heybajl Privacy Policy
At heybajl, protecting the personal data of our players is a responsibility we take seriously. This Privacy Policy explains in clear, formal terms exactly what information we collect, why we collect it, how it is stored and processed, who it may be shared with, and what rights you hold over your own data. We encourage all players — whether based in Dhaka, Chittagong, Sylhet, or anywhere else across Bangladesh — to read this document carefully before creating an account.
SSL-Encrypted Storage
All personal data collected by heybajl is stored on servers protected by SSL/TLS encryption. Sensitive fields including payment references and identity documents are encrypted at rest using industry-standard protocols.
KYC & Identity Protection
Identity documents submitted during KYC verification are handled by a dedicated compliance team, stored in isolated secure environments, and never shared with unauthorised third parties or used for purposes beyond verification.
Payment Data Privacy
heybajl does not store full payment credentials. Transaction references for bKash, Nagad, Rocket, and Upay are retained only for the minimum period required for financial compliance and dispute resolution purposes.
No Third-Party Ad Profiling
heybajl does not sell, rent, or trade your personal data to external advertising networks for profiling or targeted advertising purposes. Your data is used solely to operate and improve the heybajl platform.
Your Data Controls
As a heybajl player, you hold meaningful rights over your personal data — including the right to access, correct, restrict, or request deletion of your information. Submit a data request any time via [email protected].
Bangladesh-First Approach
heybajl's data practices are designed with Bangladeshi players in mind. We ensure that data collected from players across Dhaka, Chittagong, Sylhet, Khulna, and all other regions is handled responsibly and locally where possible.
Policy Overview & Scope
This Privacy Policy ("Policy") is issued by heybajl, the operator of the online casino and sports betting platform accessible at heybajl.net ("Platform"). It governs the collection, processing, storage, and disclosure of personal data relating to all individuals who access or use the Platform, including registered players, visitors who browse without registering, and individuals who contact heybajl's support team.
By accessing the heybajl Platform, creating an account, making a deposit, or submitting any form of personal information to heybajl, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you must not use the Platform.
This Policy applies to all personal data collected through the heybajl website, any associated mobile-optimised web interface, email communications, and support interactions. It does not extend to third-party websites, payment processors, or game studio platforms that may be accessible from or linked within the heybajl environment — each of those parties maintains its own privacy policy, for which heybajl bears no responsibility.
Information We Collect
heybajl collects personal data through several channels in the ordinary course of operating a compliant, secure online gaming platform. The categories of data we collect, and the contexts in which we collect them, are set out below.
2.1 — Registration & Account Data
- Full legal name — as it appears on your government-issued identity document, required for KYC verification and account ownership confirmation.
- Date of birth — collected to verify that you meet the minimum age requirement of 18 years. This is a mandatory field at registration.
- Email address — your primary account identifier used for login, security notifications, transaction confirmations, and support communications.
- Mobile phone number — used for OTP delivery via Grameenphone, Robi, Banglalink, or Teletalk networks, account recovery, and payment method linking.
- Residential address — collected at the KYC stage for identity verification purposes, not used for postal communications.
- Username and password (hashed) — your chosen account credentials. Passwords are stored as irreversible cryptographic hashes and are never accessible in plain text by heybajl staff.
2.2 — Identity Verification (KYC) Documents
- National ID card (NID) — the primary identity document for Bangladeshi residents.
- Passport — accepted as an alternative primary identity document.
- Driver's licence — accepted as a supplementary identity document in certain verification scenarios.
- Selfie or liveness verification — a photograph or short video used to confirm that the document presented matches the individual submitting it.
2.3 — Financial & Transaction Data
- Payment method identifiers — the registered mobile number or account reference associated with your bKash, Nagad, Rocket, or Upay account, used to match deposits and withdrawals to your heybajl account.
- Transaction history — a full log of deposits, withdrawals, wagers, bonus credits, and balance adjustments associated with your account, retained for financial compliance and dispute resolution.
- Transaction amounts in Bangladeshi Taka (৳) — all monetary values are recorded in BDT for accounting and regulatory compliance purposes.
2.4 — Technical & Device Data
- IP address — recorded at login and during sessions for security monitoring, fraud detection, and geographic access control.
- Device type and operating system — used for platform optimisation and to detect suspicious login patterns (e.g., simultaneous logins from multiple device types).
- Browser type and version — collected automatically for rendering optimisation and security logging.
- Session timestamps — start and end times of each login session, used for responsible gaming time-check features and security auditing.
2.5 — Support & Communication Data
When you contact heybajl's support team — via email at [email protected] or through any on-platform messaging feature — we retain a record of the communication, including the content of messages, attachments, and timestamps. This data is used solely to resolve your query and to maintain a service history for quality assurance purposes.
| Data Category | Collection Point | Mandatory? |
|---|---|---|
| Name & Date of Birth | Registration form | Yes |
| Email & Phone Number | Registration form | Yes |
| Identity Documents | KYC verification portal | Yes (before withdrawal) |
| Payment Method Reference | Deposit / withdrawal flow | Yes (for transactions) |
| IP Address & Device Data | Automatic (on access) | Automatic |
| Support Communications | Email / live chat | When contacting support |
| Cookie & Tracking Data | Browser (on access) | Automatic (see Section 4) |
How We Use Your Information
heybajl processes personal data only for legitimate, documented purposes. We do not process data in ways that are incompatible with the purposes for which it was originally collected. The lawful bases and specific purposes for which we process your data are as follows.
- Account Creation & Management: To create and maintain your heybajl player account, verify your identity, manage your balance, and provide you with access to the Platform's features. This processing is necessary for the performance of the contract between you and heybajl.
- Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, and Upay; to match payment references to your account; and to maintain accurate financial records in Bangladeshi Taka. This processing is both contractually necessary and required for legal financial compliance.
- KYC & Age Verification: To verify that you are at least 18 years of age and that your identity matches the account held. heybajl has a legal and ethical obligation to prevent minors from accessing the Platform, making this processing legally necessary.
- Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other forms of Prohibited Conduct as defined in the Terms & Conditions. This processing is carried out in heybajl's legitimate interests and in fulfilment of legal obligations.
- Responsible Gaming Obligations: To monitor gameplay patterns for signs of problem gambling, to enforce self-exclusion requests, and to deliver responsible gaming tools (deposit limits, time-outs, reality checks). This processing is carried out in the legitimate interests of player welfare.
- Customer Support: To respond to your queries, resolve disputes, process complaints, and maintain a support history for quality assurance. This processing is necessary for the performance of our contractual obligations to you.
- Platform Improvement & Analytics: To analyse aggregate, anonymised usage patterns, game popularity metrics, and technical performance data to improve the heybajl Platform. This processing uses data in a form that does not identify individual players.
- Promotional Communications: Where you have provided explicit consent, to send you information about heybajl promotions, seasonal offers (Eid, BPL season, T20 World Cup specials, Pohela Boishakh), and platform updates. You may withdraw this consent at any time by contacting [email protected].
- Legal Compliance: To comply with any applicable legal obligation, including responding to lawful requests from competent authorities, fulfilling anti-money-laundering (AML) and counter-terrorism financing (CTF) obligations, and maintaining legally required financial records.
Data Sharing & Third Parties
heybajl does not sell, rent, or trade your personal data. We share personal data with third parties only in the specific, limited circumstances described in this section, and only to the minimum extent necessary for the stated purpose.
- Payment Service Providers: Transaction references are shared with bKash, Nagad, Rocket, and Upay solely to process deposit and withdrawal instructions you have initiated. Each provider is bound by its own regulatory obligations under Bangladesh Bank guidelines regarding data confidentiality.
- KYC / Identity Verification Partners: Where heybajl uses a third-party identity verification service to assist in document checking, your identity documents and biometric verification data may be transmitted to that service under strict data processing agreements that prohibit use for any purpose beyond verification.
- Game Studio Technology Providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive only the minimum data required to authenticate your game session (typically a session token and account-level stake limits). They do not receive your full identity or payment data.
- Legal & Regulatory Authorities: heybajl will disclose personal data to competent governmental, regulatory, law enforcement, or judicial authorities where it is legally required to do so — for example, in response to a lawfully issued court order or an AML/CTF investigation. We will notify you of such disclosure where legally permitted to do so.
- Fraud Prevention Services: Anonymised or pseudonymised data may be shared with fraud prevention databases to identify patterns of abuse that affect multiple platforms. No fully identified personal data is shared through this channel without a specific legal basis.
- Business Transfers: In the event of a merger, acquisition, or sale of all or part of heybajl's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer, and the acquiring entity will be bound by the terms of this Policy or an equivalent successor policy.
Data Retention & Storage
heybajl retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, accounting, or reporting obligations. The following retention periods apply as a general guide.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | Legal / AML compliance |
| KYC Identity Documents | Duration of account + 5 years post-closure | Legal / AML compliance |
| Financial Transaction Records | 7 years from transaction date | Financial regulatory requirement |
| Support Communications | 3 years from last interaction | Service quality / dispute resolution |
| Session / Technical Logs | Up to 12 months | Security monitoring / fraud prevention |
| Cookie / Analytics Data | Up to 90 days (anonymised aggregates) | Platform improvement |
| Marketing Consent Records | Until consent is withdrawn + 2 years | Proof of consent |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual. Where deletion is not technically feasible (e.g., data embedded in encrypted backup archives), heybajl isolates such data and ensures it is not accessed or processed until the next scheduled backup rotation, at which point it is permanently removed.
Data is stored on servers employing physical and logical access controls. Access to production databases containing personal data is restricted to authorised heybajl personnel on a strict need-to-know basis and is subject to multi-factor authentication and audit logging.
Your Privacy Rights
heybajl respects your rights over your own personal data. The following rights are available to all players. To exercise any of these rights, submit a written request to [email protected] from your registered email address. We will acknowledge your request within 5 business days and fulfil it within 30 calendar days, subject to identity verification.
heybajl will not charge a fee for handling a data rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. In all cases we will inform you before any fee is charged. We may require proof of identity before processing a request to protect against fraudulent access to another player's data.
Data Security Measures
heybajl employs a layered, defence-in-depth security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. While no online platform can guarantee absolute security, the measures described below represent the current state of heybajl's information security programme.
- TLS/SSL Encryption in Transit: All data exchanged between your browser or device and heybajl's servers is encrypted using TLS 1.2 or higher. This prevents interception of data during transmission across public networks, including mobile data connections on Grameenphone, Robi, Banglalink, and Teletalk.
- Encryption at Rest: Sensitive data fields — including identity document images, password hashes, and payment method references — are encrypted at rest using AES-256 or equivalent symmetric encryption. Encryption keys are managed through a dedicated key management system with rotation policies.
- Access Control & Authentication: Access to systems holding personal data is restricted to authorised personnel only, enforced through role-based access control (RBAC), multi-factor authentication (MFA), and session timeout policies. No single employee has unrestricted access to the full data estate.
- Intrusion Detection & Monitoring: heybajl's infrastructure is protected by continuous intrusion detection systems (IDS), security information and event management (SIEM) tooling, and 24/7 alerting. Anomalous access patterns trigger automated alerts reviewed by the security operations team.
- Penetration Testing: heybajl commissions periodic external penetration tests of its web infrastructure and application layer to identify and remediate vulnerabilities before they can be exploited. Critical findings are addressed under a defined SLA.
- Data Minimisation: heybajl collects only the minimum personal data required for each specific purpose. Data that is no longer required is securely deleted per the retention schedule in Section 6, reducing the volume of data at risk at any given time.
- Staff Training: All heybajl employees and contractors who handle personal data are required to complete data protection training upon onboarding and at regular intervals thereafter. Access privileges are reviewed periodically and revoked promptly upon change of role or termination.
- Incident Response: heybajl maintains a documented data breach response plan. In the event of a security incident that results in a risk to player data, affected players will be notified promptly with details of the nature of the incident, the data affected, and the steps taken to mitigate harm.
Minors & Age Restriction
The heybajl Platform is strictly intended for adults aged 18 and above. heybajl does not knowingly collect, store, or process personal data belonging to individuals under the age of 18. Age verification is a mandatory step in the account registration and KYC process, and any account found to belong to a minor will be immediately suspended and permanently closed.
- Mandatory Age Gate: All users must confirm that they are 18 years of age or older as part of the account registration process. Submitting a false declaration of age constitutes a material breach of the Terms & Conditions and may have legal consequences for the individual concerned.
- KYC Age Verification: Identity documents submitted during KYC are checked to confirm that the player's date of birth meets the 18+ requirement. Accounts that fail this check will not be permitted to deposit, wager, or withdraw funds.
- Data Collected from Minors: If heybajl becomes aware that it has inadvertently collected personal data from a person under the age of 18, that data will be permanently deleted from all systems as promptly as technically possible, and the associated account will be closed. Any funds deposited by a minor will be handled in accordance with applicable law.
- Parental Responsibility: Parents and guardians are encouraged to use device-level parental control software to prevent minors from accessing online gambling platforms. heybajl accepts no liability for access by a minor that results from a failure to implement adequate parental controls on a shared device.
If you are a parent or guardian and believe that a minor in your care has registered an account on heybajl, please contact us immediately at [email protected]. We will treat such reports as a high priority and will investigate and act within 24 hours of receipt.
Changes to This Policy
heybajl reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When we make material changes to this Policy, we will notify registered players by email to their registered address at least 7 days before the revised Policy takes effect.
- Effective Date: The "Last Updated" date displayed at the top of this page and in the hero section above indicates when the most recent revision was made. The version of the Policy in effect on the date of any given data processing activity governs that activity.
- Continued Use Constitutes Acceptance: Continued access to or use of the heybajl Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must discontinue use of the Platform and may request account closure per the process described in the Terms & Conditions.
- Non-Material Changes: Minor corrections such as typographical fixes, formatting improvements, or clarifications that do not substantively alter your rights or heybajl's obligations will be made without advance notice, though the "Last Updated" date will be updated accordingly.
- Policy Archive: Previous versions of this Privacy Policy are available on request by contacting [email protected]. We retain historical versions for a minimum period of 5 years.
Contact & Data Requests
heybajl's support team handles all privacy-related enquiries, data rights requests, and data breach reports. We are committed to responding to all privacy communications promptly, professionally, and in accordance with the timelines set out in Section 7 of this Policy.
- Data Rights Requests: To exercise any of the rights described in Section 7 (access, rectification, erasure, portability, objection, or consent withdrawal), send a written request from your registered email address to [email protected] with the subject line "Data Rights Request — [Your Username]". Include your full name, registered email address, and a description of the right you wish to exercise.
- Privacy Policy Enquiries: If you have questions about this Policy, how your data is processed, or heybajl's data practices generally, direct your enquiry to [email protected] with the subject line "Privacy Enquiry". Our team operates 24/7 Bangladesh Standard Time (BST, UTC+6) and will acknowledge all privacy enquiries within 48 hours.
- Suspected Data Breach Reports: If you believe your heybajl account has been compromised, or if you have evidence of a data security incident involving heybajl, please contact [email protected] immediately with the subject line "Security Incident Report". Breach reports are treated as critical priority and are escalated to our security operations team without delay.
- Minor Protection Reports: If you believe a person under 18 years of age has accessed or registered an account on heybajl, please notify us at [email protected] with the subject line "Minor Protection Report". We will investigate and act within 24 hours of receipt.
Your Data Is Safe at heybajl
Now that you've read our Privacy Policy, you can play at heybajl with full confidence that your personal data is handled securely, responsibly, and transparently. Explore our games, review our FAQ, or log in to your account below. For adults aged 18 and above only.
18+ · Play Responsibly · SSL Encrypted · Fair Play Certified