heabaji Privacy Policy — How We Collect, Use & Protect Your Data

1. Information We Collect

heabaji collects personal information from you in several ways: information you provide directly when registering or using the platform, information generated automatically through your use of the platform, and information received from third-party service providers who assist us in operating the platform. The categories of information we collect are described in detail below.

1.1 Information You Provide Directly

When you register an account or interact with heabaji, you may provide the following categories of personal information:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, National ID number, passport number	Account registration, KYC verification, age verification
Contact Data	Mobile phone number, email address, city of residence	Account communication, OTP authentication, support
Financial Data	bKash/Nagad wallet number, bank account details, transaction history	Processing deposits and withdrawals, fraud prevention
Verification Documents	Scanned NID card, passport image, selfie for liveness check	KYC compliance, identity verification
Account Credentials	Username, encrypted password hash	Account access and security
Communication Data	Live chat transcripts, support ticket content, feedback submissions	Customer support, service improvement

1.2 Information Collected Automatically

When you access and use the heabaji platform, certain technical and behavioural data is collected automatically through cookies, log files, and similar technologies:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, bet amounts and outcomes, session duration, clicks, and navigation paths within the platform.
• Log data: Server access logs recording timestamps, request types, and error codes associated with your account activity.
• Geolocation data: Approximate geographic location derived from your IP address. We do not use GPS-level precise location tracking.

1.3 Information from Third Parties

heabaji may receive personal information about you from the following third-party sources:

• Payment processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment partners to verify deposits and withdrawals.
• Identity verification providers: Results of identity and document verification checks conducted through third-party KYC service providers.
• Fraud prevention services: Risk signals and device fingerprint data from fraud detection partners used to protect the integrity of the platform.
• Analytics providers: Aggregated, anonymised platform usage statistics from analytics partners.

2. How We Use Your Information

heabaji uses the personal information we collect for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The legal bases and purposes for processing your data are as follows:

2.1 Contract Performance

We process your personal data to the extent necessary to provide the heabaji service you have contracted for. This includes creating and managing your account, processing deposits and withdrawals, verifying your identity, settling bets and game outcomes, and providing customer support.

2.2 Legal Obligations

heabaji processes certain data to comply with anti-money-laundering (AML) obligations, age and identity verification requirements, financial record-keeping requirements, and any other applicable legal or regulatory obligations. This processing is mandatory and cannot be opted out of while you hold an active heabaji account.

2.3 Legitimate Interests

heabaji processes data for the following legitimate business interests, provided those interests are not overridden by your rights and interests:

• Fraud prevention and platform security monitoring
• Responsible gaming monitoring and intervention where a player may be at risk
• Platform performance analytics and service improvement
• Internal audit, risk management, and business reporting
• Enforcing our Terms & Conditions and other platform policies

2.4 Consent-Based Processing

Where processing is based on your consent — primarily for direct marketing communications such as promotional emails or SMS messages about heabaji bonuses, tournaments, and new game releases — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To opt out of marketing communications, update your preferences in your account settings or contact support.

3. Sharing Your Information

heabaji does not share your personal information with third parties except in the specific circumstances described in this section. All third parties with whom heabaji shares data are subject to strict contractual data protection obligations and are permitted to use the data only for the specified purpose.

3.1 Service Providers and Processors

heabaji engages trusted third-party service providers to support the operation of the platform. These providers act as data processors on heabaji's behalf and are contractually prohibited from using your data for any purpose other than providing services to heabaji. Current categories of service providers include:

• Payment processing partners: bKash, Nagad, Rocket, Upay, and banking partners process financial transactions.
• KYC and identity verification providers: Third-party verification services used to confirm player identity and age.
• Cloud hosting and infrastructure providers: Secure cloud platforms used to host the heabaji platform and store data.
• Customer support platform providers: Live chat and ticketing system providers that facilitate player support interactions.
• Fraud and risk management providers: Services that analyse transaction patterns to detect and prevent fraudulent activity.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data necessary to deliver their games.

3.2 Legal Disclosures

heabaji may disclose your personal information to law enforcement agencies, courts, regulatory bodies, or other authorities where required to do so by applicable law, court order, or legal process. heabaji will notify you of any such disclosure where legally permitted to do so.

3.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a portion of heabaji's assets, your personal information may be transferred to the successor entity. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it, before the transfer takes effect.

4. Cookies & Tracking Technologies

heabaji uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage objects) on the heabaji platform. Cookies are small text files stored on your device that help the platform function correctly and help us understand how players use the service.

4.1 Types of Cookies We Use

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Session management, login authentication, CSRF protection, security tokens	No — essential for platform function
Functional	Remembering your language preferences, game history, and responsible gaming settings	Yes — via browser settings
Analytics	Aggregated, anonymised usage statistics to understand how players navigate the platform and identify areas for improvement	Yes — via browser settings
Fraud Prevention	Device fingerprinting and session risk scoring to detect fraudulent or suspicious activity	No — required for platform security

heabaji does not use third-party advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Note that disabling functional or analytics cookies may affect your experience on the platform but will not prevent you from using core features.

5. Data Retention & Storage

heabaji retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The following retention periods apply:

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 5 years after closure	Legal and AML compliance obligations
Financial transaction records	7 years from the date of the transaction	Financial record-keeping requirements
KYC verification documents	Duration of account + 5 years after closure	Regulatory compliance and audit trail
Customer support communications	3 years from the date of the interaction	Dispute resolution and service quality review
Platform usage and analytics data	24 months (aggregated/anonymised thereafter)	Service improvement and fraud analysis
Marketing consent records	Until consent is withdrawn + 1 year	Evidence of lawful marketing basis

When data is no longer required and no legal obligation requires its continued retention, heabaji securely deletes or irreversibly anonymises it. Backups are purged on a rolling schedule consistent with the above retention periods.

6. Data Security Measures

heabaji implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. While no system can guarantee absolute security, heabaji's security framework includes the following layers of protection:

• TLS/SSL encryption: All data in transit between your device and heabaji's servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive personal data stored in heabaji's databases is encrypted at rest using AES-256 encryption.
• Password hashing: User passwords are never stored in plain text. They are hashed using a strong one-way hashing algorithm before storage.
• Two-factor authentication (2FA): SMS OTP authentication is triggered for logins from unrecognised devices, adding a second layer of account protection.
• Access controls: Access to personal data within heabaji's internal systems is restricted to authorised personnel on a strict need-to-know basis.
• Regular security audits: heabaji conducts periodic security reviews and vulnerability assessments of the platform and its underlying infrastructure.
• Incident response: heabaji maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected players and relevant authorities within the timeframe required by applicable law.

7. Your Privacy Rights

As a heabaji player, you have a number of rights in relation to the personal data we hold about you. heabaji is committed to honouring these rights promptly and without unnecessary barriers. To exercise any of the rights described below, contact our support team via live chat or email [email protected] with the subject line "Data Rights Request".

7.1 Right of Access

You have the right to request a copy of the personal data heabaji holds about you. We will provide a structured, readable summary of your data within a reasonable timeframe following identity verification of the requestor.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction. For basic account details (such as your contact email or phone number), you can update these directly in your account settings. For identity-related data that was submitted during KYC, please contact support.

7.3 Right to Erasure

You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that heabaji is required by law to retain certain categories of data (such as financial transaction records) for specified periods even after account closure, so erasure requests may not always result in complete deletion.

7.4 Right to Restrict Processing

You have the right to request that heabaji restricts the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of the data is being resolved.

7.5 Right to Data Portability

Where processing is based on your consent or on a contract with you, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.

7.6 Right to Object to Marketing

You have the right to object at any time to the processing of your personal data for direct marketing purposes. You can exercise this right by updating your communication preferences in your heabaji account settings, or by contacting our support team. Marketing communications will cease promptly following your objection.

8. Third-Party Services

The heabaji platform integrates with a number of third-party services to deliver the full gaming experience. These include game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi), payment processing partners (such as bKash, Nagad, and Rocket), and analytics or security services.

Each of these third-party providers operates under their own privacy policies and data handling practices. heabaji is not responsible for the privacy practices of third-party providers, and this Privacy Policy does not govern the data practices of those third parties. We encourage you to review the privacy policies of any third-party service you interact with through the heabaji platform.

Game providers receive only the minimum data necessary to deliver their games (typically a session token and anonymised player identifier). They do not receive your full identity data, financial details, or contact information unless operationally required and disclosed in advance.

9. Updates to This Policy

heabaji reviews this Privacy Policy periodically and will update it to reflect changes in our data practices, new services or features launched on the platform, changes in applicable law or regulatory guidance, or other operational developments that affect how we handle personal data.

Material changes to this Privacy Policy — meaning changes that affect the fundamental basis on which we process your personal data, or changes that significantly affect your rights — will be communicated to you by email or by a prominent notice on the heabaji platform before the changes take effect. The effective date at the top of this document will be updated with each revision.

For non-material changes (such as corrections of typographical errors, clarifications of existing practices, or minor structural reorganisation), the updated policy will be published on this page without prior notice. We encourage you to check this page from time to time to stay informed of any updates.

Your continued use of the heabaji platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with any changes, you may close your account and request deletion of your data before the updated policy takes effect.

10. Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way heabaji handles your personal data, please contact us using any of the following methods:

• Live Chat: Available 24/7 via the live chat widget on the heabaji platform. This is the fastest way to reach our support team for privacy-related queries.
• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" so your message is routed to the appropriate team member.

heabaji's support team will acknowledge your privacy enquiry within 2 business days (Bangladesh Standard Time, UTC+6) and will provide a substantive response within the timeframes stated in the Your Privacy Rights section above.

For data rights requests, we may need to verify your identity before processing the request. This is to ensure that personal data is not disclosed to or acted upon at the request of an unauthorised third party. Verification is typically carried out by asking you to confirm details associated with your registered account.