model, operating system and version, browser type and version, screen resolution, and device unique identifiers.
• Usage & Behavioural Data: Pages visited, time spent on each page, clickstream data, search queries entered on the Platform, game sessions launched, bet amounts and outcomes, session start and end times, and feature interactions.
• Location Data: Approximate geographic location derived from your IP address, used to ensure compliance with access restrictions and to detect anomalous login activity. We do not collect precise GPS coordinates.
• Cookie & Tracking Data: Information collected via cookies, web beacons, pixel tags, and similar technologies as described in Section 3 of this Policy.

1.3 Information Received from Third Parties

• Payment Processors: Transaction status, reference numbers, and fraud-screening signals received from bKash, Nagad, Rocket, Upay, and our card-processing partners.
• Identity Verification Partners: Verification status and risk signals received from third-party KYC and anti-money laundering (AML) screening services when we submit your identity documents for automated validation.
• Fraud Prevention Services: Risk scores and device fingerprint signals from third-party fraud-detection providers, used to identify account takeover attempts, bonus abuse patterns, and payment fraud.

Summary: Data Categories & Legal Basis for Processing

How We Use Your Data

heybaj processes your personal data for the following specific and clearly defined purposes. We do not use your data for any purpose incompatible with those listed below without obtaining your prior consent or without a valid legal basis for doing so.

2.1 Account Management & Service Delivery

We use your registration and payment data to create and maintain your heybaj account, authenticate your identity at login, process deposits and withdrawals in Bangladeshi Taka (BDT), deliver game content and betting markets, and provide access to the full range of heybaj features including slots, live casino, cricket betting, the King of Fishing game, and the Loyalty Program.

2.2 Identity Verification & Regulatory Compliance

heybaj is obligated to verify the age and identity of all registered users before processing withdrawals. Your KYC documents are used solely for this verification purpose. We also screen user data against applicable watchlists and sanctions lists as part of our AML obligations. Where legally required, we may disclose account information and transaction records to law enforcement or regulatory authorities.

2.3 Fraud Prevention & Platform Security

We analyse device data, IP addresses, usage patterns, and behavioural signals to detect and prevent unauthorised account access, bonus abuse, multi-accounting, payment fraud, money laundering, and other prohibited activities. Our fraud prevention systems operate continuously and automatically flag anomalous activity for manual review by our compliance team.

2.4 Responsible Gaming Monitoring

heybaj monitors wagering patterns and session data to identify indicators of problem gambling behaviour, such as unusually long sessions, rapid increases in stake size, and repeated deposits following significant losses. Where such patterns are detected, heybaj may proactively reach out to the affected user with responsible gaming resources and information about self-exclusion tools, in line with our commitment to player wellbeing.

2.5 Customer Support

Communication data including your support messages and our responses are retained to enable us to resolve your queries efficiently, to train our support team, and to maintain an accurate record of any disputes or complaints. heybaj's support team operates 24/7 and can be reached at [email protected].

2.6 Marketing Communications

Where you have provided explicit consent to receive marketing communications, we will use your contact details to send you promotional offers, bonus notifications, seasonal promotions (e.g., Eid, Pohela Boishakh, BPL cricket season campaigns), and platform news via email or SMS. You may withdraw your marketing consent at any time by updating your notification preferences within your account settings or by emailing [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

2.7 Platform Analytics & Improvement

Aggregated and anonymised usage data is analysed to understand how players interact with the Platform, identify usability issues, prioritise feature development, and measure the effectiveness of promotional campaigns. Where this analysis uses anonymised data only, it falls outside the scope of this Privacy Policy as it cannot be traced back to any individual user.

Cookies & Tracking Technologies

heybaj uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies allow the Platform to recognise your device, remember your preferences, maintain your login session, and collect usage analytics. The following categories of cookies are used on the heybaj Platform:

3.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They enable core features such as user authentication, session management, security token validation, and load balancing. Without these cookies, the heybaj Platform cannot operate. Because they are strictly necessary, these cookies do not require your consent and cannot be disabled via your cookie preferences.

3.2 Functional Cookies

Functional cookies remember your preferences to deliver a personalised experience. For example, they store your last-selected game category, your preferred deposit method, your responsible gaming session time limit, and whether you have previously acknowledged certain notifications. These cookies do not track your activity across other websites.

3.3 Analytics Cookies

Analytics cookies collect aggregated information about how users interact with the Platform — such as which pages are visited most frequently, how long users spend on each section, and where users drop off during the registration or deposit flow. This data is used exclusively to improve the Platform's usability and performance. Analytics data is anonymised before analysis and is not linked back to individual user accounts.

3.4 Fraud Prevention & Security Cookies

These cookies support heybaj's fraud detection systems by collecting device fingerprint signals, tracking repeat visit patterns, and identifying unusual access behaviour. They are essential to protecting the integrity of user accounts and the financial security of all players on the Platform.

3.5 Third-Party Cookies

Some cookies placed on the Platform originate from third-party service providers that heybaj uses, such as analytics platforms and fraud-detection services. These third parties may collect information about your browsing behaviour across different websites. heybaj does not control the data practices of third-party cookie providers; please refer to the relevant provider's privacy policy for details of their own data handling practices.

Data Sharing & Third Parties

heybaj does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your personal data only in the circumstances set out below, and only to the minimum extent necessary for the stated purpose.

4.1 Game Content Providers

To deliver live casino and slot game content, heybaj integrates the platforms and APIs of certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers receive technical session tokens and game identifiers necessary to authenticate and launch game sessions. They do not receive your full personal profile, payment data, or KYC documents.

4.2 Payment Processing Partners

Your payment data is transmitted to the relevant payment processor — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, or our card-processing gateway — solely for the purpose of executing your requested deposit or withdrawal transaction. These partners are contractually bound to process your data only for this purpose and in accordance with applicable data protection standards.

4.3 Identity Verification & AML Services

KYC documents and identity data are shared with our third-party identity verification and AML screening partners to carry out automated checks. These partners act as data processors under contract with heybaj and are not permitted to use your data for any purpose beyond the specific verification task.

4.4 Legal & Regulatory Disclosures

heybaj may disclose personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts where required to do so by applicable law, a valid legal order, or where heybaj determines in good faith that such disclosure is necessary to prevent fraud, protect the safety of users, or protect the legal rights of heybaj. Where permitted by law, heybaj will notify the affected user of any such disclosure request.

4.5 Business Transfers

In the event that heybaj undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change in the data controller's identity via a prominent notice on the Platform and, where applicable, by direct email communication.

Data Security

heybaj applies industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Our security infrastructure includes the following controls:

• TLS/SSL Encryption: All data transmitted between your browser and the heybaj Platform is encrypted using 256-bit TLS (Transport Layer Security), ensuring that your personal and financial information cannot be intercepted in transit.
• Password Hashing: User passwords are never stored in plain text. They are processed using a modern, salted cryptographic hashing algorithm before storage, meaning that even in the unlikely event of a data breach, your actual password cannot be recovered from our stored data.
• Card Tokenisation: Payment card details are tokenised by our PCI-DSS-compliant payment gateway. Full card numbers are never transmitted to or stored on heybaj servers.
• Two-Factor Authentication (2FA): heybaj strongly recommends — and for withdrawals above a certain threshold, requires — SMS-based two-factor authentication to protect account access.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. heybaj staff are granted the minimum level of data access required to perform their specific job function. All internal data access is logged and audited.
• Data Encryption at Rest: Sensitive personal data fields stored in heybaj's databases, including KYC document references and payment method details, are encrypted at rest using AES-256 encryption.
• Regular Security Audits: heybaj conducts periodic internal and external security reviews, including vulnerability assessments and penetration testing, to identify and remediate potential weaknesses in the Platform's security posture.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. If heybaj becomes aware of a security breach that affects your personal data, we will notify affected users as promptly as practicable, in accordance with applicable notification obligations.

Data Retention

heybaj retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in any event for no longer than is required by applicable law or regulatory guidance. The specific retention periods for each data category are set out in the summary table in Section 1 of this Policy.

In general, the following principles govern our data retention approach:

• Active Accounts: We retain all account data for the full duration of your account's existence. If your account becomes dormant (no login or transaction activity for 12 or more consecutive months), we may contact you to confirm whether you wish to keep your account open before initiating our dormant account procedure.
• Closed Accounts: Following the closure of a heybaj account — whether at your request, due to a breach of our Terms & Conditions, or for any other reason — we retain core account data (registration details, transaction history, KYC records, and communication logs) for a minimum period of five (5) years. This retention is required to satisfy our legal obligations relating to AML, fraud prevention, and financial record-keeping.
• Marketing Data: If you withdraw your consent to marketing communications, we will cease sending you promotional materials promptly. However, a suppression record (i.e., a record that you have opted out) is retained indefinitely to ensure that we do not inadvertently send you marketing communications in the future.
• Anonymised Data: Aggregated, anonymised analytics data that cannot be traced back to any individual user is not subject to a fixed retention period and may be retained indefinitely for statistical and product development purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with heybaj's internal data disposal procedures.

Your Privacy Rights

As a user of the heybaj Platform, you have a number of rights in relation to the personal data we hold about you. heybaj is committed to respecting these rights and will respond to valid requests within a reasonable timeframe. To exercise any of the rights described below, please contact us in writing at [email protected], clearly stating your request and, where necessary, providing sufficient information to allow us to verify your identity.

Right of Access

You have the right to request a copy of the personal data that heybaj holds about you, together with information about how that data is used, where it came from, and with whom it has been shared. We will provide this information in a clear, structured format within a reasonable period of receiving a verified request.

Right to Rectification

If you believe that any personal data heybaj holds about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You can update many of your account details directly from within your heybaj account settings. For changes that cannot be made self-service — such as corrections to your legal name or date of birth following a verified KYC review — please contact [email protected].

Right to Erasure

You have the right to request the deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. This right is not absolute — where heybaj is required by law to retain data (such as KYC and transaction records for AML compliance purposes), we are not able to erase that data until the legally mandated retention period expires.

Right to Restriction of Processing

You have the right to request that heybaj restrict the processing of your personal data in certain circumstances, such as while a dispute about the accuracy of your data is being resolved. Where processing is restricted, heybaj will continue to store your data but will not actively process it for other purposes without your consent or a legal basis to do so.

Right to Data Portability

Where heybaj processes your personal data on the basis of your consent or a contract, and that processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.

Right to Object

You have the right to object to heybaj processing your personal data where that processing is based on heybaj's legitimate interests. Where such an objection is raised, heybaj will cease processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms. You have an absolute right to object to the use of your personal data for direct marketing purposes at any time.

Rights Related to Self-Exclusion

If you have submitted a self-exclusion request to heybaj, you have the right to request confirmation that your self-exclusion is active, that you have been removed from marketing lists, and that your account has been correctly restricted. Self-exclusion requests are processed immediately upon confirmation. Please contact [email protected] if you have any concerns about your self-exclusion status.

Contact & Policy Updates

If you have any questions, concerns, or complaints relating to this Privacy Policy or to heybaj's data handling practices, please contact our team in writing at:

Policy Updates

heybaj reserves the right to update this Privacy Policy at any time. When we make material changes to the Policy, we will notify registered users by posting a prominent notice on the Platform and, where the changes are significant, by sending a direct email notification to the email address or mobile number associated with your account. The "Last Updated" date at the top of this Policy will be revised each time a new version is published.

Your continued use of the heybaj Platform following the publication of an updated Privacy Policy constitutes your acceptance of that updated Policy. If you do not agree to the revised terms, you should cease using the Platform and contact [email protected] to request account closure.

We encourage you to review this Privacy Policy periodically to remain informed about how heybaj collects and uses your personal data. Archived versions of previous Privacy Policy editions are available on request by contacting [email protected].