hebaji Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how hebaji ("we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the hebaji platform at hebaji.biz, including all associated services such as sports betting, live casino, slots, and customer support.

hebaji is committed to handling your personal data with care, transparency, and respect. This Policy is intended to give you a clear and complete picture of our data practices so that you can make informed decisions about your use of the platform.

By creating an account on hebaji or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the platform.

2 Personal Data We Collect

hebaji collects personal data across several categories depending on your level of engagement with the platform. The following table outlines the main categories of data we collect and examples within each category:

hebaji does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, unless such data is contained within identity documents submitted during the KYC process — in which case it is used solely for verification purposes and not processed for any other purpose.

3 How We Collect Your Data

hebaji collects personal data through the following channels:

3.1 Direct Collection

Data you provide directly when you register for an account, complete identity verification, make a deposit or withdrawal request, contact customer support, respond to a survey, or participate in a promotion. This is the primary source of identity and contact data.

3.2 Automated Collection

Data collected automatically as you interact with the platform, including via cookies, server logs, and similar tracking technologies. This includes your IP address, device fingerprint, session duration, and navigation data. See Section 6 for more detail on cookies.

3.3 Third-Party Sources

Data received from third-party service providers engaged by hebaji, including:

• Identity verification and KYC providers who confirm the authenticity of documents submitted during account opening
• Payment processors (bKash, Nagad, Rocket, Upay, and banking partners) who provide transaction confirmation data
• Fraud prevention and anti-money-laundering (AML) screening services
• Analytics providers who supply aggregated behavioural insights

In all cases, hebaji ensures that third parties who share data with us are entitled to do so under applicable law and have obtained any necessary consents from the individuals concerned.

4 Purpose and Legal Basis for Processing

hebaji processes personal data only for defined, legitimate purposes. The following table sets out the primary processing purposes and the corresponding legal basis for each:

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for optional processing (such as marketing emails) will not affect your ability to use the core hebaji platform.

5 Data Sharing and Disclosure

hebaji does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following circumstances:

5.1 Service Providers

We share data with carefully selected third-party service providers who process data on our behalf under contractual data processing agreements. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks), KYC and identity verification providers, fraud prevention and AML screening services, cloud infrastructure and hosting providers, and customer support software providers. Each service provider is permitted to use your data only for the specific purpose for which it was shared and may not use it for their own independent purposes.

5.2 Game Software Providers

The games available on hebaji are supplied by third-party software providers including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe. Certain anonymised or pseudonymised technical data (such as game session identifiers) may be shared with these providers for the purpose of operating their games. These providers do not receive your full identity or financial data.

5.3 Legal and Regulatory Disclosure

hebaji may disclose personal data where required to do so by applicable law, court order, or at the request of a competent authority. In such cases, we will disclose only the data that is legally required and will, where permitted, notify affected players of the disclosure.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of hebaji, personal data held about players may be transferred to the successor entity. Players will be notified of any such transfer and of any material change to data processing practices that results from it.

6 Cookies and Tracking Technologies

The hebaji platform uses cookies and similar tracking technologies to operate correctly, remember your preferences, and understand how players interact with the site. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without breaking core functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and responsible gaming tool configurations between sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate the site. This data helps hebaji improve the platform experience. Analytics data is not linked to individual identities.
• Marketing Cookies: Used to deliver relevant promotional content and measure the effectiveness of hebaji's marketing activity. These cookies are only set where you have provided consent.

Third-party cookies set by game software providers or analytics partners are governed by those providers' own privacy policies. hebaji does not control the cookie practices of third parties whose services are embedded within the platform.

7 Data Retention

hebaji retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any legal obligations requiring longer retention. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of the active account relationship, plus a minimum of five years following account closure, to satisfy legal and regulatory obligations.
• Transaction and financial records: Retained for a minimum of five years from the date of the transaction, in line with standard financial record-keeping requirements.
• KYC documents: Retained for the legally required minimum period from the date of submission. Copies of documents are stored securely and access is restricted to authorised personnel only.
• Customer support communications: Retained for three years from the date of the last communication, unless longer retention is required by an ongoing dispute or investigation.
• Technical and usage data: Typically retained in identifiable form for up to 24 months, after which it is anonymised or deleted.
• Marketing consent records: Retained for as long as the consent remains active, plus two years following withdrawal, to demonstrate a compliant record of consent history.

When personal data is no longer required, it is securely deleted or anonymised using processes designed to prevent reconstruction of the original data. Anonymised data may be retained indefinitely for statistical and analytical purposes.

8 Data Security

hebaji takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the hebaji platform
• Encryption of sensitive data fields at rest within our database infrastructure
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their role
• Regular security assessments, penetration testing, and vulnerability scanning of platform infrastructure
• Two-factor authentication requirements for all internal staff accessing production systems
• Incident response procedures to identify, contain, and remediate data security incidents promptly
• Regular staff training on data protection obligations and secure data handling practices

While hebaji employs industry-standard security practices, no method of electronic transmission or storage is entirely risk-free. Players are encouraged to use strong, unique passwords for their hebaji account and to contact support immediately if they suspect their account has been compromised.

9 Your Data Rights

As a player whose personal data is processed by hebaji, you have the following rights with respect to that data:

• Right of Access: You may request a copy of the personal data hebaji holds about you. We will respond within a reasonable timeframe and provide the information in a clear, accessible format.
• Right to Rectification: If any personal data held about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your contact number) can be made directly in your account settings.
• Right to Erasure: You may request that hebaji delete your personal data. This right is subject to exceptions — for example, we are required to retain transaction and KYC records for a legally mandated minimum period even after an account is closed.
• Right to Restrict Processing: In certain circumstances, you may ask hebaji to restrict the processing of your data (e.g., while a dispute about its accuracy is being resolved) without requiring deletion.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interest at any time. You also have the unconditional right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact the hebaji support team at [email protected] (plain text — not a link). hebaji may need to verify your identity before processing a rights request to ensure that personal data is not disclosed to an unauthorised person.

10 Children's Privacy

The hebaji platform is strictly intended for adults aged 18 and above. hebaji does not knowingly collect or process personal data relating to children under the age of 18. If you believe that a minor has submitted personal data to hebaji, please contact the support team immediately. Upon confirmation, hebaji will take prompt steps to delete the relevant data and close any account held by a minor.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. hebaji supports industry-wide efforts to prevent underage gambling and maintains active age verification controls as part of the account registration and KYC process.

11 Third-Party Links and Embedded Content

The hebaji platform may contain references to or embed content from third-party software providers, including game studios and live casino streaming services. These third-party services operate under their own privacy policies and terms of service, which hebaji does not control.

hebaji is not responsible for the privacy practices of third-party game providers or any other external services. Players are encouraged to review the privacy policies of any third-party service they interact with through the platform. The presence of a third-party provider's content on the hebaji platform does not constitute an endorsement of their privacy practices.

12 Cross-Border Data Transfers

In order to operate the platform effectively, some personal data may be processed by service providers located outside Bangladesh. Where such transfers occur, hebaji takes steps to ensure that the recipient provides an adequate level of data protection, including through the use of contractual data processing agreements that impose data protection obligations on the recipient equivalent to those applicable to hebaji.

hebaji does not transfer personal data to jurisdictions with materially weaker data protection standards without first implementing appropriate safeguards. If you have questions about specific cross-border transfers, please contact the support team.

13 Marketing Communications

hebaji may send you promotional communications about bonuses, new games, seasonal offers, and platform updates. Marketing communications are sent only where you have provided explicit consent during account registration or subsequently through your account communication preferences.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email from hebaji
• Updating your communication preferences in your account settings
• Contacting the support team and requesting removal from the marketing list

Opting out of marketing communications will not affect service communications related to your account — for example, deposit confirmations, withdrawal status updates, and security alerts will continue to be sent regardless of your marketing preference settings.

14 Updates to This Privacy Policy

hebaji reviews this Privacy Policy at least annually and updates it whenever there are material changes to our data processing practices. Where an update is material — for example, a new category of data being collected, a new sharing arrangement with a third party, or a change to retention periods — hebaji will notify registered players via the contact details held on their account before the change takes effect.

Minor updates (such as clarifications, corrections to typographical errors, or formatting improvements) may be made without prior notice. The effective date shown at the top of this page will always reflect the date of the most recent revision. We encourage players to review this Policy periodically to stay informed of how hebaji handles their data.

15 Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how hebaji has handled your personal data, please contact us using the details below:

• Support Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly on the hebaji platform
• Response Time: hebaji aims to acknowledge all privacy-related queries within 48 hours and to provide a substantive response within 10 business days.

If you are not satisfied with hebaji's response to a privacy concern, you have the right to escalate the matter through appropriate legal channels available in your jurisdiction. hebaji is committed to resolving privacy complaints fairly and transparently and will cooperate fully with any legitimate investigative process.