heybaj Privacy Policy

How We Use Your Personal Data

heybaj processes your personal data on the basis of contractual necessity, legal obligation, and legitimate interest, as applicable. The primary purposes for which we process your data are:

• Account Administration: Creating, managing, and maintaining your heybaj account, including verifying your identity and age in accordance with our 21+ policy.
• Payment Processing: Facilitating deposits and withdrawals through bKash, Nagad, Rocket, Upay, and other supported payment channels. Financial data is processed in partnership with our payment providers under strict data-sharing agreements.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorised account access, and other illegal conduct on the Platform.
• Legal Compliance: Meeting our obligations under applicable laws and regulations, including responding to lawful requests from competent authorities.
• Customer Support: Responding to your queries, complaints, and requests, and maintaining records of our communications for quality assurance purposes.
• Service Improvement: Analysing aggregated usage data to improve the performance, functionality, and content of the Platform.
• Responsible Gaming: Monitoring betting patterns and account activity to identify potential signs of problem gambling and to apply responsible gaming tools where appropriate.
• Marketing Communications: Sending you promotional offers, bonus notifications, and seasonal campaigns (e.g., BPL cricket season, Eid special offers) where you have provided consent. You may withdraw this consent at any time by contacting [email protected].

Legal Basis for Processing

heybaj processes personal data under the following legal bases:

• Contract Performance: Processing that is necessary to deliver the services you have requested by creating an account and using the Platform — including account management, payment processing, and bet settlement.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) requirements, age verification obligations, and responses to lawful authority requests.
• Legitimate Interests: Processing that serves heybaj's legitimate business interests, such as fraud detection, platform security, and service improvement, provided such interests are not overridden by your fundamental rights.
• Consent: Processing that relies on your freely given, specific, and informed agreement — including the sending of optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing and Disclosure

heybaj does not sell, rent, or trade your personal data to any third party. We may share your personal data with trusted third parties only in the following circumstances and only to the extent necessary:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard, solely for the purpose of processing your deposits and withdrawals.
• KYC and Identity Verification Partners: Third-party identity verification services that assist heybaj in confirming the identity and age of players in compliance with our responsible gaming and fraud-prevention obligations.
• Game Content Providers: Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive limited session and game-outcome data necessary to operate their games on the Platform.
• Analytics Providers: Aggregated and anonymised technical data may be shared with analytics service providers to help us understand Platform usage. No personally identifiable information is included in such sharing.
• Legal and Regulatory Authorities: heybaj will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law or a valid legal order.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of heybaj's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer via a notice on the Platform.

All third-party data processors engaged by heybaj are bound by written data processing agreements that require them to process data only on heybaj's instructions, to maintain appropriate security measures, and to comply with applicable data protection law.

Cookies and Tracking Technologies

heybaj uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including maintaining your login session and remembering your language and currency preferences. These cannot be disabled without disrupting core functionality.
• Performance and Analytics Cookies: Collect anonymised data about how players use the Platform — such as pages visited and session duration — to help us identify areas for improvement.
• Functionality Cookies: Remember your preferences and personalise your experience, such as your preferred bet type or saved game favourites.
• Security Cookies: Used to detect and prevent fraudulent activity and to authenticate returning users.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may limit the functionality available to you on the Platform.

Data Retention

heybaj retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as follows:

• Account Data: Retained for the duration of your account's active life and for a minimum of five (5) years following account closure, to comply with our legal, regulatory, and dispute-resolution obligations.
• Transaction and Betting Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC and Verification Documents: Retained for the period required by applicable anti-money laundering laws, typically five (5) years from the end of the business relationship.
• Support Communications: Retained for three (3) years from the date of the communication, unless linked to an ongoing dispute or legal matter.
• Technical and Log Data: Retained for up to twelve (12) months, after which it is aggregated or deleted.

When retention periods expire, heybaj will securely delete or anonymise your personal data so that it can no longer be associated with you.

Data Security

heybaj takes the security of your personal data seriously and has implemented a range of technical and organisational safeguards to protect your information against unauthorised access, loss, alteration, or disclosure. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and the heybaj Platform is encrypted using industry-standard Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocols.
• Access Controls: Access to personal data within heybaj is restricted on a strict need-to-know basis. Staff members are required to undergo data protection training and are bound by confidentiality obligations.
• Secure Data Storage: Personal data is stored on servers with physical and logical security controls, including firewalls, intrusion detection systems, and regular security audits.
• Password Hashing: Account passwords are stored as cryptographic hashes and are never stored or transmitted in plain text.
• Fraud Monitoring: heybaj operates continuous automated monitoring systems to detect unusual account activity and flag potential security threats in real time.

While heybaj employs robust security practices, no system is entirely impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, heybaj will notify affected players without undue delay in accordance with applicable law.

International Data Transfers

heybaj operates primarily within Bangladesh and processes most personal data on servers located in or serving the Bangladesh region. In certain circumstances — for example, when engaging global game content providers such as Pragmatic Play, Evolution Gaming, or Ezugi — your data may be transferred to or accessed from servers located outside Bangladesh.

Where such international transfers occur, heybaj ensures that appropriate safeguards are in place to protect your personal data, including contractual data protection clauses with the relevant third parties. heybaj does not transfer personal data to jurisdictions that do not provide an adequate level of protection without first implementing appropriate protective measures.

Children and Minors

The heybaj Platform is strictly intended for adults aged 21 years and above. heybaj does not knowingly collect or process personal data from individuals under 21 years of age. If heybaj becomes aware that a minor has registered an account or provided personal data, that account will be immediately closed, any deposited funds will be returned to the originating payment method, and all related personal data will be deleted from our systems.

If you are a parent or guardian and believe that a person under 21 has created an account on heybaj, please contact us immediately at [email protected] so that we can take appropriate action.

Changes to This Policy

heybaj reserves the right to update or revise this Privacy Policy at any time. When material changes are made, the revised Policy will be published on this page with an updated "Last Updated" date. Where changes are significant, heybaj may also notify registered players via the contact details held on their account.

Your continued use of the heybaj Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how heybaj is protecting your personal data.

Contact and Data Inquiries

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a concern about how heybaj has handled your personal data, please contact us using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Support Hours: 24/7, Bangladesh Standard Time (UTC+6)
• Response Time: heybaj aims to acknowledge all privacy-related inquiries within 48 hours and to provide a full response within 14 calendar days.

Please include your registered account username and a clear description of your request so that we can process it efficiently and securely.